bigpowers 2.91.0 → 2.92.0

package/extensions/omp-hooks.ts

@@ -18,15 +18,152 @@ import { fileURLToPath } from "node:url";
 // only truly foreign entries (e.g. a stray node_modules symlink) need exclusion.
 const EXCLUDED_DIRS = new Set([".git", "node_modules"]);
 
-const DANGEROUS_PATTERNS = [
-  /git\s+reset\s+--hard/,
-  /git\s+clean\s+-f/,
-  /git\s+branch\s+-D/,
-  /git\s+checkout\s+\./,
-  /git\s+restore\s+\./,
-  /push\s+--force/,
-  /push\s+-f(?:\s|$)/,
-];
+// ---------------------------------------------------------------------------
+// Git argv normalization (BUG-2026-11-03-guard-git-flag-normalize, #184).
+//
+// Literal substring patterns cannot see a global flag in front of the
+// subcommand (`git -C repo reset --hard`), a flag between the subcommand and the
+// destructive option (`git reset -q --hard`), or an alternative spelling of the
+// same act (`git checkout -- .`, `git branch --delete --force`). Tokenize the
+// command, drop the global options, then judge (subcommand, arguments).
+//
+// scripts/lib/git-argv.py is the same rule table in Python for the shell hooks;
+// scripts/test-guard-git-normalize.sh fails if the two disagree on any fixture.
+// ---------------------------------------------------------------------------
+
+/** Quote-aware split; a quoting error degrades to whitespace splitting, never to eval. */
+export function tokenizeArgs(command: string): string[] {
+  const tokens: string[] = [];
+  let current = "";
+  let quote: '"' | "'" | null = null;
+  let hasToken = false;
+  for (let i = 0; i < command.length; i++) {
+    const ch = command[i];
+    if (quote) {
+      if (ch === quote) quote = null;
+      else current += ch;
+      continue;
+    }
+    if (ch === '"' || ch === "'") {
+      quote = ch as '"' | "'";
+      hasToken = true;
+      continue;
+    }
+    if (/\s/.test(ch)) {
+      if (hasToken) {
+        tokens.push(current);
+        current = "";
+        hasToken = false;
+      }
+      continue;
+    }
+    current += ch;
+    hasToken = true;
+  }
+  if (hasToken) tokens.push(current);
+  return tokens;
+}
+
+// Global options that consume the next token as their value.
+const GIT_VALUE_FLAGS = new Set([
+  "-C", "-c", "--exec-path", "--git-dir", "--work-tree", "--namespace",
+  "--super-prefix", "--config-env",
+]);
+
+// Global options that stand alone.
+const GIT_BARE_FLAGS = new Set([
+  "-p", "--paginate", "--no-pager", "--bare", "--no-replace-objects",
+  "--literal-pathspecs", "--glob-pathspecs", "--icase-pathspecs",
+  "--no-optional-locks", "--version", "--help",
+]);
+
+const SEPARATORS = new Set([";", "&&", "||", "|", "&", "(", ")", "\n"]);
+
+function shortFlagHas(args: string[], letter: string): boolean {
+  return args.some((a) => a.startsWith("-") && !a.startsWith("--") && a.slice(1).includes(letter));
+}
+
+/** Block reason for one normalized git invocation, or null. Mirror git-argv.py. */
+export function classifyGitInvocation(sub: string, args: string[]): string | null {
+  if (sub === "reset" && args.includes("--hard")) return "git reset --hard discards uncommitted work";
+  if (sub === "clean" && (shortFlagHas(args, "f") || args.includes("--force"))) {
+    return "git clean -f deletes untracked files";
+  }
+  if (sub === "branch") {
+    const forced =
+      args.includes("-D") ||
+      (args.includes("--delete") && (args.includes("--force") || shortFlagHas(args, "f")));
+    if (forced) return "git branch -D deletes an unmerged branch";
+  }
+  if (sub === "checkout") {
+    if (args.includes("-f") || args.includes("--force")) return "git checkout -f discards local changes";
+    if (args.includes(".")) return "git checkout . discards local changes";
+  }
+  if (sub === "restore" && (args.includes("--worktree") || args.includes("."))) {
+    return "git restore discards local changes";
+  }
+  if (sub === "push") {
+    const leased = args.some((a) => a === "--force-with-lease" || a.startsWith("--force-with-lease="));
+    const forced =
+      args.includes("-f") ||
+      args.includes("--force") ||
+      args.some((a) => a.startsWith("+") && !a.startsWith("++"));
+    if (forced && !leased) return "force push rewrites remote history";
+  }
+  return null;
+}
+
+/** Every (subcommand, args) pair in a command, with global options stripped. */
+export function gitInvocations(tokens: string[]): Array<{ sub: string; args: string[] }> {
+  const found: Array<{ sub: string; args: string[] }> = [];
+  let i = 0;
+  while (i < tokens.length) {
+    const token = tokens[i];
+    if (token.split("/").pop() !== "git") {
+      i += 1;
+      continue;
+    }
+    let j = i + 1;
+    while (j < tokens.length) {
+      const opt = tokens[j];
+      if (SEPARATORS.has(opt)) break;
+      const name = opt.split("=")[0];
+      if (GIT_VALUE_FLAGS.has(name)) {
+        j += opt.includes("=") ? 1 : 2;
+        continue;
+      }
+      if (GIT_BARE_FLAGS.has(name) || (opt.startsWith("-") && !opt.startsWith("--") && opt.length > 1)) {
+        j += 1;
+        continue;
+      }
+      break;
+    }
+    if (j >= tokens.length || SEPARATORS.has(tokens[j])) {
+      i = j + 1;
+      continue;
+    }
+    const sub = tokens[j];
+    const args: string[] = [];
+    let k = j + 1;
+    while (k < tokens.length && !SEPARATORS.has(tokens[k])) {
+      args.push(tokens[k]);
+      k += 1;
+    }
+    found.push({ sub, args });
+    i = k;
+  }
+  return found;
+}
+
+/** The normalized verdict for a whole shell command: a reason to block, or null. */
+export function dangerousGitCommand(command: string): string | null {
+  for (const { sub, args } of gitInvocations(tokenizeArgs(command))) {
+    const reason = classifyGitInvocation(sub, args);
+    if (reason) return reason;
+  }
+  return null;
+}
+
 
