audit-tools 0.51.7 → 0.51.10

package/dist/audit/orchestrator/runtimeCommand.js

@@ -10,9 +10,11 @@ import { quoteForShellInterpreterCmd, stripAuditToolsControlEnv, } from "audit-t
 // exec.ts helpers so the safe-character set stays unified.
 // Wrapper-only control-variable stripping is owned by the shared execution
 // substrate so runtime validation never inherits driver lifecycle authority.
-// This strips the host-signaling env vars so a runtime-validation command sees a
-// clean environment — a suite that branches on CLAUDECODE would otherwise be graded
-// against the host's interactive-session state, marking healthy code "not_confirmed".
+// What `stripAuditToolsControlEnv` removes is exactly ONE variable —
+// `AUDIT_TOOLS_CALLER_CWD`, the wrapper's one-hop caller-cwd stamp, which a child
+// must not read as its own location. It does NOT clear the host session's
+// CLAUDECODE / CLAUDE_CODE_* variables: a runtime-validation command inherits
+// them like any other child (this comment used to claim otherwise).
 /**
  * The bounded wait every runtime-validation command runs under.
  *
@@ -28,6 +30,170 @@ export const RUNTIME_COMMAND_TIMEOUT_MS = 10 * 60 * 1_000;
  * child may ignore; without the escalation the "bound" would be advisory.
  */
 const KILL_ESCALATION_GRACE_MS = 2_000;
+/**
+ * How many trailing lines a command's evidence can ever show. The number is
+ * stated once because the BUFFER is sized from it: the accumulator keeps only
+ * what a reader can see, so the two cannot disagree about how much is kept.
+ */
+export const EVIDENCE_TAIL_LINES = 10;
+/**
+ * Character ceiling on the retained tail. The line budget alone does not bound
+ * a command whose output is one enormous line (a `--json` dump, a minified
+ * bundle, a progress bar with no newline): only the character cap does.
+ */
+export const EVIDENCE_TAIL_MAX_CHARS = 64 * 1024;
+/**
+ * Character ceiling on a SINGLE retained line, so the tail budget cannot be
+ * spent by one line and leave the evidence empty of anything readable.
+ */
+export const EVIDENCE_TAIL_MAX_LINE_CHARS = 8 * 1024;
+/**
+ * A bounded tail of a child's output: the last {@link EVIDENCE_TAIL_LINES}
+ * lines, plus the counts needed to describe what was dropped.
+ *
+ * This exists because the runner used to accumulate `stdout += String(chunk)`
+ * for the WHOLE stream and slice the last ten lines only at the end — so the
+ * memory a validation command could cost was whatever the command chose to
+ * print, and a sufficiently chatty one aborted the whole `advanceAudit` drain
+ * with a string-length `RangeError` from inside the runner. A drain that dies
+ * of its own evidence buffer is the bound-in-name-only failure this module
+ * already refuses for time, so the same rule is applied to bytes: keep the
+ * evidence contract's window, count the rest.
+ *
+ * The counts are what make the bound honest rather than lossy — the marker
+ * still reports the TRUE total line count of the full stream, so a reader
+ * cannot mistake ten retained lines for ten produced ones.
+ */
+export class BoundedOutputTail {
+    /**
+     * Segments between newlines. The LAST element is the in-progress line, so the
+     * array never needs a separate partial-line buffer. Invariant: after every
+     * push, `segments.length <= EVIDENCE_TAIL_LINES + 1` and every segment is at
+     * most {@link EVIDENCE_TAIL_MAX_LINE_CHARS} characters.
+     */
+    segments = [""];
+    /** Lines dropped off the front — newlines this tail no longer represents. */
+    droppedLines = 0;
+    /** Characters clipped from the head of a retained line (giant-line case). */
+    clippedChars = 0;
+    push(chunk) {
+        if (chunk.length === 0)
+            return;
+        const parts = chunk.split("\n");
+        const last = this.segments.length - 1;
+        this.segments[last] += parts[0];
+        for (let index = 1; index < parts.length; index += 1) {
+            this.segments.push(parts[index]);
+        }
+        this.trim();
+    }
+    /**
+     * Enforce both ceilings, in the order that keeps each one decidable: the line
+     * window first (cutting at a newline, never mid-line, so a retained line is a
+     * LINE rather than a fragment), then the per-line cap, then the total.
+     *
+     * The per-line cap applies to EVERY retained segment, the live one included.
+     * Clipping only the head was not a bound on the tail at all: a chunk that
+     * extends the in-progress line is appended to the LAST segment, so a command
+     * printing one newline-free blast had it buffered whole — and it was not even
+     * droppable, because the front-drop below never removes the live segment —
+     * until the next push happened to arrive and re-run this.
+     */
+    trim() {
+        const excess = this.segments.length - (EVIDENCE_TAIL_LINES + 1);
+        if (excess > 0) {
+            this.segments.splice(0, excess);
+            // Each dropped segment was terminated by a newline this tail no longer
+            // holds, so exactly that many lines left the front.
+            this.droppedLines += excess;
+        }
+        this.segments = this.segments.map((segment) => {
+            if (segment.length <= EVIDENCE_TAIL_MAX_LINE_CHARS)
+                return segment;
+            const cut = segment.length - EVIDENCE_TAIL_MAX_LINE_CHARS;
+            this.clippedChars += cut;
+            return segment.slice(cut);
+        });
+        // A tail of many max-length lines still has to fit the character budget:
+        // drop whole leading lines until it does. What is measured is the length
+        // `read()` will actually join — segments PLUS the separators between them —
+        // because the ceiling is on the retained text, and a bound that excluded
+        // the separators would be a bound on something nobody reads.
+        let total = this.retainedLength();
+        while (total > EVIDENCE_TAIL_MAX_CHARS && this.segments.length > 1) {
+            const dropped = this.segments.shift();
+            total -= dropped.length + 1;
+            this.droppedLines += 1;
+        }
+    }
+    /** The character length of what {@link read} will return. */
+    retainedLength() {
+        let total = 0;
+        for (const segment of this.segments) {
+            total += segment.length;
+        }
+        return total + Math.max(0, this.segments.length - 1);
+    }
+    /**
+     * The retained text and the true totals of the stream it came from. A trailing
+     * empty segment is the artifact of output ending in a newline, not a line.
