baro-ai 0.133.1 → 0.133.3

package/dist/cli.mjs

@@ -30070,7 +30070,7 @@ var require_cross_spawn = __commonJS({
 
 // ../baro-memory/dist/vectra-store.js
 import { LocalIndex } from "vectra";
-import { readFileSync as readFileSync18, writeFileSync as writeFileSync9, mkdirSync as mkdirSync12, existsSync as existsSync17, renameSync as renameSync5, rmSync as rmSync5, readdirSync as readdirSync11, statSync as statSync8, lstatSync as lstatSync8 } from "fs";
+import { readFileSync as readFileSync18, writeFileSync as writeFileSync9, mkdirSync as mkdirSync12, existsSync as existsSync17, renameSync as renameSync5, rmSync as rmSync5, readdirSync as readdirSync12, statSync as statSync8, lstatSync as lstatSync8 } from "fs";
 import { join as join29 } from "path";
 import { tmpdir as tmpdir9, homedir as homedir7 } from "os";
 async function createMemoryStore(config2) {
@@ -30121,7 +30121,7 @@ function pruneOldSessions(sessionsDir) {
     if (!existsSync17(sessionsDir))
       return;
     const now = Date.now();
-    for (const entry of readdirSync11(sessionsDir)) {
+    for (const entry of readdirSync12(sessionsDir)) {
       if (!entry.startsWith("run-"))
         continue;
       const entryPath = join29(sessionsDir, entry);
@@ -71364,12 +71364,12 @@ function extractStderr(e2) {
 
 // ../baro-orchestrator/src/integration/dependency-materializer.ts
 import { createHash as createHash7 } from "crypto";
-import { existsSync as existsSync11, lstatSync as lstatSync3, readdirSync as readdirSync4, readFileSync as readFileSync11, unlinkSync as unlinkSync2 } from "fs";
+import { existsSync as existsSync11, lstatSync as lstatSync3, readdirSync as readdirSync5, readFileSync as readFileSync11, unlinkSync as unlinkSync2 } from "fs";
 import { homedir as homedir4 } from "os";
 import { join as join16, relative as relative6, resolve as resolve9 } from "path";
 
 // ../baro-orchestrator/src/verification/verify.ts
-import { existsSync as existsSync10, lstatSync as lstatSync2, readdirSync as readdirSync3, readFileSync as readFileSync10, realpathSync as realpathSync6, statSync as statSync5 } from "fs";
+import { existsSync as existsSync10, lstatSync as lstatSync2, readdirSync as readdirSync4, readFileSync as readFileSync10, realpathSync as realpathSync6, statSync as statSync5 } from "fs";
 import { isAbsolute as isAbsolute4, join as join14, relative as relative5, resolve as resolve8, sep as sep3 } from "path";
 
 // ../baro-orchestrator/src/harness/liveness.ts
@@ -71572,222 +71572,20 @@ function cargoEnvFor(hostRoot, env) {
 
 // ../baro-orchestrator/src/verification/change-scope.ts
 import { execFileSync as execFileSync2 } from "child_process";
-import { existsSync as existsSync3, readFileSync as readFileSync5 } from "fs";
-import { basename as basename5, dirname as dirname3, extname, join as join5, relative, resolve as resolve3 } from "path";
-var JAVASCRIPT_TOOLS = /* @__PURE__ */ new Set(["npm", "pnpm", "yarn", "corepack", "node", "npx", "bun"]);
-var JAVASCRIPT_EXTENSIONS = /* @__PURE__ */ new Set([
-  ".js",
-  ".jsx",
-  ".ts",
-  ".tsx",
-  ".mjs",
-  ".cjs",
-  ".mts",
-  ".cts",
-  ".vue",
-  ".svelte",
-  ".astro",
-  ".css",
-  ".scss",
-  ".sass",
-  ".less"
-]);
-var JAVASCRIPT_ROOT_FILES = /* @__PURE__ */ new Set([
-  "package.json",
-  "package-lock.json",
-  "npm-shrinkwrap.json",
-  "pnpm-lock.yaml",
-  "pnpm-workspace.yaml",
-  "yarn.lock",
-  ".yarnrc",
-  ".yarnrc.yml",
-  ".npmrc",
-  ".nvmrc",
-  ".node-version",
-  "bun.lockb",
-  "bun.lock"
-]);
-var RUST_FILES = /* @__PURE__ */ new Set([
-  "Cargo.toml",
-  "Cargo.lock",
-  "build.rs",
-  "rust-toolchain",
-  "rust-toolchain.toml",
-  "rustfmt.toml",
-  ".rustfmt.toml",
-  "clippy.toml",
-  ".clippy.toml"
-]);
-var GO_FILES = /* @__PURE__ */ new Set(["go.mod", "go.sum", "go.work", "go.work.sum"]);
-var JVM_EXTENSIONS = /* @__PURE__ */ new Set([".java", ".kt", ".kts", ".groovy", ".scala"]);
-var JVM_FILES = /* @__PURE__ */ new Set([
-  "pom.xml",
-  "build.gradle",
-  "build.gradle.kts",
-  "settings.gradle",
-  "settings.gradle.kts",
-  "gradle.properties",
-  "mvnw",
-  "mvnw.cmd",
-  "gradlew",
-  "gradlew.bat"
-]);
-var DOC_EXTENSIONS = /* @__PURE__ */ new Set([".md", ".mdx", ".rst", ".adoc", ".txt"]);
-var DOC_FILES = /^(LICENSE|LICENCE|COPYING|NOTICE|AUTHORS|CHANGELOG|CODEOWNERS)(\..*)?$/iu;
-var DOC_DIRS = ["docs/", ".github/"];
-var NEUTRAL_FILES = /* @__PURE__ */ new Set([".gitignore", ".gitattributes", ".editorconfig", ".mailmap"]);
-function commandEcosystem(command) {
-  if (command.origin === "declared" || command.preflightFailure || command.incompleteReason) {
-    return null;
-  }
-  if (command.tool === "cargo") return "rust";
-  if (command.tool === "go") return "go";
-  if (/^(mvn|gradle) /u.test(command.label)) return "jvm";
-  if (JAVASCRIPT_TOOLS.has(command.tool)) return "javascript";
-  return null;
-}
-function affectedEcosystems(paths, root, javascriptDirs = javascriptPackageDirs(root)) {
-  const affected = /* @__PURE__ */ new Set();
-  const workspaces = javascriptDirs.map((dir) => relative(resolve3(root), resolve3(dir)).replace(/\\/gu, "/")).filter((dir) => dir !== "" && !dir.startsWith("..")).map((dir) => `${dir}/`);
-  for (const raw of paths) {
-    const path7 = raw.replace(/\\/gu, "/").replace(/^\.\//u, "");
-    if (!path7) continue;
-    const claims = claimsOf(path7, root, workspaces);
-    if (claims.length > 0) {
-      for (const claim of claims) affected.add(claim);
-      continue;
-    }
-    if (isNeutral(path7)) continue;
-    return "all";
-  }
-  return affected;
-}
-function claimsOf(path7, root, workspaces) {
-  const name = basename5(path7);
-  const ext = extname(name).toLowerCase();
-  const claims = [];
-  if (ext === ".rs" || RUST_FILES.has(name) || path7.startsWith(".cargo/") || insidePackageDir(path7, root, ["Cargo.toml"])) {
-    claims.push("rust");
-  }
-  if (ext === ".go" || GO_FILES.has(name) || insidePackageDir(path7, root, ["go.mod"])) {
-    claims.push("go");
-  }
-  if (JVM_EXTENSIONS.has(ext) || JVM_FILES.has(name) || path7.startsWith("gradle/") || insidePackageDir(path7, root, ["pom.xml", "build.gradle", "build.gradle.kts"])) {
-    claims.push("jvm");
-  }
-  if (JAVASCRIPT_EXTENSIONS.has(ext) || JAVASCRIPT_ROOT_FILES.has(name) && !path7.includes("/") || /^tsconfig.*\.json$/u.test(name) || workspaces.some((dir) => path7.startsWith(dir))) {
-    claims.push("javascript");
-  }
-  return claims;
-}
-function insidePackageDir(path7, root, manifests) {
-  let dir = dirname3(path7);
-  while (dir && dir !== "." && dir !== "/") {
-    if (manifests.some((manifest) => existsSync3(join5(root, dir, manifest)))) return true;
-    dir = dirname3(dir);
-  }
-  return false;
-}
-function isNeutral(path7) {
-  const name = basename5(path7);
-  return DOC_EXTENSIONS.has(extname(name).toLowerCase()) || DOC_FILES.test(name) || NEUTRAL_FILES.has(name) || DOC_DIRS.some((dir) => path7.startsWith(dir));
-}
-function javascriptPackageDirs(root) {
-  try {
-    const manifest = JSON.parse(readFileSync5(join5(root, "package.json"), "utf8"));
-    const patterns = Array.isArray(manifest.workspaces) ? manifest.workspaces : manifest.workspaces?.packages;
-    if (!Array.isArray(patterns)) return [];
-    return patterns.filter((pattern) => typeof pattern === "string").map((pattern) => pattern.replace(/\/?\*.*$/u, "")).filter(Boolean).map((dir) => join5(root, dir));
-  } catch {
-    return [];
-  }
-}
-function changedPathsSince(cwd, base) {