 // Conventional Commits specifies `type(scope)!:`, but many repositories write
 // `type!(scope):`. Accept both; the leading type is what matters.
@@ -224,6 +361,46 @@ function currentBranch(cwd: string): string {
   }
 }
 
+/** Everything the tool_call handler decides, as a pure function (testable). */
+export function evaluateBashCall(
+  command: string,
+  opts: {
+    landMode: boolean;
+    hasRepo: boolean;
+    branchFor: (upTo: number) => string | undefined;
+  },
+): string | null {
+  const gitReason = dangerousGitCommand(command);
+  if (gitReason) return `BLOCKED: ${gitReason}. Use a safer approach or ask the user.`;
+
+  if (!opts.hasRepo) return null;
+
+  const pushBranch = opts.branchFor(command.length) ?? "unknown";
+  if (/git\s+push/.test(command) && !opts.landMode && protectedPushTarget(command, pushBranch)) {
+    return "BLOCKED: Direct push to protected branch. Use kickoff-branch + release-branch.";
+  }
+
+  if (/git\s+commit/.test(command)) {
+    const commitBranches = [...command.matchAll(/\bgit\s+commit\b/g)].map(
+      (m) => opts.branchFor(m.index ?? 0) ?? "unknown",
+    );
+    const hit = commitBranches.find((b) => (PROTECTED_BRANCHES as readonly string[]).includes(b));
+    if (hit) {
+      return `BLOCKED: Direct commits to '${hit}' are forbidden. Use a feature branch.`;
+    }
+    const msg = extractCommitMessage(command);
+    if (msg) {
+      if (!CONVENTIONAL_RE.test(msg)) {
+        return `BLOCKED: Commit subject '${msg.split("\n")[0]}' must follow Conventional Commits: <type>(<scope>): <subject>.`;
+      }
+      if (msg.split("\n")[0].length > 72) {
+        return "BLOCKED: Commit subject line must be \u226472 characters.";
+      }
+    }
+  }
+  return null;
+}
+
 function protectedPushTarget(command: string, branch: string): boolean {
   if (PROTECTED_BRANCH_RE.test(command)) return true;
   const trimmed = command.trim();
@@ -414,55 +591,17 @@ export default function bigpowers(pi: ExtensionAPI) {
     const { command } = event.input as { command?: string };
     if (!command) return;
 
