audit-tools 0.45.0 → 0.46.0

package/dist/shared/tooling/commandShape.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"commandShape.d.ts","sourceRoot":"","sources":["../../../src/shared/tooling/commandShape.ts"],"names":[],"mappings":"AAgEA;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CA6BnE;AAED;;;;;;;;GAQG;AACH,wBAAgB,gCAAgC,CAC9C,QAAQ,EAAE,SAAS,MAAM,EAAE,EAC3B,eAAe,EAAE,CAAC,IAAI,EAAE,OAAO,GAAG,cAAc,EAAE,GAAG,EAAE,OAAO,KAAK,MAAM,GACxE;IAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAgB5C"}
+{"version":3,"file":"commandShape.d.ts","sourceRoot":"","sources":["../../../src/shared/tooling/commandShape.ts"],"names":[],"mappings":"AAgFA;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CA6BnE;AAED;;;;;;;;GAQG;AACH,wBAAgB,gCAAgC,CAC9C,QAAQ,EAAE,SAAS,MAAM,EAAE,EAC3B,eAAe,EAAE,CAAC,IAAI,EAAE,OAAO,GAAG,cAAc,EAAE,GAAG,EAAE,OAAO,KAAK,MAAM,GACxE;IAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAgB5C;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAyB5D"}

package/dist/shared/tooling/commandShape.js

@@ -2,18 +2,34 @@ import { scanStringAware } from "../parsing/stringAwareScanner.js";
 /**
  * THE declared single-invocation command shape — one rule, every boundary.
  *
- * A declared command (a block's `targeted_commands`) is executed VERBATIM
- * through `shell: true` in the repository root, so anything that chains,
- * redirects, substitutes or subshells turns one declared test into arbitrary
- * execution. A flat regex cannot decide this: `node -e "process.exit(0)"` is an
- * ordinary test invocation whose parens are inside quotes, and refusing it would
- * refuse the normal case.
+ * A declared command (a block's `targeted_commands`) is a string an operator
+ * wrote and this tool then RUNS. The rule exists because such a string must
+ * denote exactly ONE invocation: anything that chains, redirects, substitutes
+ * or subshells turns one declared test into arbitrary execution. A flat regex
+ * cannot decide this: `node -e "process.exit(0)"` is an ordinary test
+ * invocation whose parens are inside quotes, and refusing it would refuse the
+ * normal case.
+ *
+ * WHAT THE RULE IS *NOT*: an escaping scheme for one particular spawn. The
+ * consumers no longer agree on how they spawn — the closing suites and the
+ * required-test rerun split the string with {@link parseCommandString} and
+ * spawn `shell: false`, while the triage re-verification path still hands it to
+ * a shell — and the rule is identical for all of them. That is the point of
+ * stating it once here: the property enforced belongs to the DECLARATION, not
+ * to the spawner. A string carrying `&&` or a redirect declares work this
+ * contract cannot faithfully run as ONE invocation, and must be refused up
+ * front — whether the consumer would have let a shell act on it or would have
+ * silently reduced it to literal argv bytes. Enforcing the same rule at every
+ * boundary is also what keeps producer and consumer agreeing about which
+ * declarations are admissible at all.
  *
  * So the scan is QUOTE-AWARE — a tiny, fully-owned grammar, not a shell parser.
- * It is deliberately narrower than EITHER shell's grammar, because `shell: true`
- * is TWO grammars and no per-grammar state machine is sound for both: `/bin/sh
- * -c` on posix, `cmd.exe /d /s /c` on win32. Where they disagree, tracking state
- * under one of them MIS-CLASSIFIES the other:
+ * It is deliberately narrower than EITHER shell's grammar, because a declared
+ * command historically reached `shell: true` — TWO grammars, and no per-grammar
+ * state machine is sound for both: `/bin/sh -c` on posix, `cmd.exe /d /s /c` on
+ * win32. Where they disagree, tracking state under one of them MIS-CLASSIFIES
+ * the other, and keeping the union-of-both-grammars refusal is what lets the
+ * same admission decision hold on every platform:
  *
  *   - `'` quotes on sh and is an ORDINARY CHARACTER on cmd.exe, so crediting it
  *     reads `echo '& evil.exe'` as fully quoted while cmd.exe reads `&` as a
@@ -117,4 +133,60 @@ export function partitionCommandsByDeclaredShape(commands, describeRefusal) {
     }
     return { commands: admitted, refusals };
 }
+/**
+ * Split a command string into an argv array, so it can be spawned with
+ * `shell: false`.
+ *
+ * TOTAL, and its guarantee is stated in terms of `shell: false` — not in terms
+ * of a precondition a caller has to remember. Exactly two characters are
+ * special: an unquoted space ENDS a token, and a double quote toggles grouping
+ * and is dropped. EVERY other byte — including `' \ ^ % $` and backtick, and
+ * including `& | ; < > ( )` — is copied into the token literally, which under
+ * `shell: false` is precisely what the child receives, because no shell ever
+ * parses the result. So for any input this produces the argv that a shell-free
+ * spawn will actually deliver; it never silently drops meaning.
+ *
+ * What it does NOT do is decide whether a command was ADMISSIBLE. A string that
+ * fails {@link commandLeavesDeclaredShape} still splits — `a && b` becomes
+ * `["a", "&&", "b"]`, three literal argv tokens — and that argv is a faithful
+ * rendering of what `shell: false` would run, not an execution of the chain the
+ * author wrote. That is a declaration the contract cannot honour, so it must be
+ * REFUSED by the gate before it reaches a spawn; this function is not the place
+ * that decision is made, and it is not a shell parser standing in for one.
+ *
+ * Windows note: because `\` is an ordinary byte here, an absolute Windows path
+ * survives intact through the split (`C:\Program Files\nodejs\node.exe` stays
+ * one token when double-quoted). The declared-shape gate refuses `\` in every
+ * position, so such a path can only reach this function from a caller that did
+ * not gate — see {@link commandLeavesDeclaredShape}'s header for why the
+ * refusal is about the declaration rather than the spawn.
+ */
+export function parseCommandString(command) {
+    const argv = [];
+    let current = "";
+    let quoted = false;
+    let started = false;
+    for (const char of command) {
+        if (char === '"') {
+            // A quote both toggles the state and MARKS the token as started, so an
+            // explicit empty argument (`""`) survives as an empty string rather than
+            // vanishing at the length check below.
+            quoted = !quoted;
+            started = true;
+            continue;
+        }
+        if (char === " " && !quoted) {
+            if (started)
+                argv.push(current);
+            current = "";
+            started = false;
+            continue;
+        }
+        current += char;
+        started = true;
+    }
+    if (started)
+        argv.push(current);
+    return argv;
+}
 //# sourceMappingURL=commandShape.js.map