+     */
+    read() {
+        const segments = [...this.segments];
+        if (segments.length > 1 && segments[segments.length - 1] === "") {
+            segments.pop();
+        }
+        if (segments.length === 1 && segments[0] === "") {
+            return { text: "", totalLines: 0, clippedChars: this.clippedChars };
+        }
+        return {
+            text: segments.join("\n"),
+            totalLines: this.droppedLines + segments.length,
+            clippedChars: this.clippedChars,
+        };
+    }
+}
+/**
+ * The evidence array for a finished (or failed) command, from the two bounded
+ * tails. Kept as one function because both the `error` and the `close` handler
+ * build it, and two copies drifting is how a failure path starts reporting a
+ * different window than the success path.
+ *
+ * The TOTAL is the sum of the two tails' own counts, never a count taken over
+ * the composed text. Composing first and counting the result means counting a
+ * STRING, and every string operation that touches it is a chance to change what
+ * the number means: the previous version called `.trim()` on the composition,
+ * which deletes a whitespace-only line at either boundary — so a stream whose
+ * first line was blank reported one line fewer than it printed, in the very
+ * marker whose only job is to state the true count. Each tail already knows how
+ * many lines IT held ({@link BoundedOutputTail.read}), and the two streams meet
+ * at exactly one boundary, so their sum is the composed count with nothing to
+ * trim and nothing to get wrong.
+ */
+function commandEvidence(stdout, stderr) {
+    const out = stdout.read();
+    const err = stderr.read();
+    // The separator belongs BETWEEN two non-empty tails and nowhere else: an
+    // absent stream contributes no line, and a leading or trailing empty string
+    // in the composition would otherwise be a line the command never printed.
+    const lines = [out.text, err.text]
+        .filter((text) => text.length > 0)
+        .flatMap((text) => text.split(/\r?\n/));
+    const totalLines = out.totalLines + err.totalLines;
+    const shown = lines.slice(-EVIDENCE_TAIL_LINES);
+    if (totalLines <= shown.length && out.clippedChars === 0 && err.clippedChars === 0) {
+        return lines;
+    }
+    const clipped = out.clippedChars + err.clippedChars;
+    return [
+        `[... truncated: showing last ${shown.length} of ${totalLines} lines` +
+            (clipped > 0
+                ? `, ${clipped} character(s) clipped from the retained text`
+                : "") +
+            " ...]",
+        ...shown,
+    ];
+}
 /**
  * Terminate a timed-out child, INCLUDING anything it spawned.
  *
@@ -77,13 +243,15 @@ export async function runCommand(command, cwd, timeoutMs = RUNTIME_COMMAND_TIMEO
             stdio: ["ignore", "pipe", "pipe"],
             windowsHide: true,
         });
-        let stdout = "";
-        let stderr = "";
+        // Bounded from the first byte: the accumulator keeps only the evidence
+        // window, so no command can make this runner's memory its own choice.
+        const stdout = new BoundedOutputTail();
+        const stderr = new BoundedOutputTail();
         child.stdout.on("data", (chunk) => {
-            stdout += String(chunk);
+            stdout.push(String(chunk));
         });
         child.stderr.on("data", (chunk) => {
-            stderr += String(chunk);
+            stderr.push(String(chunk));
         });
         let exitCode = null;
         let exitSignal = null;
@@ -119,16 +287,10 @@ export async function runCommand(command, cwd, timeoutMs = RUNTIME_COMMAND_TIMEO
         };
         child.on("error", (error) => {
             clearTimers();
-            const output = `${stdout}\n${stderr}`.trim();
-            const lines = output.length > 0 ? output.split(/\r?\n/) : [];
-            const truncated = lines.length > 10;
-            const evidence = truncated
-                ? [`[... truncated: showing last 10 of ${lines.length} lines ...]`, ...lines.slice(-10)]
-                : lines;
             resolve({
                 status: "inconclusive",
                 summary: `Failed to execute ${displayCommand}: ${error.message}`,
-                evidence,
+                evidence: commandEvidence(stdout, stderr),
             });
         });
         child.on("exit", (code, signal) => {
@@ -137,12 +299,7 @@ export async function runCommand(command, cwd, timeoutMs = RUNTIME_COMMAND_TIMEO
         });
         child.on("close", () => {
             clearTimers();
-            const output = `${stdout}\n${stderr}`.trim();
-            const lines = output.length > 0 ? output.split(/\r?\n/) : [];
-            const truncated = lines.length > 10;
-            const evidence = truncated
-                ? [`[... truncated: showing last 10 of ${lines.length} lines ...]`, ...lines.slice(-10)]
-                : lines;
+            const evidence = commandEvidence(stdout, stderr);
             const succeeded = exitCode === 0 && !timedOut;
             let summary;
             if (timedOut) {

package/dist/audit/orchestrator/runtimeCommand.js.map

@@ -1 +1 @@
