codehere 1.0.3 → 2.0.0-beta.1

package/src/signals.js

@@ -0,0 +1,225 @@
+// Deterministic signals. No AI in the decision path.
+
+const ERROR_LINE =
+  /(error|exception|traceback|failed|failure|fatal|cannot|can't|not found|undefined is not|is not defined|is not a function|segmentation fault|ERR!|panic:|denied|refused|unexpected token|syntaxerror|typeerror|referenceerror|modulenotfound|no such file)/i;
+
+const NOISE = /^(\s*at\s|\s*\^+\s*$|\s*$)/;
+// A passing test whose name mentions an error ("✔ returns an error for bad input"),
+// or a summary that says zero failed ("ℹ fail 0"), is not a failure.
+const PASSING = /^\s*(✔|✓|√|ok \d+\b|PASS\b)|^\s*(ℹ\s*)?(fail|failed|failures|errors)\s*[:=]?\s*0\s*$/i;
+
+export function stripAnsi(s) {
+  return String(s).replace(/\x1b\[[0-9;]*[A-Za-z]/g, '');
+}
+
+// Pull text out of whatever shape the tool response has.
+export function responseText(resp) {
+  if (resp == null) return '';
+  if (typeof resp === 'string') return resp;
+  const parts = [];
+  for (const key of ['stderr', 'stdout', 'output', 'error', 'content', 'result']) {
+    const v = resp[key];
+    if (typeof v === 'string') parts.push(v);
+    else if (Array.isArray(v)) parts.push(v.map((x) => (typeof x === 'string' ? x : x?.text || '')).join('\n'));
+  }
+  return parts.length ? parts.join('\n') : JSON.stringify(resp);
+}
+
+export function errorLines(text, max = 12) {
+  const lines = stripAnsi(text).split('\n');
+  const hits = [];
+  for (let i = 0; i < lines.length && hits.length < max; i++) {
+    if (ERROR_LINE.test(lines[i]) && !NOISE.test(lines[i]) && !PASSING.test(lines[i])) hits.push(lines[i].trim());
+  }
+  return hits;
+}
+
+// A stable fingerprint for "the same error again".
+export function normalize(line) {
+  return stripAnsi(line)
+    .replace(/(['"`]).*?\1/g, "'…'")
+    .replace(/(?:[A-Za-z]:)?(?:[\w.-]*[\\/])+([\w.-]+)/g, '$1')
+    .replace(/0x[0-9a-f]+/gi, 'N')
+    .replace(/-?\d+(\.\d+)?/g, 'N')
+    .replace(/\s+/g, ' ')
+    .trim()
+    .slice(0, 160);
+}
+
+export function signature(text) {
+  const lines = errorLines(text, 3);
+  if (!lines.length) return null;
+  return normalize(lines[0]);
+}
+
+// The name of the failing test, from node --test / TAP, jest, pytest or go test output.
+export function failingTest(text) {
+  const t = stripAnsi(text);
+  const m =
+    t.match(/^\s*(?:✖|×|✗|not ok \d+ -)\s+(?!failing tests)(.+?)(?:\s+\(?\d[\d.]*\s?m?s\)?)?\s*$/m) ||
+    t.match(/^\s*●\s+(.+?)\s*$/m) ||
+    t.match(/^FAILED\s+(\S+)/m) ||
+    t.match(/^--- FAIL:\s+(\S+)/m);
+  return m ? m[1].trim().slice(0, 120) : null;
+}
+
+// ---------- prompts (UserPromptSubmit) ----------
+
+const words = (p) => String(p || '').trim().split(/\s+/).filter(Boolean);
+// A file path, inline code, a pasted error line or a number: the prompt carries its own
+// information. The bare word "error" does not count ("still error", "masih error").
+const SPECIFIC = /`|[\w-]+\/[\w./-]+|\.\w{1,5}\b|\w*(error|exception)\s*[:[(]|\b(traceback|line \d+|expected|got)\b|\d{3,}/i;
+// English and Indonesian words that ask for a repair. Thanks and "works now" never count.
