codehere 0.2.2 → 0.3.0-rc.10

package/dist/infrastructure/orchestration/agent-installer.js

@@ -0,0 +1,101 @@
+/**
+ * Agent installer — runs the install command for a registered adapter.
+ *
+ * Principle #10 (non-technical users first-class): the user clicks a button,
+ * codehere runs the install, streams output back to the UI. No terminal, no
+ * copy-paste. If brew isn't present, we fall back to curl/sh or npm-based
+ * installers. On success, re-check readiness and tell the UI to refresh.
+ *
+ * Security: the command comes from adapter source code (built-ins) or from
+ * the user's own ~/.codehere/agents.yaml (generic adapters) — never from an
+ * HTTP request parameter. We refuse to execute an arbitrary command supplied
+ * over the wire.
+ */
+import { spawn } from 'child_process';
+import { EventEmitter } from 'events';
+/** Execute an install command in a shell so chained commands (&& / || / |)
+ *  work. We need the user's shell rc loaded so brew / npm / path extensions
+ *  resolve — default: `$SHELL -lc "<command>"`. */
+export function runInstallCommand(command) {
+    const emitter = new EventEmitter();
+    const buffer = [];
+    let statusValue = 'running';
+    const startedAt = Date.now();
+    const emit = (event) => {
+        buffer.push(event);
+        emitter.emit('event', event);
+    };
+    const shell = process.env.SHELL || '/bin/zsh';
+    let child;
+    try {
+        child = spawn(shell, ['-lc', command], {
+            env: process.env,
+            stdio: ['ignore', 'pipe', 'pipe'],
+        });
+    }
+    catch (err) {
+        statusValue = 'failed';
+        const msg = err instanceof Error ? err.message : String(err);
+        queueMicrotask(() => emit({ type: 'error', data: msg }));
+        return {
+            get status() {
+                return statusValue;
+            },
+            subscribe(handler) {
+                for (const e of buffer)
+                    handler(e);
+                emitter.on('event', handler);
+                return () => emitter.off('event', handler);
+            },
+            kill() {
+                /* not running */
+            },
+        };
+    }
+    child.stdout?.on('data', (chunk) => {
+        emit({ type: 'out', data: chunk.toString('utf-8') });
+    });
+    child.stderr?.on('data', (chunk) => {
+        emit({ type: 'err', data: chunk.toString('utf-8') });
+    });
+    child.on('exit', (code) => {
+        statusValue = code === 0 ? 'completed' : 'failed';
+        emit({ type: 'done', code, durationMs: Date.now() - startedAt });
+    });
+    child.on('error', (err) => {
+        statusValue = 'failed';
+        emit({ type: 'error', data: err.message });
+    });
+    return {
+        get status() {
+            return statusValue;
+        },
+        subscribe(handler) {
+            for (const e of buffer)
+                handler(e);
+            emitter.on('event', handler);
+            return () => emitter.off('event', handler);
+        },
+        kill() {
+            if (statusValue !== 'running')
+                return;
+            try {
+                child.kill('SIGTERM');
+            }
+            catch {
+                /* already dead */
+            }
+        },
+    };
+}
+/** Convenience: install a registered adapter. Returns null if adapter has no
+ *  installHint configured or is already installed. */
+export function installAgent(adapter) {
+    if (!adapter.checkReadiness)
+        return null;
+    const readiness = adapter.checkReadiness();
+    if (readiness.state !== 'needs_install' || !readiness.installHint?.command)
+        return null;
+    return runInstallCommand(readiness.installHint.command);
+}
+//# sourceMappingURL=agent-installer.js.map

package/dist/infrastructure/orchestration/agents-config-seed.js

@@ -0,0 +1,56 @@
+/**
+ * Seed ~/.codehere/agents.yaml on first daemon start.
+ *
+ * Ships with NO pre-populated adapters. Users who want codehere to drive a
+ * CLI agent beyond the built-in four (Claude Code, Codex, Aider, OpenCode)
+ * add their own entry to `~/.codehere/agents.yaml` and restart the daemon.
+ *
+ * Rationale: shipping scaffolded entries we hadn't actually verified on real
+ * machines produced a "9 agents supported" claim that wasn't honest. The
+ * generic-cli-adapter mechanism is still available — users opt in per agent
+ * by editing the YAML themselves.
+ *
+ * Re-seed never overwrites an existing file.