-{"version":3,"file":"runtimeCommand.js","sourceRoot":"","sources":["../../../src/audit/orchestrator/runtimeCommand.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,GAC1B,MAAM,oBAAoB,CAAC;AAE5B,6EAA6E;AAC7E,0EAA0E;AAC1E,+EAA+E;AAC/E,6EAA6E;AAC7E,iBAAiB;AACjB,EAAE;AACF,8EAA8E;AAC9E,2DAA2D;AAE3D,2EAA2E;AAC3E,6EAA6E;AAC7E,iFAAiF;AACjF,oFAAoF;AACpF,sFAAsF;AAEtF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;AAE1D;;;GAGG;AACH,MAAM,wBAAwB,GAAG,KAAK,CAAC;AAEvC;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAAmE,EACnE,WAA4B,OAAO,CAAC,QAAQ;IAE5C,IAAI,QAAQ,KAAK,OAAO,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QACpD,MAAM,MAAM,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE;YACxE,KAAK,EAAE,QAAQ;YACf,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACtB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACxB,CAAC,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,OAAiB,EACjB,GAAW,EACX,YAAoB,0BAA0B;IAM9C,4EAA4E;IAC5E,8DAA8D;IAC9D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACxC,OAAO;YACL,MAAM,EAAE,cAAc;YACtB,OAAO,EAAE,6DAA6D;YACtE,QAAQ,EAAE,EAAE;SACb,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,oCAAoC,CAAC,OAAO,CAAC,CAAC;IACnE,MAAM,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzC,OAAO,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QACnC,MAAM,KAAK,GAAG,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,YAAY,CAAC,IAAI,EAAE;YAC3D,GAAG;YACH,GAAG,EAAE,yBAAyB,EAAE;YAChC,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;YACjC,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;QACH,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;YAChC,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;YAChC,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC;QACH,IAAI,QAAQ,GAAkB,IAAI,CAAC;QACnC,IAAI,UAAU,GAA0B,IAAI,CAAC;QAC7C,6EAA6E;QAC7E,iEAAiE;QACjE,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,UAAU,GAA0B,IAAI,CAAC;QAC7C,MAAM,QAAQ,GACZ,SAAS,GAAG,CAAC;YACX,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE;gBACd,QAAQ,GAAG,IAAI,CAAC;gBAChB,sBAAsB,CAAC,KAAK,CAAC,CAAC;gBAC9B,oEAAoE;gBACpE,iEAAiE;gBACjE,oEAAoE;gBACpE,wCAAwC;gBACxC,UAAU,GAAG,UAAU,CAAC,GAAG,EAAE;oBAC3B,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACxB,CAAC,EAAE,wBAAwB,CAAC,CAAC;gBAC7B,UAAU,CAAC,KAAK,EAAE,EAAE,CAAC;YACvB,CAAC,EAAE,SAAS,CAAC;YACf,CAAC,CAAC,IAAI,CAAC;QACX;;;;;WAKG;QACH,MAAM,WAAW,GAAG,GAAS,EAAE;YAC7B,IAAI,QAAQ;gBAAE,YAAY,CAAC,QAAQ,CAAC,CAAC;YACrC,IAAI,UAAU;gBAAE,YAAY,CAAC,UAAU,CAAC,CAAC;QAC3C,CAAC,CAAC;QACF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC1B,WAAW,EAAE,CAAC;YACd,MAAM,MAAM,GAAG,GAAG,MAAM,KAAK,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;YAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC;YACpC,MAAM,QAAQ,GAAG,SAAS;gBACxB,CAAC,CAAC,CAAC,sCAAsC,KAAK,CAAC,MAAM,aAAa,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;gBACxF,CAAC,CAAC,KAAK,CAAC;YACV,OAAO,CAAC;gBACN,MAAM,EAAE,cAAc;gBACtB,OAAO,EAAE,qBAAqB,cAAc,KAAK,KAAK,CAAC,OAAO,EAAE;gBAChE,QAAQ;aACT,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YAChC,QAAQ,GAAG,IAAI,CAAC;YAChB,UAAU,GAAG,MAAM,CAAC;QACtB,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACrB,WAAW,EAAE,CAAC;YACd,MAAM,MAAM,GAAG,GAAG,MAAM,KAAK,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;YAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC;YACpC,MAAM,QAAQ,GAAG,SAAS;gBACxB,CAAC,CAAC,CAAC,sCAAsC,KAAK,CAAC,MAAM,aAAa,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;gBACxF,CAAC,CAAC,KAAK,CAAC;YACV,MAAM,SAAS,GAAG,QAAQ,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;YAC9C,IAAI,OAAe,CAAC;YACpB,IAAI,QAAQ,EAAE,CAAC;gBACb,yEAAyE;gBACzE,wEAAwE;gBACxE,oEAAoE;gBACpE,wEAAwE;gBACxE,oEAAoE;gBACpE,OAAO;oBACL,iDAAiD,MAAM,CAAC,SAAS,CAAC,qBAAqB;wBACvF,GAAG,cAAc,EAAE,CAAC;YACxB,CAAC;iBAAM,IAAI,SAAS,EAAE,CAAC;gBACrB,OAAO,GAAG,4CAA4C,cAAc,EAAE,CAAC;YACzE,CAAC;iBAAM,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;gBAC7B,OAAO,GAAG,uDAAuD,QAAQ,KAAK,cAAc,EAAE,CAAC;YACjG,CAAC;iBAAM,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;gBAC/B,OAAO,GAAG,sDAAsD,UAAU,KAAK,cAAc,EAAE,CAAC;YAClG,CAAC;iBAAM,CAAC;gBACN,OAAO,GAAG,6DAA6D,cAAc,EAAE,CAAC;YAC1F,CAAC;YACD,OAAO,CAAC;gBACN,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,eAAe;gBACjD,OAAO;gBACP,QAAQ;aACT,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,oCAAoC,CAClD,OAAiB,EACjB,WAA4B,OAAO,CAAC,QAAQ,EAC5C,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,SAAS;IAE/C,MAAM,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC;IACtC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACnC,CAAC;IACD,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,IAAI,CAAC,SAAS,CAAC;YACb,IAAI,EAAE,wBAAwB;YAC9B,IAAI,EAAE,MAAM;YACZ,UAAU;YACV,QAAQ;YACR,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SAC7B,CAAC,GAAG,IAAI,CACV,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IACvC,CAAC;IACD,8EAA8E;IAC9E,kFAAkF;IAClF,mFAAmF;IACnF,iFAAiF;IACjF,yBAAyB;IACzB,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,IAAI,UAAU,CAAC;IAC/D,MAAM,cAAc,GAAG,QAAQ,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC3E,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QAC5D,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,IAAI,CAAC,SAAS,CAAC;YACb,IAAI,EAAE,wBAAwB;YAC9B,IAAI,EAAE,SAAS;YACf,UAAU;YACV,aAAa,EAAE,YAAY;YAC3B,QAAQ;YACR,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SAC7B,CAAC,GAAG,IAAI,CACV,CAAC;QACF,OAAO;YACL,OAAO,EAAE,YAAY;YACrB,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;SAC7E,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,IAAI,CAAC,SAAS,CAAC;QACb,IAAI,EAAE,wBAAwB;QAC9B,IAAI,EAAE,MAAM;QACZ,UAAU;QACV,QAAQ;QACR,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KAC7B,CAAC,GAAG,IAAI,CACV,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;AACvC,CAAC"}
