codetrellis 0.0.0-stage → 0.3.0

package/src/backend/services/task-attachments-service.js

@@ -0,0 +1,340 @@
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var task_attachments_service_exports = {};
+__export(task_attachments_service_exports, {
+  addAttachment: () => addAttachment,
+  deleteAttachment: () => deleteAttachment,
+  listItemAttachments: () => listItemAttachments,
+  listPlanDocAttachments: () => listPlanDocAttachments,
+  listTaskAttachments: () => listTaskAttachments,
+  resolveAttachmentLocation: () => resolveAttachmentLocation,
+  servedContentType: () => servedContentType,
+  upsertAttachment: () => upsertAttachment,
+  validateImportedAttachment: () => validateImportedAttachment
+});
+module.exports = __toCommonJS(task_attachments_service_exports);
+var import_node_crypto = require("node:crypto");
+var import_confined_fs = require("./confined-fs");
+var import_trusted_roots = require("./trusted-roots");
+var import_node_os = __toESM(require("node:os"));
+var import_node_path = __toESM(require("node:path"));
+var import_database = require("./database");
+var import_persistence = require("./persistence");
+var import_settings_service = require("./settings-service");
+var import_project_config_service = require("./project-config-service");
+var import_material_place = require("./material-place");
+const MAX_ATTACHMENT_BYTES = 25 * 1024 * 1024;
+const ALLOWED_ATTACHMENT_TYPES = /* @__PURE__ */ new Set([
+  "image/png",
+  "image/jpeg",
+  "image/gif",
+  "image/webp",
+  "image/svg+xml",
+  "video/mp4",
+  "video/webm",
+  "video/quicktime"
+]);
+function resolveAttachmentDir(targetUid, projectRoot) {
+  const location = projectRoot ? (0, import_project_config_service.getEffectiveAttachmentLocation)(projectRoot) : (0, import_settings_service.getSettings)().plans.attachmentLocation ?? "project";
+  if (location === "user" || !projectRoot) {
+    const userDataDir = process.env.CODETRELLIS_DATA_DIR ?? import_node_path.default.join(import_node_os.default.homedir(), ".codetrellis");
+    const absDir2 = import_node_path.default.join(userDataDir, "attachments", targetUid);
+    return {
+      absDir: absDir2,
+      storedValuePrefix: `userdata://attachments/${targetUid}/`
+    };
+  }
+  const absDir = import_node_path.default.join(projectRoot, ".codetrellis", "attachments", targetUid);
+  return {
+    absDir,
+    storedValuePrefix: import_node_path.default.join(".codetrellis", "attachments", targetUid) + import_node_path.default.sep
+  };
+}
+function resolveAttachmentLocation(value, targetUid, trustedProjectRoot) {
+  if (typeof value !== "string" || value.length === 0) return null;
+  if (value.startsWith("userdata://")) {
+    const prefix = `userdata://attachments/${targetUid}/`;
+    if (!value.startsWith(prefix)) return null;
+    const userDataDir = process.env.CODETRELLIS_DATA_DIR ?? import_node_path.default.join(import_node_os.default.homedir(), ".codetrellis");
+    return { root: import_node_path.default.join(userDataDir, "attachments", targetUid), rel: value.slice(prefix.length) };
+  }
+  if ((0, import_material_place.isPlacePath)(value)) return trustedProjectRoot ? (0, import_material_place.locateStored)(value, trustedProjectRoot) : null;
+  if (import_node_path.default.isAbsolute(value) || /^[a-z][a-z0-9+.-]*:/i.test(value)) return null;
+  if (!trustedProjectRoot) return null;
+  return { root: trustedProjectRoot, rel: value };
+}
+const SERVED_TYPES = {
+  png: "image/png",
+  jpg: "image/jpeg",
+  jpeg: "image/jpeg",
+  gif: "image/gif",
+  webp: "image/webp",
+  svg: "image/svg+xml",
+  mp4: "video/mp4",
+  webm: "video/webm",
+  mov: "video/quicktime"
+};
+function servedContentType(rel) {
