audit-tools 0.41.1 → 0.42.1

package/dist/remediate/steps/dispatch/implementPrompt.js

@@ -1,165 +0,0 @@
-import { readFileSync, readdirSync } from "node:fs";
-import { join, relative } from "node:path";
-import { toPromptPathToken, isBareBasename, resolveBasenameToTrackedPath, } from "audit-tools/shared";
-const TEST_FILE_RE = /\.(test|spec)\.[cm]?[jt]sx?$/;
-const WALK_SKIP_DIRS = new Set([
-    "node_modules", ".git", "dist", "build", "coverage", "out",
-    ".next", ".turbo", ".audit-tools",
-]);
-/** Bounded recursive scan for test files under `root` (skips vendor/build dirs). */
-function walkTestFiles(root, max = 400) {
-    const out = [];
-    const stack = [root];
-    let visited = 0;
-    while (stack.length > 0 && out.length < max) {
-        const dir = stack.pop();
-        let entries;
-        try {
-            entries = readdirSync(dir, { withFileTypes: true });
-        }
-        catch {
-            continue;
-        }
-        for (const entry of entries) {
-            if (++visited > 20000)
-                return out;
-            if (entry.isDirectory()) {
-                if (WALK_SKIP_DIRS.has(entry.name) || entry.name.startsWith(".test-"))
-                    continue;
-                stack.push(join(dir, entry.name));
-            }
-            else if (TEST_FILE_RE.test(entry.name)) {
-                out.push(join(dir, entry.name));
-                if (out.length >= max)
-                    break;
-            }
-        }
-    }
-    return out;
-}
-/**
- * Walk the repo ONCE and read every test file's content (bounded). Built once per
- * dispatch and shared across all blocks so the filesystem walk + reads are not
- * repeated per block.
- */
-export function buildTestFileIndex(root) {
-    const index = [];
-    for (const testPath of walkTestFiles(root)) {
-        let content;
-        try {
-            content = readFileSync(testPath, "utf8");
-        }
-        catch {
-            continue;
-        }
-        index.push({ rel: relative(root, testPath).replace(/\\/g, "/"), content });
-    }
-    return index;
-}
-/**
- * Collect test files from `index` that reference any of `sourceFiles` by
- * module basename. When `packageRoot` is supplied (repo-relative prefix, e.g.
- * `packages/foo`), only test files under that package are considered —
- * otherwise all test files in the index are matched (existing behavior).
- */
-export function collectReferencingTests(index, sourceFiles, packageRoot) {
-    if (sourceFiles.length === 0 || index.length === 0)
-        return [];
-    const basenames = sourceFiles
-        .map((f) => (f.split(/[/\\]/).pop() ?? f).replace(/\.[cm]?[jt]sx?$/, ""))
-        .filter((b) => b.length > 1);
-    if (basenames.length === 0)
-        return [];
-    const needles = basenames.map((b) => new RegExp(`\\b${b.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\b`));
-    const sourceSet = new Set(sourceFiles.map((f) => f.replace(/\\/g, "/")));
-    // Normalize packageRoot to forward slashes and ensure it ends without trailing slash
-    const pkgPrefix = packageRoot
-        ? packageRoot.replace(/\\/g, "/").replace(/\/$/, "") + "/"
-        : null;
-    const result = [];
-    for (const { rel, content } of index) {
-        if (sourceSet.has(rel))
-            continue;
-        // If a package scope is set, skip files outside that package
-        if (pkgPrefix && !rel.startsWith(pkgPrefix))
-            continue;
-        if (needles.some((re) => re.test(content)))
-            result.push(rel);
-    }
-    return result;
-}
-// ---------------------------------------------------------------------------
-// Infra-modifying block detection
-// ---------------------------------------------------------------------------
-/**
- * The live dispatch/orchestration modules whose modification can break the
- * running engine mid-run. Derived from the REAL post-A12 source layout
- * (`src/remediate/...`) — this module IS one of them (`steps/dispatch.ts`), so
- * the list is anchored to the actual files on disk, not a hand-typed monorepo
- * path that drifts when the tree is reorganised (the pre-A12
- * `packages/remediate-code/...` list silently matched NOTHING after the
- * collapse, so every infra block rendered as non-infra). Each entry is the
- * module's path relative to the `src/remediate` area, forward-slash form.
