claudecode-omc 4.4.10 → 4.7.4

package/dist/hooks/factcheck/checks.js

@@ -0,0 +1,144 @@
+/**
+ * Factcheck Guard - Individual Check Functions
+ *
+ * Each function validates a specific aspect of the claims payload and
+ * returns a list of mismatches. Ported from factcheck.py.
+ */
+import { existsSync } from 'fs';
+import { resolve } from 'path';
+import { REQUIRED_FIELDS, REQUIRED_GATES } from './types.js';
+// ---------------------------------------------------------------------------
+// Schema validation
+// ---------------------------------------------------------------------------
+/**
+ * Check for missing required top-level fields.
+ */
+export function checkMissingFields(claims) {
+    const missing = [];
+    for (const field of REQUIRED_FIELDS) {
+        if (!(field in claims)) {
+            missing.push(field);
+        }
+    }
+    return missing.sort();
+}
+/**
+ * Check for missing required gates.
+ */
+export function checkMissingGates(claims) {
+    const gates = (claims.gates ?? {});
+    const missing = [];
+    for (const gate of REQUIRED_GATES) {
+        if (!(gate in gates)) {
+            missing.push(gate);
+        }
+    }
+    return missing.sort();
+}
+// ---------------------------------------------------------------------------
+// Gate checks
+// ---------------------------------------------------------------------------
+/**
+ * Get required gates that are false.
+ */
+export function getFalseGates(claims) {
+    const gates = (claims.gates ?? {});
+    const falseGates = [];
+    for (const gate of REQUIRED_GATES) {
+        if (gate in gates && !gates[gate]) {
+            falseGates.push(gate);
+        }
+    }
+    return falseGates.sort();
+}
+/**
+ * Count source files (modified + created).
+ */
+export function sourceFileCount(claims) {
+    const modified = claims.files_modified ?? [];
+    const created = claims.files_created ?? [];
+    return modified.length + created.length;
+}
+// ---------------------------------------------------------------------------
+// Path checks
+// ---------------------------------------------------------------------------
+/**
+ * Check file paths for forbidden prefixes/substrings and existence.
+ */
+export function checkPaths(claims, policy) {
+    const out = [];
+    const allPaths = [
+        ...(claims.files_modified ?? []),
+        ...(claims.files_created ?? []),
+        ...(claims.artifacts_expected ?? []),
+    ];
+    const deleted = new Set(claims.files_deleted ?? []);
+    for (const pathStr of allPaths) {
+        if (deleted.has(pathStr))
+            continue;
+        let prefixBlocked = false;
+        for (const prefix of policy.forbidden_path_prefixes) {
+            if (pathStr.startsWith(prefix)) {
+                out.push({ check: 'H', severity: 'FAIL', detail: `Forbidden path prefix: ${pathStr}` });
+                prefixBlocked = true;
+                break;
+            }
+        }
+        if (!prefixBlocked) {
+            for (const fragment of policy.forbidden_path_substrings) {
+                if (pathStr.includes(fragment)) {
+                    out.push({ check: 'H', severity: 'FAIL', detail: `Forbidden path fragment: ${pathStr}` });
+                    break;
+                }
+            }
+        }
+        if (!existsSync(pathStr)) {
+            out.push({ check: 'C', severity: 'FAIL', detail: `File not found: ${pathStr}` });
+        }
+    }
+    return out;
+}
+// ---------------------------------------------------------------------------
+// Command checks
+// ---------------------------------------------------------------------------
+/**
+ * Check executed commands for forbidden mutating operations.
+ */
+export function checkCommands(claims, policy) {
+    const out = [];
+    const commands = (claims.commands_executed ?? []).map(String);
+    for (const cmd of commands) {
+        const hitPrefix = policy.forbidden_path_prefixes.some(forbidden => cmd.includes(forbidden));
+        if (!hitPrefix)
+            continue;
+        const stripped = cmd.trim().replace(/^\(/, '');
+        const isReadOnly = policy.readonly_command_prefixes.some(prefix => stripped.startsWith(prefix));
+        if (!isReadOnly) {
+            out.push({ check: 'H', severity: 'FAIL', detail: `Forbidden mutating command: ${cmd}` });
+        }
+    }
+    return out;
+}
+// ---------------------------------------------------------------------------
+// CWD parity check
+// ---------------------------------------------------------------------------
+/**
+ * Check that claims.cwd matches the runtime working directory.
+ */
+export function checkCwdParity(claimsCwd, runtimeCwd, mode, policy) {
+    const enforceCwd = policy.warn_on_cwd_mismatch && (mode !== 'quick' || policy.enforce_cwd_parity_in_quick);
+    if (!enforceCwd || !claimsCwd)
+        return null;
+    const claimsCwdCanonical = resolve(claimsCwd);
+    const runtimeCwdCanonical = resolve(runtimeCwd);
+    if (claimsCwdCanonical !== runtimeCwdCanonical) {
+        const severity = mode === 'strict' ? 'FAIL' : 'WARN';
+        return {
+            check: 'argv_parity',
+            severity,
+            detail: `claims.cwd=${claimsCwdCanonical} runtime.cwd=${runtimeCwdCanonical}`,
+        };
+    }
+    return null;
+}
+//# sourceMappingURL=checks.js.map