+ */
+import { existsSync, mkdirSync, writeFileSync } from 'fs';
+import { homedir } from 'os';
+import { join, dirname } from 'path';
+const CONFIG_PATH = join(homedir(), '.codehere', 'agents.yaml');
+const DEFAULT_YAML = `# codehere — pluggable agent adapters
+#
+# Built-in adapters (no configuration needed — just install the CLI):
+#   - Claude Code
+#   - Codex
+#   - Aider
+#   - OpenCode
+#
+# To add a CLI-based AI coding agent not in the built-in list, uncomment
+# and adapt the example below. Safety hook + audit log wrap every subprocess
+# regardless of agent, so adding an adapter does not bypass any security
+# layer.
+#
+# agents:
+#   - id: my-agent
+#     label: My Agent
+#     command: my-agent-cli          # must be on PATH
+#     args: [--headless]             # fixed args before the prompt
+#     prompt_via: argv               # or "stdin"
+#     process_pattern: (?:^|/)my-agent-cli(?:\\\\s|$)
+#     format: text                   # or "jsonl" if the CLI streams JSON
+#     install_command: brew install my-agent-cli   # optional · enables "Install" button
+#     install_url: https://example.com/docs         # optional · docs link
+
+agents: []
+`;
+export function seedAgentsConfig() {
+    try {
+        if (existsSync(CONFIG_PATH))
+            return;
+        mkdirSync(dirname(CONFIG_PATH), { recursive: true });
+        writeFileSync(CONFIG_PATH, DEFAULT_YAML, 'utf-8');
+    }
+    catch {
+        /* best-effort */
+    }
+}
+//# sourceMappingURL=agents-config-seed.js.map

package/dist/infrastructure/orchestration/aider-adapter.js

@@ -0,0 +1,319 @@
+/**
+ * Aider adapter — third concrete AgentAdapter.
+ *
+ * `aider --message "<prompt>" --yes-always --no-check-update --no-pretty --no-stream`
+ *
+ * Aider's output is free-form text (not JSON), so the event log shows raw lines
+ * instead of semantic tool_use blocks. Step aggregator produces zero steps — but
+ * Final report still works via git-diff (artifacts-extractor is agent-agnostic)
+ * and token accounting works through Aider's cost summary line at session end.
+ *
+ * Same structural pattern as Claude Code / Codex adapters: emit buffer,
+ * SIGTERM→SIGKILL escalation, known-error fingerprints. Intentionally keeping
+ * the duplication for now — if we grow to 5+ adapters, extract a shared helper.
+ */
+import { spawn, execFileSync } from 'child_process';
+import { EventEmitter } from 'events';
+import { randomUUID } from 'crypto';
+import { ProgressAggregator } from './progress-aggregator.js';
+import { snapshotCwd, extractArtifacts } from './artifacts-extractor.js';
+const HEADLESS_FLAGS = [
+    '--yes-always', // auto-accept all file-edit confirmations
+    '--no-check-update', // skip aider self-update probe
+    '--no-pretty', // disable ANSI colors in output
+    '--no-stream', // stream=false → one chunk per turn, cleaner stdout parsing
+    '--no-auto-commits', // don't auto-commit — leave file changes for artifacts-extractor
+];
+const ERROR_PATTERNS = [
+    {
+        code: 'credit_low',
+        // Aider has no subscription path — uses ANTHROPIC_API_KEY / OPENAI_API_KEY
+        // directly against the billed API. codehere users who run on a Claude Code
+        // subscription typically have a zero-credit API key and hit this fast.