- */
-const INFRA_MODULE_SUBPATHS = [
-    "steps/nextStep.ts",
-    "steps/dispatch.ts",
-    "state/store.ts",
-    "steps/contractPipeline.ts",
-    "steps/stepWriter.ts",
-];
-/**
- * The infra module sub-paths anchored under `src/remediate/` — the canonical
- * repo-relative form for the current (post-A12) single-package layout. A write
- * path matches when its normalised (forward-slash) form ends with one of these
- * segments, so an absolute worktree path
- * (`.../worktrees/foo/src/remediate/steps/dispatch.ts`), a repo-relative path
- * (`src/remediate/steps/dispatch.ts`), or a Windows backslash path all match,
- * while a same-basename file in another area (`src/audit/steps/dispatch.ts`)
- * does not.
- */
-const INFRA_FILE_SEGMENTS = INFRA_MODULE_SUBPATHS.map((sub) => `src/remediate/${sub}`);
-/**
- * Returns true when any path in `writePaths` is one of the live infra modules.
- * Paths are normalised to forward-slash form (win32 backslash → `/`) and matched
- * by trailing repo-relative segment so absolute/worktree/relative spellings all
- * resolve identically. Used to gate the live-surface verification section in the
- * implement prompt.
- */
-export function isInfraModifyingBlock(writePaths) {
-    for (const p of writePaths) {
-        const normalized = p.replace(/\\/g, "/");
-        for (const segment of INFRA_FILE_SEGMENTS) {
-            if (normalized === segment || normalized.endsWith("/" + segment)) {
-                return true;
-            }
-        }
-    }
-    return false;
-}
-/**
- * INV-B3-5: resolve a cited source path to the token the worker should open.
- *
- * A bare basename (`advance.ts`) that uniquely resolves to one tracked path
- * (`src/audit/orchestrator/advance.ts`) is rewritten to that tracked path FIRST,
- * so it never surfaces as a broken `<worktreeRoot>/advance.ts` prefix that
- * misdirects the worker to a non-existent top-level file. Full / dotfile-dir /
- * already-absolute / drive-letter paths pass through unchanged; when a worktree
- * root is present, a relative path is prefixed onto it (unchanged behaviour). An
- * ambiguous or unresolvable basename is left as-is (monotonic — never a
- * regression on paths that already resolved).
- */
-export function resolveCitationPathForPrompt(rel, worktreeRoot, trackedPaths) {
-    let target = rel;
-    if (isBareBasename(rel)) {
-        const resolved = resolveBasenameToTrackedPath(rel, trackedPaths);
-        if (resolved)
-            target = resolved;
-    }
-    if (!worktreeRoot)
-        return target;
-    if (target.startsWith("/") || /^[A-Za-z]:[/\\]/.test(target))
-        return target;
-    return toPromptPathToken(join(worktreeRoot, target));
-}
-//# sourceMappingURL=implementPrompt.js.map

package/dist/remediate/steps/dispatch/implementPrompt.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"implementPrompt.js","sourceRoot":"","sources":["../../../../src/remediate/steps/dispatch/implementPrompt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,4BAA4B,GAC7B,MAAM,oBAAoB,CAAC;AAE5B,MAAM,YAAY,GAAG,8BAA8B,CAAC;AACpD,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC7B,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK;IAC1D,OAAO,EAAE,QAAQ,EAAE,cAAc;CAClC,CAAC,CAAC;AAEH,oFAAoF;AACpF,SAAS,aAAa,CAAC,IAAY,EAAE,GAAG,GAAG,GAAG;IAC5C,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,KAAK,GAAa,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QAC5C,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAG,CAAC;QACzB,IAAI,OAAO,CAAC;QACZ,IAAI,CAAC;YACH,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,EAAE,OAAO,GAAG,KAAK;gBAAE,OAAO,GAAG,CAAC;YAClC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxB,IAAI,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;oBAAE,SAAS;gBAChF,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YACpC,CAAC;iBAAM,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;gBAChC,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG;oBAAE,MAAM;YAC/B,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAeD;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,MAAM,KAAK,GAAoB,EAAE,CAAC;IAClC,KAAK,MAAM,QAAQ,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3C,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CACrC,KAAsB,EACtB,WAAqB,EACrB,WAAoB;IAEpB,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC9D,MAAM,SAAS,GAAG,WAAW;SAC1B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;SACxE,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/B,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAC3B,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,KAAK,CAAC,CACvE,CAAC;IACF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IACzE,qFAAqF;IACrF,MAAM,SAAS,GAAG,WAAW;QAC3B,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,GAAG;QAC1D,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,KAAK,EAAE,CAAC;QACrC,IAAI,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QACjC,6DAA6D;QAC7D,IAAI,SAAS,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,SAAS;QACtD,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,kCAAkC;AAClC,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,qBAAqB,GAAG;IAC5B,mBAAmB;IACnB,mBAAmB;IACnB,gBAAgB;IAChB,2BAA2B;IAC3B,qBAAqB;CACb,CAAC;AAEX;;;;;;;;;GASG;AACH,MAAM,mBAAmB,GAAsB,qBAAqB,CAAC,GAAG,CACtE,CAAC,GAAG,EAAE,EAAE,CAAC,iBAAiB,GAAG,EAAE,CAChC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,UAAoB;IACxD,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,MAAM,UAAU,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACzC,KAAK,MAAM,OAAO,IAAI,mBAAmB,EAAE,CAAC;YAC1C,IAAI,UAAU,KAAK,OAAO,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,GAAG,OAAO,CAAC,EAAE,CAAC;gBACjE,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,4BAA4B,CAC1C,GAAW,EACX,YAAgC,EAChC,YAAiC;IAEjC,IAAI,MAAM,GAAG,GAAG,CAAC;IACjB,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,QAAQ,GAAG,4BAA4B,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QACjE,IAAI,QAAQ;YAAE,MAAM,GAAG,QAAQ,CAAC;IAClC,CAAC;IACD,IAAI,CAAC,YAAY;QAAE,OAAO,MAAM,CAAC;IACjC,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IAC5E,OAAO,iBAAiB,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;AACvD,CAAC"}

package/dist/remediate/steps/dispatch/verifyCommands.d.ts

@@ -1,144 +0,0 @@
-import type { RemediationState } from "../../state/store.js";
-/**
- * The host manages the build centrally; a per-node verify command that runs
- * `npm run build` (or a `npm test` whose package script prepends a build) races
- * the central build's dist/ and is therefore forbidden. A command is build-free
- * only when it neither builds nor invokes a build-prepending test script.
- *
- * Forbidden (return false):
- *  - `npm run build` / `npm run build -w ...` / `tsc` emit (`tsc -b`, `tsc --build`)
- *  - bare `npm test` / `npm t` / `npm run test` (the package script prepends build)
- *
- * Allowed (return true):
- *  - `npm run check` (no emit)
- *  - `npx vitest run <path>` / `vitest run <path>`
- *  - `node --test <path>`
- */
-export declare function isBuildFreeVerifyCommand(cmd: string): boolean;
-/**
- * Inject the tsx ESM loader into a bare `node --test <file>` command so the `.mjs`
- * node:test suites (which import `audit-tools/shared` via tsconfig `paths`, honored
- * only by tsx) resolve in a per-node worktree with no built `dist/`. A host- or
- * DAG-authored `node --test tests/audit/x.test.mjs` would otherwise fail module
- * resolution; the tool normalizes it so correctness can't depend on the host
- * remembering to add the loader. Idempotent: a command already carrying
- * `--import tsx/esm` or a `--loader` is left untouched. Mirrors the runner the
- * derived verify uses ({@link verifyCommandsForEdits}), so the displayed per-node
- * command and the in-process verify match.
- */
-export declare function normalizeNodeTestCommand(cmd: string): string;
-/**
- * True when `cmd` is a test-runner invocation whose target is a whole directory
- * or the entire suite rather than specific test files — e.g. `npx vitest run
- * tests/remediate`, `vitest run` (no path), `node --test tests/audit/`. Such a
- * command, run as an *additional* per-node verify alongside the scoped derive,
- * re-enters the FULL suite inside a per-node worktree. That is the structural
- * deadlock proven 2026-06-30: a source node's whole-suite verify fails on a
- * stale test owned by a DIFFERENT node, and concurrent worktrees race shared
- * test temp dirs. The derived verify already runs this node's OWN touched
- * tests, so a host/DAG-authored whole-suite command adds only risk — the tool
- * drops it rather than relying on the author to scope it (enforce-in-tooling,
- * never host discretion). A command naming at least one concrete `.test.<ext>`
- * file is scoped and kept.
- */
-export declare function isWholeSuiteTestCommand(cmd: string): boolean;
-/**
- * True when a verify command DEPENDS ON A BUILT `dist/` — either the command
- * string itself references a dist path (spawning the built CLI), or, when
- * `treeRoot` is supplied, a test FILE the command names imports/spawns dist in
- * its content. A per-node worktree has NO dist at all (`dist/` is gitignored
- * and only `node_modules` is junction-linked), so such a command false-reds
- * DETERMINISTICALLY under the by-design build-free accept gate — three accepts
- * in a row failed exactly this way (2026-07-23 dogfood, backlog "build-free
- * accept verify false-reds dist-importing targeted commands"). A central build
- * cannot fix it (it materializes MAIN's dist, not the worktree's), so the
- * remedy is the same as the whole-suite / cross-node families: drop from
- * per-node verify and defer to the central close gate, which runs on the
- * merged tree with a fresh build.