-    for (const pat of DANGEROUS_PATTERNS) {
-      if (pat.test(command)) {
-        return {
-          block: true,
-          reason: `BLOCKED: '${command}' matches dangerous pattern '${pat}'.`,
-        };
-      }
-    }
-
     const sessionRoot = process.cwd();
-    if (!inGitRepo(sessionRoot)) return;
-    const pushBranch = currentBranch(commandGitCwd(command, command.length, sessionRoot));
-
-    if (/git\s+push/.test(command) && protectedPushTarget(command, pushBranch)) {
-      return {
-        block: true,
-        reason:
-          "BLOCKED: Direct push to protected branch. Use kickoff-branch + release-branch.",
-      };
-    }
-
-    if (/git\s+commit/.test(command)) {
-      const commitBranches = [...command.matchAll(/\bgit\s+commit\b/g)].map((m) =>
-        currentBranch(commandGitCwd(command, m.index ?? 0, sessionRoot)),
-      );
-      const hit = commitBranches.find((b) =>
-        (PROTECTED_BRANCHES as readonly string[]).includes(b),
-      );
-      if (hit) {
-        return {
-          block: true,
-          reason: `BLOCKED: Direct commits to '${hit}' are forbidden. Use a feature branch.`,
-        };
-      }
-      const msg = extractCommitMessage(command);
-      if (msg) {
-        if (!CONVENTIONAL_RE.test(msg)) {
-          return {
-            block: true,
-            reason: `BLOCKED: Commit subject '${msg.split("\n")[0]}' must follow Conventional Commits: <type>(<scope>): <subject>.`,
-          };
-        }
-        if (msg.split("\n")[0].length > 72) {
-          return {
-            block: true,
-            reason: "BLOCKED: Commit subject line must be ≤72 characters.",
-          };
-        }
-      }
-    }
+    const verdict = evaluateBashCall(command, {
+      landMode: process.env.GIT_BIGPOWERS_LAND === "1",
+      // `undefined` means "there is no repo here"; the guard then only judges
+      // the argv rules, which need no branch.
+      branchFor: (upTo: number) =>
+        inGitRepo(sessionRoot)
+          ? currentBranch(commandGitCwd(command, upTo, sessionRoot))
+          : undefined,
+      hasRepo: inGitRepo(sessionRoot),
+    });
+    if (verdict) return { block: true, reason: verdict };
   });
 }

package/hooks/pre/bash.sh

@@ -11,7 +11,8 @@ INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.command // .tool_input.command // empty' 2>/dev/null || true)
 [ -z "$COMMAND" ] && exit 0
 
-DANGEROUS_PATTERNS=(
+# Last-resort literals, used only when the normalizer is unreachable.
+LEGACY_DANGEROUS=(
   "git reset --hard"
   "git clean -f"
   "git branch -D"
@@ -19,18 +20,64 @@ DANGEROUS_PATTERNS=(
   "push -f"
 )
 PROTECTED_BRANCHES=("main" "master")
+COMMIT_MSG_RE='-m[[:space:]]+"([^"]+)"'
 CONVENTIONAL_RE='^(feat|fix|docs|style|refactor|perf|test|build|ci|chore|revert)(\([^)]+\))?!?:[[:space:]].+'
 
