autoremediator 0.21.2 → 0.22.0

package/dist/api/bisect/remedy.d.ts

@@ -0,0 +1,25 @@
+import type { PackageManager } from "../../platform/types.js";
+import { applyPlan } from "../runs/index.js";
+import type { BisectedPackage, BisectRemedy } from "./types.js";
+export interface RemedyRequest {
+    cwd: string;
+    packageManager: PackageManager;
+    /** Lockfile name relative to `cwd`. */
+    lockfile: string;
+    culprits: readonly BisectedPackage[];
+    goodCommit: string;
+    badCommit: string;
+    command: string;
+    apply: boolean;
+    applyPlanFn?: typeof applyPlan;
+}
+/**
+ * The recommended remedy: pin each culprit back to the version it had at the good ref, recorded as a
+ * plan in the project's run store like any other (`autoremediator plan`). Nothing is changed unless
+ * `apply` is set, and then only through the same `applyPlan` that `runs apply` uses.
+ *
+ * The plan is made against the working tree as it is now, so a culprit that the working tree no longer
+ * holds at its bad version (already fixed, or the checkout is somewhere else) is reported, not planned.
+ */
+export declare function planRemedy(request: RemedyRequest): Promise<BisectRemedy>;
+//# sourceMappingURL=remedy.d.ts.map

package/dist/api/bisect/remedy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remedy.d.ts","sourceRoot":"","sources":["../../../src/api/bisect/remedy.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAkC,MAAM,yBAAyB,CAAC;AAG9F,OAAO,EAAE,SAAS,EAAe,MAAM,kBAAkB,CAAC;AAE1D,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAEhE,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,cAAc,EAAE,cAAc,CAAC;IAC/B,uCAAuC;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,SAAS,eAAe,EAAE,CAAC;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;IACf,WAAW,CAAC,EAAE,OAAO,SAAS,CAAC;CAChC;AAkBD;;;;;;;GAOG;AACH,wBAAsB,UAAU,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,CA6F9E"}

package/dist/api/bisect/remedy.js

@@ -0,0 +1,116 @@
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { sha256 } from "../../runs/hash.js";
+import { parseLockfileDependencies } from "../../scanner/lockfile-diff.js";
+import { applyPlan, persistPlan } from "../runs/index.js";
+import { directDependencyNames } from "./changes.js";
+function readLocked(cwd, lockfile) {
+    const path = join(cwd, lockfile);
+    if (!existsSync(path))
+        return undefined;
+    return parseLockfileDependencies(lockfile, readFileSync(path, "utf8"));
+}
+function readDirect(cwd) {
+    try {
+        return directDependencyNames(JSON.parse(readFileSync(join(cwd, "package.json"), "utf8")));
+    }
+    catch {
+        return new Set();
+    }
+}
+/**
+ * The recommended remedy: pin each culprit back to the version it had at the good ref, recorded as a
+ * plan in the project's run store like any other (`autoremediator plan`). Nothing is changed unless
+ * `apply` is set, and then only through the same `applyPlan` that `runs apply` uses.
+ *
+ * The plan is made against the working tree as it is now, so a culprit that the working tree no longer
+ * holds at its bad version (already fixed, or the checkout is somewhere else) is reported, not planned.
+ */
+export async function planRemedy(request) {
+    const locked = readLocked(request.cwd, request.lockfile);
+    const direct = readDirect(request.cwd);
+    const notPlanned = [];
+    const results = [];
+    for (const culprit of request.culprits) {
+        const versions = locked?.get(culprit.packageName);
+        if (!locked) {
+            notPlanned.push({
+                packageName: culprit.packageName,
+                reason: `${request.lockfile} does not exist in ${request.cwd}`,
+            });
+        }
+        else if (!versions?.has(culprit.toVersion)) {
+            notPlanned.push({
+                packageName: culprit.packageName,
+                reason: versions?.size
+                    ? `the working tree locks ${[...versions].toSorted().join(", ")}, not ${culprit.toVersion}`
+                    : "the working tree does not lock this package",
+            });
+        }
+        else {
+            const scope = direct.has(culprit.packageName) ? "direct" : "transitive";
+            results.push({
+                packageName: culprit.packageName,
+                strategy: scope === "direct" ? "version-bump" : "override",
+                fromVersion: culprit.toVersion,
+                toVersion: culprit.fromVersion,
+                applied: false,
+                dryRun: true,
+                dependencyScope: scope,
+                message: `Pin ${culprit.packageName} back to ${culprit.fromVersion}: ${culprit.toVersion} breaks \`${request.command}\`.`,
+            });
+        }
+    }
+    const pins = results.map((result) => ({
+        packageName: result.packageName,
+        version: result.toVersion ?? "",
+        strategy: result.strategy,
+    }));
+    if (results.length === 0)
+        return { pins, nextCommands: [], notPlanned };
+    const cveId = `BISECT-${sha256(`${request.goodCommit}\n${request.badCommit}\n${request.command}`).slice(0, 8)}`;
+    const report = {
+        cveId,
+        cveDetails: null,
+        vulnerablePackages: [],
+        results,
+        summary: `Lockfile bisect ${request.goodCommit.slice(0, 12)}..${request.badCommit.slice(0, 12)}: pin ${results
+            .map((result) => `${result.packageName}@${result.toVersion}`)
+            .join(", ")}.`,
+    };
+    const { runId, planId } = await persistPlan(report, { cwd: request.cwd, packageManager: request.packageManager }, request.cwd);
+    const remedy = {
+        pins,
+        runId,
+        planId,
+        nextCommands: [
+            `autoremediator runs show ${runId}`,
+            `autoremediator runs apply ${runId}`,
+            `autoremediator runs rollback ${runId}`,
+        ],
+        notPlanned,
+    };
+    if (!request.apply)
+        return remedy;
+    const run = await (request.applyPlanFn ?? applyPlan)({ cwd: request.cwd, runId });
+    const after = readLocked(request.cwd, request.lockfile);
+    const unchanged = pins.filter((pin) => {
+        const versions = after?.get(pin.packageName);
+        return !(versions?.size === 1 && versions.has(pin.version));
+    });
+    const effective = unchanged.length === 0;
+    return {
+        ...remedy,
+        applied: {
+            status: run.status,
+            effective,
+            items: run.items,
+            note: effective
+                ? "The lockfile now holds the good version of every pinned package."
+                : `The run finished ${run.status}, but the lockfile does not hold the good version of ${unchanged
+                    .map((pin) => `${pin.packageName}@${pin.version}`)
+                    .join(", ")}. The package manager may be ignoring the override it was given (pnpm 11 and later read overrides from pnpm-workspace.yaml, not package.json); roll the run back with \`autoremediator runs rollback ${runId}\` or pin it by hand.`,
+        },
+    };
+}
+//# sourceMappingURL=remedy.js.map

