baro-ai 0.125.0 → 0.126.0

package/dist/cli.mjs

@@ -70955,8 +70955,8 @@ async function getCurrentBranch(cwd) {
 }
 async function ensureGreenfieldRepo(cwd, onLog) {
   if (await isInsideGitRepo(cwd)) return false;
-  const { readdir } = await import("fs/promises");
-  const entries = (await readdir(cwd)).filter(
+  const { readdir: readdir2 } = await import("fs/promises");
+  const entries = (await readdir2(cwd)).filter(
     (name) => name !== ".DS_Store" && name !== "Thumbs.db" && // baro's own pre-branch artifacts don't make a directory a project.
     name !== "prd.json" && name !== "baro.lock" && name !== ".baro"
   );
@@ -90624,10 +90624,12 @@ function extractVerdictJson(text3) {
 }
 
 // ../baro-orchestrator/src/acceptance/critic-evidence.ts
+import { execFile as execFile4 } from "child_process";
 import { createHash as createHash18 } from "crypto";
 import { constants as constants2 } from "fs";
-import { lstat as lstat2, open as open2, readlink, realpath } from "fs/promises";
+import { lstat as lstat2, open as open2, readdir, readlink, realpath } from "fs/promises";
 import { isAbsolute as isAbsolute6, relative as relative7, resolve as resolve11, sep as sep4 } from "path";
+import { promisify as promisify2 } from "util";
 
 // ../baro-orchestrator/src/runtime/participant-identity.ts
 function participantAgentId(source) {
@@ -90794,6 +90796,110 @@ async function readLineCount(cwd, path7) {
   return countLines(await readFile(target, "utf8"));
 }
 