-for p in "${DANGEROUS_PATTERNS[@]}"; do
-  if echo "$COMMAND" | grep -qE "$p"; then
-    printf '{"decision":"block","reason":"BLOCKED: dangerous pattern %q"}\n' "$p"
-    exit 0
+# --- Normalized git argv (BUG-2026-11-03-guard-git-flag-normalize, #184) ------
+# Literal substring matching cannot see a global flag in front of the subcommand
+# or a flag between the subcommand and the destructive option: the destructive
+# tokens are all still there, only their position changed. The rules live in
+# scripts/lib/git-argv.py and are mirrored in extensions/omp-hooks.ts;
+# scripts/test-guard-git-normalize.sh fails if the two disagree on any fixture.
+SELF_PATH="${BASH_SOURCE[0]}"
+# Only pay for realpath when the hook actually is a symlink (installed copies).
+# This hook runs on every tool call, so a spawn per invocation is real latency.
+if [ -L "$SELF_PATH" ] && command -v python3 >/dev/null 2>&1; then
+  SELF_PATH="$(python3 -c 'import os,sys;print(os.path.realpath(sys.argv[1]))' "$SELF_PATH" 2>/dev/null || echo "$SELF_PATH")"
+fi
+GUARD_ROOT="$(cd "$(dirname "$SELF_PATH")/.." 2>/dev/null && pwd -P || true)"
+GIT_ARGV="$GUARD_ROOT/scripts/lib/git-argv.py"
+
+# classify_git_argv <command>: echoes "block: <reason>" or nothing.
+# Fast path: a command with no "git" token cannot contain a git invocation, so
+# the helper (a python start) is skipped. Falls back to the legacy literal
+# patterns when the helper is unreachable (hook symlinked outside the package).
+classify_git_argv() {
+  local cmd="$1" out=""
+  case "$cmd" in
+    *git*) ;;
+    *) return 0 ;;
+  esac
+  if command -v python3 >/dev/null 2>&1 && [ -f "$GIT_ARGV" ]; then
+    out="$(python3 "$GIT_ARGV" --command "$cmd" 2>/dev/null || true)"
+    case "$out" in
+      block:*) printf '%s' "$out"; return 0 ;;
+      *) return 0 ;;
+    esac
   fi
-done
+  return 0
+}
+
+GIT_VERDICT="$(classify_git_argv "$COMMAND")"
+if [ -n "$GIT_VERDICT" ]; then
+  printf '{"decision":"block","reason":"BLOCKED: %s"}\n' "${GIT_VERDICT#block: }"
+  exit 0
+fi
+if [ ! -f "$GIT_ARGV" ]; then
+  for p in "${LEGACY_DANGEROUS[@]}"; do
+    if echo "$COMMAND" | grep -qE "$p"; then
+      printf '{"decision":"block","reason":"BLOCKED: dangerous pattern %q"}\n' "$p"
+      exit 0
+    fi
+  done
+fi
 
 if [[ "$COMMAND" =~ git[[:space:]]+commit ]]; then
   MSG=""
-  if [[ "$COMMAND" =~ -m[[:space:]]+"([^"]+)" ]]; then MSG="${BASH_REMATCH[1]}"; fi
+  # Parentheses inside [[ =~ ]] must come from a variable, not the literal
+  # pattern: bash parses `([^"]+)` as a syntax error (pre-existing since #118,
+  # so this fallback hook never ran; BUG-2026-11-03-guard-git-flag-normalize).
+  if [[ "$COMMAND" =~ $COMMIT_MSG_RE ]]; then MSG="${BASH_REMATCH[1]}"; fi
   if [ -n "$MSG" ] && [[ ! "$MSG" =~ $CONVENTIONAL_RE ]]; then
     echo '{"decision":"block","reason":"BLOCKED: Conventional Commits required"}'
     exit 0

package/hooks/pre-tool-use.sh

@@ -11,16 +11,13 @@ set -euo pipefail
 
 # Configuration
 PROTECTED_BRANCHES=("main" "master")
-DANGEROUS_PATTERNS=(
+# Last-resort literals, used only when the normalizer is unreachable.
+LEGACY_DANGEROUS=(
   "git reset --hard"
-  "git clean -fd"
   "git clean -f"
   "git branch -D"
-  "git checkout \\."
-  "git restore \\."
   "push --force"
   "push -f"
-  "reset --hard"
 )
 CONVENTIONAL_COMMITS_REGEX='^(feat|fix|docs|style|refactor|perf|test|build|ci|chore|revert)(\(.+\))?!?:[[:space:]].+'
 LAND_MODE="${GIT_BIGPOWERS_LAND:-}"
@@ -29,6 +26,41 @@ LAND_MODE="${GIT_BIGPOWERS_LAND:-}"
 # GIT_GUARDRAILS_MODE: claude (default) | cursor | gemini
 MODE="${GIT_GUARDRAILS_MODE:-claude}"
 