- *
- * Detection is deliberately conservative-toward-deferral: a false positive
- * (e.g. a comment mentioning `dist/`) only moves that command to the close
- * gate — never a lost signal, never a false-red.
- */
-export declare function isDistDependentVerifyCommand(cmd: string, treeRoot?: string): boolean;
-/**
- * True when a verify command names a test FILE that is WORKTREE-HOSTILE: its
- * content spawns the `audit-code` / `remediate-code` driver CLIs, which the
- * worker-context guard (v0.34.19, cwd-discriminated) mechanically refuses from
- * inside a node worktree — so the test deterministically fails there and the
- * node can NEVER accept (accept/reverify cluster defect 8). Same
- * conservative-toward-deferral contract as the dist probe: a false positive
- * only moves the command to the close gate (root cwd, where it runs fine).
- */
-export declare function isWorktreeHostileVerifyCommand(cmd: string, treeRoot: string): boolean;
-/**
- * Partition verify commands into the per-node-runnable set and the DEFERRED set
- * (dist-dependent OR worktree-hostile — both deterministically false-red inside
- * a build-free node worktree; the central close gate runs them on the merged
- * tree at the repo root). Content-level detection: `treeRoot` should be the
- * WORKTREE the verify would run in, so the scanned test files are the node's
- * own post-edit versions. The deferred list is DEDUPLICATED — the close gate's
- * replay drains it verbatim, so a doubled entry would run twice there.
- */
-export declare function partitionDeferredVerifyCommands(commands: string[], treeRoot: string): {
-    kept: string[];
-    deferred: string[];
-};
-/**
- * cg-1: collapse the per-node DEFERRED verify commands into the close gate's
- * single residual run. Exact-duplicate commands collapse to one (first-seen
- * order); when the close phase's own full-suite leg ran green
- * (`fullSuiteCovers`), any command that leg already covers is SUBSUMED and
- * dropped — a whole-suite runner invocation, or a vitest run whose path tokens
- * are all test files (the full vitest sweep runs every test file). Everything
- * else (e.g. `npm run check`, dist-spawning scripts) survives as the residual
- * the close gate must run exactly once. The 2026-08-06 run drained the raw
- * per-node lists verbatim — duplicate full `tests/audit` passes, a 2h close.
- */
-export declare function dedupeDeferredVerifyCommands(deferred: Iterable<string>, opts: {
-    fullSuiteCovers: boolean;
-}): {
-    residual: string[];
-    subsumed: string[];
-};
-/**
- * Repo-relative path-like tokens in a shell command — tokens containing a `/` and a
- * file extension (e.g. `scripts/remediate/verify-hosts.mjs`, `tests/x.test.ts`).
- * Used to decide whether a targeted verify command is self-contained.
- */
-export declare function pathTokensInCommand(cmd: string): string[];
-/**
- * Keep only the targeted verify commands that are SELF-CONTAINED for this node:
- * every path-like token they reference is either one of the node's own paths (its
- * declared write set ∪ the files it actually edited on its branch) or already
- * present in the tree. A command referencing a path this node doesn't own and that
- * isn't in the tree depends on a SIBLING node's not-yet-created deliverable —
- * running it in per-node verify is a guaranteed-fail deadlock (proven 2026-07-03: a
- * node's `targeted_command` was `node scripts/remediate/verify-hosts.mjs`, another
- * node's pending output). Per-node verify must be self-contained; such a cross-node
- * command is dropped here and deferred to the integration/close gate. A command with
- * no path tokens (e.g. `npm run check`) is always kept.
- */
-export declare function selfContainedVerifyCommands(commands: string[], ownPaths: Iterable<string>, treeRoot: string): string[];
-/**
- * Derive a node's per-node verify commands from the test files it ACTUALLY touched
- * on its worktree branch (the git ground truth), instead of trusting host-authored
- * `targeted_commands` whose paths/runner can drift from where the worker put the
- * test. Always typechecks (`npm run check`, no emit), then runs ONLY this node's
- * own touched test files with the repo's runners — never the whole suite (which
- * would re-enter worktree-spawning tests inside a nested worktree). Build-free: the
- * host owns the central build; a node's own test imports the source it changed via
- * the tsx loader. Returns `[]` when there is no git ground truth so the caller can
- * skip the gate rather than fabricate a command.