+{"version":3,"file":"runtimeCommand.js","sourceRoot":"","sources":["../../../src/audit/orchestrator/runtimeCommand.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,GAC1B,MAAM,oBAAoB,CAAC;AAE5B,6EAA6E;AAC7E,0EAA0E;AAC1E,+EAA+E;AAC/E,6EAA6E;AAC7E,iBAAiB;AACjB,EAAE;AACF,8EAA8E;AAC9E,2DAA2D;AAE3D,2EAA2E;AAC3E,6EAA6E;AAC7E,qEAAqE;AACrE,kFAAkF;AAClF,0EAA0E;AAC1E,8EAA8E;AAC9E,oEAAoE;AAEpE;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;AAE1D;;;GAGG;AACH,MAAM,wBAAwB,GAAG,KAAK,CAAC;AAEvC;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAEtC;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,GAAG,IAAI,CAAC;AAEjD;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,GAAG,IAAI,CAAC;AAErD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,OAAO,iBAAiB;IAC5B;;;;;OAKG;IACK,QAAQ,GAAa,CAAC,EAAE,CAAC,CAAC;IAClC,6EAA6E;IACrE,YAAY,GAAG,CAAC,CAAC;IACzB,6EAA6E;IACrE,YAAY,GAAG,CAAC,CAAC;IAEzB,IAAI,CAAC,KAAa;QAChB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;QAChC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YACrD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAE,CAAC,CAAC;QACpC,CAAC;QACD,IAAI,CAAC,IAAI,EAAE,CAAC;IACd,CAAC;IAED;;;;;;;;;;;OAWG;IACK,IAAI;QACV,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,mBAAmB,GAAG,CAAC,CAAC,CAAC;QAChE,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;YACf,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;YAChC,uEAAuE;YACvE,oDAAoD;YACpD,IAAI,CAAC,YAAY,IAAI,MAAM,CAAC;QAC9B,CAAC;QACD,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;YAC5C,IAAI,OAAO,CAAC,MAAM,IAAI,4BAA4B;gBAAE,OAAO,OAAO,CAAC;YACnE,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,GAAG,4BAA4B,CAAC;YAC1D,IAAI,CAAC,YAAY,IAAI,GAAG,CAAC;YACzB,OAAO,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5B,CAAC,CAAC,CAAC;QACH,yEAAyE;QACzE,yEAAyE;QACzE,4EAA4E;QAC5E,yEAAyE;QACzE,6DAA6D;QAC7D,IAAI,KAAK,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QAClC,OAAO,KAAK,GAAG,uBAAuB,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnE,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAG,CAAC;YACvC,KAAK,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;YAC5B,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IAED,6DAA6D;IACrD,cAAc;QACpB,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpC,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC;QAC1B,CAAC;QACD,OAAO,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACvD,CAAC;IAED;;;OAGG;IACH,IAAI;QACF,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;YAChE,QAAQ,CAAC,GAAG,EAAE,CAAC;QACjB,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;YAChD,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;QACtE,CAAC;QACD,OAAO;YACL,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;YACzB,UAAU,EAAE,IAAI,CAAC,YAAY,GAAG,QAAQ,CAAC,MAAM;YAC/C,YAAY,EAAE,IAAI,CAAC,YAAY;SAChC,CAAC;IACJ,CAAC;CACF;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,eAAe,CACtB,MAAyB,EACzB,MAAyB;IAEzB,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC1B,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC1B,yEAAyE;IACzE,4EAA4E;IAC5E,0EAA0E;IAC1E,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC;SAC/B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;SACjC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC;IACnD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,mBAAmB,CAAC,CAAC;IAChD,IAAI,UAAU,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG,CAAC,YAAY,KAAK,CAAC,IAAI,GAAG,CAAC,YAAY,KAAK,CAAC,EAAE,CAAC;QACnF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,GAAG,GAAG,CAAC,YAAY,CAAC;IACpD,OAAO;QACL,gCAAgC,KAAK,CAAC,MAAM,OAAO,UAAU,QAAQ;YACnE,CAAC,OAAO,GAAG,CAAC;gBACV,CAAC,CAAC,KAAK,OAAO,8CAA8C;gBAC5D,CAAC,CAAC,EAAE,CAAC;YACP,OAAO;QACT,GAAG,KAAK;KACT,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAAmE,EACnE,WAA4B,OAAO,CAAC,QAAQ;IAE5C,IAAI,QAAQ,KAAK,OAAO,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QACpD,MAAM,MAAM,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE;YACxE,KAAK,EAAE,QAAQ;YACf,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACtB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACxB,CAAC,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,OAAiB,EACjB,GAAW,EACX,YAAoB,0BAA0B;IAM9C,4EAA4E;IAC5E,8DAA8D;IAC9D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACxC,OAAO;YACL,MAAM,EAAE,cAAc;YACtB,OAAO,EAAE,6DAA6D;YACtE,QAAQ,EAAE,EAAE;SACb,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,oCAAoC,CAAC,OAAO,CAAC,CAAC;IACnE,MAAM,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzC,OAAO,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QACnC,MAAM,KAAK,GAAG,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,YAAY,CAAC,IAAI,EAAE;YAC3D,GAAG;YACH,GAAG,EAAE,yBAAyB,EAAE;YAChC,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;YACjC,