+# --- Normalized git argv (BUG-2026-11-03-guard-git-flag-normalize, #184) ------
+# Literal substring matching cannot see a global flag in front of the subcommand
+# or a flag between the subcommand and the destructive option: the destructive
+# tokens are all still there, only their position changed. The rules live in
+# scripts/lib/git-argv.py and are mirrored in extensions/omp-hooks.ts;
+# scripts/test-guard-git-normalize.sh fails if the two disagree on any fixture.
+SELF_PATH="${BASH_SOURCE[0]}"
+# Only pay for realpath when the hook actually is a symlink (installed copies).
+# This hook runs on every tool call, so a spawn per invocation is real latency.
+if [ -L "$SELF_PATH" ] && command -v python3 >/dev/null 2>&1; then
+  SELF_PATH="$(python3 -c 'import os,sys;print(os.path.realpath(sys.argv[1]))' "$SELF_PATH" 2>/dev/null || echo "$SELF_PATH")"
+fi
+GUARD_ROOT="$(cd "$(dirname "$SELF_PATH")/.." 2>/dev/null && pwd -P || true)"
+GIT_ARGV="$GUARD_ROOT/scripts/lib/git-argv.py"
+
+# classify_git_argv <command>: echoes "block: <reason>" or nothing.
+# Fast path: a command with no "git" token cannot contain a git invocation, so
+# the helper (a python start) is skipped. Falls back to the legacy literal
+# patterns when the helper is unreachable (hook symlinked outside the package).
+classify_git_argv() {
+  local cmd="$1" out=""
+  case "$cmd" in
+    *git*) ;;
+    *) return 0 ;;
+  esac
+  if command -v python3 >/dev/null 2>&1 && [ -f "$GIT_ARGV" ]; then
+    out="$(python3 "$GIT_ARGV" --command "$cmd" 2>/dev/null || true)"
+    case "$out" in
+      block:*) printf '%s' "$out"; return 0 ;;
+      *) return 0 ;;
+    esac
+  fi
+  return 0
+}
+
 deny() {
   local reason="$1"
   if [ "$MODE" = "gemini" ]; then
@@ -72,12 +104,18 @@ if [ -z "$COMMAND" ]; then
   exit 0
 fi
 
-# 1. Check for dangerous patterns (git push is NOT blanket-blocked)
-for p in "${DANGEROUS_PATTERNS[@]}"; do
-  if echo "$COMMAND" | grep -qE "$p"; then
-    deny "BLOCKED: '$COMMAND' matches dangerous pattern '$p'. Use a safer approach or ask the user."
-  fi
-done
+# 1. Normalized git argv (git push is NOT blanket-blocked)
+GIT_VERDICT="$(classify_git_argv "$COMMAND")"
+if [ -n "$GIT_VERDICT" ]; then
+  deny "BLOCKED: ${GIT_VERDICT#block: }. Use a safer approach or ask the user."
+fi
+if [ ! -f "$GIT_ARGV" ]; then
+  for p in "${LEGACY_DANGEROUS[@]}"; do
+    if echo "$COMMAND" | grep -qE "$p"; then
+      deny "BLOCKED: '$COMMAND' matches dangerous pattern '$p'. Use a safer approach or ask the user."
+    fi
+  done
+fi
 
 # 2. Check for git commit / git push
 if [[ "$COMMAND" =~ git[[:space:]]+commit ]] || [[ "$COMMAND" =~ git[[:space:]]+push ]]; then

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bigpowers",
-  "version": "2.91.0",
+  "version": "2.92.0",
   "description": "73 agent skills synthesizing 17 years of software engineering discipline into a prescriptive methodology for solo developers",
   "main": "index.js",
   "scripts": {

package/scripts/ab-sandbox.sh

@@ -15,7 +15,7 @@ INTERNAL_NET="bp-ab-internal"
 EGRESS_NET="bp-ab-egress"
 ASSETS="$(cd "$(dirname "${BASH_SOURCE[0]}")/lib/ab-sandbox" && pwd)"
 