package/dist/shared/tooling/commandShape.js.map

@@ -1 +1 @@
-{"version":3,"file":"commandShape.js","sourceRoot":"","sources":["../../../src/shared/tooling/commandShape.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AAEnE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAEH;;;;;GAKG;AACH,MAAM,uBAAuB,GAAG,8BAA8B,CAAC;AAE/D,+EAA+E;AAC/E,MAAM,qBAAqB,GAAG,SAAS,CAAC;AAExC;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CAAC,OAAe;IACxD,IAAI,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAEvD,6EAA6E;IAC7E,8EAA8E;IAC9E,sEAAsE;IACtE,6EAA6E;IAC7E,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,eAAe,CACb,OAAO,EACP,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,EACxC;QACE,WAAW,EAAE,GAAG,EAAE;YAChB,IAAI,GAAG,IAAI,CAAC;QACd,CAAC;QACD,YAAY,EAAE,GAAG,EAAE;YACjB,IAAI,GAAG,KAAK,CAAC;QACf,CAAC;QACD,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE;YACnB,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,OAAO;YAClD,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,KAAK,CAAC;QACf,CAAC;KACF,CACF,CAAC;IACF,8EAA8E;IAC9E,wCAAwC;IACxC,OAAO,OAAO,IAAI,IAAI,CAAC;AACzB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gCAAgC,CAC9C,QAA2B,EAC3B,eAAyE;IAEzE,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;YAC7C,SAAS;QACX,CAAC;QACD,IAAI,0BAA0B,CAAC,OAAO,CAAC,EAAE,CAAC;YACxC,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC,CAAC;YACpD,SAAS;QACX,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AAC1C,CAAC"}
+{"version":3,"file":"commandShape.js","sourceRoot":"","sources":["../../../src/shared/tooling/commandShape.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AAEnE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiEG;AAEH;;;;;GAKG;AACH,MAAM,uBAAuB,GAAG,8BAA8B,CAAC;AAE/D,+EAA+E;AAC/E,MAAM,qBAAqB,GAAG,SAAS,CAAC;AAExC;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CAAC,OAAe;IACxD,IAAI,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAEvD,6EAA6E;IAC7E,8EAA8E;IAC9E,sEAAsE;IACtE,6EAA6E;IAC7E,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,eAAe,CACb,OAAO,EACP,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,EACxC;QACE,WAAW,EAAE,GAAG,EAAE;YAChB,IAAI,GAAG,IAAI,CAAC;QACd,CAAC;QACD,YAAY,EAAE,GAAG,EAAE;YACjB,IAAI,GAAG,KAAK,CAAC;QACf,CAAC;QACD,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE;YACnB,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,OAAO;YAClD,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,KAAK,CAAC;QACf,CAAC;KACF,CACF,CAAC;IACF,8EAA8E;IAC9E,wCAAwC;IACxC,OAAO,OAAO,IAAI,IAAI,CAAC;AACzB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gCAAgC,CAC9C,QAA2B,EAC3B,eAAyE;IAEzE,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;YAC7C,SAAS;QACX,CAAC;QACD,IAAI,0BAA0B,CAAC,OAAO,CAAC,EAAE,CAAC;YACxC,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC,CAAC;YACpD,SAAS;QACX,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjB,uEAAuE;YACvE,yEAAyE;YACzE,uCAAuC;YACvC,MAAM,GAAG,CAAC,MAAM,CAAC;YACjB,OAAO,GAAG,IAAI,CAAC;YACf,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YAC5B,IAAI,OAAO;gBAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAChC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,GAAG,KAAK,CAAC;YAChB,SAAS;QACX,CAAC;QACD,OAAO,IAAI,IAAI,CAAC;QAChB,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;IACD,IAAI,OAAO;QAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAChC,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/shared/tooling/exec.d.ts

@@ -22,6 +22,16 @@ export interface RunTrackedResult {
     /** Elapsed wall-clock time in milliseconds for the spawned command. */
     duration_ms: number;
     error?: Error;
+    /**
+     * The signal that killed the child, or `null` when it exited on its own.
+     *
+     * Reported, never DISCRIMINATED on by callers that need to know WHY a child
+     * died: a deadline miss, a `maxBuffer` overflow and an external `kill` all
+     * set it. The `error.code` (`ETIMEDOUT` / `ENOBUFS`) is what separates those
+     * three; `signal` is the residue that names an external kill once they are
+     * ruled out.
+     */
+    signal?: string | null;
 }
 /**
  * Quote a single argv token for embedding into the `cmd.exe /d /s /c "..."`
@@ -134,6 +144,28 @@ export declare function resolveExecArgv(argv: string[], options?: {
 export declare function stripAuditToolsControlEnv(base?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
 /** Run a command synchronously. argv[0] is the command, the rest are args. */
 export declare function runTracked(argv: string[], options?: RunTrackedOptions): RunTrackedResult;
+/**
+ * Async twin of {@link runTracked}: same argv resolution, control-env scrub, and
+ * result shape, driven by {@link spawnHidden} instead of `spawnSync`. Analyzer
+ * acquisition runs HERE rather than on the synchronous runner because a
+ * synchronous child blocks the event loop for the whole spawn — which starves
+ * every `setInterval` liveness heartbeat in the process (the advance
+ * heartbeat, and each held file lock's mtime heartbeat), so one stalled
+ * `npx --version` probe classified a LIVE lock stale and stole it mid-flight.
+ * Awaited by the acquisition engine, the binary resolver, and every closing /
+ * required-test spawn; never mixed with {@link runTracked} in one call path.
+ *
+ * DEADLINE AND OVERFLOW ARE CLASSIFIED, not left as a bare signal. `spawnSync`
+ * reports an over-deadline child as `ETIMEDOUT` and an over-`maxBuffer` child
+ * as `ENOBUFS`, and callers discriminate on those codes precisely because
+ * `signal` conflates them with an external `kill`. Node's own `timeout` option
+ * on the async path would surface both as an ordinary SIGTERM close and throw
+ * that distinction away, so this runner enforces BOTH bounds itself and stamps
+ * the same two codes — one classification serves both twins, and the bounds
+ * themselves are measured the same way (`maxBuffer` PER STREAM, as `spawnSync`
+ * measures it) so the two twins cannot disagree about which children overflow.
+ */
+export declare function runTrackedAsync(argv: string[], options?: RunTrackedOptions): Promise<RunTrackedResult>;
 /**
  * `child_process.spawnSync` with `windowsHide` forced on. A windowless parent
  * (node launched by an IDE/agent) spawning a console child (git, sqlite3, …) pops

