autor3search-typescript 0.1.0

package/dist/gitx/git.d.ts

@@ -0,0 +1,87 @@
+export declare function repoRoot(dir: string): Promise<string>;
+export declare function headCommit(root: string): Promise<string>;
+export declare function shortSha(sha: string): string;
+/**
+ * A tree is clean only if it has no modifications AND no untracked files.
+ * `--porcelain` lists untracked entries too (respecting .gitignore, so an
+ * untracked file inside an ignored directory does not count): a baseline
+ * pinned against what is on disk rather than what is in git is not
+ * reproducible, so a stray untracked file must make the tree dirty.
+ */
+export declare function isClean(root: string): Promise<boolean>;
+/**
+ * Repo-relative POSIX paths touched since `sinceRef`: everything the scope
+ * gate (and gate 8's clean-tree check) must treat as "changed," whether or
+ * not it was ever `git add`-ed, committed, or hidden from git's own normal
+ * views.
+ *
+ * This is the union of several views, because no one of them alone answers
+ * the question:
+ *
+ * - `diff --name-only <ref>` (ref vs. the *working tree*, not `HEAD`) --
+ *   catches committed changes, uncommitted edits to tracked files, and
+ *   files the agent deleted. Blind to a brand-new file never `git add`-ed,
+ *   and to a tracked file flagged assume-unchanged/skip-worktree (below).
+ * - `ls-files --others --exclude-standard` -- untracked files, respecting
+ *   `.gitignore`. Safe to trust here ONLY because `untrustedGitignores`
+ *   (above) is checked first and separately: this function does NOT
+ *   re-derive an ignore-immune untracked-file list of its own (an earlier
+ *   version did, and it made the tool refuse on a repository's own
+ *   ordinary `dist/`, `.env` or `*.log` entries -- the opposite failure).
+ * - `untrustedGitignores` -- an untracked or modified `.gitignore` is
+ *   itself reported as a change, so `--exclude-standard`'s output for
+ *   THIS invocation is never trusted while the rules it depends on are in
+ *   an unverified state.
+ * - `listSymlinks` minus git's tracked set -- an untracked symlink is
+ *   invisible to the ordinary file walk `walkRepo` uses (by design; see
+ *   its own doc comment) and to `--exclude-standard` only if it happens to
+ *   be gitignored, but it is exactly what Node and `tsc` resolve at
+ *   measure time. Reported unconditionally, gitignored or not: a symlink
+ *   is content indirection, and hiding a NEW one behind an ignore rule is
+ *   not a legitimate use this gate needs to accommodate the way `dist/`
+ *   or `.env` are.
+ * - `tamperedIndexEntries` -- see its own doc comment: a complete bypass
+ *   of `diff` for a tracked file, detected directly.
+ *
+ * `diff` and every `ls-files` call use `-z`: a path with a space or
+ * embedded newline would otherwise be able to split into extra entries
+ * under the default newline-separated, C-quoted output, and a scope gate
+ * that mis-parses a filename is one an agent can bypass by naming a file
+ * carefully. This is a security property, not formatting.
+ */
+export declare function changedFiles(root: string, sinceRef: string): Promise<string[]>;
+export declare function currentBranch(root: string): Promise<string>;
+export declare function branchExists(root: string, name: string): Promise<boolean>;
+export declare function createBranch(root: string, name: string): Promise<void>;
+/**
+ * Deletes a local branch, force (`-D`) rather than `-d`: this exists for the
+ * `baseline` unwind path, where a run that fails partway must delete the run
+ * branch it just created so a retry does not die on "branch already
+ * exists." A branch created moments ago for a fresh run is never something
+ * the merge-safety check behind `-d` needs to protect. Fails (does not
+ * silently succeed) if the branch does not exist, since a caller unwinding
+ * a partial failure needs to know its assumption about what it created was
+ * wrong.