package/dist/hooks/factcheck/checks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checks.js","sourceRoot":"","sources":["../../../src/hooks/factcheck/checks.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAChC,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAM/B,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE7D,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAA+B;IAChE,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;QACpC,IAAI,CAAC,CAAC,KAAK,IAAI,MAAM,CAAC,EAAE,CAAC;YACvB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC,IAAI,EAAE,CAAC;AACxB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAA+B;IAC/D,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAA4B,CAAC;IAC9D,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;QAClC,IAAI,CAAC,CAAC,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;YACrB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC,IAAI,EAAE,CAAC;AACxB,CAAC;AAED,8EAA8E;AAC9E,cAAc;AACd,8EAA8E;AAE9E;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,MAA+B;IAC3D,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAA4B,CAAC;IAC9D,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;QAClC,IAAI,IAAI,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,MAA+B;IAC7D,MAAM,QAAQ,GAAI,MAAM,CAAC,cAA2B,IAAI,EAAE,CAAC;IAC3D,MAAM,OAAO,GAAI,MAAM,CAAC,aAA0B,IAAI,EAAE,CAAC;IACzD,OAAO,QAAQ,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;AAC1C,CAAC;AAED,8EAA8E;AAC9E,cAAc;AACd,8EAA8E;AAE9E;;GAEG;AACH,MAAM,UAAU,UAAU,CACxB,MAA+B,EAC/B,MAAuB;IAEvB,MAAM,GAAG,GAAe,EAAE,CAAC;IAE3B,MAAM,QAAQ,GAAa;QACzB,GAAG,CAAE,MAAM,CAAC,cAA2B,IAAI,EAAE,CAAC;QAC9C,GAAG,CAAE,MAAM,CAAC,aAA0B,IAAI,EAAE,CAAC;QAC7C,GAAG,CAAE,MAAM,CAAC,kBAA+B,IAAI,EAAE,CAAC;KACnD,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,GAAG,CAAE,MAAM,CAAC,aAA0B,IAAI,EAAE,CAAC,CAAC;IAElE,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,SAAS;QAEnC,IAAI,aAAa,GAAG,KAAK,CAAC;QAC1B,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,uBAAuB,EAAE,CAAC;YACpD,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC/B,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,0BAA0B,OAAO,EAAE,EAAE,CAAC,CAAC;gBACxF,aAAa,GAAG,IAAI,CAAC;gBACrB,MAAM;YACR,CAAC;QACH,CAAC;QAED,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,yBAAyB,EAAE,CAAC;gBACxD,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAC/B,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,4BAA4B,OAAO,EAAE,EAAE,CAAC,CAAC;oBAC1F,MAAM;gBACR,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACzB,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,OAAO,EAAE,EAAE,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;GAEG;AACH,MAAM,UAAU,aAAa,CAC3B,MAA+B,EAC/B,MAAuB;IAEvB,MAAM,GAAG,GAAe,EAAE,CAAC;IAC3B,MAAM,QAAQ,GAAG,CAAE,MAAM,CAAC,iBAA8B,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAE5E,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,SAAS,GAAG,MAAM,CAAC,uBAAuB,CAAC,IAAI,CACnD,SAAS,CAAC,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CACrC,CAAC;QACF,IAAI,CAAC,SAAS;YAAE,SAAS;QAEzB,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC/C,MAAM,UAAU,GAAG,MAAM,CAAC,yBAAyB,CAAC,IAAI,CACtD,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CACtC,CAAC;QACF,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,+BAA+B,GAAG,EAAE,EAAE,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E;;GAEG;AACH,MAAM,UAAU,cAAc,CAC5B,SAAiB,EACjB,UAAkB,EAClB,IAAmB,EACnB,MAAuB;IAEvB,MAAM,UAAU,GAAG,MAAM,CAAC,oBAAoB,IAAI,CAChD,IAAI,KAAK,OAAO,IAAI,MAAM,CAAC,2BAA2B,CACvD,CAAC;IAEF,IAAI,CAAC,UAAU,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAE3C,MAAM,kBAAkB,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,mBAAmB,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAEhD,IAAI,kBAAkB,KAAK,mBAAmB,EAAE,CAAC;QAC/C,MAAM,QAAQ,GAAG,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;QACrD,OAAO;YACL,KAAK,EAAE,aAAa;YACpB,QAAQ;YACR,MAAM,EAAE,cAAc,kBAAkB,gBAAgB,mBAAmB,EAAE;SAC9E,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/hooks/factcheck/config.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Factcheck Guard Configuration
+ *
+ * Loads guard config from the OMC config system with token expansion
+ * and deep merge over sensible defaults.
+ */
+import type { GuardsConfig } from './types.js';
+export declare const DEFAULT_GUARDS_CONFIG: GuardsConfig;
+/**
+ * Expand ${HOME} and ${WORKSPACE} tokens in a string.
+ */
+export declare function expandTokens(value: string, workspace?: string): string;
+/**
+ * Load guards config from the OMC config system.
+ *
+ * Reads the `guards` key from the merged OMC config, deep-merges over
+ * defaults, and expands ${HOME}/${WORKSPACE} tokens.
+ */
+export declare function loadGuardsConfig(workspace?: string): GuardsConfig;
+/**
+ * Check if a project name matches any strict project patterns.
+ * Uses simple glob-style matching (supports * wildcard).
+ */
+export declare function shouldUseStrictMode(projectName: string, patterns: string[]): boolean;
+//# sourceMappingURL=config.d.ts.map