+        regex: /credit balance is too low|insufficient.*credit|no credits|you exceeded your current quota/i,
+        message: 'The API key has no credit — Aider cannot run on a Claude Code subscription.',
+        recovery: 'Aider needs a billed API key (Anthropic or OpenAI). Either top up your key at ' +
+            'console.anthropic.com / platform.openai.com, or switch the task to Claude Code / Codex which use ' +
+            'subscription auth.',
+    },
+    {
+        code: 'auth_invalid',
+        regex: /invalid api key|authentication.*failed|401 unauth|Please provide your.*API key/i,
+        message: 'Aider auth missing or rejected.',
+        recovery: 'Set ANTHROPIC_API_KEY or OPENAI_API_KEY in your shell, then retry.',
+    },
+    {
+        code: 'rate_limit',
+        regex: /rate.?limit(ed)?|429|too many requests/i,
+        message: 'Aider rate-limited the request.',
+        recovery: 'Wait a minute and retry, or switch --model via extraArgs.',
+    },
+    {
+        code: 'model_unavailable',
+        regex: /model.*(not found|not available|unavailable|does not exist)/i,
+        message: 'Aider could not find the model.',
+        recovery: 'Run `aider --list-models` and pass `--model <name>` via extraArgs.',
+    },
+];
+function scanForKnownError(text) {
+    for (const p of ERROR_PATTERNS) {
+        if (p.regex.test(text))
+            return { code: p.code, message: p.message, recovery: p.recovery };
+    }
+    return null;
+}
+export function spawnAider(prompt, options = {}) {
+    const sessionId = randomUUID();
+    const startedAt = Date.now();
+    const emitter = new EventEmitter();
+    const buffer = [];
+    let statusValue = 'running';
+    let killRequested = false;
+    const cwd = options.cwd ?? process.cwd();
+    const snapshot = snapshotCwd(cwd);
+    const aggregator = new ProgressAggregator('aider'); // no-op aggregator; emits no steps
+    let stepsSnapshot = [];
+    let artifactsSnapshot;
+    let textAccum = '';
+    let usageSnapshot;
+    let errorEmitted = false;
+    const emit = (event) => {
+        buffer.push(event);
+        emitter.emit('event', event);
+        if (aggregator.ingest(event)) {
+            stepsSnapshot = aggregator.steps.map((s) => ({ ...s }));
+            const snapEvt = { type: 'codehere:steps', timestamp: Date.now(), data: { steps: stepsSnapshot } };
+            buffer.push(snapEvt);
+            emitter.emit('event', snapEvt);
+        }
+        // Text accumulator for test-summary parsing + aider cost-line token extraction
+        if (event.type === 'stdout' && event.data?.line) {
+            const line = String(event.data.line);
+            textAccum += line + '\n';
+            // Aider emits a cost summary like:
+            //   "Tokens: 1.2k sent, 412 received. Cost: $0.01 request, $0.01 session."
+            const m = line.match(/Tokens:\s*([\d.]+)([kM]?)\s*sent,\s*([\d.]+)([kM]?)\s*received/i);
+            if (m) {
+                const scale = (s) => (s === 'k' ? 1000 : s === 'M' ? 1_000_000 : 1);
+                const sent = Math.round(parseFloat(m[1]) * scale(m[2]));
+                const recv = Math.round(parseFloat(m[3]) * scale(m[4]));
+                usageSnapshot = {
+                    inputTokens: (usageSnapshot?.inputTokens ?? 0) + sent,
+                    outputTokens: (usageSnapshot?.outputTokens ?? 0) + recv,
+                };
+            }
+        }
+        if (!errorEmitted) {
+            const data = event.data;
+            let text = '';
+            if ((event.type === 'stderr' || event.type === 'stdout') && typeof data?.line === 'string') {
+                text = data.line;
+            }
+            if (text) {
+                const hit = scanForKnownError(text);
+                if (hit) {
+                    errorEmitted = true;
+                    const errEvent = {
+                        type: 'codehere:error',
+                        timestamp: Date.now(),
+                        data: { code: hit.code, message: hit.message, recovery: hit.recovery },
+                    };
+                    buffer.push(errEvent);
+                    emitter.emit('event', errEvent);
+                }
+            }
+        }
+    };
+    // Whenever a codehere:error fires, we treat the session as effectively failed
+    // even if the subprocess later exits 0. Many CLIs print a logical error to
+    // stdout then return success — the status pill would otherwise lie.
+    emitter.on('event', (ev) => {
+        if (ev.type === 'codehere:error' && statusValue === 'running') {
+            // Don't overwrite if exit already settled a final status.
+            // We rely on exit handler to flip running→completed/killed/error; we pre-empt
+            // that with 'error' here so the status pill is honest from the moment the
+            // error is detected.