-  const git3 = (args) => execFileSync2("git", args, {
-    cwd,
-    encoding: "utf8",
-    stdio: ["ignore", "pipe", "ignore"],
-    timeout: 15e3,
-    maxBuffer: 16 * 1024 * 1024
-  });
-  try {
-    const paths = /* @__PURE__ */ new Set();
-    for (const line of git3(["diff", "--name-only", "-z", base]).split("\0")) {
-      if (line) paths.add(line);
-    }
-    for (const line of git3(["ls-files", "--others", "--exclude-standard", "-z"]).split("\0")) {
-      if (line) paths.add(line);
-    }
-    return [...paths];
-  } catch {
-    return null;
-  }
-}
-function scopeCommandsToChange(commands, paths, root, env = process.env) {
-  if (env.BARO_VERIFY_SCOPE === "0" || paths === null || paths.length === 0) {
-    return { run: commands, notAffected: [] };
-  }
-  const affected = affectedEcosystems(paths, root);
-  if (affected === "all") return { run: commands, notAffected: [] };
-  const run2 = [];
-  const notAffected = [];
-  for (const command of commands) {
-    const ecosystem = commandEcosystem(command);
-    if (ecosystem === null || affected.has(ecosystem)) run2.push(command);
-    else notAffected.push(command);
-  }
-  if (!run2.some((command) => commandEcosystem(command) !== null)) {
-    return { run: commands, notAffected: [] };
-  }
-  return { run: run2, notAffected };
-}
-
-// ../baro-orchestrator/src/verification/lockfile-guard.ts
-import { execFileSync as execFileSync3 } from "child_process";
-import { existsSync as existsSync4 } from "fs";
-import { join as join6 } from "path";
-var LOCKFILES = ["package-lock.json", "npm-shrinkwrap.json", "pnpm-lock.yaml", "yarn.lock"];
-function git(cwd, args) {
-  try {
-    return execFileSync3("git", args, {
-      cwd,
-      encoding: "utf8",
-      stdio: ["ignore", "pipe", "ignore"],
-      timeout: 15e3
-    });
-  } catch {
-    return null;
-  }
-}
-function pristineLockfiles(cwd) {
-  const changed = git(cwd, ["status", "--porcelain", "-z", "--untracked-files=all"]);
-  if (changed === null) return [];
-  const paths = changed.split("\0").filter(Boolean).map((entry) => entry.slice(3));
-  if (paths.some((path7) => path7 === "package.json" || path7.endsWith("/package.json"))) return [];
-  return LOCKFILES.filter(
-    (file) => existsSync4(join6(cwd, file)) && !paths.includes(file) && git(cwd, ["ls-files", "--error-unmatch", "--", file]) !== null
-  );
-}
-function restoreLockfiles(cwd, pristine) {
-  const restored = [];
-  for (const file of pristine) {
-    if (git(cwd, ["diff", "--quiet", "HEAD", "--", file]) !== null) continue;
-    if (git(cwd, ["checkout", "HEAD", "--", file]) !== null) restored.push(file);
-  }
-  return restored;
-}
+import { existsSync as existsSync5, readdirSync as readdirSync3, readFileSync as readFileSync5 } from "fs";
+import { basename as basename7, dirname as dirname5, extname, join as join7, relative as relative2, resolve as resolve5 } from "path";
 
 // ../baro-orchestrator/src/verification/command-cwd.ts
-import { existsSync as existsSync6 } from "fs";
-import { dirname as dirname5, isAbsolute as isAbsolute2, join as join8, relative as relative2, resolve as resolve5, sep } from "path";
+import { existsSync as existsSync4 } from "fs";
+import { dirname as dirname4, isAbsolute as isAbsolute2, join as join6, relative, resolve as resolve4, sep } from "path";
 
 // ../baro-orchestrator/src/integration/integration-worktree.ts
-import { existsSync as existsSync5, readdirSync as readdirSync2, realpathSync as realpathSync3, rmSync, rmdirSync } from "fs";
+import { existsSync as existsSync3, readdirSync as readdirSync2, realpathSync as realpathSync3, rmSync, rmdirSync } from "fs";
 import { tmpdir as tmpdir2 } from "os";
-import { basename as basename6, dirname as dirname4, join as join7, resolve as resolve4 } from "path";
+import { basename as basename5, dirname as dirname3, join as join5, resolve as resolve3 } from "path";
 var INTEGRATION_WORKTREE_DIRNAME = "__run";
 function integrationWorktreePath(runId, repoRoot) {
-  return join7(
+  return join5(
     tmpdir2(),
     "baro-worktrees",
     runId,
@@ -71796,16 +71594,16 @@ function integrationWorktreePath(runId, repoRoot) {
   );
 }
 function worktreeLeafName(repoRoot) {
-  let name = basename6(resolve4(repoRoot));
+  let name = basename5(resolve3(repoRoot));
   try {
-    name = basename6(realpathSync3(repoRoot));
+    name = basename5(realpathSync3(repoRoot));
   } catch {
   }
   return name && name !== "." && name !== ".." ? name : "repo";
 }
 function isIntegrationWorktreeRoot(path7) {
-  const resolved = resolve4(path7);
-  return basename6(resolved) === INTEGRATION_WORKTREE_DIRNAME || basename6(dirname4(resolved)) === INTEGRATION_WORKTREE_DIRNAME;
+  const resolved = resolve3(path7);
+  return basename5(resolved) === INTEGRATION_WORKTREE_DIRNAME || basename5(dirname3(resolved)) === INTEGRATION_WORKTREE_DIRNAME;
 }
 var IntegrationWorktree = class {
   constructor(opts) {
@@ -71829,28 +71627,28 @@ var IntegrationWorktree = class {
     const { goalBranch } = this.opts;
     const release = await this.opts.gitGate.acquire();
     try {
-      await git2(["worktree", "prune"], repoRoot);
-      const hostBranchAtStart = await git2(["branch", "--show-current"], repoRoot) || null;
-      const hostHeadAtStart = await git2(["rev-parse", "HEAD"], repoRoot);
-      const startPoint = this.opts.baseRef ? await git2(["rev-parse", "--verify", `${this.opts.baseRef}^{commit}`], repoRoot) : hostHeadAtStart;
+      await git(["worktree", "prune"], repoRoot);
+      const hostBranchAtStart = await git(["branch", "--show-current"], repoRoot) || null;
+      const hostHeadAtStart = await git(["rev-parse", "HEAD"], repoRoot);
+      const startPoint = this.opts.baseRef ? await git(["rev-parse", "--verify", `${this.opts.baseRef}^{commit}`], repoRoot) : hostHeadAtStart;
       const registered = await this.isRegistered();
       let reused = false;
-      if (registered && existsSync5(integrationRoot)) {
-        const branch = await git2(["branch", "--show-current"], integrationRoot).catch((error) => {
+      if (registered && existsSync3(integrationRoot)) {
+        const branch = await git(["branch", "--show-current"], integrationRoot).catch((error) => {
           if (isRepositoryCommandTimeout(error)) throw error;
           return null;
         });
         reused = branch === goalBranch;
       }
       if (!reused) {
-        if (registered || existsSync5(integrationRoot)) {
+        if (registered || existsSync3(integrationRoot)) {
           await gitQuiet(["worktree", "remove", "--force", integrationRoot], repoRoot);
-          if (existsSync5(integrationRoot)) {
+          if (existsSync3(integrationRoot)) {
             rmSync(integrationRoot, { recursive: true, force: true });
           }
-          await git2(["worktree", "prune"], repoRoot);
+          await git(["worktree", "prune"], repoRoot);
         }
-        const branchExists = await git2(
+        const branchExists = await git(
           ["show-ref", "--verify", "--quiet", `refs/heads/${goalBranch}`],
           repoRoot
         ).then(
@@ -71861,7 +71659,7 @@ var IntegrationWorktree = class {
           }
         );
         if (branchExists) await this.releaseStaleHolders(goalBranch);
-        await git2(
+        await git(
           branchExists ? ["worktree", "add", integrationRoot, goalBranch] : ["worktree", "add", "-b", goalBranch, integrationRoot, startPoint],
           repoRoot
         );
@@ -71874,7 +71672,7 @@ var IntegrationWorktree = class {