- */
-/** Pure assembly (git-free) of the verify commands for a set of edited paths —
- *  the testable core of {@link deriveVerifyCommandsFromBranch}. */
-export declare function verifyCommandsForEdits(editedFiles: Iterable<string>): string[];
-export declare function deriveVerifyCommandsFromBranch(root: string, branch: string): string[];
-/**
- * A node's own `targeted_commands` for the per-node verify (task_7d35176d) — the union
- * of the block's `targeted_commands` and its findings' `targeted_commands` (the
- * auditor-specified, fix-specific verification) bound into the host workload.
- */
-export declare function targetedCommandsForBlock(state: RemediationState, blockId: string): string[];
-//# sourceMappingURL=verifyCommands.d.ts.map

package/dist/remediate/steps/dispatch/verifyCommands.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"verifyCommands.d.ts","sourceRoot":"","sources":["../../../../src/remediate/steps/dispatch/verifyCommands.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAO7D;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CA4B7D;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAM5D;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAU5D;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAkBpF;AAED;;;;;;;;GAQG;AACH,wBAAgB,8BAA8B,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAgBrF;AAED;;;;;;;;GAQG;AACH,wBAAgB,+BAA+B,CAC7C,QAAQ,EAAE,MAAM,EAAE,EAClB,QAAQ,EAAE,MAAM,GACf;IAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAWxC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,EAC1B,IAAI,EAAE;IAAE,eAAe,EAAE,OAAO,CAAA;CAAE,GACjC;IAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAe5C;AAaD;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAGzD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,MAAM,EAAE,EAClB,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,EAC1B,QAAQ,EAAE,MAAM,GACf,MAAM,EAAE,CAUV;AAaD;;;;;;;;;;GAUG;AACH;mEACmE;AACnE,wBAAgB,sBAAsB,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAW9E;AAED,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAIrF;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAS3F"}

package/dist/remediate/steps/dispatch/verifyCommands.js

@@ -1,331 +0,0 @@
-import { existsSync, readFileSync } from "node:fs";
-import { join } from "node:path";
-import { gitEditedFilesForBranch } from "./common.js";
-// ---------------------------------------------------------------------------
-// Build-free per-node verification commands (residual CE-001)
-// ---------------------------------------------------------------------------
-/**
- * The host manages the build centrally; a per-node verify command that runs
- * `npm run build` (or a `npm test` whose package script prepends a build) races
- * the central build's dist/ and is therefore forbidden. A command is build-free
- * only when it neither builds nor invokes a build-prepending test script.
- *
- * Forbidden (return false):
- *  - `npm run build` / `npm run build -w ...` / `tsc` emit (`tsc -b`, `tsc --build`)
- *  - bare `npm test` / `npm t` / `npm run test` (the package script prepends build)
- *
- * Allowed (return true):
- *  - `npm run check` (no emit)
- *  - `npx vitest run <path>` / `vitest run <path>`
- *  - `node --test <path>`
- */
-export function isBuildFreeVerifyCommand(cmd) {
-    if (cmd.trim().length === 0)
-        return false;
-    // INV-RSM-VERIFY-01 (COR-8c497987): judge each shell-chained INVOCATION on its
-    // own flags, never the whole string — `tsc --noEmit && tsc -p build` must not
-    // pass because a `--noEmit` appears SOMEWHERE in the command. Split on the
-    // shell chain separators (&&, ||, ;, |, newline) first, then validate every
-    // segment independently; one emitting segment forbids the whole command.
-    const segments = cmd
-        .replace(/\r\n/g, "\n")
-        .split(/&&|\|\||[;|\n]/)
-        .map((s) => s.trim().toLowerCase().replace(/\s+/g, " "))
-        .filter((s) => s.length > 0);
-    if (segments.length === 0)
-        return false;
-    for (const c of segments) {
-        // Any explicit build step is forbidden.
-        if (/\bnpm\s+run\s+build\b/.test(c))
-            return false;
-        if (/\btsc\b.*(-b\b|--build\b)/.test(c))
-            return false;
-        if (/(^|\s)tsc(\s|$)/.test(c) && !/--noemit\b/.test(c)) {
-            // A bare `tsc` (or `tsc -p ...`) emits unless --noEmit is set — judged
-            // per invocation, so a sibling segment's --noEmit cannot vouch for it.
-            return false;
-        }
-        // A build-prepending `npm test` / `npm t` / `npm run test` is forbidden; the
-        // build-free runner (vitest run / node --test) must be invoked directly.