package/dist/hooks/factcheck/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../src/hooks/factcheck/config.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,YAAY,EAAmC,MAAM,YAAY,CAAC;AA+BhF,eAAO,MAAM,qBAAqB,EAAE,YAGnC,CAAC;AAMF;;GAEG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAMtE;AAqDD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,YAAY,CAUjE;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAAE,GACjB,OAAO,CAUT"}

package/dist/hooks/factcheck/config.js

@@ -0,0 +1,125 @@
+/**
+ * Factcheck Guard Configuration
+ *
+ * Loads guard config from the OMC config system with token expansion
+ * and deep merge over sensible defaults.
+ */
+import { homedir } from 'os';
+import { loadConfig } from '../../config/loader.js';
+// ---------------------------------------------------------------------------
+// Defaults
+// ---------------------------------------------------------------------------
+const DEFAULT_FACTCHECK_POLICY = {
+    enabled: false,
+    mode: 'quick',
+    strict_project_patterns: [],
+    forbidden_path_prefixes: ['${HOME}/.claude/plugins/cache/omc/'],
+    forbidden_path_substrings: ['/.omc/', '.omc-config.json'],
+    readonly_command_prefixes: [
+        'ls ', 'cat ', 'find ', 'grep ', 'head ', 'tail ', 'stat ', 'echo ', 'wc ',
+    ],
+    warn_on_cwd_mismatch: true,
+    enforce_cwd_parity_in_quick: false,
+    warn_on_unverified_gates: true,
+    warn_on_unverified_gates_when_no_source_files: false,
+};
+const DEFAULT_SENTINEL_POLICY = {
+    enabled: false,
+    readiness: {
+        min_pass_rate: 0.60,
+        max_timeout_rate: 0.10,
+        max_warn_plus_fail_rate: 0.40,
+        min_reason_coverage_rate: 0.95,
+    },
+};
+export const DEFAULT_GUARDS_CONFIG = {
+    factcheck: { ...DEFAULT_FACTCHECK_POLICY },
+    sentinel: { ...DEFAULT_SENTINEL_POLICY },
+};
+// ---------------------------------------------------------------------------
+// Token expansion
+// ---------------------------------------------------------------------------
+/**
+ * Expand ${HOME} and ${WORKSPACE} tokens in a string.
+ */
+export function expandTokens(value, workspace) {
+    const home = homedir();
+    const ws = workspace ?? process.env.OMC_WORKSPACE ?? process.cwd();
+    return value
+        .replace(/\$\{HOME\}/g, home)
+        .replace(/\$\{WORKSPACE\}/g, ws);
+}
+/**
+ * Recursively expand tokens in string values within an object or array.
+ */
+function expandTokensDeep(obj, workspace) {
+    if (typeof obj === 'string') {
+        return expandTokens(obj, workspace);
+    }
+    if (Array.isArray(obj)) {
+        return obj.map(item => expandTokensDeep(item, workspace));
+    }
+    if (typeof obj === 'object' && obj !== null) {
+        const result = {};
+        for (const [key, value] of Object.entries(obj)) {
+            result[key] = expandTokensDeep(value, workspace);
+        }
+        return result;
+    }
+    return obj;
+}
+// ---------------------------------------------------------------------------
+// Deep merge (local, type-safe for guards config)
+// ---------------------------------------------------------------------------
+function deepMergeGuards(target, source) {
+    const result = { ...target };
+    if (source.factcheck) {
+        result.factcheck = { ...result.factcheck, ...source.factcheck };
+    }
+    if (source.sentinel) {
+        result.sentinel = {
+            ...result.sentinel,
+            ...source.sentinel,
+            readiness: {
+                ...result.sentinel.readiness,
+                ...(source.sentinel.readiness ?? {}),
+            },
+        };
+    }
+    return result;
+}
+// ---------------------------------------------------------------------------
+// Public API
+// ---------------------------------------------------------------------------
+/**
+ * Load guards config from the OMC config system.
+ *
+ * Reads the `guards` key from the merged OMC config, deep-merges over
+ * defaults, and expands ${HOME}/${WORKSPACE} tokens.
+ */
+export function loadGuardsConfig(workspace) {
+    try {
+        const fullConfig = loadConfig();
+        const guardsRaw = (fullConfig.guards ?? {});
+        const merged = deepMergeGuards(DEFAULT_GUARDS_CONFIG, guardsRaw);
+        return expandTokensDeep(merged, workspace);
+    }
+    catch {
+        // If config loading fails, return expanded defaults
+        return expandTokensDeep({ ...DEFAULT_GUARDS_CONFIG }, workspace);
+    }
+}
+/**
+ * Check if a project name matches any strict project patterns.
+ * Uses simple glob-style matching (supports * wildcard).
+ */
+export function shouldUseStrictMode(projectName, patterns) {
+    for (const pattern of patterns) {
+        const regex = new RegExp('^' + pattern.replace(/\*/g, '.*').replace(/\?/g, '.') + '$');
+        if (regex.test(projectName)) {
+            return true;
+        }
+    }
+    return false;
+}
+//# sourceMappingURL=config.js.map