+            statusValue = 'error';
+        }
+    });
+    const spawnEnv = { ...process.env, ...(options.env ?? {}) };
+    let child;
+    try {
+        child = spawn('aider', ['--message', prompt, ...HEADLESS_FLAGS, ...(options.extraArgs ?? [])], {
+            cwd,
+            env: spawnEnv,
+            stdio: ['ignore', 'pipe', 'pipe'],
+        });
+    }
+    catch (err) {
+        statusValue = 'error';
+        const msg = err instanceof Error ? err.message : String(err);
+        queueMicrotask(() => emit({ type: 'error', timestamp: Date.now(), data: { message: msg } }));
+        return {
+            sessionId,
+            startedAt,
+            prompt,
+            agent: 'aider',
+            get status() {
+                return statusValue;
+            },
+            get steps() {
+                return stepsSnapshot;
+            },
+            get artifacts() {
+                return artifactsSnapshot;
+            },
+            subscribe(handler) {
+                for (const e of buffer)
+                    handler(e);
+                emitter.on('event', handler);
+                return () => emitter.off('event', handler);
+            },
+            kill() {
+                /* already not running */
+            },
+        };
+    }
+    let stdoutBuf = '';
+    child.stdout?.on('data', (chunk) => {
+        stdoutBuf += chunk.toString('utf-8');
+        let idx;
+        while ((idx = stdoutBuf.indexOf('\n')) >= 0) {
+            const line = stdoutBuf.slice(0, idx).trim();
+            stdoutBuf = stdoutBuf.slice(idx + 1);
+            if (!line)
+                continue;
+            emit({ type: 'stdout', timestamp: Date.now(), data: { line } });
+        }
+    });
+    child.stderr?.on('data', (chunk) => {
+        const text = chunk.toString('utf-8');
+        for (const line of text.split('\n')) {
+            if (line.trim())
+                emit({ type: 'stderr', timestamp: Date.now(), data: { line } });
+        }
+    });
+    child.on('exit', (code, signal) => {
+        // Preserve 'error' if we already flipped to it on codehere:error.
+        statusValue =
+            killRequested || signal !== null ? 'killed' : errorEmitted ? 'error' : code === 0 ? 'completed' : 'error';
+        if (aggregator.finalize(statusValue === 'completed' ? 'completed' : statusValue === 'killed' ? 'killed' : 'error')) {
+            stepsSnapshot = aggregator.steps.map((s) => ({ ...s }));
+            emit({ type: 'codehere:steps', timestamp: Date.now(), data: { steps: stepsSnapshot } });
+        }
+        if (statusValue === 'completed') {
+            try {
+                artifactsSnapshot = { ...extractArtifacts(snapshot, textAccum), usage: usageSnapshot };
+                emit({ type: 'codehere:artifacts', timestamp: Date.now(), data: artifactsSnapshot });
+            }
+            catch {
+                /* best-effort */
+            }
+        }
+        emit({
+            type: 'exit',
+            timestamp: Date.now(),
+            data: { code, signal, status: statusValue, durationMs: Date.now() - startedAt },
+        });
+    });
+    child.on('error', (err) => {
+        statusValue = 'error';
+        emit({ type: 'error', timestamp: Date.now(), data: { message: err.message } });
+    });
+    return {
+        sessionId,
+        startedAt,
+        prompt,
+        agent: 'aider',
+        get status() {
+            return statusValue;
+        },
+        get steps() {
+            return stepsSnapshot;
+        },
+        get artifacts() {
+            return artifactsSnapshot;
+        },
+        subscribe(handler) {
+            for (const e of buffer)
+                handler(e);
+            emitter.on('event', handler);
+            return () => emitter.off('event', handler);
+        },
+        kill() {
+            if (statusValue !== 'running')
+                return;
+            killRequested = true;
+            child.kill('SIGTERM');
+            setTimeout(() => {
+                if (statusValue === 'running') {
+                    try {
+                        child.kill('SIGKILL');
+                    }
+                    catch {
+                        /* already dead */
+                    }
+                }
+            }, 3000);
+        },
+    };
+}
+export const AiderAdapter = {
+    id: 'aider',
+    label: 'Aider',
+    processPattern: /(?:^|\/)aider(?:\s|$)/,
+    isInstalled() {
+        try {
+            const out = execFileSync('which', ['aider'], { encoding: 'utf-8', timeout: 2000 });
+            return out.trim().length > 0;
+        }
+        catch {
+            return false;
+        }
+    },
+    spawn(prompt, options) {
+        return spawnAider(prompt, options);
+    },
+    checkReadiness() {
+        const installed = this.isInstalled();
+        if (!installed) {
+            return {
+                id: this.id,
+                label: this.label,
+                state: 'needs_install',
+                installed: false,
+                installHint: { command: 'brew install aider', url: 'https://aider.chat/docs/install.html' },
+            };
+        }
+        // Aider has no subscription path — needs a BILLED API key with credit.