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;QACH,uEAAuE;QACvE,sEAAsE;QACtE,MAAM,MAAM,GAAG,IAAI,iBAAiB,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,IAAI,iBAAiB,EAAE,CAAC;QACvC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;YAChC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC7B,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;YAChC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC7B,CAAC,CAAC,CAAC;QACH,IAAI,QAAQ,GAAkB,IAAI,CAAC;QACnC,IAAI,UAAU,GAA0B,IAAI,CAAC;QAC7C,6EAA6E;QAC7E,iEAAiE;QACjE,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,UAAU,GAA0B,IAAI,CAAC;QAC7C,MAAM,QAAQ,GACZ,SAAS,GAAG,CAAC;YACX,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE;gBACd,QAAQ,GAAG,IAAI,CAAC;gBAChB,sBAAsB,CAAC,KAAK,CAAC,CAAC;gBAC9B,oEAAoE;gBACpE,iEAAiE;gBACjE,oEAAoE;gBACpE,wCAAwC;gBACxC,UAAU,GAAG,UAAU,CAAC,GAAG,EAAE;oBAC3B,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACxB,CAAC,EAAE,wBAAwB,CAAC,CAAC;gBAC7B,UAAU,CAAC,KAAK,EAAE,EAAE,CAAC;YACvB,CAAC,EAAE,SAAS,CAAC;YACf,CAAC,CAAC,IAAI,CAAC;QACX;;;;;WAKG;QACH,MAAM,WAAW,GAAG,GAAS,EAAE;YAC7B,IAAI,QAAQ;gBAAE,YAAY,CAAC,QAAQ,CAAC,CAAC;YACrC,IAAI,UAAU;gBAAE,YAAY,CAAC,UAAU,CAAC,CAAC;QAC3C,CAAC,CAAC;QACF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC1B,WAAW,EAAE,CAAC;YACd,OAAO,CAAC;gBACN,MAAM,EAAE,cAAc;gBACtB,OAAO,EAAE,qBAAqB,cAAc,KAAK,KAAK,CAAC,OAAO,EAAE;gBAChE,QAAQ,EAAE,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC;aAC1C,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YAChC,QAAQ,GAAG,IAAI,CAAC;YAChB,UAAU,GAAG,MAAM,CAAC;QACtB,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACrB,WAAW,EAAE,CAAC;YACd,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YACjD,MAAM,SAAS,GAAG,QAAQ,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;YAC9C,IAAI,OAAe,CAAC;YACpB,IAAI,QAAQ,EAAE,CAAC;gBACb,yEAAyE;gBACzE,wEAAwE;gBACxE,oEAAoE;gBACpE,wEAAwE;gBACxE,oEAAoE;gBACpE,OAAO;oBACL,iDAAiD,MAAM,CAAC,SAAS,CAAC,qBAAqB;wBACvF,GAAG,cAAc,EAAE,CAAC;YACxB,CAAC;iBAAM,IAAI,SAAS,EAAE,CAAC;gBACrB,OAAO,GAAG,4CAA4C,cAAc,EAAE,CAAC;YACzE,CAAC;iBAAM,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;gBAC7B,OAAO,GAAG,uDAAuD,QAAQ,KAAK,cAAc,EAAE,CAAC;YACjG,CAAC;iBAAM,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;gBAC/B,OAAO,GAAG,sDAAsD,UAAU,KAAK,cAAc,EAAE,CAAC;YAClG,CAAC;iBAAM,CAAC;gBACN,OAAO,GAAG,6DAA6D,cAAc,EAAE,CAAC;YAC1F,CAAC;YACD,OAAO,CAAC;gBACN,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,eAAe;gBACjD,OAAO;gBACP,QAAQ;aACT,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,oCAAoC,CAClD,OAAiB,EACjB,WAA4B,OAAO,CAAC,QAAQ,EAC5C,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,SAAS;IAE/C,MAAM,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC;IACtC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACnC,CAAC;IACD,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,IAAI,CAAC,SAAS,CAAC;YACb,IAAI,EAAE,wBAAwB;YAC9B,IAAI,EAAE,MAAM;YACZ,UAAU;YACV,QAAQ;YACR,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SAC7B,CAAC,GAAG,IAAI,CACV,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IACvC,CAAC;IACD,8EAA8E;IAC9E,kFAAkF;IAClF,mFAAmF;IACnF,iFAAiF;IACjF,yBAAyB;IACzB,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,IAAI,UAAU,CAAC;IAC/D,MAAM,cAAc,GAAG,QAAQ,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC3E,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QAC5D,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,IAAI,CAAC,SAAS,CAAC;YACb,IAAI,EAAE,wBAAwB;YAC9B,IAAI,EAAE,SAAS;YACf,UAAU;YACV,aAAa,EAAE,YAAY;YAC3B,QAAQ;YACR,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SAC7B,CAAC,GAAG,IAAI,CACV,CAAC;QACF,OAAO;YACL,OAAO,EAAE,YAAY;YACrB,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;SAC7E,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,IAAI,CAAC,SAAS,CAAC;QACb,IAAI,EAAE,wBAAwB;QAC9B,IAAI,EAAE,MAAM;QACZ,UAAU;QACV,QAAQ;QACR,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KAC7B,CAAC,GAAG,IAAI,CACV,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;AACvC,CAAC"}

package/dist/audit/orchestrator/scopeIndexBaseline.d.ts

@@ -0,0 +1,56 @@
+import type { RepoManifest } from "../types.js";
+/**
+ * Probe the live git index for the audited candidate set and return a stable
+ * content key over the tracked intersection, or `null` when git cannot be read
+ * (no root, not a work tree, git absent, non-zero exit, spawn failure). Never
+ * throws — this runs inside the advance fold, where a bad manifest must degrade
+ * and not take down the run.
+ *
+ * Sorted and separator-normalized before hashing, so the key is derived from
+ * the tracked SET and never from `ls-files` output order.
+ */
+export declare function probeScopeIndexKey(root: string, candidatePaths: readonly string[]): Promise<string | null>;
+/**
+ * A fold's probe cache: the last probe's inputs and its answer.
+ *
+ * `runSingleAdvanceStep` probes on EVERY dispatch, and a fold dispatches up to
+ * `MAX_DRAIN_STEPS` times — a `git` spawn per obligation execution over a value
+ * that cannot move underneath it. The fold creates ONE of these and every git
+ * probe it makes shares it (`runSingleAdvanceStep` directly, and the
+ * submission-polling gates through `runAuditStepUnlocked`), so a `next-step`
+ * call spawns `git` once instead of once per obligation.