       } else {
         this.log(`[git] local-only; not pushing ${goalBranch}`);
       }
-      const baseSha = await git2(["rev-parse", "HEAD"], integrationRoot);
+      const baseSha = await git(["rev-parse", "HEAD"], integrationRoot);
       this.prepared = {
         integrationRoot,
         baseSha,
@@ -71901,12 +71699,12 @@ var IntegrationWorktree = class {
     try {
       release = await this.opts.gitGate.acquire();
       await gitQuiet(["worktree", "remove", "--force", integrationRoot], repoRoot);
-      if (existsSync5(integrationRoot)) {
+      if (existsSync3(integrationRoot)) {
         rmSync(integrationRoot, { recursive: true, force: true });
       }
       await gitQuiet(["worktree", "prune"], repoRoot);
-      for (const dir of [dirname4(integrationRoot), dirname4(dirname4(integrationRoot))]) {
-        if (existsSync5(dir) && readdirSync2(dir).length === 0) rmdirSync(dir);
+      for (const dir of [dirname3(integrationRoot), dirname3(dirname3(integrationRoot))]) {
+        if (existsSync3(dir) && readdirSync2(dir).length === 0) rmdirSync(dir);
       }
     } catch (error) {
       this.log(
@@ -71940,7 +71738,7 @@ var IntegrationWorktree = class {
     let release = null;
     try {
       release = await this.opts.gitGate.acquire();
-      const current = await git2(["branch", "--show-current"], repoRoot);
+      const current = await git(["branch", "--show-current"], repoRoot);
       if (!prepared.hostBranchAtStart || current !== prepared.hostBranchAtStart) {
         return untouched(
           "not_on_base_branch",
@@ -71959,13 +71757,13 @@ var IntegrationWorktree = class {
           `uncommitted changes on [${paths.join(", ")}]; merge ${goalBranch} manually`
         );
       }
-      const head = await git2(["rev-parse", "HEAD"], repoRoot);
-      const goalSha = await git2(["rev-parse", `refs/heads/${goalBranch}`], repoRoot);
+      const head = await git(["rev-parse", "HEAD"], repoRoot);
+      const goalSha = await git(["rev-parse", `refs/heads/${goalBranch}`], repoRoot);
       if (head === goalSha) {
         return untouched("up_to_date", `${current} already at ${goalBranch}`);
       }
       try {
-        await git2(["merge-base", "--is-ancestor", head, goalSha], repoRoot);
+        await git(["merge-base", "--is-ancestor", head, goalSha], repoRoot);
       } catch (error) {
         if (!(error instanceof RepositoryCommandError) || error.code !== 1) throw error;
         return untouched(
@@ -71973,7 +71771,7 @@ var IntegrationWorktree = class {
           `${current} has diverged from ${goalBranch}`
         );
       }
-      await git2(["merge", "--ff-only", goalSha], repoRoot);
+      await git(["merge", "--ff-only", goalSha], repoRoot);
       return { kind: "fast_forwarded", from: head, to: goalSha };
     } catch (error) {
       return untouched("error", errMsg(error));
@@ -71989,7 +71787,7 @@ var IntegrationWorktree = class {
    * the user's and stays, with git's own error.
    */
   async releaseStaleHolders(goalBranch) {
-    const listing = await git2(["worktree", "list", "--porcelain"], this.repoRoot);
+    const listing = await git(["worktree", "list", "--porcelain"], this.repoRoot);
     const own = canonicalPath(this.integrationRoot);
     for (const entry of listing.split(/\n\s*\n/u)) {
       const lines = entry.split("\n");
@@ -71999,17 +71797,17 @@ var IntegrationWorktree = class {
       if (canonicalPath(path7) === own || !isIntegrationWorktreeRoot(path7)) continue;
       this.log(`[integration] releasing ${goalBranch} from a stopped run's worktree ${path7}`);
       await gitQuiet(["worktree", "remove", "--force", path7], this.repoRoot);
-      if (existsSync5(path7)) rmSync(path7, { recursive: true, force: true });
+      if (existsSync3(path7)) rmSync(path7, { recursive: true, force: true });
     }
-    await git2(["worktree", "prune"], this.repoRoot);
+    await git(["worktree", "prune"], this.repoRoot);
   }
   async isRegistered() {
-    const listing = await git2(["worktree", "list", "--porcelain"], this.repoRoot);
+    const listing = await git(["worktree", "list", "--porcelain"], this.repoRoot);
     const target = canonicalPath(this.integrationRoot);
     return listing.split("\n").filter((line) => line.startsWith("worktree ")).some((line) => canonicalPath(line.slice("worktree ".length)) === target);
   }
 };
-async function git2(args, cwd) {
+async function git(args, cwd) {
   const { stdout } = await runRepositoryCommand("git", args, { cwd });
   return stdout.trim();
 }
@@ -72021,12 +71819,12 @@ async function gitQuiet(args, cwd) {
   }
 }
 function canonicalPath(path7) {
-  const absolute = resolve4(path7);
+  const absolute = resolve3(path7);
   try {
     return realpathSync3(absolute);
   } catch {
-    const parent = dirname4(absolute);
-    return parent === absolute ? absolute : join7(canonicalPath(parent), basename6(absolute));
+    const parent = dirname3(absolute);
+    return parent === absolute ? absolute : join5(canonicalPath(parent), basename5(absolute));
   }
 }
 function untouched(reason, detail) {
@@ -72055,7 +71853,7 @@ function repositoryRelativePath(root, path7) {
 // ../baro-orchestrator/src/verification/command-cwd.ts
 var RETRY_BACKOFF_MS = 2e3;
 function strictlyUnder(root, candidate) {
-  const rel = relative2(root, candidate);
+  const rel = relative(root, candidate);
   return rel !== "" && !rel.startsWith("..") && !isAbsolute2(rel);
 }
 function sameDirectory(a, b) {
@@ -72066,10 +71864,10 @@ function remappableWorktreeRoot(runCwd, candidate) {
   const at = parts.lastIndexOf("baro-worktrees");
   if (at < 0 || parts.length < at + 4) return null;
   const root = parts.slice(0, at + 4).join(sep);
-  return sameDirectory(dirname5(dirname5(root)), dirname5(dirname5(runCwd))) || !existsSync6(root) ? root : null;
+  return sameDirectory(dirname4(dirname4(root)), dirname4(dirname4(runCwd))) || !existsSync4(root) ? root : null;
 }
 function integrationCwdResolver(integrationRoot, repoRoot) {
-  return () => existsSync6(integrationRoot) ? integrationRoot : repoRoot;
+  return () => existsSync4(integrationRoot) ? integrationRoot : repoRoot;
 }
 function spawnRunCwd(cwd, hostRepoRoot, resolveRunCwd) {
   if (resolveRunCwd) return resolveRunCwd();
@@ -72077,8 +71875,8 @@ function spawnRunCwd(cwd, hostRepoRoot, resolveRunCwd) {
 }
 function resolveCommandCwd(runCwd, commandCwd) {
   if (commandCwd === void 0) return runCwd;
-  const resolved = resolve5(commandCwd);
-  const runResolved = resolve5(runCwd);
+  const resolved = resolve4(commandCwd);
+  const runResolved = resolve4(runCwd);
   if (sameDirectory(runResolved, resolved) || strictlyUnder(runResolved, resolved)) {
     return commandCwd;
   }
@@ -72089,12 +71887,297 @@ function resolveCommandCwd(runCwd, commandCwd) {
   }
   const worktreeRoot = remappableWorktreeRoot(runCanonical, canonical);
   if (worktreeRoot) {
-    const remapped = join8(runCwd, relative2(worktreeRoot, canonical));
-    if (existsSync6(remapped)) return remapped;
+    const remapped = join6(runCwd, relative(worktreeRoot, canonical));
+    if (existsSync4(remapped)) return remapped;
   }
   return runCwd;
 }
 
+// ../baro-orchestrator/src/verification/change-scope.ts
+var JAVASCRIPT_TOOLS = /* @__PURE__ */ new Set(["npm", "pnpm", "yarn", "corepack", "node", "npx", "bun"]);
+var JAVASCRIPT_EXTENSIONS = /* @__PURE__ */ new Set([
+  ".js",
+  ".jsx",
+  ".ts",
+  ".tsx",
+  ".mjs",
+  ".cjs",
+  ".mts",
+  ".cts",
+  ".vue",
+  ".svelte",