-        if (/\bnpm\s+(test|t)\b/.test(c))
-            return false;
-        if (/\bnpm\s+run\s+test\b/.test(c))
-            return false;
-    }
-    return true;
-}
-/**
- * Inject the tsx ESM loader into a bare `node --test <file>` command so the `.mjs`
- * node:test suites (which import `audit-tools/shared` via tsconfig `paths`, honored
- * only by tsx) resolve in a per-node worktree with no built `dist/`. A host- or
- * DAG-authored `node --test tests/audit/x.test.mjs` would otherwise fail module
- * resolution; the tool normalizes it so correctness can't depend on the host
- * remembering to add the loader. Idempotent: a command already carrying
- * `--import tsx/esm` or a `--loader` is left untouched. Mirrors the runner the
- * derived verify uses ({@link verifyCommandsForEdits}), so the displayed per-node
- * command and the in-process verify match.
- */
-export function normalizeNodeTestCommand(cmd) {
-    const trimmed = cmd.trim();
-    if (!/^node\b/.test(trimmed))
-        return cmd;
-    if (!/\s--test\b/.test(trimmed))
-        return cmd;
-    if (/--import\s+tsx\/esm\b/.test(trimmed) || /--loader\b/.test(trimmed))
-        return cmd;
-    return trimmed.replace(/^node\b/, "node --import tsx/esm");
-}
-/**
- * True when `cmd` is a test-runner invocation whose target is a whole directory
- * or the entire suite rather than specific test files — e.g. `npx vitest run
- * tests/remediate`, `vitest run` (no path), `node --test tests/audit/`. Such a
- * command, run as an *additional* per-node verify alongside the scoped derive,
- * re-enters the FULL suite inside a per-node worktree. That is the structural
- * deadlock proven 2026-06-30: a source node's whole-suite verify fails on a
- * stale test owned by a DIFFERENT node, and concurrent worktrees race shared
- * test temp dirs. The derived verify already runs this node's OWN touched
- * tests, so a host/DAG-authored whole-suite command adds only risk — the tool
- * drops it rather than relying on the author to scope it (enforce-in-tooling,
- * never host discretion). A command naming at least one concrete `.test.<ext>`
- * file is scoped and kept.
- */
-export function isWholeSuiteTestCommand(cmd) {
-    const c = cmd.trim();
-    const isVitest = /\bvitest\b\s+run\b/.test(c) || /\bvitest\b(?!\s+run)/.test(c);
-    const isNodeTest = /^node\b/.test(c) && /\s--test\b/.test(c);
-    if (!isVitest && !isNodeTest)
-        return false;
-    // Tokenise; a concrete test file makes it scoped. Anything that is a runner
-    // with no concrete test-file target (bare runner, or a directory/glob target)
-    // is whole-suite.
-    const namesConcreteTestFile = /(^|\s)[^\s]*\.test\.(ts|tsx|mjs|cjs|js)(\s|$)/.test(c);
-    return !namesConcreteTestFile;
-}
-/**
- * True when a verify command DEPENDS ON A BUILT `dist/` — either the command
- * string itself references a dist path (spawning the built CLI), or, when
- * `treeRoot` is supplied, a test FILE the command names imports/spawns dist in
- * its content. A per-node worktree has NO dist at all (`dist/` is gitignored
- * and only `node_modules` is junction-linked), so such a command false-reds
- * DETERMINISTICALLY under the by-design build-free accept gate — three accepts
- * in a row failed exactly this way (2026-07-23 dogfood, backlog "build-free
- * accept verify false-reds dist-importing targeted commands"). A central build
- * cannot fix it (it materializes MAIN's dist, not the worktree's), so the
- * remedy is the same as the whole-suite / cross-node families: drop from
- * per-node verify and defer to the central close gate, which runs on the
- * merged tree with a fresh build.
- *
- * Detection is deliberately conservative-toward-deferral: a false positive
- * (e.g. a comment mentioning `dist/`) only moves that command to the close
- * gate — never a lost signal, never a false-red.
- */
-export function isDistDependentVerifyCommand(cmd, treeRoot) {
-    if (/\bdist[\/\\]/.test(cmd))
-        return true;
-    if (treeRoot === undefined)
-        return false;
-    for (const token of pathTokensInCommand(cmd)) {
-        if (!/\.test\.(mjs|cjs|js|ts|tsx)$/.test(token))
-            continue;
-        const p = join(treeRoot, token);
-        if (!existsSync(p))
-            continue;
-        let content;
-        try {
-            content = readFileSync(p, "utf8");
-        }
-        catch {
-            continue;
-        }
-        // `dist/`-style path (import/spawn) or a `"dist"` path-segment argument
-        // (join(root, "dist", ...) — how the wrapper e2es locate the built entry).