package/dist/api/bisect/remedy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remedy.js","sourceRoot":"","sources":["../../../src/api/bisect/remedy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAqB,MAAM,cAAc,CAAC;AAgBxE,SAAS,UAAU,CAAC,GAAW,EAAE,QAAgB;IAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACjC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACxC,OAAO,yBAAyB,CAAC,QAAQ,EAAE,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,IAAI,CAAC;QACH,OAAO,qBAAqB,CAC1B,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAiB,CAC5E,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,GAAG,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,OAAsB;IACrD,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,UAAU,GAA+B,EAAE,CAAC;IAClD,MAAM,OAAO,GAAkB,EAAE,CAAC;IAElC,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACvC,MAAM,QAAQ,GAAG,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,UAAU,CAAC,IAAI,CAAC;gBACd,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,MAAM,EAAE,GAAG,OAAO,CAAC,QAAQ,sBAAsB,OAAO,CAAC,GAAG,EAAE;aAC/D,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7C,UAAU,CAAC,IAAI,CAAC;gBACd,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,MAAM,EAAE,QAAQ,EAAE,IAAI;oBACpB,CAAC,CAAC,0BAA0B,CAAC,GAAG,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,OAAO,CAAC,SAAS,EAAE;oBAC3F,CAAC,CAAC,6CAA6C;aAClD,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC;YACxE,OAAO,CAAC,IAAI,CAAC;gBACX,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,QAAQ,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU;gBAC1D,WAAW,EAAE,OAAO,CAAC,SAAS;gBAC9B,SAAS,EAAE,OAAO,CAAC,WAAW;gBAC9B,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,IAAI;gBACZ,eAAe,EAAE,KAAK;gBACtB,OAAO,EAAE,OAAO,OAAO,CAAC,WAAW,YAAY,OAAO,CAAC,WAAW,KAAK,OAAO,CAAC,SAAS,aAAa,OAAO,CAAC,OAAO,KAAK;aAC1H,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACpC,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,OAAO,EAAE,MAAM,CAAC,SAAS,IAAI,EAAE;QAC/B,QAAQ,EAAE,MAAM,CAAC,QAAuC;KACzD,CAAC,CAAC,CAAC;IACJ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC;IAExE,MAAM,KAAK,GAAG,UAAU,MAAM,CAAC,GAAG,OAAO,CAAC,UAAU,KAAK,OAAO,CAAC,SAAS,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;IAChH,MAAM,MAAM,GAAsB;QAChC,KAAK;QACL,UAAU,EAAE,IAAI;QAChB,kBAAkB,EAAE,EAAE;QACtB,OAAO;QACP,OAAO,EAAE,mBAAmB,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,OAAO;aAC3G,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;aAC5D,IAAI,CAAC,IAAI,CAAC,GAAG;KACjB,CAAC;IACF,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,WAAW,CACzC,MAAM,EACN,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,EAC5D,OAAO,CAAC,GAAG,CACZ,CAAC;IAEF,MAAM,MAAM,GAAiB;QAC3B,IAAI;QACJ,KAAK;QACL,MAAM;QACN,YAAY,EAAE;YACZ,4BAA4B,KAAK,EAAE;YACnC,6BAA6B,KAAK,EAAE;YACpC,gCAAgC,KAAK,EAAE;SACxC;QACD,UAAU;KACX,CAAC;IACF,IAAI,CAAC,OAAO,CAAC,KAAK;QAAE,OAAO,MAAM,CAAC;IAElC,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,IAAI,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;IAClF,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IACxD,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;QACpC,MAAM,QAAQ,GAAG,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC7C,OAAO,CAAC,CAAC,QAAQ,EAAE,IAAI,KAAK,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC;IACzC,OAAO;QACL,GAAG,MAAM;QACT,OAAO,EAAE;YACP,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,SAAS;YACT,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,IAAI,EAAE,SAAS;gBACb,CAAC,CAAC,kEAAkE;gBACpE,CAAC,CAAC,oBAAoB,GAAG,CAAC,MAAM,wDAAwD,SAAS;qBAC5F,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;qBACjD,IAAI,CACH,IAAI,CACL,wMAAwM,KAAK,uBAAuB;SAC5O;KACF,CAAC;AACJ,CAAC"}