package/dist/hooks/factcheck/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../src/hooks/factcheck/config.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAGpD,8EAA8E;AAC9E,WAAW;AACX,8EAA8E;AAE9E,MAAM,wBAAwB,GAAoB;IAChD,OAAO,EAAE,KAAK;IACd,IAAI,EAAE,OAAO;IACb,uBAAuB,EAAE,EAAE;IAC3B,uBAAuB,EAAE,CAAC,oCAAoC,CAAC;IAC/D,yBAAyB,EAAE,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACzD,yBAAyB,EAAE;QACzB,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK;KAC3E;IACD,oBAAoB,EAAE,IAAI;IAC1B,2BAA2B,EAAE,KAAK;IAClC,wBAAwB,EAAE,IAAI;IAC9B,6CAA6C,EAAE,KAAK;CACrD,CAAC;AAEF,MAAM,uBAAuB,GAAmB;IAC9C,OAAO,EAAE,KAAK;IACd,SAAS,EAAE;QACT,aAAa,EAAE,IAAI;QACnB,gBAAgB,EAAE,IAAI;QACtB,uBAAuB,EAAE,IAAI;QAC7B,wBAAwB,EAAE,IAAI;KAC/B;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,qBAAqB,GAAiB;IACjD,SAAS,EAAE,EAAE,GAAG,wBAAwB,EAAE;IAC1C,QAAQ,EAAE,EAAE,GAAG,uBAAuB,EAAE;CACzC,CAAC;AAEF,8EAA8E;AAC9E,kBAAkB;AAClB,8EAA8E;AAE9E;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,KAAa,EAAE,SAAkB;IAC5D,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,EAAE,GAAG,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACnE,OAAO,KAAK;SACT,OAAO,CAAC,aAAa,EAAE,IAAI,CAAC;SAC5B,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;AACrC,CAAC;AAED;;GAEG;AACH,SAAS,gBAAgB,CAAI,GAAM,EAAE,SAAkB;IACrD,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,YAAY,CAAC,GAAG,EAAE,SAAS,CAAiB,CAAC;IACtD,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAiB,CAAC;IAC5E,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QAC5C,MAAM,MAAM,GAA4B,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/C,MAAM,CAAC,GAAG,CAAC,GAAG,gBAAgB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QACnD,CAAC;QACD,OAAO,MAAW,CAAC;IACrB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8EAA8E;AAC9E,kDAAkD;AAClD,8EAA8E;AAE9E,SAAS,eAAe,CACtB,MAAoB,EACpB,MAA6B;IAE7B,MAAM,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC;IAE7B,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACrB,MAAM,CAAC,SAAS,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,EAAE,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;IAClE,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,MAAM,CAAC,QAAQ,GAAG;YAChB,GAAG,MAAM,CAAC,QAAQ;YAClB,GAAG,MAAM,CAAC,QAAQ;YAClB,SAAS,EAAE;gBACT,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS;gBAC5B,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,IAAI,EAAE,CAAC;aACrC;SACF,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,SAAkB;IACjD,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,UAAU,EAA6B,CAAC;QAC3D,MAAM,SAAS,GAAG,CAAC,UAAU,CAAC,MAAM,IAAI,EAAE,CAA0B,CAAC;QACrE,MAAM,MAAM,GAAG,eAAe,CAAC,qBAAqB,EAAE,SAAS,CAAC,CAAC;QACjE,OAAO,gBAAgB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,oDAAoD;QACpD,OAAO,gBAAgB,CAAC,EAAE,GAAG,qBAAqB,EAAE,EAAE,SAAS,CAAC,CAAC;IACnE,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,WAAmB,EACnB,QAAkB;IAElB,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,IAAI,MAAM,CACtB,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,GAAG,CAC7D,CAAC;QACF,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/hooks/factcheck/index.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Factcheck Guard - Main Entry Point
+ *
+ * Portable factcheck engine that validates a claims payload against
+ * configurable policies. Ported from rolldav/portable-omc-guards (issue #1155).
+ *
+ * Modes:
+ *   - strict:   All gates must be true, cwd mismatch is FAIL
+ *   - declared:  Warns on false gates if source files exist
+ *   - manual:   Same as declared
+ *   - quick:    Skips cwd parity check by default
+ */
+import type { FactcheckMode, FactcheckPolicy, FactcheckResult } from './types.js';
+export type { FactcheckClaims, FactcheckMode, FactcheckPolicy, FactcheckResult, Mismatch, Severity, } from './types.js';
+export { loadGuardsConfig, shouldUseStrictMode } from './config.js';
+/**
+ * Run the portable factcheck logic against a claims payload.
+ *
+ * @param claims     - The claims payload to validate
+ * @param mode       - Validation mode: strict | declared | manual | quick
+ * @param policy     - Factcheck policy (loaded from config or provided)
+ * @param runtimeCwd - Runtime working directory (defaults to process.cwd())
+ * @returns Factcheck result with verdict, mismatches, notes, and evidence
+ */
+export declare function runChecks(claims: Record<string, unknown>, mode: FactcheckMode, policy: FactcheckPolicy, runtimeCwd?: string): FactcheckResult;
+/**
+ * Convenience wrapper: load config and run checks in one call.
+ */
+export declare function runFactcheck(claims: Record<string, unknown>, options?: {
+    mode?: FactcheckMode;
+    runtimeCwd?: string;
+    workspace?: string;
+}): FactcheckResult;
+//# sourceMappingURL=index.d.ts.map