-die() { echo "ERROR: $*" >&2; exit 1; }
+sandbox_die() { echo "ERROR: $*" >&2; exit 1; }
 
 have_image() { docker image inspect "$1" >/dev/null 2>&1; }
 have_net() { docker network inspect "$1" >/dev/null 2>&1; }
@@ -43,7 +43,7 @@ wait_for_proxy() {
     sleep 1
   done
   docker logs "$PROXY_NAME" >&2 || true
-  die "proxy did not start listening"
+  sandbox_die "proxy did not start listening"
 }
 
 cmd_up() {
@@ -81,5 +81,5 @@ case "${1:-status}" in
   up) cmd_up ;;
   down) cmd_down ;;
   status) cmd_status ;;
-  *) die "usage: $(basename "$0") up|down|status" ;;
+  *) sandbox_die "usage: $(basename "$0") up|down|status" ;;
 esac

package/scripts/adapters/agy.sh

@@ -38,7 +38,7 @@ wire_context() {
 }
 
 # If stdin is a pipe/redirect, read the SkillIR JSON and render
-if [[ ! -t 0 ]]; then
+if [[ "${BASH_SOURCE[0]}" == "${0}" ]] && [[ ! -t 0 ]]; then
   JSON_INPUT=$(cat)
   if [[ -n "$JSON_INPUT" ]]; then
     IR_NAME=$(echo "$JSON_INPUT" | jq -r '.name')

package/scripts/adapters/cursor.sh

@@ -29,7 +29,7 @@ wire_context() {
 }
 
 # If stdin is a pipe/redirect, read the SkillIR JSON and render
-if [[ ! -t 0 ]]; then
+if [[ "${BASH_SOURCE[0]}" == "${0}" ]] && [[ ! -t 0 ]]; then
   JSON_INPUT=$(cat)
   if [[ -n "$JSON_INPUT" ]]; then
     IR_NAME=$(echo "$JSON_INPUT" | jq -r '.name')

package/scripts/adapters/gemini.sh

@@ -101,7 +101,7 @@ if [[ "${1:-}" == "--list-hook-events" ]]; then
 fi
 
 # If stdin is a pipe/redirect, read the SkillIR JSON and render
-if [[ ! -t 0 ]]; then
+if [[ "${BASH_SOURCE[0]}" == "${0}" ]] && [[ ! -t 0 ]]; then
   JSON_INPUT=$(cat)
   if [[ -n "$JSON_INPUT" ]]; then
     IR_NAME=$(echo "$JSON_INPUT" | jq -r '.name')

package/scripts/adapters/mimo.sh

@@ -30,7 +30,7 @@ wire_context() {
 }
 
 # If stdin is a pipe/redirect, read the SkillIR JSON and render
-if [[ ! -t 0 ]]; then
+if [[ "${BASH_SOURCE[0]}" == "${0}" ]] && [[ ! -t 0 ]]; then
   JSON_INPUT=$(cat)
   if [[ -n "$JSON_INPUT" ]]; then
     IR_NAME=$(echo "$JSON_INPUT" | jq -r '.name')

package/scripts/adapters/pi.sh

@@ -41,7 +41,7 @@ wire_context() {
 }
 
 # If stdin is a pipe/redirect, read the SkillIR JSON and render
-if [[ ! -t 0 ]]; then
+if [[ "${BASH_SOURCE[0]}" == "${0}" ]] && [[ ! -t 0 ]]; then
   JSON_INPUT=$(cat)
   if [[ -n "$JSON_INPUT" ]]; then
     IR_NAME=$(echo "$JSON_INPUT" | jq -r '.name')

package/scripts/adapters/zcode.sh

@@ -27,7 +27,7 @@ wire_context() {
 }
 
 # If stdin is a pipe/redirect, read the SkillIR JSON and render
-if [[ ! -t 0 ]]; then
+if [[ "${BASH_SOURCE[0]}" == "${0}" ]] && [[ ! -t 0 ]]; then
   JSON_INPUT=$(cat)
   if [[ -n "$JSON_INPUT" ]]; then
     IR_NAME=$(echo "$JSON_INPUT" | jq -r '.name')

package/scripts/generate-context-bundle.sh

@@ -51,7 +51,8 @@ while IFS= read -r row; do
 
   adapter_script="$SCRIPT_DIR/adapters/${adapter}.sh"
   # shellcheck source=/dev/null
-  source "$adapter_script"
+  # stdin is this loop's target list: an adapter that reads stdin when sourced would swallow it.
+  source "$adapter_script" </dev/null
   case "$mode" in
     symlink) wire_context_mode symlink "$file" ;;
     copy) wire_context_mode copy "$file" ;;

package/scripts/lib/ab-eval.py

@@ -1,5 +1,5 @@
 #!/usr/bin/env python3
-# story: e58s01 e58s02 e58s03 e58s05 e58s06 e58s07
+# story: e58s01 e58s02 e58s03 e58s05 e58s06 e58s07 e58s08 e58s09
 """A/B eval: run the same tasks with and without bigpowers and grade only the outcome.
 