package/dist/api/bisect/shell.d.ts

@@ -0,0 +1,41 @@
+export interface ProcessResult {
+    /** `null` when the process was killed by a signal. */
+    exitCode: number | null;
+    timedOut: boolean;
+    aborted: boolean;
+    durationMs: number;
+    /** Interleaved stdout and stderr; only the end is kept when it is long. */
+    output: string;
+}
+export interface ProcessSpec {
+    /** A program and its arguments, run without a shell. */
+    argv?: readonly string[];
+    /** A shell command line, run by `/bin/sh -c` (`cmd.exe` on Windows). */
+    shell?: string;
+    cwd: string;
+    env?: NodeJS.ProcessEnv;
+    timeoutMs: number;
+    signal?: AbortSignal;
+    /** How much output to keep, counted from the end (default 256 KiB). */
+    keepBytes?: number;
+}
+/**
+ * Run a process to completion in its own process group, so a timeout or Ctrl-C ends the whole tree
+ * (the shell, the test runner, whatever it spawned) and nothing keeps running in a checkout that is
+ * about to be deleted. Never rejects: failing to start is reported as exit code 127.
+ */
+export declare function runProcess(spec: ProcessSpec): Promise<ProcessResult>;
+export interface SanitizeOptions {
+    /** Paths to show as `<name>` instead of their real value. */
+    paths?: ReadonlyArray<[path: string, label: string]>;
+    env?: NodeJS.ProcessEnv;
+    /** Keep this many characters from the end (default 1500). */
+    maxChars?: number;
+}
+/**
+ * Make command output safe to put in a report: no terminal escapes, no credentials (known token
+ * shapes, and the value of any secret-looking environment variable), no home directory or checkout
+ * paths, and only the end of it.
+ */
+export declare function sanitizeOutput(text: string, options?: SanitizeOptions): string;
+//# sourceMappingURL=shell.d.ts.map

package/dist/api/bisect/shell.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell.d.ts","sourceRoot":"","sources":["../../../src/api/bisect/shell.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,aAAa;IAC5B,sDAAsD;IACtD,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,2EAA2E;IAC3E,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,WAAW;IAC1B,wDAAwD;IACxD,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,wEAAwE;IACxE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,uEAAuE;IACvE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAID;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,aAAa,CAAC,CA6FpE;AAqBD,MAAM,WAAW,eAAe;IAC9B,6DAA6D;IAC7D,KAAK,CAAC,EAAE,aAAa,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;IACrD,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,eAAoB,GAAG,MAAM,CA0BlF"}