package/dist/hooks/factcheck/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/hooks/factcheck/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EACV,aAAa,EACb,eAAe,EACf,eAAe,EAGhB,MAAM,YAAY,CAAC;AAYpB,YAAY,EACV,eAAe,EACf,aAAa,EACb,eAAe,EACf,eAAe,EACf,QAAQ,EACR,QAAQ,GACT,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAgBpE;;;;;;;;GAQG;AACH,wBAAgB,SAAS,CACvB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,IAAI,EAAE,aAAa,EACnB,MAAM,EAAE,eAAe,EACvB,UAAU,CAAC,EAAE,MAAM,GAClB,eAAe,CAwFjB;AAED;;GAEG;AACH,wBAAgB,YAAY,CAC1B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,OAAO,CAAC,EAAE;IACR,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GACA,eAAe,CAIjB"}

package/dist/hooks/factcheck/index.js

@@ -0,0 +1,120 @@
+/**
+ * Factcheck Guard - Main Entry Point
+ *
+ * Portable factcheck engine that validates a claims payload against
+ * configurable policies. Ported from rolldav/portable-omc-guards (issue #1155).
+ *
+ * Modes:
+ *   - strict:   All gates must be true, cwd mismatch is FAIL
+ *   - declared:  Warns on false gates if source files exist
+ *   - manual:   Same as declared
+ *   - quick:    Skips cwd parity check by default
+ */
+import { checkMissingFields, checkMissingGates, getFalseGates, sourceFileCount, checkPaths, checkCommands, checkCwdParity, } from './checks.js';
+import { loadGuardsConfig } from './config.js';
+export { loadGuardsConfig, shouldUseStrictMode } from './config.js';
+// ---------------------------------------------------------------------------
+// Severity ranking
+// ---------------------------------------------------------------------------
+function severityRank(value) {
+    if (value === 'FAIL')
+        return 2;
+    if (value === 'WARN')
+        return 1;
+    return 0;
+}
+// ---------------------------------------------------------------------------
+// Main check runner
+// ---------------------------------------------------------------------------
+/**
+ * Run the portable factcheck logic against a claims payload.
+ *
+ * @param claims     - The claims payload to validate
+ * @param mode       - Validation mode: strict | declared | manual | quick
+ * @param policy     - Factcheck policy (loaded from config or provided)
+ * @param runtimeCwd - Runtime working directory (defaults to process.cwd())
+ * @returns Factcheck result with verdict, mismatches, notes, and evidence
+ */
+export function runChecks(claims, mode, policy, runtimeCwd) {
+    const mismatches = [];
+    const notes = [];
+    // A. Missing required fields
+    const missingFields = checkMissingFields(claims);
+    if (missingFields.length > 0) {
+        mismatches.push({
+            check: 'A',
+            severity: 'FAIL',
+            detail: `Missing required fields: ${JSON.stringify(missingFields)}`,
+        });
+    }
+    // A. Missing required gates
+    const missingGates = checkMissingGates(claims);
+    if (missingGates.length > 0) {
+        mismatches.push({
+            check: 'A',
+            severity: 'FAIL',
+            detail: `Missing required gates: ${JSON.stringify(missingGates)}`,
+        });
+    }
+    // B. Gate value checks
+    const falseGates = getFalseGates(claims);
+    const srcFiles = sourceFileCount(claims);
+    if (mode === 'strict' && falseGates.length > 0) {
+        mismatches.push({
+            check: 'B',
+            severity: 'FAIL',
+            detail: `Strict mode requires all gates true, got false: ${JSON.stringify(falseGates)}`,
+        });
+    }
+    else if ((mode === 'declared' || mode === 'manual') &&
+        falseGates.length > 0 &&
+        policy.warn_on_unverified_gates) {
+        if (srcFiles > 0 || policy.warn_on_unverified_gates_when_no_source_files) {
+            mismatches.push({
+                check: 'B',
+                severity: 'WARN',
+                detail: `Unverified gates in declared/manual mode: ${JSON.stringify(falseGates)}`,
+            });
+        }
+        else {
+            notes.push('No source files declared; unverified gates are ignored by policy');
+        }
+    }
+    // H/C. Path checks
+    mismatches.push(...checkPaths(claims, policy));
+    // H. Command checks
+    mismatches.push(...checkCommands(claims, policy));
+    // CWD parity
+    const claimsCwd = String(claims.cwd ?? '').trim();
+    const cwdMismatch = checkCwdParity(claimsCwd, runtimeCwd ?? process.cwd(), mode, policy);