+const REPAIR =
+  /\b(still|again|broken|fix|fail|fails|failing|failed|wrong|same|bug|error|errors|wtf|ugh|stuck|nope|masih|lagi|rusak|gagal|eror|salah|belum|tolong|perbaiki|benerin|betulin)\b|\b(not|doesn'?t|didn'?t|isn'?t|won'?t|can'?t|gak|nggak|ngga|ga|tidak|blm)\s+(work|working|run|running|pass|passing|load|loading|jalan|bisa|berhasil)\b/i;
+const POSITIVE = /\b(thanks|thank you|thx|works now|working now|great|nice|good|perfect|awesome|mantap|makasih|terima kasih|sip|berhasil|sudah bisa|udah bisa)\b/i;
+
+// "still broken", "fix it", "masih error": short, no specifics, asks for a repair.
+export function lowInfoPrompt(p) {
+  const w = words(p);
+  if (!w.length || w.length > 8 || SPECIFIC.test(p) || POSITIVE.test(p)) return false;
+  return REPAIR.test(p);
+}
+
+const BUILD_START =
+  /^\s*(please\s+|tolong\s+|can you\s+|could you\s+)?(build|create|make|add|implement|develop|design|set up|setup|buat|buatkan|bikin|bikinin|tambah|tambahkan|bangun)\b/i;
+const BIG = /\b(app|application|feature|system|platform|website|site|dashboard|service|bot|game|aplikasi|fitur|sistem|situs|web)\b/i;
+const SMALL = /\b(make sure|pastikan|instead|still|again|fix|bug|error|rename|change|ubah|ganti|refactor|button|color|colour|font|style)\b/i;
+const CHECKABLE =
+  /\b(tests?|spec|expect|assert|should (return|show|be|print)|when i|given|acceptance|example|input|output|returns?|tes|uji|contoh|harus|kalau|jika)\b/i;
+
+// "build me a todo app with login": a new feature with nothing that says how to check it.
+// Questions and small edits ("make the button blue") do not count.
+export function vagueFeature(p) {
+  return (
+    words(p).length >= 6 &&
+    BUILD_START.test(p) &&
+    BIG.test(p) &&
+    !SMALL.test(p) &&
+    !CHECKABLE.test(p) &&
+    !SPECIFIC.test(p) &&
+    !/\?\s*$/.test(p)
+  );
+}
+
+function tokens(s) {
+  return new Set(
+    String(s)
+      .toLowerCase()
+      .split(/[^a-z0-9_]+/)
+      .filter((w) => w.length > 2 && w !== 'n')
+  );
+}
+
+export function similarity(a, b) {
+  const A = tokens(a);
+  const B = tokens(b);
+  if (!A.size || !B.size) return 0;
+  let inter = 0;
+  for (const t of A) if (B.has(t)) inter++;
+  return inter / (A.size + B.size - inter);
+}
+
+// ---------- test tampering ----------
+
+const TEST_FILE = /(^|\/)(test|tests|__tests__|spec)\/|\.(test|spec)\.[a-z]+$|_test\.(go|py)$|(^|\/)test_[^/]+\.py$/i;
+
+const TAMPER_ADDED = [
+  { re: /\b(it|test|describe)\.skip\s*\(/, why: 'a test was skipped (.skip)' },
+  { re: /\b(xit|xdescribe|xtest)\s*\(/, why: 'a test was disabled (xit/xdescribe)' },
+  { re: /@pytest\.mark\.skip|unittest\.skip/, why: 'a Python test was skipped' },
+  { re: /@ts-nocheck/, why: 'type checking was turned off (@ts-nocheck)' },
+  { re: /--no-verify/, why: 'git hooks were bypassed (--no-verify)' },
+  { re: /expect\([^)]*\)\.(toBe|toEqual)\(\s*(true|1)\s*\)\s*;?\s*\/\/\s*(todo|temp|hack)/i, why: 'an assertion was replaced with a placeholder' },
+];
+
+export function tamperFindings(nameStatus, diff) {
+  const found = [];
+  for (const line of nameStatus.split('\n')) {
+    const [status, file] = line.split(/\s+/);
+    if (status === 'D' && file && TEST_FILE.test(file)) found.push(`test file deleted: ${file}`);
+  }
+  let current = '';
+  let removedAsserts = 0;
+  let addedAsserts = 0;
+  for (const line of diff.split('\n')) {
+    if (line.startsWith('+++ ')) {
+      current = line.replace(/^\+\+\+ (b\/)?/, '');
+      continue;
+    }
+    if (line.startsWith('--- ')) continue;
+    if (line.startsWith('+')) {
+      for (const t of TAMPER_ADDED) if (t.re.test(line)) found.push(`${t.why} in ${current}`);