+ *
+ * The cache is HELD, not looked up, and the key is the point: it names the
+ * probe's WHOLE input — the repo root and the candidate path set — so a probe
+ * whose inputs differ cannot replay a stale entry. A step that re-derives the
+ * manifest (the auto-fix phase writes into the audited tree, moving `files[]`)
+ * mints a different key and re-probes, which is why the re-read the reviewer
+ * asked to keep survives: only an identical question is answered from cache.
+ * Nothing inside a fold moves the INDEX itself — no deterministic executor
+ * stages or unstages, the two directions the rule reads, and the fold is
+ * in-process, so no host is running `git add` underneath it.
+ *
+ * A caller that passes no memo (every bare `advanceAudit`, and the CLI claim
+ * path) simply re-probes every time: the cache is an optimization a fold opts
+ * into, never a correctness dependency.
+ */
+export interface ScopeIndexMemo {
+    /** The last probe's input key — absent until the first probe. */
+    key?: string;
+    /** That probe's answer. `null` is a real answer (git unreadable), so the
+     *  presence of `key` — never the truthiness of `value` — is the cache test. */
+    value?: string | null;
+}
+/**
+ * {@link probeScopeIndexKey}, memoized against `memo` when one is supplied.
+ * Behaves identically to the bare probe; a caller with no memo re-probes.
+ */
+export declare function probeScopeIndexKeyCached(memo: ScopeIndexMemo | undefined, root: string, candidatePaths: readonly string[]): Promise<string | null>;
+/**
+ * Return a copy of the manifest carrying the probed index key. `null` (git
+ * unreadable) leaves the manifest untouched rather than stamping a sentinel —
+ * a sentinel would be a claim about the index that the probe could not make,
+ * and it would hash differently from the unprobed manifest for no reason.
+ */
+export declare function withScopeIndexKey(repoManifest: RepoManifest | undefined, key: string | null): RepoManifest | undefined;
+//# sourceMappingURL=scopeIndexBaseline.d.ts.map

package/dist/audit/orchestrator/scopeIndexBaseline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scopeIndexBaseline.d.ts","sourceRoot":"","sources":["../../../src/audit/orchestrator/scopeIndexBaseline.ts"],"names":[],"mappings":"AAsDA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAGhD;;;;;;;;;GASG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,MAAM,EACZ,cAAc,EAAE,SAAS,MAAM,EAAE,GAChC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA0BxB;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,WAAW,cAAc;IAC7B,iEAAiE;IACjE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;mFAC+E;IAC/E,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED;;;GAGG;AACH,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,cAAc,GAAG,SAAS,EAChC,IAAI,EAAE,MAAM,EACZ,cAAc,EAAE,SAAS,MAAM,EAAE,GAChC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CASxB;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,YAAY,EAAE,YAAY,GAAG,SAAS,EACtC,GAAG,EAAE,MAAM,GAAG,IAAI,GACjB,YAAY,GAAG,SAAS,CAG1B"}

package/dist/audit/orchestrator/scopeIndexBaseline.js

@@ -0,0 +1,114 @@
+/**
+ * The live git-index probe behind `repo_manifest.json`'s `scope_index_key`.
+ *
+ * WHY THIS EXISTS. `buildFileDisposition`'s untracked scope rule reads the git
+ * INDEX: the tracked set (`git ls-files`) decides which candidates are in scope.
+ * But `file_disposition.json`'s only declared upstream was `repo_manifest.json`,
+ * and a manifest is a pure WORKTREE read — its per-file hashes do not move when
+ * a file is merely staged (`git add`) or unstaged (`git rm --cached`) with its
+ * content untouched. So an index-only change re-staled nothing, the persisted
+ * disposition kept the old classification, and a file committed mid-run never
+ * entered scope on the next audit until some unrelated content edit churned the
+ * manifest.
+ *
+ * THE FIX IS DAG-NATIVE, not a freshness check: the index state becomes part of
+ * `repo_manifest.json`'s CONTENT. `repo_manifest.json` is already
+ * `file_disposition.json`'s declared upstream, so an index move now propagates
+ * through the existing edge with no new artifact, no new edge, and no change to
+ * the constitutional `spec/audit/dependency-map.md`.
+ *
+ * HOW A LIVE PROBE REACHES THE METADATA. A plain artifact's recorded content
+ * hash only moves when something RE-DERIVES it, and nothing re-derives it until
+ * it is stale — the chicken-and-egg this probe breaks by riding the mechanism
+ * `tooling_manifest.json` already uses: `advanceAudit` re-probes it from live
+ * state on every fold and lists it in the always-updated set, so
+ * `computeArtifactMetadata` restamps it from live content. Unchanged content
+ * keeps its revision (no churn); a moved index bumps it, and
+ * `file_disposition.json` goes stale exactly once.
+ *
+ * READ-SET DIRECTION. The probe is restricted to the manifest's own candidate
+ * paths — exactly the set the untracked rule classifies. An `ls-files` entry
+ * outside that set (an unrelated file staged elsewhere) cannot change the
+ * disposition, and hashing it would churn the whole downstream DAG for nothing.
+ * Absent root / absent git / a failed spawn yields `null`, which the caller
+ * leaves unset: the manifest then carries no index claim at all, and the
+ * pre-existing content-only behaviour is preserved verbatim.
+ *
+ * RECURSION IS PART OF THE ATOMIC PAIR, not a tuning knob. The rule this probe
+ * tracks (`buildFileDisposition`'s untracked classification) reads the index
+ * with `--recurse-submodules`, and so does the citation-grounding corpus
+ * (`enumerateTrackedFilePaths`) — the flag is ONE decision shared by all three,
+ * because "tracked" must mean one thing everywhere or a finding grounds against
+ * a file the disposition excluded. A probe without the flag returns a stable,
+ * plausible key that simply cannot see a move INSIDE a submodule: the gitlink
+ * line is unchanged, the parent's own entries are unchanged, so
+ * `scope_index_key` holds still while the recursive tracked set moves — and the
+ * stale `file_disposition.json` this probe exists to catch is carried forward
+ * silently, for exactly the repos that have first-party submodules.