+        // If neither Anthropic nor OpenAI key is present → needs_auth.
+        // If a key IS present but the user is running on a Claude Code subscription
+        // (no billing configured), Aider will hit credit_low at runtime. We can't
+        // detect that pre-spawn without making an API call. Flag the risk in the
+        // detail string so the UI can surface it.
+        const hasAnthropic = !!process.env.ANTHROPIC_API_KEY;
+        const hasOpenai = !!process.env.OPENAI_API_KEY;
+        if (!hasAnthropic && !hasOpenai) {
+            return {
+                id: this.id,
+                label: this.label,
+                state: 'needs_auth',
+                installed: true,
+                authHint: {
+                    detail: 'Aider needs a BILLED API key (Anthropic or OpenAI). Unlike Claude Code, it has no subscription path.',
+                    url: 'https://console.anthropic.com',
+                },
+            };
+        }
+        return {
+            id: this.id,
+            label: this.label,
+            state: 'billed_key_required',
+            installed: true,
+            authHint: {
+                detail: 'API key detected. Aider requires the key to have billing credit (not just presence). If you run on a Claude Code subscription, Aider will fail at the first model call.',
+            },
+        };
+    },
+};
+//# sourceMappingURL=aider-adapter.js.map

package/dist/infrastructure/orchestration/artifacts-extractor.js

@@ -0,0 +1,175 @@
+/**
+ * ArtifactsExtractor — PM UX Layer 3 (principles #2 "info density", #7 "agent-provenance").
+ *
+ * When a task finishes, a product manager reports: what changed, was anything
+ * risky, did tests pass. We derive that from ground truth:
+ *   - git diff (working tree + untracked) vs the HEAD snapshot taken at spawn
+ *   - trust score per changed file via the existing SAST scorer (F0)
+ *   - test pass/fail counts parsed out of collected stdout (best-effort)
+ *
+ * Agent-agnostic on purpose. Both Claude and Codex mutate the filesystem;
+ * git tells the truth regardless of which tool did the write.
+ */
+import { execFileSync } from 'child_process';
+import { existsSync, readFileSync, statSync } from 'fs';
+import { join, isAbsolute } from 'path';
+import { scoreFile } from '../security/trust-scorer.js';
+/** Take a baseline so Layer 3 can diff against it on exit. Cheap; ~5ms. */
+export function snapshotCwd(cwd) {
+    const spawnedAtMs = Date.now();
+    try {
+        const out = execFileSync('git', ['rev-parse', 'HEAD'], {
+            cwd,
+            encoding: 'utf-8',
+            timeout: 2000,
+            stdio: ['ignore', 'pipe', 'ignore'],
+        }).trim();
+        return { cwd, head: out, isGitRepo: out.length > 0, spawnedAtMs };
+    }
+    catch {
+        return { cwd, head: null, isGitRepo: false, spawnedAtMs };
+    }
+}
+/** Collect {path, +, -} from git diff (numstat) + untracked files (wc -l). */
+function changedFiles(snap) {
+    if (!snap.isGitRepo)
+        return [];
+    const out = [];
+    try {
+        // Staged + unstaged vs HEAD at spawn
+        const diff = execFileSync('git', ['diff', '--numstat', snap.head ?? 'HEAD'], {
+            cwd: snap.cwd,
+            encoding: 'utf-8',
+            timeout: 5000,
+            stdio: ['ignore', 'pipe', 'ignore'],
+        });
+        for (const line of diff.split('\n')) {
+            const m = line.match(/^(-|\d+)\t(-|\d+)\t(.+)$/);
+            if (!m)
+                continue;
+            const [, aStr, rStr, path] = m;
+            out.push({
+                path,
+                added: aStr === '-' ? 0 : parseInt(aStr, 10) || 0,
+                removed: rStr === '-' ? 0 : parseInt(rStr, 10) || 0,
+            });
+        }
+    }
+    catch {
+        /* diff failed — skip */
+    }
+    try {
+        // Untracked files — not in diff output
+        const untracked = execFileSync('git', ['ls-files', '--others', '--exclude-standard'], {
+            cwd: snap.cwd,
+            encoding: 'utf-8',
+            timeout: 5000,
+            stdio: ['ignore', 'pipe', 'ignore'],
+        });
+        for (const rel of untracked.split('\n')) {
+            if (!rel.trim())
+                continue;
+            // Count lines in the new file
+            try {
+                const full = isAbsolute(rel) ? rel : join(snap.cwd, rel);
+                if (!existsSync(full))
+                    continue;
+                const size = statSync(full).size;
+                if (size > 2 * 1024 * 1024)
+                    continue; // skip files >2MB, don't need their trust score
+                const content = readFileSync(full, 'utf-8');
+                const lines = content ? content.split('\n').length : 0;
+                out.push({ path: rel, added: lines, removed: 0 });
+            }
+            catch {
+                /* skip */
+            }
+        }
+    }
+    catch {
+        /* ls-files failed — skip */
+    }
+    return out;
+}
+/** Parse "N passed", "M failed", "K tests" out of accumulated stdout. Best-effort.