+    if (cwdMismatch) {
+        mismatches.push(cwdMismatch);
+    }
+    // Compute verdict from worst severity
+    const maxRank = mismatches.reduce((max, m) => Math.max(max, severityRank(m.severity)), 0);
+    let verdict = 'PASS';
+    if (maxRank === 2)
+        verdict = 'FAIL';
+    else if (maxRank === 1)
+        verdict = 'WARN';
+    return {
+        verdict,
+        mode,
+        mismatches,
+        notes,
+        claims_evidence: {
+            source_files: srcFiles,
+            commands_count: (claims.commands_executed ?? []).length,
+            models_count: (claims.models_used ?? []).length,
+        },
+    };
+}
+/**
+ * Convenience wrapper: load config and run checks in one call.
+ */
+export function runFactcheck(claims, options) {
+    const config = loadGuardsConfig(options?.workspace);
+    const mode = options?.mode ?? config.factcheck.mode;
+    return runChecks(claims, mode, config.factcheck, options?.runtimeCwd);
+}
+//# sourceMappingURL=index.js.map

package/dist/hooks/factcheck/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/hooks/factcheck/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AASH,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,aAAa,EACb,eAAe,EACf,UAAU,EACV,aAAa,EACb,cAAc,GACf,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAU/C,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAEpE,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E,SAAS,YAAY,CAAC,KAAe;IACnC,IAAI,KAAK,KAAK,MAAM;QAAE,OAAO,CAAC,CAAC;IAC/B,IAAI,KAAK,KAAK,MAAM;QAAE,OAAO,CAAC,CAAC;IAC/B,OAAO,CAAC,CAAC;AACX,CAAC;AAED,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,UAAU,SAAS,CACvB,MAA+B,EAC/B,IAAmB,EACnB,MAAuB,EACvB,UAAmB;IAEnB,MAAM,UAAU,GAAe,EAAE,CAAC;IAClC,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,6BAA6B;IAC7B,MAAM,aAAa,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACjD,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,UAAU,CAAC,IAAI,CAAC;YACd,KAAK,EAAE,GAAG;YACV,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,4BAA4B,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE;SACpE,CAAC,CAAC;IACL,CAAC;IAED,4BAA4B;IAC5B,MAAM,YAAY,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC/C,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,UAAU,CAAC,IAAI,CAAC;YACd,KAAK,EAAE,GAAG;YACV,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,2BAA2B,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,EAAE;SAClE,CAAC,CAAC;IACL,CAAC;IAED,uBAAuB;IACvB,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IAEzC,IAAI,IAAI,KAAK,QAAQ,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/C,UAAU,CAAC,IAAI,CAAC;YACd,KAAK,EAAE,GAAG;YACV,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,mDAAmD,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE;SACxF,CAAC,CAAC;IACL,CAAC;SAAM,IACL,CAAC,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,QAAQ,CAAC;QAC1C,UAAU,CAAC,MAAM,GAAG,CAAC;QACrB,MAAM,CAAC,wBAAwB,EAC/B,CAAC;QACD,IAAI,QAAQ,GAAG,CAAC,IAAI,MAAM,CAAC,6CAA6C,EAAE,CAAC;YACzE,UAAU,CAAC,IAAI,CAAC;gBACd,KAAK,EAAE,GAAG;gBACV,QAAQ,EAAE,MAAM;gBAChB,MAAM,EAAE,6CAA6C,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE;aAClF,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IAED,mBAAmB;IACnB,UAAU,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAE/C,oBAAoB;IACpB,UAAU,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAElD,aAAa;IACb,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAClD,MAAM,WAAW,GAAG,cAAc,CAChC,SAAS,EACT,UAAU,IAAI,OAAO,CAAC,GAAG,EAAE,EAC3B,IAAI,EACJ,MAAM,CACP,CAAC;IACF,IAAI,WAAW,EAAE,CAAC;QAChB,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC/B,CAAC;IAED,sCAAsC;IACtC,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAC/B,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EACnD,CAAC,CACF,CAAC;IACF,IAAI,OAAO,GAAa,MAAM,CAAC;IAC/B,IAAI,OAAO,KAAK,CAAC;QAAE,OAAO,GAAG,MAAM,CAAC;SAC/B,IAAI,OAAO,KAAK,CAAC;QAAE,OAAO,GAAG,MAAM,CAAC;IAEzC,OAAO;QACL,OAAO;QACP,IAAI;QACJ,UAAU;QACV,KAAK;QACL,eAAe,EAAE;YACf,YAAY,EAAE,QAAQ;YACtB,cAAc,EAAE,CAAE,MAAM,CAAC,iBAA8B,IAAI,EAAE,CAAC,CAAC,MAAM;YACrE,YAAY,EAAE,CAAE,MAAM,CAAC,WAAwB,IAAI,EAAE,CAAC,CAAC,MAAM;SAC9D;KACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAC1B,MAA+B,EAC/B,OAIC;IAED,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,OAAO,EAAE,IAAI,IAAK,MAAM,CAAC,SAAS,CAAC,IAAsB,CAAC;IACvE,OAAO,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;AACxE,CAAC"}