+ */
+export declare function deleteBranch(root: string, name: string): Promise<void>;
+export declare function addWorktree(root: string, dir: string, commit: string): Promise<void>;
+export declare function removeWorktree(root: string, dir: string): Promise<void>;
+/**
+ * Moves an existing detached worktree to another commit.
+ *
+ * This is how the MEASUREMENT commit advances after a KEEP. It must never be
+ * used on the frozen-test snapshot: moving the measurement point must not move
+ * the success criteria.
+ *
+ * `--force` (in addition to `-q --detach`): this is also how `eval` gate 8
+ * self-heals a worktree merely left at the wrong commit (e.g. by a crash
+ * between recording an advanced `measureCommit` and repointing the
+ * worktree to match it -- see `pipeline/eval.ts`). That worktree's own
+ * frozen files were restored on a previous run and may still differ from
+ * the target commit's tree; a plain `checkout --detach` would refuse to
+ * discard those local changes, which the self-heal must not depend on a
+ * human clearing first. Safe to discard unconditionally: the worktree
+ * holds nothing this tool did not itself put there, and `restore` runs
+ * again immediately after this to reassert the frozen bytes regardless.
+ */
+export declare function repointWorktree(worktreeDir: string, commit: string): Promise<void>;

package/dist/gitx/git.js

@@ -0,0 +1,235 @@
+import path from 'node:path';
+import { listSymlinks, walkRepo } from '../discover/files.js';
+import { ok, run } from '../runner/exec.js';
+const TIMEOUT_MS = 60_000;
+async function git(cwd, args) {
+    const r = await run('git', args, { cwd, timeoutMs: TIMEOUT_MS });
+    if (!ok(r)) {
+        throw new Error(`git ${args.join(' ')} failed in ${cwd} (exit ${r.exitCode}): ${r.stderr.trim()}`);
+    }
+    return r.stdout.trim();
+}
+/**
+ * Like `git`, but returns stdout untrimmed.
+ *
+ * `.trim()` is safe for the scalar callers (`repoRoot`, `headCommit`,
+ * `currentBranch`, ...), which only ever get one shell-wrapped value back.
+ * It is NOT safe for a `-z` NUL-separated list: `String.prototype.trim`
+ * strips leading ASCII whitespace, and a leading space (0x20) sorts before
+ * any letter in git's output — so a repo-relative path that legitimately
+ * starts with a space (e.g. a directory named `" src"`) would have that
+ * space clipped from the *first* entry every time, silently turning
+ * `" src/evil.ts"` into `"src/evil.ts"`. Under a scope gate that allowlists
+ * `src/**`, that reported path is in scope while the real file is not —
+ * the same "name a file to bypass the gate" class `-z` itself exists to
+ * prevent, reintroduced one layer up by an over-eager trim. `-z` and NUL
+ * splitting still take care of the trailing edge: `trim()` does not treat
+ * `\0` as whitespace, so it never eats the sentinel a caller's split relies
+ * on.
+ */
+async function gitRaw(cwd, args) {
+    const r = await run('git', args, { cwd, timeoutMs: TIMEOUT_MS });
+    if (!ok(r)) {
+        throw new Error(`git ${args.join(' ')} failed in ${cwd} (exit ${r.exitCode}): ${r.stderr.trim()}`);
+    }
+    return r.stdout;
+}
+export async function repoRoot(dir) {
+    return git(dir, ['rev-parse', '--show-toplevel']);
+}
+export async function headCommit(root) {
+    return git(root, ['rev-parse', 'HEAD']);
+}
+export function shortSha(sha) {
+    return sha.slice(0, 7);
+}
+/**
+ * A tree is clean only if it has no modifications AND no untracked files.
+ * `--porcelain` lists untracked entries too (respecting .gitignore, so an
+ * untracked file inside an ignored directory does not count): a baseline
+ * pinned against what is on disk rather than what is in git is not
+ * reproducible, so a stray untracked file must make the tree dirty.
+ */
+export async function isClean(root) {
+    return (await git(root, ['status', '--porcelain'])) === '';
+}
+/**
+ * Splits a NUL-separated `-z` git listing into repo-relative POSIX paths.