+  ".astro",
+  ".css",
+  ".scss",
+  ".sass",
+  ".less"
+]);
+var JAVASCRIPT_ROOT_FILES = /* @__PURE__ */ new Set([
+  "package.json",
+  "package-lock.json",
+  "npm-shrinkwrap.json",
+  "pnpm-lock.yaml",
+  "pnpm-workspace.yaml",
+  "yarn.lock",
+  ".yarnrc",
+  ".yarnrc.yml",
+  ".npmrc",
+  ".nvmrc",
+  ".node-version",
+  "bun.lockb",
+  "bun.lock"
+]);
+var RUST_FILES = /* @__PURE__ */ new Set([
+  "Cargo.toml",
+  "Cargo.lock",
+  "build.rs",
+  "rust-toolchain",
+  "rust-toolchain.toml",
+  "rustfmt.toml",
+  ".rustfmt.toml",
+  "clippy.toml",
+  ".clippy.toml"
+]);
+var GO_FILES = /* @__PURE__ */ new Set(["go.mod", "go.sum", "go.work", "go.work.sum"]);
+var JVM_EXTENSIONS = /* @__PURE__ */ new Set([".java", ".kt", ".kts", ".groovy", ".scala"]);
+var JVM_FILES = /* @__PURE__ */ new Set([
+  "pom.xml",
+  "build.gradle",
+  "build.gradle.kts",
+  "settings.gradle",
+  "settings.gradle.kts",
+  "gradle.properties",
+  "mvnw",
+  "mvnw.cmd",
+  "gradlew",
+  "gradlew.bat"
+]);
+var DOC_EXTENSIONS = /* @__PURE__ */ new Set([".md", ".mdx", ".rst", ".adoc", ".txt"]);
+var DOC_FILES = /^(LICENSE|LICENCE|COPYING|NOTICE|AUTHORS|CHANGELOG|CODEOWNERS)(\..*)?$/iu;
+var DOC_DIRS = ["docs/", ".github/"];
+var NEUTRAL_FILES = /* @__PURE__ */ new Set([".gitignore", ".gitattributes", ".editorconfig", ".mailmap"]);
+function commandEcosystem(command) {
+  if (command.origin === "declared" || command.preflightFailure || command.incompleteReason) {
+    return null;
+  }
+  if (command.tool === "cargo") return "rust";
+  if (command.tool === "go") return "go";
+  if (/^(mvn|gradle) /u.test(command.label)) return "jvm";
+  if (JAVASCRIPT_TOOLS.has(command.tool)) return "javascript";
+  return null;
+}
+function affectedEcosystems(paths, root, javascriptDirs = javascriptPackageDirs(root)) {
+  const affected = /* @__PURE__ */ new Set();
+  const workspaces = javascriptDirs.map((dir) => relative2(resolve5(root), resolve5(dir)).replace(/\\/gu, "/")).filter((dir) => dir !== "" && !dir.startsWith("..")).map((dir) => `${dir}/`);
+  for (const raw of paths) {
+    const path7 = raw.replace(/\\/gu, "/").replace(/^\.\//u, "");
+    if (!path7) continue;
+    const claims = claimsOf(path7, root, workspaces);
+    if (claims.length > 0) {
+      for (const claim of claims) affected.add(claim);
+      continue;
+    }
+    if (isNeutral(path7)) continue;
+    return "all";
+  }
+  return affected;
+}
+function claimsOf(path7, root, workspaces) {
+  const name = basename7(path7);
+  const ext = extname(name).toLowerCase();
+  const claims = [];
+  if (ext === ".rs" || RUST_FILES.has(name) || path7.startsWith(".cargo/") || insidePackageDir(path7, root, ["Cargo.toml"])) {
+    claims.push("rust");
+  }
+  if (ext === ".go" || GO_FILES.has(name) || insidePackageDir(path7, root, ["go.mod"])) {
+    claims.push("go");
+  }
+  if (JVM_EXTENSIONS.has(ext) || JVM_FILES.has(name) || path7.startsWith("gradle/") || insidePackageDir(path7, root, ["pom.xml", "build.gradle", "build.gradle.kts"])) {
+    claims.push("jvm");
+  }
+  if (JAVASCRIPT_EXTENSIONS.has(ext) || JAVASCRIPT_ROOT_FILES.has(name) && !path7.includes("/") || /^tsconfig.*\.json$/u.test(name) || workspaces.some((dir) => path7.startsWith(dir))) {
+    claims.push("javascript");
+  }
+  return claims;
+}
+function insidePackageDir(path7, root, manifests) {
+  let dir = dirname5(path7);
+  while (dir && dir !== "." && dir !== "/") {
+    if (manifests.some((manifest) => existsSync5(join7(root, dir, manifest)))) return true;
+    dir = dirname5(dir);
+  }
+  return false;
+}
+function isNeutral(path7) {
+  const name = basename7(path7);
+  return DOC_EXTENSIONS.has(extname(name).toLowerCase()) || DOC_FILES.test(name) || NEUTRAL_FILES.has(name) || DOC_DIRS.some((dir) => path7.startsWith(dir));
+}
+function javascriptPackageDirs(root) {
+  try {
+    const manifest = JSON.parse(readFileSync5(join7(root, "package.json"), "utf8"));
+    const patterns = Array.isArray(manifest.workspaces) ? manifest.workspaces : manifest.workspaces?.packages;
+    if (!Array.isArray(patterns)) return [];
+    return patterns.filter((pattern) => typeof pattern === "string").map((pattern) => pattern.replace(/\/?\*.*$/u, "")).filter(Boolean).map((dir) => join7(root, dir));
+  } catch {
+    return [];
+  }
+}
+function changedPathsSince(cwd, base) {
+  const git3 = (args) => execFileSync2("git", args, {
+    cwd,
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "ignore"],
+    timeout: 15e3,
+    maxBuffer: 16 * 1024 * 1024
+  });
+  try {
+    const paths = /* @__PURE__ */ new Set();
+    for (const line of git3(["diff", "--name-only", "-z", base]).split("\0")) {
+      if (line) paths.add(line);
+    }
+    for (const line of git3(["ls-files", "--others", "--exclude-standard", "-z"]).split("\0")) {
+      if (line) paths.add(line);
+    }
+    return [...paths];
+  } catch {
+    return null;
+  }
+}
+function commandsOfUntouchedPackages(commands, paths, root) {
+  const untouched2 = /* @__PURE__ */ new Set();
+  const packages = workspacePackages(root);
+  if (packages.length === 0) return untouched2;
+  const prefixes = javascriptPackageDirs(root).map((dir) => relative2(resolve5(root), resolve5(dir)).replace(/\\/gu, "/")).filter((dir) => dir !== "" && !dir.startsWith("..")).map((dir) => `${dir}/`);
+  const touched = /* @__PURE__ */ new Set();
+  for (const raw of paths) {
+    const path7 = raw.replace(/\\/gu, "/").replace(/^\.\//u, "");
+    if (!path7 || !claimsOf(path7, root, prefixes).includes("javascript")) continue;
+    const owner = packageOf(path7, packages);
+    if (!owner) return untouched2;
+    touched.add(owner);
+  }
+  if (touched.size === 0) return untouched2;
+  const affected = new Set(touched);
+  for (let grew = true; grew; ) {
+    grew = false;
+    for (const candidate of packages) {
+      if (affected.has(candidate)) continue;
+      if ([...affected].some(({ name }) => name !== null && candidate.dependsOn.includes(name))) {
+        affected.add(candidate);
+        grew = true;
+      }
+    }
+  }
+  for (const command of commands) {
+    if (commandEcosystem(command) !== "javascript" || command.cwd === void 0) continue;
+    const dir = relative2(resolve5(root), resolve5(resolveCommandCwd(root, command.cwd))).replace(/\\/gu, "/");
+    const owner = packages.find((candidate) => candidate.dir === `${dir}/`);
+    if (owner && !affected.has(owner)) untouched2.add(command);
+  }
+  return untouched2;
+}
+function packageOf(path7, packages) {
+  let owner = null;
+  for (const candidate of packages) {
+    if (path7.startsWith(candidate.dir) && (owner === null || candidate.dir.length > owner.dir.length)) {
+      owner = candidate;
+    }
+  }
+  return owner;
+}
+function workspacePackages(root) {
+  const dirs = /* @__PURE__ */ new Set();
+  for (const prefix of javascriptPackageDirs(root)) {
+    if (existsSync5(join7(prefix, "package.json"))) {
+      dirs.add(prefix);
+      continue;
+    }
+    try {
+      for (const entry of readdirSync3(prefix, { withFileTypes: true })) {
+        if (entry.isDirectory() && existsSync5(join7(prefix, entry.name, "package.json"))) {
+          dirs.add(join7(prefix, entry.name));
+        }
+      }
+    } catch {
+    }
+  }
+  const packages = [];
+  for (const dir of dirs) {
+    try {
+      const manifest = JSON.parse(readFileSync5(join7(dir, "package.json"), "utf8"));
+      const dependsOn = ["dependencies", "devDependencies", "peerDependencies", "optionalDependencies"].flatMap((field) => {