+ */
+import { hashContent, runTrackedAsync, TRACKED_CHILD_DEADLINE_MS, normalizeRepoPath, } from "audit-tools/shared";
+import { toPosixPath } from "audit-tools/shared";
+/**
+ * Probe the live git index for the audited candidate set and return a stable
+ * content key over the tracked intersection, or `null` when git cannot be read
+ * (no root, not a work tree, git absent, non-zero exit, spawn failure). Never
+ * throws — this runs inside the advance fold, where a bad manifest must degrade
+ * and not take down the run.
+ *
+ * Sorted and separator-normalized before hashing, so the key is derived from
+ * the tracked SET and never from `ls-files` output order.
+ */
+export async function probeScopeIndexKey(root, candidatePaths) {
+    if (candidatePaths.length === 0)
+        return null;
+    let result;
+    try {
+        result = await runTrackedAsync(["git", "ls-files", "-z", "--recurse-submodules"], {
+            cwd: root,
+            encoding: "utf8",
+            maxBuffer: 256 * 1024 * 1024,
+            timeout: TRACKED_CHILD_DEADLINE_MS,
+        });
+    }
+    catch {
+        return null;
+    }
+    if (result.error || result.status !== 0)
+        return null;
+    const tracked = new Set((result.stdout ?? "")
+        .split("\0")
+        .filter((path) => path.length > 0)
+        .map(normalizeRepoPath));
+    const trackedCandidates = candidatePaths
+        .map((path) => normalizeRepoPath(toPosixPath(path)))
+        .filter((path) => tracked.has(path))
+        .sort();
+    return hashContent(trackedCandidates.join("\n"));
+}
+/**
+ * {@link probeScopeIndexKey}, memoized against `memo` when one is supplied.
+ * Behaves identically to the bare probe; a caller with no memo re-probes.
+ */
+export async function probeScopeIndexKeyCached(memo, root, candidatePaths) {
+    const key = `${root}\0${candidatePaths.join("\n")}`;
+    if (memo && memo.key === key)
+        return memo.value ?? null;
+    const value = await probeScopeIndexKey(root, candidatePaths);
+    if (memo) {
+        memo.key = key;
+        memo.value = value;
+    }
+    return value;
+}
+/**
+ * Return a copy of the manifest carrying the probed index key. `null` (git
+ * unreadable) leaves the manifest untouched rather than stamping a sentinel —
+ * a sentinel would be a claim about the index that the probe could not make,
+ * and it would hash differently from the unprobed manifest for no reason.
+ */
+export function withScopeIndexKey(repoManifest, key) {
+    if (!repoManifest || key === null)
+        return repoManifest;
+    return { ...repoManifest, scope_index_key: key };
+}
+//# sourceMappingURL=scopeIndexBaseline.js.map

package/dist/audit/orchestrator/scopeIndexBaseline.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scopeIndexBaseline.js","sourceRoot":"","sources":["../../../src/audit/orchestrator/scopeIndexBaseline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,OAAO,EACL,WAAW,EACX,eAAe,EACf,yBAAyB,EACzB,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEjD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAY,EACZ,cAAiC;IAEjC,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,eAAe,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,sBAAsB,CAAC,EAAE;YAChF,GAAG,EAAE,IAAI;YACT,QAAQ,EAAE,MAAM;YAChB,SAAS,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI;YAC5B,OAAO,EAAE,yBAAyB;SACnC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAErD,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;SAClB,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;SACjC,GAAG,CAAC,iBAAiB,CAAC,CAC1B,CAAC;IACF,MAAM,iBAAiB,GAAG,cAAc;SACrC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,iBAAiB,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;SACnD,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;SACnC,IAAI,EAAE,CAAC;IACV,OAAO,WAAW,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AACnD,CAAC;AAkCD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,IAAgC,EAChC,IAAY,EACZ,cAAiC;IAEjC,MAAM,GAAG,GAAG,GAAG,IAAI,KAAK,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IACpD,IAAI,IAAI,IAAI,IAAI,CAAC,GAAG,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC;IACxD,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAC7D,IAAI,IAAI,EAAE,CAAC;QACT,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,YAAsC,EACtC,GAAkB;IAElB,IAAI,CAAC,YAAY,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,YAAY,CAAC;IACvD,OAAO,EAAE,GAAG,YAAY,EAAE,eAAe,EAAE,GAAG,EAAE,CAAC;AACnD,CAAC"}

package/dist/audit/orchestrator/staleness.d.ts

@@ -16,12 +16,49 @@ import type { ArtifactBundle } from "../io/artifacts.js";
  * stale set (`deriveAuditState`, the drain boundary) keeps its `Set<string>`
  * type and behaviour unchanged, so the deferred channel can never be dropped by
  * a caller "forgetting" a second return value.
+ *
+ * THE CARRY IS A FIELD OF THE VALUE, so it lives exactly as long as the value.
+ * A consumer that rebuilds, forwards or re-types the set into a fresh object
+ * holds a value without it, whatever that consumer's `instanceof` says.
+ *
+ * The residual is real and is NOT papered over. `Set.prototype.union` builds a
+ * PLAIN `Set` — measured, not assumed. It consults neither the receiver's
+ * constructor nor `Set[Symbol.species]` (the property exists and is
+ * configurable, and is ignored), and the subclass constructor is never invoked,
+ * so NOTHING inside this class can reach the copy. `structuredClone` likewise
+ * rebuilds a plain `Set` and has no hook at all. Both results are still
+ * iterable, still `instanceof`-false, and so still type-acceptable to every
+ * consumer — the silently-DISCARDED deferral this class was introduced to make
+ * impossible, one derivation away.
+ *
+ * So the contract is stated LOUDLY at the read instead: {@link deferredArtifactsOf}
+ * returns the carried set for a {@link StaleArtifactSet} and `undefined` for
+ * everything else — which is distinguishable from "this one deferred nothing"
+ * (an EMPTY set on a `StaleArtifactSet`). A caller that unions or clones a stale
+ * set therefore gets `undefined` — an explicit "I lost the deferrals", not an
+ * empty set that reads as "nothing was deferred". The ONLY carry that survives a
+ * derivation is the constructor's: a `StaleArtifactSet` built FROM another one
+ * describes the same computation, so it inherits the source's carry (see the
+ * constructor). Nothing else does — neither derivation is a staleness result.