package/dist/hooks/factcheck/sentinel.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Sentinel Health Analyzer
+ *
+ * Parses JSONL log files of sentinel runs and computes readiness stats.
+ * Ported from sentinel_health.py (issue #1155).
+ */
+import type { SentinelStats, SentinelReadinessResult, SentinelReadinessPolicy } from './types.js';
+export declare function getPassRate(stats: SentinelStats): number;
+export declare function getTimeoutRate(stats: SentinelStats): number;
+export declare function getWarnPlusFailRate(stats: SentinelStats): number;
+export declare function getReasonCoverageRate(stats: SentinelStats): number;
+/**
+ * Parse a JSONL log file and compute aggregate sentinel stats.
+ *
+ * @param logPath - Path to the JSONL log file
+ * @returns Aggregated sentinel statistics
+ */
+export declare function analyzeLog(logPath: string): SentinelStats;
+/**
+ * Determine if the sentinel signal is upstream-ready based on
+ * configurable thresholds.
+ *
+ * @param stats  - Computed sentinel statistics
+ * @param policy - Readiness thresholds (from config or provided)
+ * @returns Tuple of [ready, blockers] — ready is true if all thresholds met
+ */
+export declare function isUpstreamReady(stats: SentinelStats, policy: SentinelReadinessPolicy): [boolean, string[]];
+/**
+ * Convenience wrapper: analyze a log file and check readiness.
+ */
+export declare function checkSentinelHealth(logPath: string, workspace?: string): SentinelReadinessResult;
+//# sourceMappingURL=sentinel.d.ts.map

package/dist/hooks/factcheck/sentinel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sentinel.d.ts","sourceRoot":"","sources":["../../../src/hooks/factcheck/sentinel.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAEV,aAAa,EACb,uBAAuB,EACvB,uBAAuB,EACxB,MAAM,YAAY,CAAC;AAYpB,wBAAgB,WAAW,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CAExD;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CAE3D;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CAEhE;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CAElE;AAqCD;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,aAAa,CA4CzD;AAMD;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,aAAa,EACpB,MAAM,EAAE,uBAAuB,GAC9B,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAgCrB;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,MAAM,EACf,SAAS,CAAC,EAAE,MAAM,GACjB,uBAAuB,CAKzB"}