package/dist/shared/tooling/exec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"exec.d.ts","sourceRoot":"","sources":["../../../src/shared/tooling/exec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AASzE,MAAM,WAAW,iBAAiB;IAChC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;CAC5B;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,0DAA0D;IAC1D,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,mGAAmG;IACnG,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,uEAAuE;IACvE,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,KAAK,CAAC;CACf;AAiDD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAgB/C;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CACxB,GAAG,EAAE,MAAM,EACX,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,MAAM,CAGR;AAWD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEvD;AAWD;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAI3D;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAEnE;AAED,wBAAgB,mBAAmB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACnE,KAAK,EAAE,CAAC,GAAG,MAAM,GAAG,SAAS,EAC7B,KAAK,EAAE,MAAM,GACZ,CAAC,CAeH;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,EACf,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,MAAM,CAKR;AAkBD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAGjE;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAA;CAAO,GAC3C,MAAM,EAAE,CAOV;AAOD;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,CAAC,EAAE,MAAM,CAAC,UAAU,GACvB,MAAM,CAAC,UAAU,CAWnB;AAED,8EAA8E;AAC9E,wBAAgB,UAAU,CACxB,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,GAAE,iBAAsB,GAC9B,gBAAgB,CAoClB;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe,EAQnB,OAAO,SAAS,CAAC;AAE1B;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW,EAQf,OAAO,KAAK,CAAC"}
+{"version":3,"file":"exec.d.ts","sourceRoot":"","sources":["../../../src/shared/tooling/exec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AASzE,MAAM,WAAW,iBAAiB;IAChC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;CAC5B;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,0DAA0D;IAC1D,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,mGAAmG;IACnG,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,uEAAuE;IACvE,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,KAAK,CAAC;IACd;;;;;;;;OAQG;IACH,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAyDD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAgB/C;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CACxB,GAAG,EAAE,MAAM,EACX,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,MAAM,CAGR;AAWD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEvD;AAWD;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAI3D;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAEnE;AAED,wBAAgB,mBAAmB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACnE,KAAK,EAAE,CAAC,GAAG,MAAM,GAAG,SAAS,EAC7B,KAAK,EAAE,MAAM,GACZ,CAAC,CAeH;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,EACf,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,MAAM,CAKR;AAkBD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAGjE;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAA;CAAO,GAC3C,MAAM,EAAE,CAOV;AAOD;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,CAAC,EAAE,MAAM,CAAC,UAAU,GACvB,MAAM,CAAC,UAAU,CAWnB;AAED,8EAA8E;AAC9E,wBAAgB,UAAU,CACxB,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,GAAE,iBAAsB,GAC9B,gBAAgB,CAqClB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,gBAAgB,CAAC,CA+K3B;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe,EAQnB,OAAO,SAAS,CAAC;AAE1B;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW,EAQf,OAAO,KAAK,CAAC"}