-        if (/\bdist[\/\\]/.test(content) || /["']dist["']/.test(content))
-            return true;
-    }
-    return false;
-}
-/**
- * True when a verify command names a test FILE that is WORKTREE-HOSTILE: its
- * content spawns the `audit-code` / `remediate-code` driver CLIs, which the
- * worker-context guard (v0.34.19, cwd-discriminated) mechanically refuses from
- * inside a node worktree — so the test deterministically fails there and the
- * node can NEVER accept (accept/reverify cluster defect 8). Same
- * conservative-toward-deferral contract as the dist probe: a false positive
- * only moves the command to the close gate (root cwd, where it runs fine).
- */
-export function isWorktreeHostileVerifyCommand(cmd, treeRoot) {
-    for (const token of pathTokensInCommand(cmd)) {
-        if (!/\.test\.(mjs|cjs|js|ts|tsx)$/.test(token))
-            continue;
-        const p = join(treeRoot, token);
-        if (!existsSync(p))
-            continue;
-        let content;
-        try {
-            content = readFileSync(p, "utf8");
-        }
-        catch {
-            continue;
-        }
-        // The driver CLI names (bin or wrapper .mjs) appearing in test content —
-        // spawn targets the worker-context guard refuses inside a worktree.
-        if (/\b(?:audit|remediate)-code(?:\.mjs)?\b/.test(content))
-            return true;
-    }
-    return false;
-}
-/**
- * Partition verify commands into the per-node-runnable set and the DEFERRED set
- * (dist-dependent OR worktree-hostile — both deterministically false-red inside
- * a build-free node worktree; the central close gate runs them on the merged
- * tree at the repo root). Content-level detection: `treeRoot` should be the
- * WORKTREE the verify would run in, so the scanned test files are the node's
- * own post-edit versions. The deferred list is DEDUPLICATED — the close gate's
- * replay drains it verbatim, so a doubled entry would run twice there.
- */
-export function partitionDeferredVerifyCommands(commands, treeRoot) {
-    const kept = [];
-    const deferred = new Set();
-    for (const c of commands) {
-        if (isDistDependentVerifyCommand(c, treeRoot) || isWorktreeHostileVerifyCommand(c, treeRoot)) {
-            deferred.add(c);
-        }
-        else {
-            kept.push(c);
-        }
-    }
-    return { kept, deferred: [...deferred] };
-}
-/**
- * cg-1: collapse the per-node DEFERRED verify commands into the close gate's
- * single residual run. Exact-duplicate commands collapse to one (first-seen
- * order); when the close phase's own full-suite leg ran green
- * (`fullSuiteCovers`), any command that leg already covers is SUBSUMED and
- * dropped — a whole-suite runner invocation, or a vitest run whose path tokens
- * are all test files (the full vitest sweep runs every test file). Everything
- * else (e.g. `npm run check`, dist-spawning scripts) survives as the residual
- * the close gate must run exactly once. The 2026-08-06 run drained the raw
- * per-node lists verbatim — duplicate full `tests/audit` passes, a 2h close.
- */
-export function dedupeDeferredVerifyCommands(deferred, opts) {
-    const residual = [];
-    const subsumed = [];
-    const seen = new Set();
-    for (const raw of deferred) {
-        const cmd = raw.trim();
-        if (cmd.length === 0 || seen.has(cmd))
-            continue;
-        seen.add(cmd);
-        if (opts.fullSuiteCovers && isSubsumedByFullSuite(cmd)) {
-            subsumed.push(cmd);
-            continue;
-        }
-        residual.push(cmd);
-    }
-    return { residual, subsumed };
-}
-/** A green full-suite leg covers whole-suite runs and test-file-only vitest runs. */
-function isSubsumedByFullSuite(cmd) {
-    if (isWholeSuiteTestCommand(cmd))
-        return true;
-    if (!/\bvitest\b/.test(cmd))
-        return false;
-    const tokens = pathTokensInCommand(cmd);
-    return (tokens.length > 0 &&
-        tokens.every((t) => /\.test\.(ts|tsx|mts|cts|js|mjs|cjs)$/.test(t)));
-}
-/**
- * Repo-relative path-like tokens in a shell command — tokens containing a `/` and a
- * file extension (e.g. `scripts/remediate/verify-hosts.mjs`, `tests/x.test.ts`).