 Each run gets a fresh temp git workdir (outside the repo) copied from the task fixture.
@@ -25,7 +25,9 @@ from pathlib import Path
 import yaml
 
 sys.path.insert(0, str(Path(__file__).resolve().parent))
-from ab_metrics import parse_metrics, tap_score  # type: ignore[import]  # noqa: E402
+from ab_metrics import parse_metrics, tap_score, tap_failures, tap_failed_names  # type: ignore[import]  # noqa: E402
+from ab_vsm import vsm_from  # type: ignore[import]  # noqa: E402
+from ab_waste import waste_for  # type: ignore[import]  # noqa: E402
 from ab_report import (  # type: ignore[import]  # noqa: E402
     BOOTSTRAP_RESAMPLES, BOOTSTRAP_SEED, aggregate, bigpowers_sha, print_summary, write_reports,
 )
@@ -180,6 +182,8 @@ def run_once(task: dict, arm: str, setup: str, adapter: dict, model: str | None,
 
         tampered, protected_added = protected_changes(workdir, before)
         diff = changed_lines(workdir, base)
+        waste = waste_for(workdir, base, stdout, adapter.get("parser", "none"), task["dir"],
+                          trace_dir / f"{task['id']}-{arm}-{run_idx}.patch.gz" if trace_dir else None)
         shutil.copytree(task["dir"] / "hidden", workdir, dirs_exist_ok=True)
         cmd, genv = grade_cmd(adapter, task["grade"], env)
         passed = sh(cmd, workdir, genv, timeout=300).returncode == 0
@@ -187,12 +191,22 @@ def run_once(task: dict, arm: str, setup: str, adapter: dict, model: str | None,
         if task.get("score"):
             cmd, genv = grade_cmd(adapter, task["score"], env)
             score = tap_score(sh(cmd, workdir, genv, timeout=300).stdout)
+        bugs_opened = 0
+        bug_details = []
+        if task.get("audit"):
+            if (task["dir"] / "audit").is_dir():
+                shutil.copytree(task["dir"] / "audit", workdir, dirs_exist_ok=True)
+            cmd, genv = grade_cmd(adapter, task["audit"], env)
+            out = sh(cmd, workdir, genv, timeout=300).stdout
+            bugs_opened = tap_failures(out)
+            bug_details = tap_failed_names(out)
         metrics = parse_metrics(adapter.get("parser", "none"), stdout)
         return {
-            "task": task["id"], "arm": arm, "run": run_idx, "pass": passed, "score": score, "tampered": tampered,
+            "task": task["id"], "arm": arm, "run": run_idx, "pass": passed, "score": score,
+            "bugs_opened": bugs_opened, "bug_details": bug_details, "tampered": tampered,
             "protected_lines_added": protected_added, "diff_lines": diff, "duration_s": duration, "agent_exit": exit_code,
             "agent_error": timed_out or exit_code != 0 or bool(metrics.pop("agent_reported_error")),
-            "timed_out": timed_out, **metrics,
+            "timed_out": timed_out, "vsm": vsm_from(adapter.get("parser", "none"), stdout), "waste": waste, **metrics,
         }
     finally:
         shutil.rmtree(home, ignore_errors=True)
@@ -262,7 +276,7 @@ def main(argv: list[str] | None = None) -> int:
                     with live.open("a") as f:
                         f.write(json.dumps({**rec, "bigpowers_sha": sha, "model": model}) + "\n")
                     print(f"  {task['id']:<8} {arm:<10} run {i}: {'PASS' if rec['pass'] else 'FAIL'}"
-                          f"{' TAMPERED' if rec['tampered'] else ''}{' AGENT-ERROR' if rec['agent_error'] else ''}")
+                          f"{' TAMPERED' if rec['tampered'] else ''}{' AGENT-ERROR' if rec['agent_error'] else ''}", flush=True)
     except ConfigError as exc:
         print(f"ERROR: {exc}")
         return 2