+ *  Vitest + jest output both have TWO pass/fail lines ("Test Files 11 passed" then
+ *  "Tests  47 passed"). We want the second/last. Take the last match in the buffer,
+ *  which is also what appears in the final summary. */
+function lastMatch(s, re) {
+    const g = new RegExp(re.source, re.flags.includes('g') ? re.flags : re.flags + 'g');
+    let last = null;
+    let m;
+    while ((m = g.exec(s)) !== null)
+        last = m;
+    return last;
+}
+function parseTestSummary(stdout) {
+    if (!stdout)
+        return undefined;
+    const s = stdout.slice(-8000); // only look at the tail
+    // vitest / jest: "Tests  47 passed, 1 failed (48)"  or  "passing" (mocha)
+    const passed = lastMatch(s, /(\d+)\s+pass(?:ed|ing)/i);
+    const failed = lastMatch(s, /(\d+)\s+fail(?:ed|ing)/i);
+    if (!passed && !failed)
+        return undefined;
+    const result = {
+        passed: passed ? parseInt(passed[1], 10) : 0,
+        failed: failed ? parseInt(failed[1], 10) : 0,
+    };
+    const dur = lastMatch(s, /Duration\s+([\d.]+)s/i) ?? lastMatch(s, /Time:\s+([\d.]+)\s*s/i);
+    if (dur)
+        result.durationMs = Math.round(parseFloat(dur[1]) * 1000);
+    return result;
+}
+/** Score each changed file with the existing SAST trust scorer. Safe on binaries (skipped). */
+function annotateTrust(snap, files) {
+    return files.map((f) => {
+        try {
+            const full = isAbsolute(f.path) ? f.path : join(snap.cwd, f.path);
+            if (!existsSync(full))
+                return f;
+            const size = statSync(full).size;
+            if (size > 2 * 1024 * 1024)
+                return f;
+            // Only score text-like files — trust scorer regexes operate on UTF-8
+            if (!/\.(ts|tsx|js|jsx|mjs|cjs|py|rb|go|rs|java|kt|cs|php|sh|bash|zsh|yml|yaml|json|md|sql)$/i.test(f.path))
+                return f;
+            const content = readFileSync(full, 'utf-8');
+            const scored = scoreFile(f.path, content);
+            return { ...f, trust: scored.score };
+        }
+        catch {
+            return f;
+        }
+    });
+}
+/**
+ * Keep only files whose mtime is at or after spawn time — the signal that this
+ * session touched them. Prevents Session B in the same cwd from reporting files
+ * Session A already edited before B started. Not bulletproof (both sessions
+ * hitting the same file both report it) but fixes the common concurrent-sessions
+ * pollution observed in beta.3.
+ */
+function filterByMtime(snap, files) {
+    const grace = 1000; // ms; allow clock skew between git's touch and our Date.now()
+    return files.filter((f) => {
+        try {
+            const full = isAbsolute(f.path) ? f.path : join(snap.cwd, f.path);
+            if (!existsSync(full))
+                return true; // file was deleted — keep it
+            const { mtimeMs } = statSync(full);
+            return mtimeMs >= snap.spawnedAtMs - grace;
+        }
+        catch {
+            return true; // stat failed — be permissive
+        }
+    });
+}
+export function extractArtifacts(snap, collectedStdout) {
+    const raw = changedFiles(snap);
+    const mine = filterByMtime(snap, raw);
+    const files = annotateTrust(snap, mine);
+    const tests = parseTestSummary(collectedStdout);
+    return { files, tests };
+}
+//# sourceMappingURL=artifacts-extractor.js.map