package/dist/shared/tooling/exec.js

@@ -1,5 +1,12 @@
 import { spawn, spawnSync } from "node:child_process";
 const SHELL_SHIM_COMMANDS = new Set(["npm", "npx", "pnpm", "yarn"]);
+/**
+ * How long {@link runTrackedAsync} waits after SIGTERM before escalating to an
+ * unignorable SIGKILL for a child it killed on its own deadline/overflow bound.
+ * Long enough for an ordinary child to flush and exit, short enough that a
+ * child which ignores SIGTERM cannot hang the awaiting caller.
+ */
+const KILL_ESCALATION_GRACE_MS = 2_000;
 // --- cmd.exe quoting helpers ---
 //
 // There are two distinct contexts in which a token must be quoted for cmd.exe,
@@ -293,8 +300,190 @@ export function runTracked(argv, options = {}) {
         cwd: options.cwd,
         duration_ms: Date.now() - start,
         error: result.error,
+        signal: result.signal ?? null,
     };
 }
+/**
+ * Async twin of {@link runTracked}: same argv resolution, control-env scrub, and
+ * result shape, driven by {@link spawnHidden} instead of `spawnSync`. Analyzer
+ * acquisition runs HERE rather than on the synchronous runner because a
+ * synchronous child blocks the event loop for the whole spawn — which starves
+ * every `setInterval` liveness heartbeat in the process (the advance
+ * heartbeat, and each held file lock's mtime heartbeat), so one stalled
+ * `npx --version` probe classified a LIVE lock stale and stole it mid-flight.
+ * Awaited by the acquisition engine, the binary resolver, and every closing /
+ * required-test spawn; never mixed with {@link runTracked} in one call path.
+ *
+ * DEADLINE AND OVERFLOW ARE CLASSIFIED, not left as a bare signal. `spawnSync`
+ * reports an over-deadline child as `ETIMEDOUT` and an over-`maxBuffer` child
+ * as `ENOBUFS`, and callers discriminate on those codes precisely because
+ * `signal` conflates them with an external `kill`. Node's own `timeout` option
+ * on the async path would surface both as an ordinary SIGTERM close and throw
+ * that distinction away, so this runner enforces BOTH bounds itself and stamps
+ * the same two codes — one classification serves both twins, and the bounds
+ * themselves are measured the same way (`maxBuffer` PER STREAM, as `spawnSync`
+ * measures it) so the two twins cannot disagree about which children overflow.
+ */
+export async function runTrackedAsync(argv, options = {}) {
+    if (argv.length === 0) {
+        return {
+            status: null,
+            stdout: "",
+            stderr: "",
+            argv: [],
+            cwd: options.cwd,
+            duration_ms: 0,
+            error: new Error("runTrackedAsync requires a non-empty argv"),
+        };
+    }
+    const resolved = resolveExecArgv(argv, {
+        platform: options.platform,
+    });
+    const start = Date.now();
+    return await new Promise((resolve) => {
+        const child = spawnHidden(resolved[0], resolved.slice(1), {
+            cwd: options.cwd,
+            env: stripAuditToolsControlEnv(options.env),
+            windowsHide: true,
+            shell: false,
+            stdio: ["pipe", "pipe", "pipe"],
+        });
+        let stdout = "";
+        let stderr = "";
+        // Bytes SEEN on each pipe, which is not the same as bytes kept: the counters
+        // keep rising after MAX_CAPTURE stops appending. See `capture`.
+        let stdoutBytes = 0;
+        let stderrBytes = 0;
+        let settled = false;
+        // Which bound killed the child, when one did. Read on `close` to stamp the
+        // matching `spawnSync` error code.
+        let killedBy = null;
+        // Bounded: a hostile/oversized emitter cannot grow the heap without limit.
+        // An explicit `maxBuffer` is the caller's stricter bound and is REPORTED as
+        // an overflow; the 10MiB default is the silent backstop.
+        const MAX_CAPTURE = 10 * 1024 * 1024;
+        const overflowLimit = options.maxBuffer;
+        let killTimer = null;
+        /**
+         * Terminate the child for a bound this runner owns, and make the
+         * termination ACTUALLY terminal.
+         *
+         * `child.kill()` sends SIGTERM, which is a request: a child that installs a
+         * handler and ignores it never emits `close`, so the promise would never
+         * settle and the deadline this runner advertises would be a deadline in
+         * name only (`spawnSync`'s `timeout` had no such hole — it kills from the
+         * runtime). So the SIGTERM is followed by an unignorable SIGKILL after a
+         * short grace period. The timer is `unref`d so a settled call never holds
+         * the event loop open.
+         */
+        const killForBound = () => {
+            child.kill();
+            if (killTimer)
+                return;
+            killTimer = setTimeout(() => {
+                if (!settled)
+                    child.kill("SIGKILL");
+            }, KILL_ESCALATION_GRACE_MS);
+            killTimer.unref?.();
+        };
+        const timer = options.timeout !== undefined && options.timeout > 0
+            ? setTimeout(() => {
+                killedBy = "timeout";
+                killForBound();
+            }, options.timeout)
+            : null;
+        const finish = (result) => {
+            if (settled)
+                return;
+            settled = true;
+            if (timer)
+                clearTimeout(timer);
+            if (killTimer)
+                clearTimeout(killTimer);
+            resolve(result);
+        };
+        /**
+         * Accumulate one chunk and enforce the overflow bound.
+         *
+         * The bound is checked PER STREAM and against bytes SEEN, not against what
+         * was kept — both deliberate:
+         *
+         *  - per stream, because `spawnSync`'s `maxBuffer`, which the sync twin
+         *    {@link runTracked} still enforces, is per stream. A combined bound
+         *    would classify a child emitting 5MiB on each pipe under an 8MiB limit
+         *    as an overflow that the sync twin admits verbatim, and this module's
+         *    claim that one classification serves both twins would be false.
+         *  - against bytes seen, because the MAX_CAPTURE backstop stops APPENDING
+         *    at 10MiB. Counting kept characters instead would make ENOBUFS
+         *    unreachable for any caller whose `maxBuffer` exceeds MAX_CAPTURE — the
+         *    output would silently truncate where the contract says it refuses.
+         */
+        const capture = (chunk, append, seen, kept) => {
+            if (kept() < MAX_CAPTURE) {
+                append(chunk.toString(options.encoding ?? "utf8"));
+            }
+            if (overflowLimit !== undefined &&
+                seen() > overflowLimit &&
+                killedBy === null) {
+                killedBy = "overflow";
+                killForBound();
+            }
+        };
+        child.stdout?.on("data", (chunk) => {
+            stdoutBytes += chunk.length;
+            capture(chunk, (text) => {
+                stdout += text;
+            }, () => stdoutBytes, () => stdout.length);
+        });
+        child.stderr?.on("data", (chunk) => {
+            stderrBytes += chunk.length;
+            capture(chunk, (text) => {
+                stderr += text;
+            }, () => stderrBytes, () => stderr.length);
+        });
+        // stdin is CLOSED (optionally after `input`), never left open: a command
+        // that reads stdin would otherwise block forever on a pipe nothing writes,
+        // turning an ordinary test invocation into a hang.
+        if (options.input !== undefined)
+            child.stdin?.write(options.input);
+        child.stdin?.end();
+        child.on("error", (error) => {
+            finish({
+                status: null,
+                stdout,
+                stderr,
+                argv: resolved,
+                cwd: options.cwd,
+                duration_ms: Date.now() - start,
+                error,
+                signal: null,
+            });
+        });
+        child.on("close", (code, signal) => {
+            let error;
+            if (killedBy !== null) {
+                const bound = new Error(killedBy === "timeout"
+                    ? `child exceeded the ${String(options.timeout)}ms deadline`
+                    : `child exceeded the ${String(overflowLimit)}-byte output bound`);
+                bound.code = killedBy === "timeout" ? "ETIMEDOUT" : "ENOBUFS";
+                error = bound;
+            }
+            else if (signal !== null && signal !== undefined) {
+                error = new Error(`child terminated by signal ${signal}`);
+            }
+            finish({
+                status: code,
+                stdout,
+                stderr,
+                argv: resolved,
+                cwd: options.cwd,
+                duration_ms: Date.now() - start,
+                ...(error ? { error } : {}),
+                signal: signal ?? null,
+            });
+        });
+    });
+}
 /**
  * `child_process.spawnSync` with `windowsHide` forced on. A windowless parent
  * (node launched by an IDE/agent) spawning a console child (git, sqlite3, …) pops