+      if (TEST_FILE.test(current) && /\b(expect|assert)\w*\s*\(/.test(line)) addedAsserts++;
+    } else if (line.startsWith('-')) {
+      if (TEST_FILE.test(current) && /\b(expect|assert)\w*\s*\(/.test(line)) removedAsserts++;
+    }
+  }
+  if (removedAsserts - addedAsserts >= 2) {
+    found.push(`${removedAsserts - addedAsserts} assertions removed from test files`);
+  }
+  return [...new Set(found)];
+}
+
+// ---------- redaction for anything that leaves the machine ----------
+
+const SECRETS = [
+  /sk-[A-Za-z0-9_-]{16,}/g,
+  /sk-ant-[A-Za-z0-9_-]{16,}/g,
+  /gh[pousr]_[A-Za-z0-9]{20,}/g,
+  /AKIA[0-9A-Z]{16}/g,
+  /xox[abprs]-[A-Za-z0-9-]{10,}/g,
+  /AIza[0-9A-Za-z_-]{30,}/g,
+  /eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g,
+  /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,
+  /\b[\w.+-]+@[\w-]+\.[\w.-]+\b/g,
+];
+
+export function redact(text) {
+  let out = String(text);
+  for (const re of SECRETS) out = out.replace(re, '[redacted]');
+  out = out.replace(
+    /\b([A-Z0-9_]*(SECRET|TOKEN|PASSWORD|PASSWD|API_KEY|APIKEY|PRIVATE_KEY|ACCESS_KEY)[A-Z0-9_]*)\s*[:=]\s*\S+/gi,
+    '$1=[redacted]'
+  );
+  return out;
+}
+
+// Passed and failed counts from a test runner's own summary line, or null. Exactly one
+// summary must be found: with two runners in one command, or a runner that prints one per
+// package, a count would cover only part of the run, so the finish line says "exit 0".
+const num = (s, re) => {
+  const m = s.match(re);
+  return m ? Number(m[1]) : null;
+};
+const counts = (passed, failed) => (passed == null && failed == null ? null : { passed: passed || 0, failed: failed || 0 });
+const SUMMARIES = [
+  // node --test, spec and TAP reporters: "ℹ tests 3", "ℹ pass 2", "ℹ fail 1"
+  { re: /^(?:ℹ|#) tests \d+$/gm, read: (t) => counts(num(t, /^(?:ℹ|#) pass (\d+)$/m), num(t, /^(?:ℹ|#) fail (\d+)$/m)) },
+  // jest "Tests:       2 failed, 46 passed, 48 total", vitest " Tests  2 failed | 46 passed (48)"
+  { re: /^\s*Tests:?\s+.*\d+ (?:passed|failed)\b.*$/gm, read: (t, line) => counts(num(line, /(\d+) passed/), num(line, /(\d+) failed/)) },
+  // pytest "===== 1 failed, 1 passed in 0.02s ====="
+  {
+    re: /^[=\s]*(?:\d+ \w+(?:, )?)+ in [\d.]+s\b.*$/gm,
+    read: (t, line) => counts(num(line, /(\d+) passed/), (num(line, /(\d+) failed/) || 0) + (num(line, /(\d+) errors?/) || 0)),
+  },
+  // mocha "46 passing" and "2 failing"
+  { re: /^\s*\d+ passing\b.*$/gm, read: (t) => counts(num(t, /^\s*(\d+) passing\b/m), num(t, /^\s*(\d+) failing\b/m)) },
+  // python unittest "Ran 5 tests in 0.001s", then "OK" or "FAILED (failures=2, errors=1)"
+  {
+    re: /^Ran \d+ tests? in [\d.]+s$/gm,
+    read: (t) => {
+      if (/expected failures|unexpected successes/.test(t)) return null; // neither passed nor failed
+      const failed = (num(t, /failures=(\d+)/) || 0) + (num(t, /errors=(\d+)/) || 0);
+      return counts(num(t, /^Ran (\d+) tests?/m) - failed - (num(t, /skipped=(\d+)/) || 0), failed);
+    },
+  },
+  // cargo "test result: ok. 4 passed; 0 failed", one line per test binary
+  { re: /^test result: \w+\. \d+ passed; \d+ failed\b.*$/gm, read: (t, line) => counts(num(line, /(\d+) passed/), num(line, /(\d+) failed/)) },
+];
+
+export function testCounts(output) {
+  const t = stripAnsi(output);
+  const found = SUMMARIES.flatMap((s) => [...t.matchAll(s.re)].map((m) => ({ s, line: m[0] })));
+  return found.length === 1 ? found[0].s.read(t, found[0].line) : null;
+}

package/dist/application/use-cases/check-claimed-tests.js

@@ -1,81 +0,0 @@
-/**
- * Did the agent name a test file that is not in the repo?