package/dist/hooks/factcheck/sentinel.js

@@ -0,0 +1,153 @@
+/**
+ * Sentinel Health Analyzer
+ *
+ * Parses JSONL log files of sentinel runs and computes readiness stats.
+ * Ported from sentinel_health.py (issue #1155).
+ */
+import { readFileSync, existsSync } from 'fs';
+import { loadGuardsConfig } from './config.js';
+// ---------------------------------------------------------------------------
+// Stats computation helpers
+// ---------------------------------------------------------------------------
+function computeRate(numerator, denominator) {
+    if (denominator === 0)
+        return 0;
+    return numerator / denominator;
+}
+export function getPassRate(stats) {
+    return computeRate(stats.pass_count, stats.total_runs);
+}
+export function getTimeoutRate(stats) {
+    return computeRate(stats.timeout_count, stats.total_runs);
+}
+export function getWarnPlusFailRate(stats) {
+    return computeRate(stats.warn_count + stats.fail_count, stats.total_runs);
+}
+export function getReasonCoverageRate(stats) {
+    return computeRate(stats.reason_coverage_count, stats.total_runs);
+}
+// ---------------------------------------------------------------------------
+// Log entry helpers
+// ---------------------------------------------------------------------------
+/**
+ * Normalize a verdict string to PASS, WARN, or FAIL.
+ */
+function extractVerdict(entry) {
+    const raw = String(entry.verdict ?? '').toUpperCase().trim();
+    if (raw === 'PASS')
+        return 'PASS';
+    if (raw === 'WARN')
+        return 'WARN';
+    return 'FAIL';
+}
+/**
+ * Check if a log entry has a reason/explanation.
+ */
+function hasReason(entry) {
+    return !!(entry.reason || entry.error || entry.message);
+}
+/**
+ * Check if a log entry indicates a timeout.
+ */
+function isTimeout(entry) {
+    if (entry.runtime?.timed_out === true)
+        return true;
+    if (entry.runtime?.global_timeout === true)
+        return true;
+    const reason = String(entry.reason ?? '').toLowerCase();
+    return reason.includes('timeout');
+}
+// ---------------------------------------------------------------------------
+// Log analysis
+// ---------------------------------------------------------------------------
+/**
+ * Parse a JSONL log file and compute aggregate sentinel stats.
+ *
+ * @param logPath - Path to the JSONL log file
+ * @returns Aggregated sentinel statistics
+ */
+export function analyzeLog(logPath) {
+    const stats = {
+        total_runs: 0,
+        pass_count: 0,
+        warn_count: 0,
+        fail_count: 0,
+        timeout_count: 0,
+        reason_coverage_count: 0,
+    };
+    if (!existsSync(logPath)) {
+        return stats;
+    }
+    let content;
+    try {
+        content = readFileSync(logPath, 'utf-8');
+    }
+    catch {
+        return stats;
+    }
+    const lines = content.split('\n').filter(line => line.trim().length > 0);
+    for (const line of lines) {
+        let entry;
+        try {
+            entry = JSON.parse(line);
+        }
+        catch {
+            // Skip malformed lines
+            continue;
+        }
+        stats.total_runs++;
+        const verdict = extractVerdict(entry);
+        if (verdict === 'PASS')
+            stats.pass_count++;
+        else if (verdict === 'WARN')
+            stats.warn_count++;
+        else
+            stats.fail_count++;
+        if (isTimeout(entry))
+            stats.timeout_count++;
+        if (hasReason(entry))
+            stats.reason_coverage_count++;
+    }
+    return stats;
+}
+// ---------------------------------------------------------------------------
+// Readiness check
+// ---------------------------------------------------------------------------
+/**
+ * Determine if the sentinel signal is upstream-ready based on
+ * configurable thresholds.
+ *
+ * @param stats  - Computed sentinel statistics
+ * @param policy - Readiness thresholds (from config or provided)
+ * @returns Tuple of [ready, blockers] — ready is true if all thresholds met
+ */
+export function isUpstreamReady(stats, policy) {
+    const blockers = [];
+    const passRate = getPassRate(stats);
+    if (passRate < policy.min_pass_rate) {
+        blockers.push(`pass_rate ${passRate.toFixed(3)} < min ${policy.min_pass_rate}`);
+    }
+    const timeoutRate = getTimeoutRate(stats);
+    if (timeoutRate > policy.max_timeout_rate) {
+        blockers.push(`timeout_rate ${timeoutRate.toFixed(3)} > max ${policy.max_timeout_rate}`);
+    }
+    const warnFailRate = getWarnPlusFailRate(stats);
+    if (warnFailRate > policy.max_warn_plus_fail_rate) {
+        blockers.push(`warn_plus_fail_rate ${warnFailRate.toFixed(3)} > max ${policy.max_warn_plus_fail_rate}`);
+    }
+    const reasonRate = getReasonCoverageRate(stats);
+    if (reasonRate < policy.min_reason_coverage_rate) {
+        blockers.push(`reason_coverage_rate ${reasonRate.toFixed(3)} < min ${policy.min_reason_coverage_rate}`);
+    }
+    return [blockers.length === 0, blockers];
+}
+/**
+ * Convenience wrapper: analyze a log file and check readiness.
+ */
+export function checkSentinelHealth(logPath, workspace) {
+    const config = loadGuardsConfig(workspace);
+    const stats = analyzeLog(logPath);
+    const [ready, blockers] = isUpstreamReady(stats, config.sentinel.readiness);
+    return { ready, blockers, stats };
+}
+//# sourceMappingURL=sentinel.js.map