package/dist/api/bisect/shell.js

@@ -0,0 +1,155 @@
+import { spawn } from "node:child_process";
+import { homedir } from "node:os";
+import { sanitizeEnvironment } from "../../platform/safe-exec.js";
+const GRACE_MS = 2000;
+/**
+ * Run a process to completion in its own process group, so a timeout or Ctrl-C ends the whole tree
+ * (the shell, the test runner, whatever it spawned) and nothing keeps running in a checkout that is
+ * about to be deleted. Never rejects: failing to start is reported as exit code 127.
+ */
+export function runProcess(spec) {
+    const keep = spec.keepBytes ?? 256 * 1024;
+    const started = Date.now();
+    const env = sanitizeEnvironment(spec.env ?? process.env);
+    const windows = process.platform === "win32";
+    return new Promise((resolve) => {
+        let output = "";
+        let timedOut = false;
+        let aborted = false;
+        let settled = false;
+        const timers = {};
+        const finish = (exitCode) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timers.timeout);
+            clearTimeout(timers.kill);
+            spec.signal?.removeEventListener("abort", onAbort);
+            resolve({ exitCode, timedOut, aborted, durationMs: Date.now() - started, output });
+        };
+        let child;
+        try {
+            if (spec.shell !== undefined) {
+                child = spawn(spec.shell, {
+                    cwd: spec.cwd,
+                    env,
+                    shell: true,
+                    detached: !windows,
+                    stdio: ["ignore", "pipe", "pipe"],
+                });
+            }
+            else {
+                const [file, ...args] = spec.argv ?? [];
+                if (!file)
+                    throw new Error("empty command");
+                child = spawn(file, args, {
+                    cwd: spec.cwd,
+                    env,
+                    detached: !windows,
+                    stdio: ["ignore", "pipe", "pipe"],
+                });
+            }
+        }
+        catch (error) {
+            output = `could not start: ${error instanceof Error ? error.message : String(error)}`;
+            resolve({ exitCode: 127, timedOut: false, aborted: false, durationMs: 0, output });
+            return;
+        }
+        const append = (chunk) => {
+            output += chunk.toString("utf8");
+            if (output.length > keep * 2)
+                output = output.slice(-keep);
+        };
+        child.stdout.on("data", append);
+        child.stderr.on("data", append);
+        const killTree = (signalName) => {
+            try {
+                if (windows || child.pid === undefined)
+                    child.kill(signalName);
+                else
+                    process.kill(-child.pid, signalName);
+            }
+            catch {
+                // Already gone.
+            }
+        };
+        const stop = () => {
+            killTree("SIGTERM");
+            timers.kill = setTimeout(() => {
+                killTree("SIGKILL");
+                // Descendants may hold the pipes open after the group is killed.
+                setTimeout(() => finish(null), 500).unref();
+            }, GRACE_MS);
+        };
+        timers.timeout = setTimeout(() => {
+            timedOut = true;
+            stop();
+        }, spec.timeoutMs);
+        const onAbort = () => {
+            aborted = true;
+            stop();
+        };
+        if (spec.signal?.aborted)
+            onAbort();
+        else
+            spec.signal?.addEventListener("abort", onAbort, { once: true });
+        child.on("error", (error) => {
+            output += `\ncould not start: ${error.message}`;
+            finish(127);
+        });
+        child.on("close", (code) => {
+            // A process that ended after its group was signalled still leaves orphans behind sometimes.
+            if (timedOut || aborted)
+                killTree("SIGKILL");
+            finish(code);
+        });
+    });
+}
+// ---------------------------------------------------------------------------
+// Output that goes into a report
+// ---------------------------------------------------------------------------
+const ANSI = new RegExp(`${String.fromCodePoint(27)}\\[[0-9;?]*[ -/]*[@-~]`, "g");
+const SECRET_NAME = /(TOKEN|SECRET|PASSWORD|PASSWD|API[_-]?KEY|AUTH|CREDENTIAL|PRIVATE)/i;
+const SECRET_PATTERNS = [
+    /npm_[A-Za-z0-9]{20,}/g,
+    /gh[pousr]_[A-Za-z0-9]{20,}/g,
+    /github_pat_[A-Za-z0-9_]{20,}/g,
+    /glpat-[A-Za-z0-9_-]{16,}/g,
+    /AKIA[0-9A-Z]{16}/g,
+    /sk-[A-Za-z0-9_-]{20,}/g,
+    /xox[abprs]-[A-Za-z0-9-]{10,}/g,
+    /(_authToken|_auth|_password)=[^\s'"]+/gi,
+    /Bearer\s+[A-Za-z0-9._~+/=-]{12,}/g,
+    /(?<=:\/\/)[^\s/@:]+:[^\s/@]+(?=@)/g,
+];
+/**
+ * Make command output safe to put in a report: no terminal escapes, no credentials (known token
+ * shapes, and the value of any secret-looking environment variable), no home directory or checkout
+ * paths, and only the end of it.
+ */
+export function sanitizeOutput(text, options = {}) {
+    let result = text.replaceAll(ANSI, "").replaceAll("\r\n", "\n").replaceAll("\r", "\n");
+    const env = options.env ?? process.env;
+    const secrets = Object.entries(env)
+        .filter(([name, value]) => SECRET_NAME.test(name) && typeof value === "string" && value.length >= 8)
+        .map(([, value]) => value)
+        .toSorted((a, b) => b.length - a.length);
+    for (const secret of secrets)
+        result = result.replaceAll(secret, "[redacted]");
+    for (const pattern of SECRET_PATTERNS)
+        result = result.replaceAll(pattern, "[redacted]");
+    const paths = [...(options.paths ?? []), [homedir(), "~"]]
+        .filter(([path]) => path.length > 1)
+        .toSorted((a, b) => b[0].length - a[0].length);
+    for (const [path, label] of paths)
+        result = result.replaceAll(path, label);
+    const max = options.maxChars ?? 1500;
+    result = result.trimEnd().replace(/^\n+/, "");
+    if (result.length > max) {
+        const tail = result.slice(-max);
+        const cut = tail.indexOf("\n");
+        result = `...${cut !== -1 && cut < 200 ? tail.slice(cut) : tail}`;
+    }
+    return result;
+}
+//# sourceMappingURL=shell.js.map