package/dist/shared/tooling/exec.js.map

@@ -1 +1 @@
-{"version":3,"file":"exec.js","sourceRoot":"","sources":["../../../src/shared/tooling/exec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,SAAS,EAAqB,MAAM,oBAAoB,CAAC;AAmCzE,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAEpE,kCAAkC;AAClC,EAAE;AACF,+EAA+E;AAC/E,yDAAyD;AACzD,EAAE;AACF,6EAA6E;AAC7E,6EAA6E;AAC7E,6EAA6E;AAC7E,4EAA4E;AAC5E,sEAAsE;AACtE,uEAAuE;AACvE,6EAA6E;AAC7E,4EAA4E;AAC5E,iEAAiE;AACjE,yEAAyE;AACzE,4EAA4E;AAC5E,uEAAuE;AACvE,yEAAyE;AACzE,uEAAuE;AACvE,wDAAwD;AACxD,2EAA2E;AAC3E,EAAE;AACF,gEAAgE;AAChE,uEAAuE;AACvE,6EAA6E;AAC7E,4EAA4E;AAC5E,gFAAgF;AAChF,2EAA2E;AAC3E,qEAAqE;AACrE,wEAAwE;AACxE,sEAAsE;AACtE,2EAA2E;AAC3E,8EAA8E;AAC9E,6EAA6E;AAC7E,EAAE;AACF,4EAA4E;AAC5E,4DAA4D;AAE5D,0EAA0E;AAC1E,sEAAsE;AACtE,uEAAuE;AACvE,yEAAyE;AACzE,sBAAsB;AACtB,MAAM,kBAAkB,GAAG,UAAU,CAAC;AAEtC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,kEAAkE;YAChE,wDAAwD;YACxD,qEAAqE;YACrE,kEAAkE;YAClE,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAC3B,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,eAAe,GAAG,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrD,IAAI,CAAC,YAAY,IAAI,CAAC,eAAe;QAAE,OAAO,GAAG,CAAC;IAClD,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IACnE,OAAO,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AACxE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CACxB,GAAW,EACX,WAA4B,OAAO,CAAC,QAAQ;IAE5C,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC;IAClD,OAAO,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,GAAG,CAAC;AAChD,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACtC,OAAO,CACL,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC;QAC3B,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC;QAClC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC;QACzB,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,6CAA6C,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CACpF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,OAAO,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACtE,CAAC;AAED,4EAA4E;AAC5E,0EAA0E;AAC1E,6EAA6E;AAC7E,4EAA4E;AAC5E,8EAA8E;AAC9E,4EAA4E;AAC5E,6EAA6E;AAC7E,MAAM,yBAAyB,GAAG,6BAA6B,CAAC;AAEhE;;;;;;;;;;GAUG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAa;IACjD,OAAO,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC;QAC1C,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC;AACxC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAuB;IACzD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,qBAAqB,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACtF,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,KAA6B,EAC7B,KAAa;IAEb,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAO,CAAC;IACxC,IAAI,MAAM,GAAY,KAAK,CAAC;IAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,MAAM,IAAI,SAAS,CAAC,GAAG,KAAK,6CAA6C,OAAO,EAAE,CAAC,CAAC;QACtF,CAAC;IACH,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,SAAS,CAAC,GAAG,KAAK,2CAA2C,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,MAAW,CAAC;AACrB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC7B,OAAe,EACf,WAA4B,OAAO,CAAC,QAAQ;IAE5C,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,OAAO,CAAC;IACzC,IAAI,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IAC7D,IAAI,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,GAAG,OAAO,MAAM,CAAC;IAC9D,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,cAAc,CAAC,OAAe,EAAE,QAAyB;IAChE,OAAO,QAAQ,KAAK,OAAO,IAAI,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,mBAAmB,CAC1B,OAAe,EACf,IAAc,EACd,QAAyB;IAEzB,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,QAAQ,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACjE,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,SAAS;QACzC,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;KACxE,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,2BAA2B,CAAC,KAAa;IACvD,IAAI,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxD,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,cAAc,EAAE,KAAK,CAAC,GAAG,CAAC;AACrD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC7B,IAAc,EACd,UAA0C,EAAE;IAE5C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACtD,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,OAAO,GAAG,mBAAmB,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC7D,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,MAAM,CAAC,KAAyC;IACvD,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,EAAE,CAAC;IAC7B,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;AAC9D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CACvC,IAAwB;IAExB,MAAM,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC;IAChC,MAAM,GAAG,GAAsB,EAAE,CAAC;IAClC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACzC,0EAA0E;QAC1E,2EAA2E;QAC3E,yDAAyD;QACzD,IAAI,CAAC,KAAK,wBAAwB;YAAE,SAAS;QAC7C,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACb,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,UAAU,CACxB,IAAc,EACd,UAA6B,EAAE;IAE/B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO;YACL,MAAM,EAAE,IAAI;YACZ,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,EAAE;YACV,IAAI,EAAE,EAAE;YACR,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,WAAW,EAAE,CAAC;YACd,KAAK,EAAE,IAAI,KAAK,CAAC,sCAAsC,CAAC;SACzD,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,EAAE;QACrC,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;QACvD,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,GAAG,EAAE,yBAAyB,CAAC,OAAO,CAAC,GAAG,CAAC;QAC3C,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,MAAM;QACpC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,IAAI;QACxC,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,KAAK,EAAE,KAAK;KACb,CAAC,CAAC;IACH,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;QAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;QAC7B,IAAI,EAAE,QAAQ;QACd,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;QAC/B,KAAK,EAAE,MAAM,CAAC,KAAK;KACpB,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAC9B,OAAe,EACf,IAAwB,EACxB,OAAyC,EACzC,EAAE,CACF,SAAS,CAAC,OAAO,EAAE,IAAgB,EAAE;IACnC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;IAClB,WAAW,EAAE,IAAI;CAClB,CAAC,CAAqB,CAAC;AAE1B;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAC1B,OAAe,EACf,IAAwB,EACxB,OAAqC,EACrC,EAAE,CACF,KAAK,CAAC,OAAO,EAAE,IAAgB,EAAE;IAC/B,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;IAClB,WAAW,EAAE,IAAI;CAClB,CAAC,CAAiB,CAAC"}