  */
 export declare class StaleArtifactSet extends Set<string> {
     /** Downstreams held behind a slice projection this call — always disjoint from the stale set. */
     readonly deferred: ReadonlySet<string>;
     constructor(stale?: Iterable<string>, deferred?: Iterable<string>);
 }
+/**
+ * The deferred downstreams a stale set carries, `undefined` when the argument
+ * is not a staleness result at all. A `StaleArtifactSet` that deferred nothing
+ * reports an empty set — never `undefined`, so "deferred nothing" and "was
+ * never a staleness result" stay distinguishable.
+ *
+ * The `instanceof` test here is EXACT, not a widening: only a
+ * `StaleArtifactSet` has a carry, and its constructor is the only thing that
+ * puts the deferrals back on a DERIVED value. A plain `Set` — from `union`,
+ * `structuredClone`, or `new Set(...)` — is simply not a staleness result, so
+ * answering `undefined` for it is the honest answer, not a lost lookup.
+ */
+export declare function deferredArtifactsOf(stale: ReadonlySet<string> | Iterable<string>): ReadonlySet<string> | undefined;
 /** Options controlling the staleness pass's observability side effect. */
 export interface StalenessOptions {
     /**
@@ -39,7 +76,39 @@ export interface StalenessOptions {
  * emits, while the intra-call repeats (the observed 28×/~15× spam) collapse.
  */
 export declare function resetStalenessDedup(): void;
-export declare function emitStalenessRecord(stale: Set<string>, reason?: string): void;
+/**
+ * The recovery a stale set describes, when it describes one — or `undefined`
+ * for the ordinary case of staling work that had not been done yet.
+ *
+ * WHY THIS EXISTS AT ALL (the 2026-07-16 self-audit dogfood entry): fixing this
+ * tool WHILE it audits a tree changes the audited tree, the dependency DAG
+ * correctly marks the planning chain stale, and the run restarts from
+ * `charter_extraction`. The cascade is RIGHT — the planning was derived from a
+ * tree that no longer exists — and it is deliberately NOT narrowed here. The
+ * defect was that a large, expensive, correct action happened SILENTLY, so an
+ * operator could not tell it from a wedge and would eventually be trained to
+ * defeat it. The DAG stays truth; the explanation is added.
+ *
+ * "Expensive" is what makes this a recovery rather than routine planning: a
+ * stale artifact that ALREADY HAS A BODY is prior work being redone. One that
+ * was never written is simply the next thing to do, and announcing it would
+ * make the signal fire constantly — which is the same as not having it. So the
+ * trigger is: this set reaches at least one artifact that already exists.
+ *
+ * The CAUSES are the upstreams that moved. A stale artifact with tracked
+ * dependencies attributes to whichever of them is itself absent-or-stale (the
+ * head of the cascade); a stale artifact with none is its own cause — for the
+ * dogfood case that is `repo_manifest.json`, the artifact that actually
+ * noticed the tool's source change.
+ */
+export interface StalenessRecovery {
+    /** The upstream artifact(s) whose change triggered this cascade, sorted. */
+    caused_by: string[];
+    /** How many artifacts are being re-derived, including the causes. */
+    rederiving: number;
+}
+export declare function describeStalenessRecovery(stale: ReadonlySet<string>, bundle: ArtifactBundle): StalenessRecovery | undefined;
+export declare function emitStalenessRecord(stale: Set<string>, reason?: string, bundle?: ArtifactBundle): void;
 /**
  * True exactly when `computeStaleArtifacts` would take the metadata-schema
  * migration degrade path (an old-shape manifest that must not be trusted to

package/dist/audit/orchestrator/staleness.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"staleness.d.ts","sourceRoot":"","sources":["../../../src/audit/orchestrator/staleness.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AA6BzD;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,gBAAiB,SAAQ,GAAG,CAAC,MAAM,CAAC;IAC/C,iGAAiG;IACjG,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;gBAE3B,KAAK,GAAE,QAAQ,CAAC,MAAM,CAAM,EAAE,QAAQ,GAAE,QAAQ,CAAC,MAAM,CAAM;CAM1E;AAgED,0EAA0E;AAC1E,MAAM,WAAW,gBAAgB;IAC/B;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAgBD;;;;GAIG;AACH,wBAAgB,mBAAmB,IAAI,IAAI,CAE1C;AAED,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,EAClB,MAAM,CAAC,EAAE,MAAM,GACd,IAAI,CAoBN;AAED;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAG5E;AAED,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,cAAc,EACtB,OAAO,GAAE,gBAAqB,GAC7B,gBAAgB,CAwMlB"}
+{"version":3,"file":"staleness.d.ts","sourceRoot":"","sources":["../../../src/audit/orchestrator/staleness.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AA6BzD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,qBAAa,gBAAiB,SAAQ,GAAG,CAAC,MAAM,CAAC;IAC/C,iGAAiG;IACjG,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;gBAE3B,KAAK,GAAE,QAAQ,CAAC,MAAM,CAAM,EAAE,QAAQ,GAAE,QAAQ,CAAC,MAAM,CAAM;CAe1E;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,GAC5C,WAAW,CAAC,MAAM,CAAC,GAAG,SAAS,CAEjC;AA4FD,0EAA0E;AAC1E,MAAM,WAAW,gBAAgB;IAC/B;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAgBD;;;;GAIG;AACH,wBAAgB,mBAAmB,IAAI,IAAI,CAE1C;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,WAAW,iBAAiB;IAChC,4EAA4E;IAC5E,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,qEAAqE;IACrE,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,EAC1B,MAAM,EAAE,cAAc,GACrB,iBAAiB,GAAG,SAAS,CA2C/B;AAED,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,EAClB,MAAM,CAAC,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,cAAc,GACtB,IAAI,CA0CN;AAED;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAG5E;AAED,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,cAAc,EACtB,OAAO,GAAE,gBAAqB,GAC7B,gBAAgB,CA+MlB"}