+ * `out` must come from `gitRaw`, not `git` — see `gitRaw`'s doc comment for
+ * why trimming first would silently corrupt a path with a leading space.
+ */
+function parseNulList(out) {
+    return out
+        .split('\0')
+        .filter((s) => s !== '')
+        .map((s) => s.split(path.sep).join('/'));
+}
+/**
+ * Repo-relative POSIX paths of every tracked file whose git-index "assume
+ * unchanged" or "skip-worktree" bit is set.
+ *
+ * Either bit tells git to stop comparing that path against the working
+ * tree at all -- `git diff <ref>` (which `changedFiles` otherwise relies on
+ * to see committed-vs-disk differences) reports NO difference for such a
+ * file even after its on-disk content is completely rewritten, because git
+ * trusts the index entry without ever re-reading the file. That is a
+ * complete, one-command bypass of both the scope gate and gate 8's
+ * clean-tree check (`git update-index --assume-unchanged <path>`, or
+ * `--skip-worktree`) -- strictly easier than the `.gitignore`-hiding attack
+ * this function otherwise closes -- so it is detected directly rather than
+ * trusted through a diff mechanism that cannot see it.
+ *
+ * `git ls-files -v` tags every tracked path with one status letter; the
+ * letter is lowercased when the assume-unchanged bit is set, and a
+ * skip-worktree path is tagged `S` regardless. Either is reported here.
+ */
+async function tamperedIndexEntries(root) {
+    const out = await gitRaw(root, ['ls-files', '-v', '-z']);
+    const flagged = [];
+    for (const entry of out.split('\0')) {
+        if (entry === '')
+            continue;
+        const tag = entry.charAt(0);
+        const rel = entry.slice(2); // "<tag><SP><path>"
+        if (tag === 'S' || (tag >= 'a' && tag <= 'z')) {
+            flagged.push(rel.split(path.sep).join('/'));
+        }
+    }
+    return flagged;
+}
+/**
+ * Repo-relative POSIX paths of every `.gitignore` (a plain file -- a
+ * SYMLINKED `.gitignore` is caught separately, as an untracked symlink)
+ * that is either untracked or differs from `sinceRef`: one whose rules
+ * cannot be trusted for this comparison.
+ *
+ * `--exclude-standard` (used below to list ordinary untracked files) is
+ * only safe to rely on once this comes back empty. An agent-authored
+ * `.gitignore` an agent just wrote to hide a directory of untracked source
+ * (`printf '*\n' > lib/.gitignore`) is exactly what this catches: rather
+ * than distrust `--exclude-standard`'s output in general (which would also
+ * make it blind to the REPOSITORY's own, entirely legitimate ignore rules
+ * -- `dist/`, `.env`, `.DS_Store`, `*.log`, ...), an untracked or modified
+ * `.gitignore` is treated as a violation in its own right and refused
+ * before `--exclude-standard`'s output is ever trusted.
+ */
+function untrustedGitignores(allFiles, tracked, diffed) {
+    return allFiles.filter((f) => path.posix.basename(f) === '.gitignore' && (!tracked.has(f) || diffed.has(f)));
+}
+/**
+ * Repo-relative POSIX paths touched since `sinceRef`: everything the scope
+ * gate (and gate 8's clean-tree check) must treat as "changed," whether or
+ * not it was ever `git add`-ed, committed, or hidden from git's own normal
+ * views.
+ *
+ * This is the union of several views, because no one of them alone answers
+ * the question:
+ *
+ * - `diff --name-only <ref>` (ref vs. the *working tree*, not `HEAD`) --
+ *   catches committed changes, uncommitted edits to tracked files, and
+ *   files the agent deleted. Blind to a brand-new file never `git add`-ed,
+ *   and to a tracked file flagged assume-unchanged/skip-worktree (below).