+{"version":3,"file":"exec.js","sourceRoot":"","sources":["../../../src/shared/tooling/exec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,SAAS,EAAqB,MAAM,oBAAoB,CAAC;AA6CzE,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAEpE;;;;;GAKG;AACH,MAAM,wBAAwB,GAAG,KAAK,CAAC;AAEvC,kCAAkC;AAClC,EAAE;AACF,+EAA+E;AAC/E,yDAAyD;AACzD,EAAE;AACF,6EAA6E;AAC7E,6EAA6E;AAC7E,6EAA6E;AAC7E,4EAA4E;AAC5E,sEAAsE;AACtE,uEAAuE;AACvE,6EAA6E;AAC7E,4EAA4E;AAC5E,iEAAiE;AACjE,yEAAyE;AACzE,4EAA4E;AAC5E,uEAAuE;AACvE,yEAAyE;AACzE,uEAAuE;AACvE,wDAAwD;AACxD,2EAA2E;AAC3E,EAAE;AACF,gEAAgE;AAChE,uEAAuE;AACvE,6EAA6E;AAC7E,4EAA4E;AAC5E,gFAAgF;AAChF,2EAA2E;AAC3E,qEAAqE;AACrE,wEAAwE;AACxE,sEAAsE;AACtE,2EAA2E;AAC3E,8EAA8E;AAC9E,6EAA6E;AAC7E,EAAE;AACF,4EAA4E;AAC5E,4DAA4D;AAE5D,0EAA0E;AAC1E,sEAAsE;AACtE,uEAAuE;AACvE,yEAAyE;AACzE,sBAAsB;AACtB,MAAM,kBAAkB,GAAG,UAAU,CAAC;AAEtC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,kEAAkE;YAChE,wDAAwD;YACxD,qEAAqE;YACrE,kEAAkE;YAClE,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAC3B,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,eAAe,GAAG,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrD,IAAI,CAAC,YAAY,IAAI,CAAC,eAAe;QAAE,OAAO,GAAG,CAAC;IAClD,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IACnE,OAAO,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AACxE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CACxB,GAAW,EACX,WAA4B,OAAO,CAAC,QAAQ;IAE5C,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC;IAClD,OAAO,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,GAAG,CAAC;AAChD,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACtC,OAAO,CACL,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC;QAC3B,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC;QAClC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC;QACzB,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,6CAA6C,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CACpF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,OAAO,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACtE,CAAC;AAED,4EAA4E;AAC5E,0EAA0E;AAC1E,6EAA6E;AAC7E,4EAA4E;AAC5E,8EAA8E;AAC9E,4EAA4E;AAC5E,6EAA6E;AAC7E,MAAM,yBAAyB,GAAG,6BAA6B,CAAC;AAEhE;;;;;;;;;;GAUG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAa;IACjD,OAAO,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC;QAC1C,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC;AACxC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAuB;IACzD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,qBAAqB,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACtF,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,KAA6B,EAC7B,KAAa;IAEb,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAO,CAAC;IACxC,IAAI,MAAM,GAAY,KAAK,CAAC;IAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,MAAM,IAAI,SAAS,CAAC,GAAG,KAAK,6CAA6C,OAAO,EAAE,CAAC,CAAC;QACtF,CAAC;IACH,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,SAAS,CAAC,GAAG,KAAK,2CAA2C,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,MAAW,CAAC;AACrB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC7B,OAAe,EACf,WAA4B,OAAO,CAAC,QAAQ;IAE5C,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,OAAO,CAAC;IACzC,IAAI,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IAC7D,IAAI,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,GAAG,OAAO,MAAM,CAAC;IAC9D,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,cAAc,CAAC,OAAe,EAAE,QAAyB;IAChE,OAAO,QAAQ,KAAK,OAAO,IAAI,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,mBAAmB,CAC1B,OAAe,EACf,IAAc,EACd,QAAyB;IAEzB,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,QAAQ,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACjE,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,SAAS;QACzC,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;KACxE,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,2BAA2B,CAAC,KAAa;IACvD,IAAI,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxD,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,cAAc,EAAE,KAAK,CAAC,GAAG,CAAC;AACrD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC7B,IAAc,EACd,UAA0C,EAAE;IAE5C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACtD,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,OAAO,GAAG,mBAAmB,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC7D,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,MAAM,CAAC,KAAyC;IACvD,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,EAAE,CAAC;IAC7B,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;AAC9D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CACvC,IAAwB;IAExB,MAAM,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC;IAChC,MAAM,GAAG,GAAsB,EAAE,CAAC;IAClC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACzC,0EAA0E;QAC1E,2EAA2E;QAC3E,yDAAyD;QACzD,IAAI,CAAC,KAAK,wBAAwB;YAAE,SAAS;QAC7C,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACb,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,UAAU,CACxB,IAAc,EACd,UAA6B,EAAE;IAE/B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO;YACL,MAAM,EAAE,IAAI;YACZ,