+// ../baro-orchestrator/src/acceptance/content-preserving-command.ts
+var NOT_PRESERVING = { preserving: false, commits: false };
+var READ_ONLY = /* @__PURE__ */ new Set([
+  "cd",
+  "pwd",
+  "ls",
+  "cat",
+  "head",
+  "tail",
+  "wc",
+  "grep",
+  "egrep",
+  "fgrep",
+  "rg",
+  "echo",
+  "printf",
+  "true",
+  "test",
+  "[",
+  "stat",
+  "which",
+  "type",
+  "diff",
+  "cmp",
+  "cut",
+  "tr",
+  "basename",
+  "dirname",
+  "realpath",
+  "printenv",
+  "sleep",
+  "jq"
+]);
+var GIT_READ_ONLY = /* @__PURE__ */ new Set([
+  "status",
+  "diff",
+  "log",
+  "show",
+  "rev-parse",
+  "ls-files",
+  "ls-tree",
+  "cat-file",
+  "blame",
+  "grep",
+  "describe",
+  "shortlog",
+  "merge-base",
+  "rev-list",
+  "name-rev"
+]);
+var GIT_INDEX_ONLY = /* @__PURE__ */ new Set(["add"]);
+var SHELL_WRAPPER = /^(?:\/(?:usr\/)?bin\/)?(?:ba|z)?sh\s+-l?c\s+(['"])([\s\S]*)\1\s*$/u;
+var HARMLESS_REDIRECT = /\s*(?:\d?>\s*\/dev\/null|\d>&\d)/gu;
+var HEREDOC_MESSAGE = /"\$\(cat <<-?\s*(['"])(\w+)\1\n[\s\S]*?\n\s*\2\s*\)"/gu;
+var SINGLE_QUOTED = /'[^']*'/gu;
+var DOUBLE_QUOTED = /"(?:[^"\\$`]|\\.)*"/gu;
+var UNSAFE = /[<>`$"']|\b(?:xargs|tee)\b/u;
+var UNSAFE_OPTION = /^(?:--output|--pre\b|-O$|--open-files-in-pager|--ext-diff)/u;
+function contentPreservingCommand(command) {
+  let script = command.trim();
+  const wrapped = SHELL_WRAPPER.exec(script);
+  if (wrapped) script = wrapped[2].trim();
+  script = script.replace(HEREDOC_MESSAGE, "MSG").replace(SINGLE_QUOTED, "Q").replace(DOUBLE_QUOTED, "Q").replace(HARMLESS_REDIRECT, "");
+  if (script === "" || UNSAFE.test(script)) return NOT_PRESERVING;
+  let commits = false;
+  for (const segment of script.split(/&&|\|\||[;|\n]/u)) {
+    const words = segment.trim().split(/\s+/u).filter(Boolean);
+    if (words.length === 0) continue;
+    const [program, ...rest] = words;
+    if (rest.some((w) => UNSAFE_OPTION.test(w))) return NOT_PRESERVING;
+    if (program === "git") {
+      const sub = gitSubcommand(rest);
+      if (sub === null) return NOT_PRESERVING;
+      if (sub === "commit") {
+        commits = true;
+        continue;
+      }
+      if (GIT_READ_ONLY.has(sub) || GIT_INDEX_ONLY.has(sub)) continue;
+      return NOT_PRESERVING;
+    }
+    if (program === "sed") {
+      if (rest.some((w) => /^-[a-zA-Z]*i/u.test(w) || w.startsWith("--in-place"))) return NOT_PRESERVING;
+      if (!rest.includes("-n")) return NOT_PRESERVING;
+      continue;
+    }
+    if (program === "find") {
+      if (rest.some((w) => /^-(?:delete|exec|execdir|ok|okdir|fprint|fprintf|fls)$/u.test(w))) return NOT_PRESERVING;
+      continue;
+    }
+    if (!READ_ONLY.has(program)) return NOT_PRESERVING;
+  }
+  return { preserving: true, commits };
+}
+function gitSubcommand(words) {
+  let i2 = 0;
+  while (i2 < words.length && words[i2].startsWith("-")) {
+    const option = words[i2];
+    if (option === "-C") i2 += 2;
+    else if (option === "--no-pager") i2 += 1;
+    else return null;
+  }
+  return words[i2] ?? null;
+}
+
 // ../baro-orchestrator/src/acceptance/critic-evidence.ts
 var DEFAULT_GIT_TIMEOUT_MS = 1e4;
 var DEFAULT_MAX_DIFF_CHARS = 32e3;
@@ -90871,6 +90977,9 @@ var CriticCommandEvidenceCollector = class extends BusMember {
   pending = /* @__PURE__ */ new Map();
   fingerprintTasks = /* @__PURE__ */ new Map();
   fallbackRevisions = /* @__PURE__ */ new Map();
+  /** What advanced each revision, so a fingerprint raced only by commands
+   * that cannot change content (git add/commit, git status, reads) is kept. */
+  activity = /* @__PURE__ */ new Map();
   onExternalEvent(source, event) {
     if (AgentState.is(event) && this.acceptsSource(source, event.payload.agentId) && event.payload.phase === "running" && (event.payload.detail?.startsWith("attempt ") === true || event.payload.detail === "first turn")) {
       this.resetAttempt(event.payload.agentId);
@@ -90881,7 +90990,7 @@ var CriticCommandEvidenceCollector = class extends BusMember {
     if (!agentId) return;
     if (!this.acceptsSource(source, agentId)) return;
     if (isWorkspaceWriteTool(item.name)) {
-      this.advanceFallbackRevision(agentId);