+        const value = manifest[field];
+        return value && typeof value === "object" ? Object.keys(value) : [];
+      });
+      packages.push({
+        dir: `${relative2(resolve5(root), resolve5(dir)).replace(/\\/gu, "/")}/`,
+        name: typeof manifest.name === "string" ? manifest.name : null,
+        dependsOn
+      });
+    } catch {
+      return [];
+    }
+  }
+  return packages;
+}
+function scopeCommandsToChange(commands, paths, root, env = process.env, options = {}) {
+  if (env.BARO_VERIFY_SCOPE === "0" || paths === null || paths.length === 0) {
+    return { run: commands, notAffected: [] };
+  }
+  const affected = affectedEcosystems(paths, root);
+  if (affected === "all") return { run: commands, notAffected: [] };
+  const untouchedPackages = options.byPackage && affected.has("javascript") ? commandsOfUntouchedPackages(commands, paths, root) : /* @__PURE__ */ new Set();
+  const run2 = [];
+  const notAffected = [];
+  for (const command of commands) {
+    const ecosystem = commandEcosystem(command);
+    if (ecosystem !== null && (!affected.has(ecosystem) || untouchedPackages.has(command))) {
+      notAffected.push(command);
+    } else {
+      run2.push(command);
+    }
+  }
+  if (!run2.some((command) => commandEcosystem(command) !== null)) {
+    return { run: commands, notAffected: [] };
+  }
+  return { run: run2, notAffected };
+}
+
+// ../baro-orchestrator/src/verification/lockfile-guard.ts
+import { execFileSync as execFileSync3 } from "child_process";
+import { existsSync as existsSync6 } from "fs";
+import { join as join8 } from "path";
+var LOCKFILES = ["package-lock.json", "npm-shrinkwrap.json", "pnpm-lock.yaml", "yarn.lock"];
+function git2(cwd, args) {
+  try {
+    return execFileSync3("git", args, {
+      cwd,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: 15e3
+    });
+  } catch {
+    return null;
+  }
+}
+function pristineLockfiles(cwd) {
+  const changed = git2(cwd, ["status", "--porcelain", "-z", "--untracked-files=all"]);
+  if (changed === null) return [];
+  const paths = changed.split("\0").filter(Boolean).map((entry) => entry.slice(3));
+  if (paths.some((path7) => path7 === "package.json" || path7.endsWith("/package.json"))) return [];
+  return LOCKFILES.filter(
+    (file) => existsSync6(join8(cwd, file)) && !paths.includes(file) && git2(cwd, ["ls-files", "--error-unmatch", "--", file]) !== null
+  );
+}
+function restoreLockfiles(cwd, pristine) {
+  const restored = [];
+  for (const file of pristine) {
+    if (git2(cwd, ["diff", "--quiet", "HEAD", "--", file]) !== null) continue;
+    if (git2(cwd, ["checkout", "HEAD", "--", file]) !== null) restored.push(file);
+  }
+  return restored;
+}
+
 // ../baro-orchestrator/src/verification/command-timing.ts
 import { createHash as createHash5, randomUUID as randomUUID3 } from "crypto";
 import { mkdirSync as mkdirSync4, readFileSync as readFileSync6, realpathSync as realpathSync4, renameSync as renameSync2, writeFileSync as writeFileSync3 } from "fs";
@@ -74146,6 +74229,13 @@ function packageManagerCommand(pm, declared, script, trailingArgs = []) {
   }
   return { tool: pm, args: ["run", script, ...trailingArgs] };
 }
+function gateScript(manifest, gate) {
+  const scripts = manifest?.scripts ?? {};
+  const declared = manifest?.baro?.verification?.scripts;
+  const override = declared && typeof declared === "object" ? declared[gate] : void 0;
+  if (typeof override === "string" && typeof scripts[override] === "string") return override;
+  return typeof scripts[gate] === "string" ? gate : null;
+}
 function readPackageManifest(path7) {
   try {
     return JSON.parse(readFileSync10(path7, "utf8"));
@@ -74201,7 +74291,7 @@ function workspacePackageDirs(cwd, workspaces) {
     if (!pattern.endsWith("/*") || pattern.slice(0, -2).includes("*")) continue;
     const parent = join14(root, pattern.slice(0, -2));
     if (!existsSync10(parent)) continue;
-    for (const entry of readdirSync3(parent, { withFileTypes: true })) {
+    for (const entry of readdirSync4(parent, { withFileTypes: true })) {
       if (entry.isDirectory()) addIfPackage(join14(parent, entry.name));
     }
   }
@@ -74299,17 +74389,19 @@ function detectCommands(cwd) {
         preflightFailure: `${displayCwd}/package.json is not valid JSON`
       });
     }
-    for (const script of managerResolutionFailed ? [] : ["build", "typecheck", "test", "lint"]) {
-      if (typeof scripts[script] === "string") {
-        const command = packageManagerCommand(pm, declared, script);
+    for (const gate of managerResolutionFailed ? [] : ["build", "typecheck", "test", "lint"]) {
+      const rootScript = gateScript(manifest, gate);
+      if (rootScript) {
+        const command = packageManagerCommand(pm, declared, rootScript);
         cmds.push({
-          label: `${pm} run ${script}`,
+          label: `${pm} run ${rootScript}`,
           ...command
         });
         continue;
       }
       for (const workspace of workspaces) {
-        if (typeof workspace.manifest?.scripts?.[script] !== "string") continue;
+        const script = gateScript(workspace.manifest, gate);
+        if (!script) continue;
         const displayCwd = relative5(cwd, workspace.cwd).replace(/\\/g, "/");
         const command = packageManagerCommand(pm, declared, script);
         cmds.push({
@@ -74936,7 +75028,13 @@ async function verifyBuild(cwd, options = {}) {
   const hostRepoRoot = options.hostRepoRoot ?? cwd;
   const emitActivity = options.emitActivity ?? emit;
   const ceilingFor = createCeilingResolver(cwd, hostRepoRoot, options.ceilingFloorMs);
-  const scoped = options.changedSince ? scopeCommandsToChange(plan.commands, changedPathsSince(cwd, options.changedSince), cwd) : { run: plan.commands, notAffected: [] };
+  const scoped = options.changedSince ? scopeCommandsToChange(
+    plan.commands,
+    changedPathsSince(cwd, options.changedSince),
+    cwd,
+    process.env,
+    { byPackage: options.scopeByPackage === true }
+  ) : { run: plan.commands, notAffected: [] };
   if (scoped.notAffected.length > 0) {
     emitActivity({
       type: "activity",
@@ -75269,7 +75367,7 @@ function nestedLockedPackages(root, depth = 3) {
     if (left <= 0) return;
     let entries;
     try {
-      entries = readdirSync4(dir, { withFileTypes: true });
+      entries = readdirSync5(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -75343,7 +75441,7 @@ import {
   lstatSync as lstatSync5,
   mkdirSync as mkdirSync6,
   readFileSync as readFileSync13,
-  readdirSync as readdirSync7,
+  readdirSync as readdirSync8,
   rmSync as rmSync3,
   rmdirSync as rmdirSync3,
   unlinkSync as unlinkSync3,
@@ -75353,7 +75451,7 @@ import { tmpdir as tmpdir4 } from "os";
 import { join as join19, resolve as resolve11 } from "path";
 
 // ../baro-orchestrator/src/runtime/disk-usage.ts
-import { lstatSync as lstatSync4, readdirSync as readdirSync5 } from "fs";
+import { lstatSync as lstatSync4, readdirSync as readdirSync6 } from "fs";
 import { join as join17 } from "path";
 function diskUsage(path7) {
   let stat3;
@@ -75365,7 +75463,7 @@ function diskUsage(path7) {
   if (!stat3.isDirectory()) return stat3.size;
   let names;
   try {
-    names = readdirSync5(path7);
+    names = readdirSync6(path7);
   } catch {
     return 0;
   }
@@ -75386,7 +75484,7 @@ import {
   existsSync as existsSync12,
   mkdirSync as mkdirSync5,
   readFileSync as readFileSync12,
-  readdirSync as readdirSync6,