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,EAAE;YACV,IAAI,EAAE,EAAE;YACR,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,WAAW,EAAE,CAAC;YACd,KAAK,EAAE,IAAI,KAAK,CAAC,sCAAsC,CAAC;SACzD,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,EAAE;QACrC,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;QACvD,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,GAAG,EAAE,yBAAyB,CAAC,OAAO,CAAC,GAAG,CAAC;QAC3C,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,MAAM;QACpC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,IAAI;QACxC,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,KAAK,EAAE,KAAK;KACb,CAAC,CAAC;IACH,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;QAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;QAC7B,IAAI,EAAE,QAAQ;QACd,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;QAC/B,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,IAAI;KAC9B,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAc,EACd,UAA6B,EAAE;IAE/B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO;YACL,MAAM,EAAE,IAAI;YACZ,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,EAAE;YACV,IAAI,EAAE,EAAE;YACR,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,WAAW,EAAE,CAAC;YACd,KAAK,EAAE,IAAI,KAAK,CAAC,2CAA2C,CAAC;SAC9D,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,EAAE;QACrC,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,OAAO,MAAM,IAAI,OAAO,CAAmB,CAAC,OAAO,EAAE,EAAE;QACrD,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;YACxD,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,GAAG,EAAE,yBAAyB,CAAC,OAAO,CAAC,GAAG,CAAC;YAC3C,WAAW,EAAE,IAAI;YACjB,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SAChC,CAAC,CAAC;QACH,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,6EAA6E;QAC7E,gEAAgE;QAChE,IAAI,WAAW,GAAG,CAAC,CAAC;QACpB,IAAI,WAAW,GAAG,CAAC,CAAC;QACpB,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,2EAA2E;QAC3E,mCAAmC;QACnC,IAAI,QAAQ,GAAkC,IAAI,CAAC;QACnD,2EAA2E;QAC3E,4EAA4E;QAC5E,yDAAyD;QACzD,MAAM,WAAW,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;QACrC,MAAM,aAAa,GAAG,OAAO,CAAC,SAAS,CAAC;QAExC,IAAI,SAAS,GAA0B,IAAI,CAAC;QAC5C;;;;;;;;;;;WAWG;QACH,MAAM,YAAY,GAAG,GAAS,EAAE;YAC9B,KAAK,CAAC,IAAI,EAAE,CAAC;YACb,IAAI,SAAS;gBAAE,OAAO;YACtB,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC1B,IAAI,CAAC,OAAO;oBAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACtC,CAAC,EAAE,wBAAwB,CAAC,CAAC;YAC7B,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC;QACtB,CAAC,CAAC;QAEF,MAAM,KAAK,GACT,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,OAAO,GAAG,CAAC;YAClD,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE;gBACd,QAAQ,GAAG,SAAS,CAAC;gBACrB,YAAY,EAAE,CAAC;YACjB,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC;YACrB,CAAC,CAAC,IAAI,CAAC;QACX,MAAM,MAAM,GAAG,CAAC,MAAwB,EAAQ,EAAE;YAChD,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,IAAI,KAAK;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;YAC/B,IAAI,SAAS;gBAAE,YAAY,CAAC,SAAS,CAAC,CAAC;YACvC,OAAO,CAAC,MAAM,CAAC,CAAC;QAClB,CAAC,CAAC;QACF;;;;;;;;;;;;;;;WAeG;QACH,MAAM,OAAO,GAAG,CACd,KAAa,EACb,MAA8B,EAC9B,IAAkB,EAClB,IAAkB,EACZ,EAAE;YACR,IAAI,IAAI,EAAE,GAAG,WAAW,EAAE,CAAC;gBACzB,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,IAAI,MAAM,CAAC,CAAC,CAAC;YACrD,CAAC;YACD,IACE,aAAa,KAAK,SAAS;gBAC3B,IAAI,EAAE,GAAG,aAAa;gBACtB,QAAQ,KAAK,IAAI,EACjB,CAAC;gBACD,QAAQ,GAAG,UAAU,CAAC;gBACtB,YAAY,EAAE,CAAC;YACjB,CAAC;QACH,CAAC,CAAC;QACF,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,WAAW,IAAI,KAAK,CAAC,MAAM,CAAC;YAC5B,OAAO,CACL,KAAK,EACL,CAAC,IAAI,EAAE,EAAE;gBACP,MAAM,IAAI,IAAI,CAAC;YACjB,CAAC,EACD,GAAG,EAAE,CAAC,WAAW,EACjB,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CACpB,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,WAAW,IAAI,KAAK,CAAC,MAAM,CAAC;YAC5B,OAAO,CACL,KAAK,EACL,CAAC,IAAI,EAAE,EAAE;gBACP,MAAM,IAAI,IAAI,CAAC;YACjB,CAAC,EACD,GAAG,EAAE,CAAC,WAAW,EACjB,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CACpB,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,yEAAyE;QACzE,2EAA2E;QAC3E,mDAAmD;QACnD,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;YAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACnE,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC;QAEnB,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC1B,MAAM,CAAC;gBACL,MAAM,EAAE,IAAI;gBACZ,MAAM;gBACN,MAAM;gBACN,IAAI,EAAE,QAAQ;gBACd,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;gBAC/B,KAAK;gBACL,MAAM,EAAE,IAAI;aACb,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YACjC,IAAI,KAAwB,CAAC;YAC7B,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;gBACtB,MAAM,KAAK,GAA0B,IAAI,KAAK,CAC5C,QAAQ,KAAK,SAAS;oBACpB,CAAC,CAAC,sBAAsB,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa;oBAC5D,CAAC,CAAC,sBAAsB,MAAM,CAAC,aAAa,CAAC,oBAAoB,CACpE,CAAC;gBACF,KAAK,CAAC,IAAI,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;gBAC9D,KAAK,GAAG,KAAK,CAAC;YAChB,CAAC;iBAAM,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACnD,KAAK,GAAG,IAAI,KAAK,CAAC,8BAA8B,MAAM,EAAE,CAAC,CAAC;YAC5D,CAAC;YACD,MAAM,CAAC;gBACL,MAAM,EAAE,IAAI;gBACZ,MAAM;gBACN,MAAM;gBACN,IAAI,EAAE,QAAQ;gBACd,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;gBAC/B,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3B,MAAM,EAAE,MAAM,IAAI,IAAI;aACvB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAC9B,OAAe,EACf,IAAwB,EACxB,OAAyC,EACzC,EAAE,CACF,SAAS,CAAC,OAAO,EAAE,IAAgB,EAAE;IACnC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;IAClB,WAAW,EAAE,IAAI;CAClB,CAAC,CAAqB,CAAC;AAE1B;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAC1B,OAAe,EACf,IAAwB,EACxB,OAAqC,EACrC,EAAE,CACF,KAAK,CAAC,OAAO,EAAE,IAAgB,EAAE;IAC/B,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;IAClB,WAAW,EAAE,IAAI;CAClB,CAAC,CAAiB,CAAC"}