+ * - `ls-files --others --exclude-standard` -- untracked files, respecting
+ *   `.gitignore`. Safe to trust here ONLY because `untrustedGitignores`
+ *   (above) is checked first and separately: this function does NOT
+ *   re-derive an ignore-immune untracked-file list of its own (an earlier
+ *   version did, and it made the tool refuse on a repository's own
+ *   ordinary `dist/`, `.env` or `*.log` entries -- the opposite failure).
+ * - `untrustedGitignores` -- an untracked or modified `.gitignore` is
+ *   itself reported as a change, so `--exclude-standard`'s output for
+ *   THIS invocation is never trusted while the rules it depends on are in
+ *   an unverified state.
+ * - `listSymlinks` minus git's tracked set -- an untracked symlink is
+ *   invisible to the ordinary file walk `walkRepo` uses (by design; see
+ *   its own doc comment) and to `--exclude-standard` only if it happens to
+ *   be gitignored, but it is exactly what Node and `tsc` resolve at
+ *   measure time. Reported unconditionally, gitignored or not: a symlink
+ *   is content indirection, and hiding a NEW one behind an ignore rule is
+ *   not a legitimate use this gate needs to accommodate the way `dist/`
+ *   or `.env` are.
+ * - `tamperedIndexEntries` -- see its own doc comment: a complete bypass
+ *   of `diff` for a tracked file, detected directly.
+ *
+ * `diff` and every `ls-files` call use `-z`: a path with a space or
+ * embedded newline would otherwise be able to split into extra entries
+ * under the default newline-separated, C-quoted output, and a scope gate
+ * that mis-parses a filename is one an agent can bypass by naming a file
+ * carefully. This is a security property, not formatting.
+ */
+export async function changedFiles(root, sinceRef) {
+    const [diffOut, trackedOut, untrackedOut, allFiles, symlinks, tamperedTags] = await Promise.all([
+        gitRaw(root, ['diff', '--name-only', '-z', sinceRef]),
+        gitRaw(root, ['ls-files', '-z']),
+        gitRaw(root, ['ls-files', '--others', '--exclude-standard', '-z']),
+        walkRepo(root),
+        listSymlinks(root),
+        tamperedIndexEntries(root),
+    ]);
+    const tracked = new Set(parseNulList(trackedOut));
+    const diffed = new Set(parseNulList(diffOut));
+    const gitignoreViolations = untrustedGitignores(allFiles, tracked, diffed);
+    const untrackedSymlinks = symlinks.filter((f) => !tracked.has(f));
+    return [
+        ...new Set([
+            ...diffed,
+            ...parseNulList(untrackedOut),
+            ...gitignoreViolations,
+            ...untrackedSymlinks,
+            ...tamperedTags,
+        ]),
+    ].sort();
+}
+export async function currentBranch(root) {
+    return git(root, ['rev-parse', '--abbrev-ref', 'HEAD']);
+}
+export async function branchExists(root, name) {
+    const r = await run('git', ['show-ref', '--verify', '--quiet', `refs/heads/${name}`], {
+        cwd: root,
+        timeoutMs: TIMEOUT_MS,
+    });
+    return r.exitCode === 0;
+}
+export async function createBranch(root, name) {
+    await git(root, ['checkout', '-q', '-b', name]);
+}
+/**
+ * Deletes a local branch, force (`-D`) rather than `-d`: this exists for the
+ * `baseline` unwind path, where a run that fails partway must delete the run
+ * branch it just created so a retry does not die on "branch already
+ * exists." A branch created moments ago for a fresh run is never something
+ * the merge-safety check behind `-d` needs to protect. Fails (does not
+ * silently succeed) if the branch does not exist, since a caller unwinding
+ * a partial failure needs to know its assumption about what it created was
+ * wrong.
+ */
+export async function deleteBranch(root, name) {
+    await git(root, ['branch', '-D', name]);
+}
+export async function addWorktree(root, dir, commit) {
+    await git(root, ['worktree', 'add', '--detach', '-q', dir, commit]);
+}
+export async function removeWorktree(root, dir) {
+    await git(root, ['worktree', 'remove', '--force', dir]);
+}
+/**
+ * Moves an existing detached worktree to another commit.