- *
- * "The webhook tests passed" while the file never existed is a lie a green re-run cannot see:
- * the suite passes because it never contained the test. Given the agent's own words, this lists
- * the test files it named that exist nowhere in the checkout. A file counts as present when any
- * file with the same name exists (so a wrong folder is not flagged). Deterministic, no model.
- * It cannot tell that a named test never ran, only that it is not there.
- */
-import { readdirSync } from 'node:fs';
-import { basename, join } from 'node:path';
-const TEST_FILE = /^(?:[\w.@-]+\/)*(?:test_[\w.-]+\.py|[\w.-]+_test\.(?:py|go)|[\w.-]+\.(?:test|spec)\.[cm]?[jt]sx?|[\w-]+Test\.php)$/;
-const SKIP_DIRS = new Set([
-    'node_modules',
-    '.git',
-    'dist',
-    'build',
-    '.venv',
-    'venv',
-    '__pycache__',
-    'vendor',
-    'target',
-]);
-const MAX_DEPTH = 8;
-const MAX_ENTRIES = 50_000;
-/** Separators: whitespace, quotes, backticks, brackets of every kind, markdown emphasis and table pipes. */
-const SEPARATORS = /[\s`'"(),;[\]<>{}|*]+/;
-/** `tests/test_x.py::test_y` → `tests/test_x.py`; `a.spec.ts:42:3` → `a.spec.ts`; `_a.test.js_` → `a.test.js`; trailing punctuation dropped. */
-function cleanToken(raw) {
-    let t = raw.replace(/^\.\//, '').replace(/::.*$/, '');
-    t = t.replace(/[.:…!?]+$/, '').replace(/(:\d+)+$/, '');
-    if (t.length > 2 && t.startsWith('_') && t.endsWith('_'))
-        t = t.slice(1, -1);
-    return t;
-}
-export function extractClaimedTestFiles(text) {
-    const found = [];
-    for (const raw of text.split(SEPARATORS)) {
-        const token = cleanToken(raw);
-        if (token.startsWith('/') || token.split('/').includes('..'))
-            continue;
-        if (TEST_FILE.test(token) && !found.includes(token))
-            found.push(token);
-    }
-    return found;
-}
-function namesInRepo(cwd) {
-    const names = new Set();
-    let seen = 0;
-    const walk = (dir, depth) => {
-        if (depth > MAX_DEPTH || seen > MAX_ENTRIES)
-            return;
-        let entries;
-        try {
-            entries = readdirSync(dir, { withFileTypes: true });
-        }
-        catch {
-            return;
-        }
-        for (const e of entries) {
-            seen++;
-            if (e.isDirectory()) {
-                if (!SKIP_DIRS.has(e.name))
-                    walk(join(dir, e.name), depth + 1);
-            }
-            else {
-                names.add(e.name);
-            }
-        }
-    };
-    walk(cwd, 0);
-    return names;
-}
-export function findMissingClaimedTests(cwd, claim) {
-    const claimed = extractClaimedTestFiles(claim);
-    if (!claimed.length)
-        return [];
-    const present = namesInRepo(cwd);
-    return claimed.filter((p) => !present.has(basename(p)));
-}
-//# sourceMappingURL=check-claimed-tests.js.map

package/dist/application/use-cases/detect-test-weakening.js

@@ -1,237 +0,0 @@
-/**
- * Did the change make a test pass without checking anything?