package/dist/api/bisect/shell.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell.js","sourceRoot":"","sources":["../../../src/api/bisect/shell.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAElC,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAyBlE,MAAM,QAAQ,GAAG,IAAI,CAAC;AAEtB;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,IAAiB;IAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,IAAI,GAAG,GAAG,IAAI,CAAC;IAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,mBAAmB,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC;IACzD,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC;IAE7C,OAAO,IAAI,OAAO,CAAgB,CAAC,OAAO,EAAE,EAAE;QAC5C,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAwD,EAAE,CAAC;QAEvE,MAAM,MAAM,GAAG,CAAC,QAAuB,EAAE,EAAE;YACzC,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC7B,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC1B,IAAI,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACnD,OAAO,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QACrF,CAAC,CAAC;QAEF,IAAI,KAAK,CAAC;QACV,IAAI,CAAC;YACH,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBAC7B,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE;oBACxB,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,GAAG;oBACH,KAAK,EAAE,IAAI;oBACX,QAAQ,EAAE,CAAC,OAAO;oBAClB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;iBAClC,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;gBACxC,IAAI,CAAC,IAAI;oBAAE,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;gBAC5C,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE;oBACxB,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,GAAG;oBACH,QAAQ,EAAE,CAAC,OAAO;oBAClB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;iBAClC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,GAAG,oBAAoB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YACtF,OAAO,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;YACnF,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,EAAE;YAC/B,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACjC,IAAI,MAAM,CAAC,MAAM,GAAG,IAAI,GAAG,CAAC;gBAAE,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC;QAC7D,CAAC,CAAC;QACF,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAChC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAEhC,MAAM,QAAQ,GAAG,CAAC,UAA0B,EAAE,EAAE;YAC9C,IAAI,CAAC;gBACH,IAAI,OAAO,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS;oBAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;;oBAC1D,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;YAC5C,CAAC;YAAC,MAAM,CAAC;gBACP,gBAAgB;YAClB,CAAC;QACH,CAAC,CAAC;QACF,MAAM,IAAI,GAAG,GAAG,EAAE;YAChB,QAAQ,CAAC,SAAS,CAAC,CAAC;YACpB,MAAM,CAAC,IAAI,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,QAAQ,CAAC,SAAS,CAAC,CAAC;gBACpB,iEAAiE;gBACjE,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC;YAC9C,CAAC,EAAE,QAAQ,CAAC,CAAC;QACf,CAAC,CAAC;QAEF,MAAM,CAAC,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;YAC/B,QAAQ,GAAG,IAAI,CAAC;YAChB,IAAI,EAAE,CAAC;QACT,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACnB,MAAM,OAAO,GAAG,GAAG,EAAE;YACnB,OAAO,GAAG,IAAI,CAAC;YACf,IAAI,EAAE,CAAC;QACT,CAAC,CAAC;QACF,IAAI,IAAI,CAAC,MAAM,EAAE,OAAO;YAAE,OAAO,EAAE,CAAC;;YAC/B,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAErE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC1B,MAAM,IAAI,sBAAsB,KAAK,CAAC,OAAO,EAAE,CAAC;YAChD,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,4FAA4F;YAC5F,IAAI,QAAQ,IAAI,OAAO;gBAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;YAC7C,MAAM,CAAC,IAAI,CAAC,CAAC;QACf,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,iCAAiC;AACjC,8EAA8E;AAE9E,MAAM,IAAI,GAAG,IAAI,MAAM,CAAC,GAAG,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC;AAClF,MAAM,WAAW,GAAG,qEAAqE,CAAC;AAC1F,MAAM,eAAe,GAAa;IAChC,uBAAuB;IACvB,6BAA6B;IAC7B,+BAA+B;IAC/B,2BAA2B;IAC3B,mBAAmB;IACnB,wBAAwB;IACxB,+BAA+B;IAC/B,yCAAyC;IACzC,mCAAmC;IACnC,oCAAoC;CACrC,CAAC;AAUF;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,OAAO,GAAoB,EAAE;IACxE,IAAI,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAEvF,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;SAChC,MAAM,CACL,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,CAC5F;SACA,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAM,CAAC;SAC1B,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IAC3C,KAAK,MAAM,MAAM,IAAI,OAAO;QAAE,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAC/E,KAAK,MAAM,OAAO,IAAI,eAAe;QAAE,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAEzF,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,GAAG,CAAqB,CAAC;SAC3E,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;SACnC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACjD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,KAAK;QAAE,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAE3E,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC;IACrC,MAAM,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9C,IAAI,MAAM,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,GAAG,MAAM,GAAG,KAAK,CAAC,CAAC,IAAI,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACpE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/api/bisect/types.d.ts