package/docs/audit-pkg/contracts.md

@@ -86,7 +86,8 @@ audit-code validate-results --results /path/to/results.json
 ## Artifact bundle
 
 Resumable state lives under `.audit-tools/audit/`. The registry-backed contract
-in [`artifact-contract.md`](../../spec/audit/artifact-contract.md) covers the
+in [`spec/audit/artifact-contract.md`](https://github.com/OhOkThisIsFine/audit-tools/blob/HEAD/spec/audit/artifact-contract.md)
+(repository-only, so the link is absolute) covers the
 complete set. Representative artifacts include repository and unit manifests,
 file disposition, graph and critical-flow data, coverage, risk, audit tasks,
 runtime validation, accepted host results, synthesis narrative, and the final

package/docs/audit-pkg/operator-guide.md

@@ -15,8 +15,11 @@ bootstraps the current repository with:
 audit-code ensure --quiet
 ```
 
-For setup repair or inspection, use `audit-code ensure`, `audit-code install`,
-`audit-code verify-install`, or `audit-code prompt-path`.
+For setup repair or inspection, use the installer verbs, plus the
+`audit-code prompt-path` helper. Their one home is
+[`product.md`](product.md#supported-surfaces): the installer-verb block there is
+generated from the module both bins read, and `audit-code <verb> --help` prints
+the same summary plus its options.
 
 The install surface includes the repo-local import prompt, getting-started
 guide, manifest, and the host-specific command or skill files supported by the

package/docs/audit-pkg/product.md

@@ -1,8 +1,10 @@
 # Product
 
-> Normative definition: [`spec/audit/audit-goals.md`](../../spec/audit/audit-goals.md) — product
-> identity, invariants, deterministic/LLM boundaries, and completion. This page is
-> the product overview.
+> Normative definition:
+> [`spec/audit/audit-goals.md`](https://github.com/OhOkThisIsFine/audit-tools/blob/HEAD/spec/audit/audit-goals.md)
+> — product identity, invariants, deterministic/LLM boundaries, and completion.
+> This page is the product overview. (The `spec/` corpus is repository-only and
+> is not part of the published package, so the link is absolute.)
 
 ## Canonical surface
 
@@ -26,9 +28,23 @@ The supported user-facing surfaces are:
 1. `/audit-code` in conversation
 2. `npm install -g audit-tools` as the one-time package install
 3. `audit-code prompt-path` to locate the packaged prompt asset
-4. `audit-code ensure` for idempotent repo-local bootstrap
-5. `audit-code install` for explicit repair or force refresh
-6. `audit-code` as the repo-local backend fallback
+4. the installer verbs below, for bootstrap, repair, and post-install verification
+5. `audit-code` as the repo-local backend fallback
+
+<!-- BEGIN GENERATED CLI SURFACE — scripts/shared/generate-cli-surface.mjs — DO NOT EDIT BY HAND -->
+
+> Rendered from `wrapper/installer-verb-help.mjs` — the module both shipped bins read to answer
+> `<verb> --help`. Add a verb there and this list follows.
+
+- `audit-code ensure` — lazily bootstraps repo-local /audit-code assets when they are missing or stale
+- `audit-code install` — bootstraps /audit-code into supported repo-local host surfaces
+- `audit-code install-host` — installs /audit-code into ONE named host surface (--host <name>)
+- `audit-code verify-install` — smoke-tests the generated /audit-code host assets after an install
+
+<!-- END GENERATED CLI SURFACE -->
+
+This is the one home for that list — `operator-guide.md` points here rather than
+restating it.
 
 Anything below `dist/` is backend or development interface.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "audit-tools",
-  "version": "0.45.0",
+  "version": "0.46.0",
   "private": false,
   "license": "ISC",
   "description": "Provider-neutral code auditing and remediation workflows for arbitrary repositories.",
@@ -34,7 +34,9 @@
     "scripts/shared/install-host-assets.mjs",
     "opencode.json",
     "README.md",
-    "docs/audit-pkg/**"
+    "docs/audit-pkg/product.md",
+    "docs/audit-pkg/operator-guide.md",
+    "docs/audit-pkg/contracts.md"
   ],
   "scripts": {
     "postinstall": "node scripts/postinstall.mjs",
@@ -48,7 +50,7 @@
     "test": "npm run build && node scripts/shared/run-vitest-gate.mjs",
     "test:single": "npm run build && node scripts/shared/run-vitest-gate.mjs",
     "verify:guards": "node scripts/shared/run-vitest-gate.mjs --retry=2 --exclude \"**/audit-code-completion-*.test.ts\" --exclude \"**/audit-code-wrapper-*.test.ts\" --exclude \"**/audit/next-step-core-*.test.ts\" --exclude \"**/seam-host-only-next-step.test.ts\" --exclude \"**/*-e2e.test.*\" --exclude \"**/next-step-implement-dispatch.test.ts\" --exclude \"**/next-step-pipeline-dispatch.test.ts\"",
-    "verify:checks": "node scripts/shared/profile-run.mjs verify-checks check:control-bytes check:version-gates check:guard-reach check:ci-trigger-paths check:offload-lanes check:loop-core-patterns check:constitutional-doc-paths check:runtime-artifact-names check:deadcode check:lint check:dup check:depgraph check:doc-manifest check:doc-links check:doc-code-citations check:gate-enumeration check:philosophy-brief check:nightly-routine-prompt check:handoff-roadmap check:backlog-index check:memory-citations check:backlog-budget check:backlog-status check:backlog-line-numbers check:tests build verify:hosts verify:remediate-hosts pack:smoke smoke:packaged-audit-code smoke:packaged-remediate-code",
+    "verify:checks": "node scripts/shared/profile-run.mjs verify-checks check:control-bytes check:version-gates check:guard-reach check:ci-trigger-paths check:offload-lanes check:loop-core-patterns check:constitutional-doc-paths check:runtime-artifact-names check:executor-producers check:cli-surface check:deadcode check:lint check:dup check:depgraph check:doc-manifest check:doc-links check:doc-code-citations check:gate-enumeration check:philosophy-brief check:nightly-routine-prompt check:handoff-roadmap check:backlog-index check:memory-citations check:backlog-budget check:backlog-status check:backlog-line-numbers check:tests build verify:hosts verify:remediate-hosts pack:smoke smoke:packaged-audit-code smoke:packaged-remediate-code",
     "verify:release": "npm run verify:checks && node scripts/shared/run-vitest-gate.mjs && npm run smoke:linked-audit-code && npm run smoke:linked-remediate-code",
     "check:control-bytes": "node scripts/check-control-bytes.mjs",
     "check:guard-reach": "node scripts/check-guard-reach.mjs",
@@ -94,6 +96,8 @@
     "check:offload-lanes": "node scripts/check-offload-lanes.mjs",
     "check:backlog-line-numbers": "node scripts/check-backlog-line-numbers.mjs",
     "check:runtime-artifact-names": "node scripts/shared/generate-runtime-artifact-names.mjs --check",
+    "check:executor-producers": "node scripts/shared/generate-executor-producers.mjs --check",
+    "check:cli-surface": "node scripts/shared/generate-cli-surface.mjs --check",
     "generate:shard-baseline": "node scripts/shared/generate-vitest-shard-baseline.mjs"
   },
   "engines": {
@@ -102,6 +106,8 @@
   "dependencies": {
     "commander": "^13.0.0",
     "smol-toml": "^1.6.1",
+    "tree-sitter-wasms": "^0.1.13",
+    "web-tree-sitter": "^0.25.10",
     "yaml": "^2.9.0",
     "zod": "^3.25.76",
     "zod-to-json-schema": "^3.24.6"
@@ -117,11 +123,9 @@
     "jscpd": "^5.0.14",
     "knip": "^6.23.0",
     "linguist-languages": "^9.3.2",
-    "tree-sitter-wasms": "^0.1.13",
     "tsx": "^4.19.0",
     "typescript": "^5.9.2",
-    "vitest": "^3.0.0",
-    "web-tree-sitter": "^0.25.10"
+    "vitest": "^3.0.0"
   },
   "repository": {
     "type": "git",