- *
- * A green re-run proves nothing when the agent got there by editing the test: swapping a failing
- * assertion for `assert True`, skipping the test, commenting the assertion out, or returning above
- * it. This reads `git diff` against HEAD and flags such lines added to test files that already
- * existed. It is a deterministic diff read (no model), so it is measured evidence (DESIGN.md §1).
- * By default it reads uncommitted changes against HEAD. With a base ref it reads everything since
- * the branch left that base (committed or not), which is the view a pull request needs.
- */
-import { execFileSync } from 'node:child_process';
-import { existsSync, readFileSync } from 'node:fs';
-import { dirname, join, resolve } from 'node:path';
-const TEST_PATH = /(^|\/)(test_[^/]*\.py|[^/]*_test\.py|[^/]*\.(test|spec)\.[cm]?[jt]sx?|[^/]*_test\.go|[^/]*Test\.php)$|(^|\/)(__tests__|tests?)\//;
-const TRIVIAL = [
-    // `assert True`, `assert(True)`, `assert True, "message"`
-    /^assert\s*\(?\s*(True|1|not\s+False)\s*\)?\s*(,.*)?(#.*)?$/,
-    /^assert\s+([\w.'"]+)\s*==\s*\1\s*(#.*)?$/,
-    /\bexpect\(\s*(true|1)\s*\)\s*\.\s*(toBe|toEqual|toStrictEqual)\(\s*(true|1)\s*\)/,
-    /\bexpect\(\s*([\w.'"]+)\s*\)\s*\.\s*(toBe|toEqual|toStrictEqual)\(\s*\1\s*\)/,
-    /\bexpect\(\s*true\s*\)\s*\.\s*toBeTruthy\(\)/,
-    /\bassert(\.ok)?\(\s*true\s*\)/,
-    /\bassert\.(equal|strictEqual|deepEqual|deepStrictEqual)\(\s*([\w.'"]+)\s*,\s*\2\s*\)/,
-    /\bassert(Equal|Equals|Same)\(\s*([\w.'"]+)\s*,\s*\2\s*\)/,
-    /\bassertTrue\(\s*(true|True)\s*\)/,
-];
-const SKIP = [
-    /@pytest\.mark\.(skip|xfail)\b/,
-    /@pytest\.mark\.skipif\(\s*True\b/,
-    /\bpytest\.(skip|xfail)\(/,
-    /@unittest\.skip/,
-    /\b(it|test|describe)\.(skip|todo)\(/,
-    /\b(xit|xtest|xdescribe)\(/,
-    /\bmarkTest(Skipped|Incomplete)\(/,
-    /\bt\.Skip(f|Now)?\(/,
-    // node:test options: { skip: true } / { skip: 'reason' } / { todo: true }; a conditional skip is left alone
-    /\b(skip|todo)\s*:\s*(true\b|['"`])/,
-];
-/** `.only` makes jest, mocha and Playwright skip every other test: the original pattern, on any test file. */
-const ONLY = /\b(it|test|describe)\.only\(/;
-/** `fit` and `fdescribe` do the same, but `fit` is also an ordinary function name: JS, TS and Vue files, at a statement
- * start, after `=>`, or after `void`, `await` or `return`. */
-const JS_FILE = /\.([cm]?[jt]sx?|vue)$/i;
-const JS_FOCUS = /(^|[;{}]\s*|=>\s*|\b(void|await|return)\s+)(fit|fdescribe)\(/;
-/** The line with quoted text emptied and a trailing `//` comment dropped, so neither can pose as a call. */
-const jsCode = (text) => text.replace(/(["'`])(?:\\.|(?!\1).)*\1/g, '""').replace(/\/\/.*$/, '');
-const ASSERTION = /\b(assert\w*|expect|should|self\.assert\w*|this->assert\w*|t\.(Error|Fatal)\w*)\s*[.(]|^\s*assert\s+\S/;
-const BARE_RETURN = /^return\s*;?$/;
-/** A line that opens a branch: a return under it is conditional, not an unconditional skip. */
-const CONDITIONAL = /^(\}\s*)?(if|else|for|while|switch|case|default|catch|try|finally)\b/;
-/** How far below a bare return an assertion still counts as the one it hides. */
-const RETURN_LOOKAHEAD = 8;
-function uncomment(text) {
-    const m = /^(?:\/\/+|#+|\/\*+|\*)\s?(.*?)\s*(?:\*\/)?$/.exec(text);
-    return m ? m[1].trim() : null;
-}
-/** The commented text is an assertion that the same change removed (alone on its line, or inside a one-line test). */
-function wasCommentedOut(body, removed) {
-    const core = body.replace(/;$/, '');
-    return core.length >= 12 && ASSERTION.test(core) && removed.some((r) => r.includes(core));
-}
-/** `b/path` or git's C-quoted `"b/p\"ath"` form → `path`. */
-function headerPath(raw) {
-    // git appends a tab to the header when the path contains a space.