@@ -0,0 +1,130 @@
+import type { PackageManager } from "../../platform/types.js";
+import type { ItemOutcome } from "../runs/index.js";
+export interface BisectOptions {
+    /** Project directory (default: process.cwd()). A subdirectory of a git repository is fine. */
+    cwd?: string;
+    /** Git ref (commit, tag, branch) where the command passes. */
+    good: string;
+    /** Git ref where the command fails (default: HEAD). Committed state is used, not the working tree. */
+    bad?: string;
+    /**
+     * Shell command to run after installing, in a checkout of the project. It runs with your
+     * privileges, exactly as if you ran it yourself; exit code 0 means pass.
+     */
+    command: string;
+    /** Kill the command after this many seconds and count it as failing (default: 600). */
+    timeoutSeconds?: number;
+    /** Evaluate at most this many candidate states, not counting the good and bad refs (default: 30). */
+    maxSteps?: number;
+    /** Package manager (default: from the lockfile). npm and pnpm are supported; yarn classic is not exercised. */
+    packageManager?: PackageManager;
+    /** Pass `--ignore-scripts` to every install, so package install scripts do not run. */
+    ignoreScripts?: boolean;
+    /** Apply the recommended pin to the project through the run machinery instead of only planning it. */
+    apply?: boolean;
+    /** SDK only: stop the search (Ctrl-C). Checkouts are removed and the report so far is returned. */
+    signal?: AbortSignal;
+}
+/** One package whose locked version differs between the two refs. */
+export interface BisectedPackage {
+    packageName: string;
+    /** Version at the good ref. */
+    fromVersion: string;
+    /** Version at the bad ref. */
+    toVersion: string;
+    dependencyScope: "direct" | "transitive";
+}
+/** A lockfile change that cannot be tried one package at a time, with why. */
+export interface BisectSkippedChange {
+    packageName: string;
+    fromVersions: string[];
+    toVersions: string[];
+    reason: string;
+}
+export type BisectStepKind = "good-ref" | "bad-ref" | "all-updates" | "subset" | "without-culprit";
+export interface BisectCommandRecord {
+    /** What was run, as a display string. */
+    command: string;
+    exitCode: number | null;
+    durationMs: number;
+    timedOut: boolean;
+}
+export interface BisectStep {
+    step: number;
+    kind: BisectStepKind;
+    /** Packages held at their bad-ref version in this state (every other changed package is at its good-ref version). */
+    updated: string[];
+    /** `pass`: install and command succeeded. `fail`: either failed. `unresolved`: the state could not be built as intended. */
+    outcome: "pass" | "fail" | "unresolved";
+    /** Which stage ended the step. */
+    phase: "install" | "pins" | "command";
+    install?: BisectCommandRecord;
+    run?: BisectCommandRecord;
+    /** End of the output of the stage that ended the step; secrets removed, paths shortened. */
+    outputTail: string;
+    note?: string;
+}
+export interface BisectRemedy {
+    /** What to pin and to which version: the good-ref version of each culprit. */
+    pins: Array<{
+        packageName: string;
+        version: string;
+        strategy: "version-bump" | "override";
+    }>;
+    /** The run holding the plan; apply it with `autoremediator runs apply <runId>`. */
+    runId?: string;
+    planId?: string;
+    nextCommands: string[];
+    /** Pins that could not be planned, with why (for example the working tree does not hold the bad version). */
+    notPlanned: Array<{
+        packageName: string;
+        reason: string;
+    }>;
+    /** Present with `apply`: what happened. */
+    applied?: {
+        status: string;
+        /** True when the lockfile afterwards holds the good version of every pinned culprit. */
+        effective: boolean;
+        items: ItemOutcome[];
+        note: string;
+    };
+}
+export type BisectStatus = "culprit" | "culprit-set" | "not-reproducible" | "not-attributable" | "no-changes" | "incomplete";
+export interface BisectReport {
+    schemaVersion: "1";
+    status: BisectStatus;
+    summary: string;
+    good: {
+        ref: string;
+        commit: string;
+    };
+    bad: {
+        ref: string;
+        commit: string;
+    };
+    packageManager: PackageManager;
+    /** Lockfile compared, relative to the project directory. */
+    lockfile: string;
+    command: string;
+    /** Packages whose version changed and that were tried one by one. */
+    updates: BisectedPackage[];
+    /** Lockfile changes that were not tried one by one (added, removed, several versions). */
+    skipped: BisectSkippedChange[];
+    /** The packages whose bad-ref versions make the command fail: one, or a set that fails only together. */
+    culprits: BisectedPackage[];
+    /**
+     * True when every update except the culprits' is applied and the command passes: holding the
+     * culprits back is enough. False means something else breaks the command too. Absent when not checked.
+     */
+    holdingBackFixes?: boolean;
+    steps: BisectStep[];
+    /** Candidate states evaluated, not counting the good and bad refs. */
+    stepsUsed: number;
+    maxSteps: number;
+    stopped?: "max-steps" | "interrupted";
+    remedy?: BisectRemedy;
+    warnings: string[];
+    startedAt: string;
+    durationMs: number;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/api/bisect/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/api/bisect/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEpD,MAAM,WAAW,aAAa;IAC5B,8FAA8F;IAC9F,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAC;IACb,sGAAsG;IACtG,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB,uFAAuF;IACvF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,qGAAqG;IACrG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+GAA+G;IAC/G,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,uFAAuF;IACvF,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,sGAAsG;IACtG,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,mGAAmG;IACnG,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,qEAAqE;AACrE,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,+BAA+B;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,8BAA8B;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,QAAQ,GAAG,YAAY,CAAC;CAC1C;AAED,8EAA8E;AAC9E,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,SAAS,GAAG,aAAa,GAAG,QAAQ,GAAG,iBAAiB,CAAC;AAEnG,MAAM,WAAW,mBAAmB;IAClC,yCAAyC;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,cAAc,CAAC;IACrB,qHAAqH;IACrH,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,4HAA4H;IAC5H,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,YAAY,CAAC;IACxC,kCAAkC;IAClC,KAAK,EAAE,SAAS,GAAG,MAAM,GAAG,SAAS,CAAC;IACtC,OAAO,CAAC,EAAE,mBAAmB,CAAC;IAC9B,GAAG,CAAC,EAAE,mBAAmB,CAAC;IAC1B,4FAA4F;IAC5F,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,YAAY;IAC3B,8EAA8E;IAC9E,IAAI,EAAE,KAAK,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,cAAc,GAAG,UAAU,CAAA;KAAE,CAAC,CAAC;IAC7F,mFAAmF;IACnF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,6GAA6G;IAC7G,UAAU,EAAE,KAAK,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC3D,2CAA2C;IAC3C,OAAO,CAAC,EAAE;QACR,MAAM,EAAE,MAAM,CAAC;QACf,wFAAwF;QACxF,SAAS,EAAE,OAAO,CAAC;QACnB,KAAK,EAAE,WAAW,EAAE,CAAC;QACrB,IAAI,EAAE,MAAM,CAAC;KACd,CAAC;CACH;AAED,MAAM,MAAM,YAAY,GACpB,SAAS,GACT,aAAa,GACb,kBAAkB,GAClB,kBAAkB,GAClB,YAAY,GACZ,YAAY,CAAC;AAEjB,MAAM,WAAW,YAAY;IAC3B,aAAa,EAAE,GAAG,CAAC;IACnB,MAAM,EAAE,YAAY,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACtC,GAAG,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACrC,cAAc,EAAE,cAAc,CAAC;IAC/B,4DAA4D;IAC5D,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,qEAAqE;IACrE,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,0FAA0F;IAC1F,OAAO,EAAE,mBAAmB,EAAE,CAAC;IAC/B,yGAAyG;IACzG,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B;;;OAGG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,sEAAsE;IACtE,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,WAAW,GAAG,aAAa,CAAC;IACtC,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB"}