- * Used to decide whether a targeted verify command is self-contained.
- */
-export function pathTokensInCommand(cmd) {
-    const tokens = cmd.match(/(?:[\w.@-]+[\/\\])+[\w.@-]+\.\w+/g) ?? [];
-    return [...new Set(tokens.map((t) => t.replace(/\\/g, "/")))];
-}
-/**
- * Keep only the targeted verify commands that are SELF-CONTAINED for this node:
- * every path-like token they reference is either one of the node's own paths (its
- * declared write set ∪ the files it actually edited on its branch) or already
- * present in the tree. A command referencing a path this node doesn't own and that
- * isn't in the tree depends on a SIBLING node's not-yet-created deliverable —
- * running it in per-node verify is a guaranteed-fail deadlock (proven 2026-07-03: a
- * node's `targeted_command` was `node scripts/remediate/verify-hosts.mjs`, another
- * node's pending output). Per-node verify must be self-contained; such a cross-node
- * command is dropped here and deferred to the integration/close gate. A command with
- * no path tokens (e.g. `npm run check`) is always kept.
- */
-export function selfContainedVerifyCommands(commands, ownPaths, treeRoot) {
-    const owned = new Set([...ownPaths].map((p) => p.replace(/\\/g, "/")));
-    return commands.filter((cmd) => {
-        for (const token of pathTokensInCommand(cmd)) {
-            if (owned.has(token))
-                continue;
-            if (existsSync(join(treeRoot, token)))
-                continue;
-            return false;
-        }
-        return true;
-    });
-}
-/** A repo-relative test path → the runner that executes that file directly. */
-function verifyRunnerForTestFile(repoRelPath) {
-    // ONE vitest runner across all suites (audit / shared / remediate). The node:test
-    // split was retired 2026-07-02, so every tracked `.test.mjs` / `.test.ts` file is a
-    // vitest file — running a `.mjs` vitest suite under `node --test` throws "Vitest
-    // failed to access its internal state". vitest resolves `audit-tools/shared` via its
-    // config alias, so a per-node worktree needs no prior build (`npx vitest run <file>`).
-    if (/^tests\/.+\.test\.(mjs|ts|tsx)$/.test(repoRelPath))
-        return "vitest";
-    return undefined;
-}
-/**
- * Derive a node's per-node verify commands from the test files it ACTUALLY touched
- * on its worktree branch (the git ground truth), instead of trusting host-authored
- * `targeted_commands` whose paths/runner can drift from where the worker put the
- * test. Always typechecks (`npm run check`, no emit), then runs ONLY this node's
- * own touched test files with the repo's runners — never the whole suite (which
- * would re-enter worktree-spawning tests inside a nested worktree). Build-free: the
- * host owns the central build; a node's own test imports the source it changed via
- * the tsx loader. Returns `[]` when there is no git ground truth so the caller can
- * skip the gate rather than fabricate a command.
- */
-/** Pure assembly (git-free) of the verify commands for a set of edited paths —
- *  the testable core of {@link deriveVerifyCommandsFromBranch}. */
-export function verifyCommandsForEdits(editedFiles) {
-    const vitestTests = [];
-    for (const f of editedFiles) {
-        const rel = f.replace(/\\/g, "/");
-        if (verifyRunnerForTestFile(rel) === "vitest")
-            vitestTests.push(rel);
-    }
-    const cmds = ["npm run check"];
-    if (vitestTests.length > 0) {
-        cmds.push(`npx vitest run ${vitestTests.sort().join(" ")}`);
-    }
-    return cmds;
-}
-export function deriveVerifyCommandsFromBranch(root, branch) {
-    const edited = gitEditedFilesForBranch(root, branch);
-    if (!edited.available)
-        return [];
-    return verifyCommandsForEdits(edited.files);
-}
-/**
- * A node's own `targeted_commands` for the per-node verify (task_7d35176d) — the union
- * of the block's `targeted_commands` and its findings' `targeted_commands` (the
- * auditor-specified, fix-specific verification) bound into the host workload.
- */
-export function targetedCommandsForBlock(state, blockId) {
-    const block = state.plan?.blocks?.find((b) => b.block_id === blockId);
-    if (!block)
-        return [];
-    const out = [...(block.targeted_commands ?? [])];
-    for (const fid of block.items) {
-        const finding = state.plan?.findings?.find((f) => f.id === fid);
-        for (const c of finding?.targeted_commands ?? [])
-            out.push(c);
-    }
-    return [...new Set(out)];
-}
-//# sourceMappingURL=verifyCommands.js.map