-    const v = raw.slice(4).replace(/\t$/, '');
-    if (v.startsWith('b/'))
-        return v.slice(2);
-    if (v.startsWith('"b/') && v.endsWith('"')) {
-        return v.slice(3, -1).replace(/\\(["\\tn])/g, (_, c) => (c === 't' ? '\t' : c === 'n' ? '\n' : c));
-    }
-    return null;
-}
-export function parseTestWeakening(diff, readLines) {
-    const found = [];
-    let file = null;
-    let existing = false;
-    let line = 0;
-    let removed = [];
-    // File headers (`--- a/...`, `+++ b/...`) only appear between `diff --git` and the first hunk, so an added line
-    // whose text starts with `++ ` cannot pose as a header.
-    let inHeader = false;
-    for (const raw of diff.split('\n')) {
-        if (raw.startsWith('diff --git ')) {
-            file = null;
-            existing = true;
-            removed = [];
-            inHeader = true;
-        }
-        else if (inHeader && raw.startsWith('--- ')) {
-            existing = raw !== '--- /dev/null';
-        }
-        else if (inHeader && raw.startsWith('+++ ')) {
-            const path = headerPath(raw);
-            file = path && existing && TEST_PATH.test(path) ? path : null;
-        }
-        else if (raw.startsWith('@@')) {
-            inHeader = false;
-            const m = /\+(\d+)/.exec(raw);
-            line = m ? Number(m[1]) : 0;
-            removed = [];
-        }
-        else if (raw.startsWith('-')) {
-            removed.push(raw.slice(1).trim());
-        }
-        else if (raw.startsWith('+') && file) {
-            const text = raw.slice(1).trim();
-            const body = uncomment(text);
-            let why = null;
-            if (TRIVIAL.some((re) => re.test(text)))
-                why = 'trivial-assertion';
-            else if (SKIP.some((re) => re.test(text)) ||
-                ONLY.test(jsCode(text)) ||
-                (JS_FILE.test(file) && JS_FOCUS.test(jsCode(text))))
-                why = 'skipped';
-            else if (body !== null && wasCommentedOut(body, removed))
-                why = 'commented-out';
-            else if (BARE_RETURN.test(text)) {
-                const lines = readLines?.(file);
-                const above = (lines?.[line - 2] ?? '').trim();
-                const below = lines?.slice(line, line + RETURN_LOOKAHEAD) ?? [];
-                if (!CONDITIONAL.test(above) && below.some((l) => ASSERTION.test(l)))
-                    why = 'unreachable-assertion';
-            }
-            if (why)
-                found.push({ file, line, why, text: text.slice(0, 80) });
-            line++;
-        }
-    }
-    return found;
-}
-/** The commit the current branch left `base` at, so changes made on `base` since are not blamed on the branch. */
-function resolveBase(cwd, base) {
-    if (base.startsWith('-'))
-        throw new Error(`Invalid --base "${base}": a ref cannot start with "-".`);
-    try {
-        return execFileSync('git', ['merge-base', base, 'HEAD'], {
-            cwd,
-            encoding: 'utf8',
-            stdio: ['ignore', 'pipe', 'ignore'],
-        }).trim();
-    }
-    catch {
-        throw new Error(`Unknown --base "${base}": not a ref in this repository.`);
-    }
-}
-const MAX_DIFF = 64 * 1024 * 1024;
-/** git with literal paths and unquoted non-ASCII names. */
-function git(cwd, args) {
-    // GIT_DIFF_OPTS overrides --unified=0, and context lines would shift every line number after them.