package/dist/api/bisect/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/api/bisect/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/api/bisect/types.ts"],"names":[],"mappings":""}

package/dist/api/change-request/branch.d.ts

@@ -0,0 +1,13 @@
+import type { RemediationReport } from "../../platform/types.js";
+/**
+ * The branch for a group of reports. It depends only on which CVEs and packages the group covers,
+ * so running again for the same findings updates the same branch (and so the same pull request)
+ * instead of opening a duplicate. One CVE in one package reads as `<prefix>/<cve>-<package>`;
+ * anything larger is named by its first CVE and a short hash of the whole set.
+ */
+export declare function deterministicBranchName(prefix: string, cveIds: readonly string[], packageNames: readonly string[]): string;
+/** Trailers appended to the commit message so history says which advisory, run and checks a commit came from. */
+export declare function commitTrailers(reports: readonly RemediationReport[]): string[];
+/** Commit message: the title, a blank line, then trailers. */
+export declare function commitMessage(title: string, reports: readonly RemediationReport[]): string;
+//# sourceMappingURL=branch.d.ts.map

package/dist/api/change-request/branch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"branch.d.ts","sourceRoot":"","sources":["../../../src/api/change-request/branch.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAmBjE;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,SAAS,MAAM,EAAE,EACzB,YAAY,EAAE,SAAS,MAAM,EAAE,GAC9B,MAAM,CAkBR;AAED,iHAAiH;AACjH,wBAAgB,cAAc,CAAC,OAAO,EAAE,SAAS,iBAAiB,EAAE,GAAG,MAAM,EAAE,CAiC9E;AAED,8DAA8D;AAC9D,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,iBAAiB,EAAE,GAAG,MAAM,CAG1F"}