+ *
+ * This is how the MEASUREMENT commit advances after a KEEP. It must never be
+ * used on the frozen-test snapshot: moving the measurement point must not move
+ * the success criteria.
+ *
+ * `--force` (in addition to `-q --detach`): this is also how `eval` gate 8
+ * self-heals a worktree merely left at the wrong commit (e.g. by a crash
+ * between recording an advanced `measureCommit` and repointing the
+ * worktree to match it -- see `pipeline/eval.ts`). That worktree's own
+ * frozen files were restored on a previous run and may still differ from
+ * the target commit's tree; a plain `checkout --detach` would refuse to
+ * discard those local changes, which the self-heal must not depend on a
+ * human clearing first. Safe to discard unconditionally: the worktree
+ * holds nothing this tool did not itself put there, and `restore` runs
+ * again immediately after this to reassert the frozen bytes regardless.
+ */
+export async function repointWorktree(worktreeDir, commit) {
+    await git(worktreeDir, ['checkout', '-q', '--detach', '--force', commit]);
+}
+//# sourceMappingURL=git.js.map

package/dist/gitx/git.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git.js","sourceRoot":"","sources":["../../src/gitx/git.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAC7D,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAA;AAE3C,MAAM,UAAU,GAAG,MAAM,CAAA;AAEzB,KAAK,UAAU,GAAG,CAAC,GAAW,EAAE,IAAc;IAC5C,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAA;IAChE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,GAAG,UAAU,CAAC,CAAC,QAAQ,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;IACpG,CAAC;IACD,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAA;AACxB,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,KAAK,UAAU,MAAM,CAAC,GAAW,EAAE,IAAc;IAC/C,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAA;IAChE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,GAAG,UAAU,CAAC,CAAC,QAAQ,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;IACpG,CAAC;IACD,OAAO,CAAC,CAAC,MAAM,CAAA;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,GAAW;IACxC,OAAO,GAAG,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC,CAAA;AACnD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAY;IAC3C,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAA;AACzC,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,GAAW;IAClC,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;AACxB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAY;IACxC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC,KAAK,EAAE,CAAA;AAC5D,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,GAAW;IAC/B,OAAO,GAAG;SACP,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;SACvB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;AAC5C,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,KAAK,UAAU,oBAAoB,CAAC,IAAY;IAC9C,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;IACxD,MAAM,OAAO,GAAa,EAAE,CAAA;IAC5B,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,IAAI,KAAK,KAAK,EAAE;YAAE,SAAQ;QAC1B,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;QAC3B,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA,CAAC,oBAAoB;QAC/C,IAAI,GAAG,KAAK,GAAG,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC;YAC9C,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;QAC7C,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAS,mBAAmB,CAAC,QAAkB,EAAE,OAAoB,EAAE,MAAmB;IACxF,OAAO,QAAQ,CAAC,MAAM,CACpB,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,YAAY,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CACrF,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAY,EAAE,QAAgB;IAC/D,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC9F,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;QACrD,MAAM,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QAChC,MAAM,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,oBAAoB,EAAE,IAAI,CAAC,CAAC;QAClE,QAAQ,CAAC,IAAI,CAAC;QACd,YAAY,CAAC,IAAI,CAAC;QAClB