+      this.advanceFallbackRevision(agentId, { preserving: false, commits: false });
       return;
     }
     if (!isShellTool(item.name)) return;
@@ -90891,7 +91000,7 @@ var CriticCommandEvidenceCollector = class extends BusMember {
       existing.command = redactSensitiveText(extractCommand(item.args));
       return;
     }
-    this.advanceFallbackRevision(agentId);
+    this.advanceFallbackRevision(agentId, contentPreservingCommand(extractCommand(item.args)));
     const entry = {
       callId: item.callId,
       tool: item.name,
@@ -90985,6 +91094,7 @@ var CriticCommandEvidenceCollector = class extends BusMember {
   resetAttempt(agentId) {
     this.commands.delete(agentId);
     this.fallbackRevisions.delete(agentId);
+    this.activity.delete(agentId);
     const prefix = `${agentId}\0`;
     for (const key of this.pending.keys()) {
       if (key.startsWith(prefix)) this.pending.delete(key);
@@ -91021,12 +91131,13 @@ var CriticCommandEvidenceCollector = class extends BusMember {
       return;
     }
     const task = (async () => {
+      const resolved = await target;
       const fingerprint = await this.fingerprintResolvedTarget(
-        await target,
+        resolved,
         fallbackRevision
       );
       const completedRevision = this.fallbackRevisions.get(agentId) ?? 0;
-      entry.fingerprint = completedRevision === fallbackRevision ? fingerprint : {
+      entry.fingerprint = completedRevision === fallbackRevision || await this.onlyContentPreservingSince(agentId, fallbackRevision, completedRevision, resolved) ? fingerprint : {
         state: "unavailable",
         reason: "shell/write activity advanced while the command fingerprint was being captured"
       };
@@ -91075,11 +91186,32 @@ var CriticCommandEvidenceCollector = class extends BusMember {
       };
     }
   }
-  advanceFallbackRevision(agentId) {
-    this.fallbackRevisions.set(
-      agentId,
-      (this.fallbackRevisions.get(agentId) ?? 0) + 1
-    );
+  advanceFallbackRevision(agentId, kind) {
+    const revision = (this.fallbackRevisions.get(agentId) ?? 0) + 1;
+    this.fallbackRevisions.set(agentId, revision);
+    let log2 = this.activity.get(agentId);
+    if (!log2) {
+      log2 = /* @__PURE__ */ new Map();
+      this.activity.set(agentId, log2);
+    }
+    log2.set(revision, kind);
+    for (const old of log2.keys()) {
+      if (old > revision - MAX_ACTIVITY_LOG) break;
+      log2.delete(old);
+    }
+  }
+  /** True when every activity in (from, to] provably left the working tree
+   * as it was, so a fingerprint taken meanwhile still describes the command. */
+  async onlyContentPreservingSince(agentId, from, to, target) {
+    if (!target) return false;
+    const log2 = this.activity.get(agentId);
+    let commits = false;
+    for (let revision = from + 1; revision <= to; revision++) {
+      const kind = log2?.get(revision);
+      if (!kind?.preserving) return false;
+      commits ||= kind.commits;
+    }
+    return !commits || !await hasCommitHooks(target.cwd);
   }
   async drainFingerprintTasks(agentId) {
     while ((this.fingerprintTasks.get(agentId)?.size ?? 0) > 0) {
@@ -91945,6 +92077,24 @@ async function collectRepositoryEvidence(target, opts) {
     renderGitOutput(commits, MAX_LOG_CHARS)
   ].join("\n");
 }
+var MAX_ACTIVITY_LOG = 256;
+var execFileAsync = promisify2(execFile4);
+var COMMIT_HOOKS = /* @__PURE__ */ new Set(["pre-commit", "prepare-commit-msg", "commit-msg", "post-commit"]);
+async function hasCommitHooks(cwd) {
+  try {
+    const { stdout } = await execFileAsync("git", ["rev-parse", "--git-path", "hooks"], {
+      cwd: resolve11(cwd),
+      timeout: DEFAULT_GIT_TIMEOUT_MS
+    });
+    const names = await readdir(resolve11(cwd, stdout.trim())).catch((error) => {
+      if (error.code === "ENOENT") return [];
+      throw error;
+    });
+    return names.some((name) => COMMIT_HOOKS.has(name));
+  } catch {
+    return true;
+  }
+}
 async function runGit(cwd, args, timeoutMs) {
   const nullDevice = process.platform === "win32" ? "NUL" : "/dev/null";
   const hardenedArgs = [