+  readdirSync as readdirSync7,
   rmSync as rmSync2,
   rmdirSync as rmdirSync2,
   symlinkSync
@@ -76550,7 +76648,7 @@ var WorktreeManager = class {
     const scan = (rel, depth) => {
       let entries;
       try {
-        entries = readdirSync6(join18(root, rel) || root, { withFileTypes: true });
+        entries = readdirSync7(join18(root, rel) || root, { withFileTypes: true });
       } catch {
         return;
       }
@@ -76954,7 +77052,7 @@ async function execQuiet(cmd, args, cwd) {
 }
 function rmdirIfEmpty(path7) {
   try {
-    if (readdirSync6(path7).length === 0) rmdirSync2(path7);
+    if (readdirSync7(path7).length === 0) rmdirSync2(path7);
   } catch {
   }
 }
@@ -77001,7 +77099,7 @@ function claimRunDir(runDir, pid = process.pid) {
     } catch {
     }
     try {
-      if (readdirSync7(runDir).length === 0) rmdirSync3(runDir);
+      if (readdirSync8(runDir).length === 0) rmdirSync3(runDir);
     } catch {
     }
   };
@@ -77140,7 +77238,7 @@ async function inspectWorktree(tree, integration) {
 }
 function listDir(path7) {
   try {
-    return readdirSync7(path7);
+    return readdirSync8(path7);
   } catch {
     return [];
   }
@@ -80100,7 +80198,7 @@ import {
   mkdirSync as mkdirSync8,
   lstatSync as lstatSync6,
   readFileSync as readFileSync15,
-  readdirSync as readdirSync8,
+  readdirSync as readdirSync9,
   renameSync as renameSync4,
   unlinkSync as unlinkSync5,
   writeFileSync as writeFileSync6
@@ -82398,7 +82496,7 @@ var CollaborationBridge = class extends SerializedObserver {
   }
   consumeAvailableOutbox() {
     if (!existsSync14(this.outboxDir)) return;
-    const files = readdirSync8(this.outboxDir).filter((name) => name.endsWith(".json")).sort();
+    const files = readdirSync9(this.outboxDir).filter((name) => name.endsWith(".json")).sort();
     for (const name of files) this.consume(join20(this.outboxDir, name));
   }
   consume(path7) {
@@ -82555,7 +82653,7 @@ var CollaborationBridge = class extends SerializedObserver {
       return sameChallenge2(candidate, persisted) ? "duplicate" : `challenge id ${candidate.challengeId} conflicts with persisted evidence`;
     }
     if (existsSync14(this.challengeInflightDir)) {
-      for (const name of readdirSync8(this.challengeInflightDir)) {
+      for (const name of readdirSync9(this.challengeInflightDir)) {
         if (!name.endsWith(".json")) continue;
         try {
           const retained = this.readInflightChallenge(
@@ -82595,7 +82693,7 @@ var CollaborationBridge = class extends SerializedObserver {
   }
   publishAvailableInflightChallenges() {
     if (!existsSync14(this.challengeInflightDir)) return;
-    const files = readdirSync8(this.challengeInflightDir).filter((name) => name.endsWith(".json")).sort();
+    const files = readdirSync9(this.challengeInflightDir).filter((name) => name.endsWith(".json")).sort();
     for (const name of files) {
       try {
         this.publishInflightChallenge(
@@ -82651,7 +82749,7 @@ var CollaborationBridge = class extends SerializedObserver {
       });
     }
     if (!existsSync14(this.challengeInflightDir)) return;
-    const files = readdirSync8(this.challengeInflightDir).filter((name) => name.endsWith(".json")).sort();
+    const files = readdirSync9(this.challengeInflightDir).filter((name) => name.endsWith(".json")).sort();
     for (const name of files) {
       const path7 = join20(this.challengeInflightDir, name);
       try {
@@ -91240,6 +91338,30 @@ function parseContractConflicts(value) {
   }
   return conflicts;
 }
+function parseUnavailableChecks(value) {
+  if (!Array.isArray(value)) return [];
+  const seen = /* @__PURE__ */ new Set();
+  const checks = [];
+  for (const entry of value) {
+    if (typeof entry !== "object" || entry === null) continue;
+    const { criterion, reason, kind } = entry;
+    if (kind !== "check_unavailable") continue;
+    if (typeof criterion !== "string" || !criterion.trim() || seen.has(criterion)) continue;
+    if (typeof reason !== "string" || !reason.trim()) continue;
+    seen.add(criterion);
+    checks.push({ criterion, reason: reason.trim().slice(0, MAX_CONFLICT_REASON_CHARS) });
+    if (checks.length >= MAX_CONTRACT_CONFLICTS) break;
+  }
+  return checks;
+}
+function parsedConflictFields(value) {
+  const conflicts = parseContractConflicts(value);
+  const unavailable = parseUnavailableChecks(value);
+  return {
+    ...conflicts.length > 0 ? { contractConflicts: conflicts } : {},
+    ...unavailable.length > 0 ? { unavailableChecks: unavailable } : {}
+  };
+}
 function applyContractConflicts(evaluation, criteria, enabled = CONTRACT_CONFLICTS_ENABLED) {
   const conflicts = (enabled ? evaluation.contractConflicts ?? [] : []).filter(
     (conflict) => criteria.includes(conflict.criterion)
@@ -91269,9 +91391,10 @@ or
   const remediationRule = options.remediationGroups ? `
 - For "fail", "remediation_groups" is required and must partition "violated_criteria" exactly once. Every group needs a concise "root_cause" and one or more exact failed criterion strings. For "pass" or "inconclusive", omit "remediation_groups".` : "";
   const conflictsRule = options.contractConflicts ? `
-- "contract_conflicts" (optional, default []) lists criteria this story cannot satisfy as written, each as {"criterion":"exact criterion string","kind":"outside_write_surface" or "contradiction","reason":"\u2026"}. Use "outside_write_surface" only when meeting the criterion requires changing files outside the "## Write surface" Baro lists for this story, and name those files. Use "contradiction" only when no change could meet it together with another of this story's criteria, and quote that other criterion.
+- "contract_conflicts" (optional, default []) lists criteria this story cannot satisfy as written, each as {"criterion":"exact criterion string","kind":"outside_write_surface", "contradiction" or "check_unavailable","reason":"\u2026"}. Use "outside_write_surface" only when meeting the criterion requires changing files outside the "## Write surface" Baro lists for this story, and name those files. Use "contradiction" only when no change could meet it together with another of this story's criteria, and quote that other criterion.
 - A conflicted criterion is not this story's to meet: leave it out of "violated_criteria" and decide "verdict" on every other criterion. Baro moves an "outside_write_surface" criterion to a follow-up story that may change those files, and records a "contradiction" for the run-level reviews.
-- Never list a criterion the story could meet within its write surface but did not, or one that merely lacks evidence: those are violations. Without a "## Write surface" section, only the contradiction case applies.` : "";
+- A command whose runtime status reads "could not start" did not run: its tool is not installed in this worktree. That is a fact about the environment, not about the work. When the only thing a criterion lacks is a passing run of such a command, use kind "check_unavailable" and name the command; leave the criterion out of "violated_criteria". Never use it for a command that ran and failed, or when no command is marked "could not start".
+- Never list a criterion the story could meet within its write surface but did not, or one that merely lacks evidence: those are violations. Without a "## Write surface" section, only the contradiction and check_unavailable cases apply.` : "";
   return `You are a strict acceptance-criteria evaluator. You will receive:
 1. A list of acceptance criteria that must ALL be satisfied.
 2. Optionally, the accepted architecture decisions the agent was bound to.
@@ -91648,6 +91771,8 @@ var MAX_FINGERPRINT_PATHS = 5e3;
 var MAX_FINGERPRINT_FILE_BYTES = 64 * 1024 * 1024;
 var MAX_FINGERPRINT_TOTAL_BYTES = 256 * 1024 * 1024;
 var CRITIC_MAX_PROMPT_CHARS = 14e4;
+var COULD_NOT_START_STATUS = "could not start; the command's tool is not available in this worktree";
+var TOOL_UNAVAILABLE_ISSUE = "a verification command could not start: its tool is not available in the worktree";
 var PublishedNoteCollector = class extends BusMember {
   constructor(maxNotesPerStory = 6) {
     super();
@@ -91768,7 +91893,8 @@ var CriticCommandEvidenceCollector = class extends BusMember {
         entry.fingerprint,
         currentFingerprint
       );
-      const status = output === null ? "pending/no output observed" : commandOutputLooksFailed(output) ? "completed; output indicates failure" : "completed; consult captured output for the result";
+      const toolUnavailable = output !== null && outputLooksToolUnavailable(output);
+      const status = output === null ? "pending/no output observed" : toolUnavailable ? COULD_NOT_START_STATUS : commandOutputLooksFailed(output) ? "completed; output indicates failure" : "completed; consult captured output for the result";
       return {
         chronologicalIndex: index,
         command: entry.command,
@@ -91776,7 +91902,8 @@ var CriticCommandEvidenceCollector = class extends BusMember {
           command: entry.command,
           terminal: output !== null,
           freshness: freshness.state,
-          sandboxBlocked: output !== null && outputLooksSandboxBlocked(output)
+          sandboxBlocked: output !== null && outputLooksSandboxBlocked(output),
+          toolUnavailable
         },
         rendered: [
           `### Command ${index + 1}`,
@@ -92278,7 +92405,8 @@ async function prepareCriticEvaluation(criteria, resultText, agentId, source, es
     issues,
     staleCommands: staleCommandsToRerun(commandEvidence, issues),
     repositoryFingerprint: issues.length === 0 ? afterFingerprint.value : null,
-    established
+    established,
+    unavailableCommands: (commandEvidence.commands ?? []).filter((command) => command.toolUnavailable && command.freshness === "fresh").map((command) => command.command)
   };
 }
 function mergeSegmentVerdicts(verdicts) {
@@ -92301,6 +92429,11 @@ function mergeSegmentVerdicts(verdicts) {
       verdicts.flatMap((verdict) => verdict.contractConflicts ?? []).map((conflict) => [conflict.criterion, conflict])
     ).values()
   ];
+  const unavailable = [
+    ...new Map(
+      verdicts.flatMap((verdict) => verdict.unavailableChecks ?? []).map((check) => [check.criterion, check])
+    ).values()
+  ];
   const reasoning = decisive.length > 0 ? decisive.map(({ verdict, pass }) => `[pass ${pass}] ${verdict.reasoning}`).join(" ") : first.reasoning;
   return {
     ...first,
@@ -92308,7 +92441,32 @@ function mergeSegmentVerdicts(verdicts) {
     verdict: decisive.length > 0 ? "fail" : "pass",
     reasoning,
     violatedCriteria: violated,
-    ...conflicts.length > 0 ? { contractConflicts: conflicts } : {}
+    ...conflicts.length > 0 ? { contractConflicts: conflicts } : {},
+    ...unavailable.length > 0 ? { unavailableChecks: unavailable } : {}
+  };
+}
+var EVIDENCE_UNAVAILABLE_MARKER = "[acceptance evidence unavailable]";
+function applyUnavailableChecks(evaluation, criteria, unavailableCommands) {
+  const { unavailableChecks, ...rest } = evaluation;
+  const settled = rest;
+  const claims = (unavailableChecks ?? []).filter(({ criterion }) => criteria.includes(criterion));
+  if (claims.length === 0 || (settled.status ?? "evaluated") !== "evaluated") return settled;
+  const claimed = new Set(claims.map(({ criterion }) => criterion));
+  if (unavailableCommands.length === 0) {
+    return {
+      ...settled,
+      verdict: "fail",
+      violatedCriteria: [.../* @__PURE__ */ new Set([...settled.violatedCriteria, ...claimed])]
+    };
+  }
+  const violated = settled.violatedCriteria.filter((criterion) => !claimed.has(criterion));
+  if (violated.length > 0) return { ...settled, verdict: "fail", violatedCriteria: violated };
+  return {
+    ...settled,
+    status: "inconclusive",
+    verdict: "fail",
+    reasoning: `Critic could not evaluate the candidate: ${claims.length} ${claims.length === 1 ? "criterion needs" : "criteria need"} a command that could not start in this worktree (${unavailableCommands.map((command) => boundText(command, 120)).join("; ")}). ` + settled.reasoning,
+    violatedCriteria: [EVIDENCE_UNAVAILABLE_MARKER]
   };
 }
 function inconclusiveEvidenceVerdict(issues) {
@@ -92317,7 +92475,7 @@ function inconclusiveEvidenceVerdict(issues) {
     status: "inconclusive",
     verdict: "fail",
     reasoning: `Critic could not evaluate the candidate: ${detail}`,
-    violatedCriteria: ["[acceptance evidence unavailable]"]
+    violatedCriteria: [EVIDENCE_UNAVAILABLE_MARKER]
   };
 }
 function buildEvalPrompt(criteria, resultText, commandEvidence = null, repositoryEvidence = null, decisionDocument = null, segment, publishedNotes = [], hostRunsWholeTreeVerification = false, altitudeSection = null, writeSurface = null, established = []) {
@@ -92510,7 +92668,7 @@ function evidenceReadinessIssues(commandEvidence, repositoryEvidence) {
     issues.push("no terminal shell command evidence was observed");
   } else if (commandEvidence.commands && commandEvidence.commands.length > 0) {
     const hasUsableFreshTerminalCommand = commandEvidence.commands.some(
-      (command) => command.freshness === "fresh" && command.terminal && !command.sandboxBlocked
+      (command) => command.freshness === "fresh" && command.terminal && !command.sandboxBlocked && !command.toolUnavailable
     );
     if (!hasUsableFreshTerminalCommand) {
       if (commandEvidence.commands.some(
@@ -92526,8 +92684,13 @@ function evidenceReadinessIssues(commandEvidence, repositoryEvidence) {
       )) {
         issues.push("verification command was blocked by the sandbox");
       }
+      if (commandEvidence.commands.some(
+        (command) => command.toolUnavailable
+      )) {
+        issues.push(TOOL_UNAVAILABLE_ISSUE);
+      }
       if (!issues.some(
-        (issue2) => issue2 === STALE_COMMAND_EVIDENCE || issue2 === "a verification command has no terminal output" || issue2 === "verification command was blocked by the sandbox"
+        (issue2) => issue2 === STALE_COMMAND_EVIDENCE || issue2 === "a verification command has no terminal output" || issue2 === "verification command was blocked by the sandbox" || issue2 === TOOL_UNAVAILABLE_ISSUE
       )) {
         issues.push("command evidence has no usable fresh terminal command");
       }
@@ -92563,11 +92726,13 @@ function parseRenderedCommandEvidence(evidence) {
     const command = /^command:\s*(.+)$/m.exec(metadata)?.[1]?.trim() ?? "";
     const freshnessText = /^freshness:\s*(.+)$/m.exec(metadata)?.[1]?.trim();
     const freshness = freshnessText?.startsWith("fresh") === true ? "fresh" : freshnessText?.startsWith("STALE/UNVERIFIABLE") === true ? "unverifiable" : "stale";
+    const toolUnavailable = runtime === COULD_NOT_START_STATUS || outputLooksToolUnavailable(output);
     return {
       command,
-      terminal: runtime?.startsWith("completed;") === true,
+      terminal: runtime?.startsWith("completed;") === true || toolUnavailable,
       freshness,
-      sandboxBlocked: outputLooksSandboxBlocked(output)
+      sandboxBlocked: outputLooksSandboxBlocked(output),
+      toolUnavailable
     };
   });
 }
@@ -93040,6 +93205,11 @@ function shellCommandSegments(command) {
     (segment) => segment.trim().replace(/^\(+\s*/u, "").replace(/^(?:[A-Za-z_][A-Za-z0-9_]*=[^\s]+\s+)+/u, "")
   );
 }
+function outputLooksToolUnavailable(output) {
+  return /\b(?:exit(?:ed)?(?: with)? (?:code|status)|status=)\s*127\b|(?:^|\n)\s*(?:(?:ba|z|da)?sh|npm error|npx)(?::\s*(?:line\s*)?\d+)?:\s.*(?:command not found|: not found)\b|\bcommand not found: \S+|\bis not recognized as an internal or external command\b|\bspawn \S+ ENOENT\b/i.test(
+    output
+  );
+}
 function outputLooksSandboxBlocked(output) {
   return /sandbox-exec|operation not permitted|permission denied|seatbelt|denied by sandbox/i.test(
     output
@@ -93143,13 +93313,12 @@ var OneShotCritic = class extends BusMember {
   /** Turn raw evaluator text into a verdict; throw to mark inconclusive. */
   parseVerdict(text3) {
     const parsed = JSON.parse(extractVerdictJson(text3.trim()));
-    const conflicts = parseContractConflicts(parsed.contract_conflicts);
     return {
       status: "evaluated",
       verdict: parsed.verdict === "pass" ? "pass" : "fail",
       reasoning: parsed.reasoning ?? "",
       violatedCriteria: Array.isArray(parsed.violated_criteria) ? parsed.violated_criteria : [],
-      ...conflicts.length > 0 ? { contractConflicts: conflicts } : {}
+      ...parsedConflictFields(parsed.contract_conflicts)