,oBAAoB,CAAC,IAAI,CAAC;KAC3B,CAAC,CAAA;IACF,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAA;IACjD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAA;IAC7C,MAAM,mBAAmB,GAAG,mBAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAA;IAC1E,MAAM,iBAAiB,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;IAEjE,OAAO;QACL,GAAG,IAAI,GAAG,CAAC;YACT,GAAG,MAAM;YACT,GAAG,YAAY,CAAC,YAAY,CAAC;YAC7B,GAAG,mBAAmB;YACtB,GAAG,iBAAiB;YACpB,GAAG,YAAY;SAChB,CAAC;KACH,CAAC,IAAI,EAAE,CAAA;AACV,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAY;IAC9C,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC,CAAA;AACzD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAY,EAAE,IAAY;IAC3D,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,cAAc,IAAI,EAAE,CAAC,EAAE;QACpF,GAAG,EAAE,IAAI;QACT,SAAS,EAAE,UAAU;KACtB,CAAC,CAAA;IACF,OAAO,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAA;AACzB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAY,EAAE,IAAY;IAC3D,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;AACjD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAY,EAAE,IAAY;IAC3D,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;AACzC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAY,EAAE,GAAW,EAAE,MAAc;IACzE,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,CAAA;AACrE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAY,EAAE,GAAW;IAC5D,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,CAAA;AACzD,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,WAAmB,EAAE,MAAc;IACvE,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAA;AAC3E,CAAC"}

package/dist/measure/interleave.d.ts

@@ -0,0 +1,32 @@
+import type { Benchmark } from '../discover/benchmarks.js';
+export type Observations = Map<string, number[]>;
+export interface InterleaveOptions {
+    rounds: number;
+    benchmarks: Benchmark[];
+    baseDir: string;
+    candDir: string;
+    measureOne: (dir: string, b: Benchmark) => Promise<number>;
+}
+/**
+ * Alternates the two sides while measuring, and accumulates one observation
+ * per benchmark per round per side.
+ *
+ * Two orderings matter, for two different reasons.
+ *
+ * Across rounds: comparing a candidate measured now against a baseline
+ * measured minutes ago attributes thermal drift, frequency scaling and
+ * background load to the code change. Alternating cancels it.
+ *
+ * Within a pair: measuring base immediately before cand, every time, leaves a
+ * small consistent bias on a machine that is steadily warming. Swapping the
+ * order on alternate rounds cancels that too -- an asymmetry the Go
+ * implementation documents as known and residual.
+ *
+ * Within one round, both sides of a given benchmark are measured adjacently
+ * before moving on to the next benchmark, keeping the pair as close in time
+ * as possible -- which is the whole point of interleaving at all.
+ */
+export declare function interleave(o: InterleaveOptions): Promise<{
+    base: Observations;
+    cand: Observations;
+}>;

package/dist/measure/interleave.js

@@ -0,0 +1,42 @@
+/**
+ * Alternates the two sides while measuring, and accumulates one observation
+ * per benchmark per round per side.
+ *
+ * Two orderings matter, for two different reasons.
+ *
+ * Across rounds: comparing a candidate measured now against a baseline
+ * measured minutes ago attributes thermal drift, frequency scaling and
+ * background load to the code change. Alternating cancels it.
+ *
+ * Within a pair: measuring base immediately before cand, every time, leaves a
+ * small consistent bias on a machine that is steadily warming. Swapping the
+ * order on alternate rounds cancels that too -- an asymmetry the Go
+ * implementation documents as known and residual.
+ *
+ * Within one round, both sides of a given benchmark are measured adjacently
+ * before moving on to the next benchmark, keeping the pair as close in time
+ * as possible -- which is the whole point of interleaving at all.