-    const env = { ...process.env };
-    delete env.GIT_DIFF_OPTS;
-    return execFileSync('git', ['-c', 'core.quotepath=false', '--literal-pathspecs', ...args], {
-        cwd,
-        env,
-        encoding: 'utf8',
-        stdio: ['ignore', 'pipe', 'ignore'],
-        maxBuffer: MAX_DIFF,
-    });
-}
-function hasGitAbove(cwd) {
-    for (let d = resolve(cwd);; d = dirname(d)) {
-        if (existsSync(join(d, '.git')))
-            return true;
-        if (dirname(d) === d)
-            return false;
-    }
-}
-/**
- * Changes in `cwd` against HEAD, or against where the branch left `base` when it is given. Only test files are
- * diffed, so a large change elsewhere cannot push the test diff past the read limit.
- */
-export function scanTestWeakening(cwd, base) {
-    try {
-        git(cwd, ['rev-parse', '--is-inside-work-tree']);
-    }
-    catch (e) {
-        if (e.code === 'ENOENT')
-            return { findings: [], error: 'git is not installed' };
-        // Skipped only when there is no repository at all. Any other git failure (GIT_DIR, ownership checks, a broken
-        // .git) means the scan should have run and did not; with --base a repository is required.
-        if (!base && !hasGitAbove(cwd))
-            return { findings: [], skipped: 'not a git repository' };
-        return { findings: [], error: 'git could not read this repository; run `git status` here to see why' };
-    }
-    if (!base) {
-        try {
-            git(cwd, ['rev-parse', '--verify', '--quiet', 'HEAD']);
-        }
-        catch {
-            return { findings: [], skipped: 'no commit to compare against yet' };
-        }
-    }
-    const from = base ? resolveBase(cwd, base) : 'HEAD';
-    // Fixed diff options, so a user's or the change's own git config cannot alter what the parser reads: paths
-    // relative to `cwd` (a package folder inside a repository), a/ and b/ prefixes, no external diff or textconv,
-    // binary attributes ignored, renames paired.
-    const opts = ['--relative', '--no-ext-diff', '--no-textconv', '--text', '--src-prefix=a/', '--dst-prefix=b/', '-M'];
-    let tests;
-    try {
-        // -z name-status: status, path (and for renames and copies a second path), NUL-separated. Both paths of a
-        // rename go into the pathspec so git can pair them; a test renamed and weakened is still an existing test.
-        const fields = git(cwd, ['diff', ...opts, '--name-status', '-z', from]).split('\0');
-        tests = [];
-        for (let i = 0; i < fields.length - 1;) {
-            const status = fields[i++];
-            const paths = /^[RC]/.test(status) ? [fields[i++], fields[i++]] : [fields[i++]];
-            if (paths.some((p) => p && TEST_PATH.test(p)))
-                tests.push(...paths.filter(Boolean));
-        }
-    }
-    catch {
-        return { findings: [], error: 'could not read the diff (the list of changed files)' };
-    }
-    if (!tests.length)
-        return { findings: [] };
-    let diff;
-    try {
-        diff = git(cwd, ['diff', ...opts, '--unified=0', '--no-color', from, '--', ...tests]);
-    }
-    catch {
-        return {
-            findings: [],
-            error: `could not read the diff of ${tests.length} changed test file(s); it may be larger than 64 MB`,
-        };
-    }
-    return {
-        findings: parseTestWeakening(diff, (f) => {
-            try {
-                return readFileSync(join(cwd, f), 'utf8').split('\n');
-            }
-            catch {
-                return null;
-            }
-        }),
-    };
-}
-//# sourceMappingURL=detect-test-weakening.js.map