     };
   }
   /**
@@ -93196,15 +93365,19 @@ var OneShotCritic = class extends BusMember {
         staleCommands = preparation.staleCommands;
         preparationReady = preparation.status === "ready";
         evaluation = preparationReady ? honorEstablished(
-          applyContractConflicts(
-            mergeSegmentVerdicts(
-              await Promise.all(
-                preparation.prompts.map(
-                  (prompt) => this.evaluate(prompt, agentId, turn)
+          applyUnavailableChecks(
+            applyContractConflicts(
+              mergeSegmentVerdicts(
+                await Promise.all(
+                  preparation.prompts.map(
+                    (prompt) => this.evaluate(prompt, agentId, turn)
+                  )
                 )
-              )
+              ),
+              criteria
             ),
-            criteria
+            criteria,
+            preparation.unavailableCommands
           ),
           preparation.established
         ) : inconclusiveEvidenceVerdict(preparation.issues);
@@ -93420,13 +93593,12 @@ var Critic = class extends OneShotCritic {
       }
       const verdictJson = extractVerdictJson(verdictText);
       const parsed = JSON.parse(verdictJson);
-      const conflicts = parseContractConflicts(parsed.contract_conflicts);
       return {
         status: "evaluated",
         verdict: parsed.verdict === "pass" ? "pass" : "fail",
         reasoning: parsed.reasoning ?? "",
         violatedCriteria: Array.isArray(parsed.violated_criteria) ? parsed.violated_criteria : [],
-        ...conflicts.length > 0 ? { contractConflicts: conflicts } : {},
+        ...parsedConflictFields(parsed.contract_conflicts),
         telemetry
       };
     } catch (err) {
@@ -94519,7 +94691,7 @@ function importAliases() {
 }
 
 // ../baro-orchestrator/src/harness/package-cache.ts
-import { mkdirSync as mkdirSync9, readdirSync as readdirSync10, realpathSync as realpathSync8 } from "fs";
+import { mkdirSync as mkdirSync9, readdirSync as readdirSync11, realpathSync as realpathSync8 } from "fs";
 import { homedir as homedir5 } from "os";
 import { join as join23 } from "path";
 function packageCacheRoot(env = process.env) {
@@ -94560,7 +94732,7 @@ function sharedDependencyTargets(worktreeRoot, depth = 4) {
   const scan = (dir, left) => {
     let entries;
     try {
-      entries = readdirSync10(dir, { withFileTypes: true });
+      entries = readdirSync11(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -95763,13 +95935,12 @@ ${prompt}`,
     if (!isCodexVerdict(parsed)) {
       throw new Error("Codex critic returned an invalid verdict object");
     }
-    const conflicts = parseContractConflicts(parsed.contract_conflicts);
     return {
       status: "evaluated",
       verdict: parsed.verdict,
       reasoning: parsed.reasoning,
       violatedCriteria: [...parsed.violated_criteria],
-      ...conflicts.length > 0 ? { contractConflicts: conflicts } : {}
+      ...parsedConflictFields(parsed.contract_conflicts)
     };
   }
 };
@@ -96366,15 +96537,19 @@ var CriticOpenAI = class extends BusMember {
         (fingerprint) => this.ledger.established(agentId, fingerprint)
       );
       const evaluation = preparation.status === "ready" ? honorEstablished(
-        applyContractConflicts(
-          mergeSegmentVerdicts(
-            await Promise.all(
-              preparation.prompts.map(
-                (prompt) => this.evaluate(prompt, agentId, turn, correlation)
+        applyUnavailableChecks(
+          applyContractConflicts(
+            mergeSegmentVerdicts(
+              await Promise.all(
+                preparation.prompts.map(
+                  (prompt) => this.evaluate(prompt, agentId, turn, correlation)
+                )
               )
-            )
+            ),
+            criteria
           ),
-          criteria
+          criteria,
+          preparation.unavailableCommands
         ),
         preparation.established
       ) : inconclusiveEvidenceVerdict(preparation.issues);
@@ -96523,13 +96698,12 @@ var CriticOpenAI = class extends BusMember {
       }
       const verdictJson = extractVerdictJson(assistantText);
       const parsed = JSON.parse(verdictJson);
-      const conflicts = parseContractConflicts(parsed.contract_conflicts);
       return {
         status: "evaluated",
         verdict: parsed.verdict === "pass" ? "pass" : "fail",
         reasoning: parsed.reasoning ?? "",
         violatedCriteria: Array.isArray(parsed.violated_criteria) ? parsed.violated_criteria : [],
-        ...conflicts.length > 0 ? { contractConflicts: conflicts } : {},
+        ...parsedConflictFields(parsed.contract_conflicts),
         telemetry
       };
     } catch (err) {
@@ -111499,7 +111673,7 @@ function nativeTurnUsage(usage) {
 }
 
 // ../baro-orchestrator/src/verification/cargo-target-prune.ts
-import { lstatSync as lstatSync9, readdirSync as readdirSync13, rmSync as rmSync8 } from "fs";
+import { lstatSync as lstatSync9, readdirSync as readdirSync14, rmSync as rmSync8 } from "fs";
 import { homedir as homedir10 } from "os";
 import { join as join33 } from "path";
 var CARGO_LEFTOVER_MAX_AGE_MS = 2 * 24 * 60 * 6e4;
@@ -111571,7 +111745,7 @@ function subdirs(path7) {
 }
 function list(path7) {
   try {
-    return readdirSync13(path7);
+    return readdirSync14(path7);
   } catch {
     return [];
   }
@@ -117097,7 +117271,9 @@ function summarizeGate(commands) {
   });
 }
 function gateFingerprint(outcome) {
-  return outcome.commands.map(({ label, passed, detail }) => `${label}\0${passed ? "1" : "0"}\0${detail}`).join("
");
+  return outcome.commands.map(
+    ({ label, passed, detail, timedOut }) => `${label}\0${timedOut ? "slow" : passed ? "1" : "0"}\0${timedOut ? "" : detail}`
+  ).join("
");
 }
 function shouldDeliverGate(previous, next) {
   if (next.commands.length === 0) return false;
@@ -117106,10 +117282,11 @@ function shouldDeliverGate(previous, next) {
 }
 function renderGateReport(outcome) {
   const lines = ["[baro] Your worktree was checked after your last change:"];
-  for (const { label, passed } of outcome.commands) {
-    lines.push(`  ${passed ? "PASS" : "FAIL"}  ${label}`);
+  for (const { label, passed, timedOut } of outcome.commands) {
+    lines.push(`  ${timedOut ? "SLOW" : passed ? "PASS" : "FAIL"}  ${label}`);
   }
-  const failures = outcome.commands.filter(({ passed }) => !passed);
+  const failures = outcome.commands.filter(({ passed, timedOut }) => !passed && !timedOut);
+  const unfinished = outcome.commands.filter(({ timedOut }) => timedOut);
   for (const failure of failures.slice(0, MAX_REPORTED_FAILURES)) {
     if (!failure.detail) continue;
     lines.push("", `--- ${failure.label} ---`, boundedDetail(failure.detail));
@@ -117121,6 +117298,12 @@ function renderGateReport(outcome) {
     "",
     outcome.allPassed ? "These are the project's own gates and they are green. You do not need to run them yourself." : "These are the project's own gates. You do not need to run them yourself \u2014 they are re-run and reported after every change you make."
   );
+  if (unfinished.length > 0) {
+    lines.push(
+      "",
+      `SLOW means the command did not finish within this gate's time limit: it says nothing about your change. Run the part of it your change needs yourself (${unfinished.map(({ label }) => label).join(", ")}).`
+    );
+  }
   return lines.join("\n");
 }
 function boundedDetail(detail) {
@@ -117138,6 +117321,14 @@ function gateCommandWasKilled(command) {
   const tail = command.tail ?? "";
   return /exited with code null/u.test(tail) || /signal: (killed|terminated)/u.test(tail);
 }
+function gateCommandOutcomes(commands) {
+  return commands.filter((command) => command.status !== "skipped").map((command) => ({
+    label: command.command,
+    passed: command.status === "passed",
+    detail: command.status === "passed" ? "" : command.tail ?? "",
+    ...command.status === "failed" && command.timedOut ? { timedOut: true } : {}
+  }));
+}
 var ContinuousGateRunner = class extends BusMember {
   constructor(opts) {
     super();
@@ -117243,16 +117434,13 @@ var ContinuousGateRunner = class extends BusMember {
       signal: this.controller.signal,
       ...this.opts.plan ? { plan: this.opts.plan } : {},
       ...this.opts.hostRepoRoot ? { hostRepoRoot: this.opts.hostRepoRoot } : {},
-      changedSince: baseSha
+      changedSince: baseSha,
+      scopeByPackage: true
     });
     if (result.commands.some((command) => gateCommandWasKilled(command))) {
       throw new Error("a gate command was killed before it reported");
     }
-    return result.commands.filter((command) => command.status !== "skipped").map((command) => ({
-      label: command.command,
-      passed: command.status === "passed",
-      detail: command.status === "passed" ? "" : command.tail ?? ""
-    }));
+    return gateCommandOutcomes(result.commands);
   }
   deliver(agentId, outcome) {
     const event = AgentTargetedMessage.create({