+ */
+export async function interleave(o) {
+    const base = new Map();
+    const cand = new Map();
+    for (const b of o.benchmarks) {
+        base.set(b.id, []);
+        cand.set(b.id, []);
+    }
+    for (let round = 0; round < o.rounds; round++) {
+        const baseFirst = round % 2 === 0;
+        for (const b of o.benchmarks) {
+            if (baseFirst) {
+                base.get(b.id).push(await o.measureOne(o.baseDir, b));
+                cand.get(b.id).push(await o.measureOne(o.candDir, b));
+            }
+            else {
+                cand.get(b.id).push(await o.measureOne(o.candDir, b));
+                base.get(b.id).push(await o.measureOne(o.baseDir, b));
+            }
+        }
+    }
+    return { base, cand };
+}
+//# sourceMappingURL=interleave.js.map

package/dist/measure/interleave.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"interleave.js","sourceRoot":"","sources":["../../src/measure/interleave.ts"],"names":[],"mappings":"AAYA;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,CAAoB;IAInD,MAAM,IAAI,GAAiB,IAAI,GAAG,EAAE,CAAA;IACpC,MAAM,IAAI,GAAiB,IAAI,GAAG,EAAE,CAAA;IACpC,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;QAC7B,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;QAClB,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;IACpB,CAAC;IAED,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QAC9C,MAAM,SAAS,GAAG,KAAK,GAAG,CAAC,KAAK,CAAC,CAAA;QACjC,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;YAC7B,IAAI,SAAS,EAAE,CAAC;gBACd,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAA;gBACtD,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAA;YACxD,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAA;gBACtD,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAA;YACxD,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;AACvB,CAAC"}

package/dist/pipeline/eval.d.ts

@@ -0,0 +1,67 @@
+import type { Benchmark } from '../discover/benchmarks.js';
+import { type Delta } from '../stats/delta.js';
+import { type Verdict } from '../verdict/verdict.js';
+export type GateName = 
+/** No baseline for this tag, or the config file itself could not be loaded at all. */
+'setup' | 'scope' | 'config-integrity' | 'restore' | 'unmanifested' | 'typecheck' | 'build' | 'test' | 'worktree-integrity' | 'measure'
+/** Advancing measureCommit after a KEEP was already decided. */
+ | 'advance';
+/**
+ * The subset of `RunCtx` (see `cli/runctx.ts`) this pipeline needs. Declared
+ * independently rather than importing `RunCtx` itself so the pipeline layer
+ * does not depend on the CLI layer -- `cli/cmd-eval.ts` passes its `RunCtx`
+ * straight through, which satisfies this structurally.
+ */
+export interface EvalRepoCtx {
+    repoRoot: string;
+    configPath: string;
+    resultsPath: string;
+}
+export interface EvalOptions {
+    ctx: EvalRepoCtx;
+    tag: string;
+    /** Free-text experiment description, recorded on the results.tsv row. */
+    description: string;
+    /** Subprocess transcripts (typecheck/build/test/measurement children). */
+    log?: (chunk: string) => void;
+    /**
+     * Testing hook: overrides how one benchmark is measured in one directory.
+     * Defaults to a real `runChild` spawn. Exists so gate-order tests can prove
+     * a rejected gate never measures anything, by asserting this was never
+     * called, without needing to spawn (and then discard) a real subprocess.
+     */
+    measureOne?: (dir: string, b: Benchmark) => Promise<number>;
+}
+export interface EvalOutcome {
+    verdict: Verdict;
+    deltas: Delta[];
+    stopRequested: boolean;
+    failedGate?: GateName;
+    message: string;
+    /**
+     * Every non-verdict warning gathered along the way (e.g. "gate 3 restored
+     * N frozen file(s)"), followed by the verdict's own warnings when a score
+     * was actually computed. Not in the brief's minimal interface, but
+     * `cmd-eval`'s `--json` output and its human "WARNING:" lines both need a
+     * single combined list, and building it here (once, where the gates run)
+     * beats recomputing it at the CLI layer from partial information.
+     */
+    warnings: string[];
+    /** Repo-relative frozen files whose content differed from baseline and were restored. */
+    restoredFiles: string[];
+    /** HEAD of the repository being evaluated -- the commit this verdict is about. */
+    candidateCommit: string;
+    frozenCommit: string;
+    measureCommit: string;
+    /** 1-based count of experiments recorded in results.tsv, this one included. */
+    experiment: number;
+}
+/**
+ * Runs one experiment end to end: the full gate chain, and -- for whatever
+ * outcome it ends in -- one `results.tsv` row.
+ *
+ * The eval lock is held for the whole chain and released in a `finally`, so
+ * a crash mid-chain (this function throwing something genuinely
+ * unanticipated) never leaves a future eval permanently blocked.
+ */
+export declare function runEval(opts: EvalOptions): Promise<EvalOutcome>;