package/dist/api/change-request/branch.js

@@ -0,0 +1,78 @@
+import { createHash } from "node:crypto";
+import { trimChar } from "../../platform/trim.js";
+/** Make text safe as part of a git ref: no `..`, no leading dots, no `.lock` endings, no odd characters. */
+function refSafe(value, allowSlash) {
+    const pattern = allowSlash ? /[^a-z0-9._/-]+/g : /[^a-z0-9._-]+/g;
+    return value
+        .toLowerCase()
+        .replaceAll(pattern, "-")
+        .replaceAll(/\.{2,}/g, ".")
+        .split("/")
+        .map((segment) => trimChar(trimChar(segment, "-"), ".").replace(/\.lock$/, ""))
+        .filter(Boolean)
+        .join("/");
+}
+function token(value, max = 60) {
+    return refSafe(value, false).slice(0, max);
+}
+/**
+ * The branch for a group of reports. It depends only on which CVEs and packages the group covers,
+ * so running again for the same findings updates the same branch (and so the same pull request)
+ * instead of opening a duplicate. One CVE in one package reads as `<prefix>/<cve>-<package>`;
+ * anything larger is named by its first CVE and a short hash of the whole set.
+ */
+export function deterministicBranchName(prefix, cveIds, packageNames) {
+    const cves = [...new Set(cveIds.map((id) => id.toUpperCase()))].toSorted();
+    const packages = [...new Set(packageNames)].toSorted();
+    const safePrefix = refSafe(prefix, true).slice(0, 80) || "autoremediator";
+    let name;
+    if (cves.length === 1 && packages.length <= 1) {
+        name = [token(cves[0]), packages[0] ? token(packages[0].replaceAll("/", "-")) : ""]
+            .filter(Boolean)
+            .join("-");
+    }
+    else {
+        const digest = createHash("sha256")
+            .update(JSON.stringify([cves, packages]))
+            .digest("hex")
+            .slice(0, 8);
+        name = `${token(cves[0] ?? "remediation", 40)}-and-${Math.max(cves.length - 1, 0) + packages.length}-more-${digest}`;
+    }
+    return `${safePrefix}/${name || "remediation"}`;
+}
+/** Trailers appended to the commit message so history says which advisory, run and checks a commit came from. */
+export function commitTrailers(reports) {
+    const trailers = [];
+    const cveIds = [...new Set(reports.map((report) => report.cveId.toUpperCase()))].toSorted();
+    // A freshness step fixes no advisory; its pseudo id names the branch. It still gets a trailer of
+    // its own, so a re-run can tell the commit is ours.
+    for (const id of cveIds) {
+        trailers.push(id.startsWith("FRESHNESS-") ? `Autoremediator-Change: ${id}` : `Fixes-CVE: ${id}`);
+    }
+    const runIds = [
+        ...new Set(reports.map((report) => report.runId).filter((id) => Boolean(id))),
+    ];
+    for (const id of runIds)
+        trailers.push(`Autoremediator-Run: ${id}`);
+    // Claim verification only for phases that actually ran and passed in every applied result.
+    const applied = reports.flatMap((report) => report.results).filter((result) => result.applied);
+    const phaseSets = applied.map((result) => result.validationPhases ?? []);
+    if (phaseSets.length > 0 &&
+        phaseSets.every((phases) => phases.length > 0 && phases.every((phase) => phase.passed))) {
+        let common = new Set(phaseSets[0].map((phase) => phase.phase));
+        for (const phases of phaseSets.slice(1)) {
+            const names = new Set(phases.map((phase) => phase.phase));
+            common = new Set([...common].filter((phase) => names.has(phase)));
+        }
+        if (common.size > 0) {
+            trailers.push(`Verified-By: autoremediator (${[...common].toSorted().join(", ")})`);
+        }
+    }
+    return trailers;
+}
+/** Commit message: the title, a blank line, then trailers. */
+export function commitMessage(title, reports) {
+    const trailers = commitTrailers(reports);
+    return trailers.length > 0 ? `${title}\n\n${trailers.join("\n")}` : title;
+}
+//# sourceMappingURL=branch.js.map

package/dist/api/change-request/branch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"branch.js","sourceRoot":"","sources":["../../../src/api/change-request/branch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAGlD,4GAA4G;AAC5G,SAAS,OAAO,CAAC,KAAa,EAAE,UAAmB;IACjD,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,gBAAgB,CAAC;IAClE,OAAO,KAAK;SACT,WAAW,EAAE;SACb,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC;SACxB,UAAU,CAAC,SAAS,EAAE,GAAG,CAAC;SAC1B,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;SAC9E,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,SAAS,KAAK,CAAC,KAAa,EAAE,GAAG,GAAG,EAAE;IACpC,OAAO,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAc,EACd,MAAyB,EACzB,YAA+B;IAE/B,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC3E,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACvD,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,gBAAgB,CAAC;IAE1E,IAAI,IAAY,CAAC;IACjB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QAC9C,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aACjF,MAAM,CAAC,OAAO,CAAC;aACf,IAAI,CAAC,GAAG,CAAC,CAAC;IACf,CAAC;SAAM,CAAC;QACN,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC;aAChC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;aACxC,MAAM,CAAC,KAAK,CAAC;aACb,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACf,IAAI,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,aAAa,EAAE,EAAE,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,QAAQ,CAAC,MAAM,SAAS,MAAM,EAAE,CAAC;IACvH,CAAC;IACD,OAAO,GAAG,UAAU,IAAI,IAAI,IAAI,aAAa,EAAE,CAAC;AAClD,CAAC;AAED,iHAAiH;AACjH,MAAM,UAAU,cAAc,CAAC,OAAqC;IAClE,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC5F,iGAAiG;IACjG,oDAAoD;IACpD,KAAK,MAAM,EAAE,IAAI,MAAM,EAAE,CAAC;QACxB,QAAQ,CAAC,IAAI,CACX,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,0BAA0B,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,EAAE,EAAE,CAClF,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG;QACb,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;KAC5F,CAAC;IACF,KAAK,MAAM,EAAE,IAAI,MAAM;QAAE,QAAQ,CAAC,IAAI,CAAC,uBAAuB,EAAE,EAAE,CAAC,CAAC;IAEpE,2FAA2F;IAC3F,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC/F,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC;IACzE,IACE,SAAS,CAAC,MAAM,GAAG,CAAC;QACpB,SAAS,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EACvF,CAAC;QACD,IAAI,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,CAAE,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QAChE,KAAK,MAAM,MAAM,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;YAC1D,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACpE,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YACpB,QAAQ,CAAC,IAAI,CAAC,gCAAgC,CAAC,GAAG,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtF,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,aAAa,CAAC,KAAa,EAAE,OAAqC;IAChF,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACzC,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;AAC5E,CAAC"}