+  return SERVED_TYPES[import_node_path.default.extname(rel).slice(1).toLowerCase()] ?? null;
+}
+function addAttachment(input) {
+  const uid = (0, import_node_crypto.randomUUID)();
+  const now = Date.now();
+  let value = input.value;
+  const isInlineByteUpload = (input.kind === "image" || input.kind === "video") && input.dataBase64;
+  if (isInlineByteUpload) {
+    if (input.contentType && !ALLOWED_ATTACHMENT_TYPES.has(input.contentType.toLowerCase())) {
+      throw new Error(`Unsupported attachment content type: ${input.contentType}`);
+    }
+    const approxBytes = Math.floor(input.dataBase64.length * 3 / 4);
+    if (approxBytes > MAX_ATTACHMENT_BYTES) {
+      throw new Error(
+        `Attachment exceeds the ${MAX_ATTACHMENT_BYTES / 1024 / 1024} MB limit`
+      );
+    }
+    const buf = Buffer.from(input.dataBase64, "base64");
+    if (buf.length > MAX_ATTACHMENT_BYTES) {
+      throw new Error(
+        `Attachment exceeds the ${MAX_ATTACHMENT_BYTES / 1024 / 1024} MB limit`
+      );
+    }
+    const trustedRoot = input.projectRoot ? (0, import_trusted_roots.resolveTrustedProjectRoot)(input.projectRoot, "addAttachment(projectRoot)") : void 0;
+    const ext = guessExtensionFromContentType(input.contentType) || guessExtensionFromValue(input.value) || (input.kind === "video" ? "mp4" : "png");
+    const { absDir, storedValuePrefix } = resolveAttachmentDir(input.targetUid, trustedRoot);
+    const filename = `${uid}.${ext}`;
+    const containmentRoot = trustedRoot ? import_node_path.default.join(trustedRoot, ".codetrellis", "attachments") : import_node_path.default.dirname(absDir);
+    (0, import_confined_fs.writeFileWithin)(containmentRoot, import_node_path.default.join(absDir, filename), buf, "attachment");
+    value = storedValuePrefix + filename;
+  }
+  (0, import_database.getDb)().run(
+    `INSERT INTO attachments (uid, target_type, target_uid, kind, value, label, content_type, author, author_type, created_at)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+    [
+      uid,
+      input.targetType,
+      input.targetUid,
+      input.kind,
+      value,
+      input.label ?? null,
+      input.contentType ?? null,
+      input.author,
+      input.authorType,
+      now
+    ]
+  );
+  (0, import_persistence.markDirty)();
+  if (input.targetType === "task" || input.targetType === "item") {
+    return {
+      uid,
+      taskUid: input.targetUid,
+      kind: input.kind,
+      value,
+      label: input.label,
+      contentType: input.contentType,
+      author: input.author,
+      authorType: input.authorType,
+      createdAt: now
+    };
+  }
+  return {
+    uid,
+    docUid: input.targetUid,
+    kind: input.kind,
+    value,
+    label: input.label,
+    contentType: input.contentType,
+    author: input.author,
+    authorType: input.authorType,
+    createdAt: now
+  };
+}
+function listTaskAttachments(taskUid) {
+  const result = (0, import_database.getDb)().exec(
+    `SELECT uid, target_uid, kind, value, label, content_type, author, author_type, created_at
+     FROM attachments WHERE target_type = 'task' AND target_uid = ? ORDER BY created_at ASC`,
+    [taskUid]
+  );
+  if (!result[0]) return [];
+  return result[0].values.map((r) => ({
+    uid: r[0],
+    taskUid: r[1],
+    kind: r[2],
+    value: r[3],
+    label: r[4] ?? void 0,
+    contentType: r[5] ?? void 0,
+    author: r[6],
+    authorType: r[7],
+    createdAt: r[8]
+  }));
+}
+function listItemAttachments(itemUid) {
+  const result = (0, import_database.getDb)().exec(
+    `SELECT uid, target_uid, kind, value, label, content_type, author, author_type, created_at, role, sha256
+     FROM attachments
+     WHERE target_uid = ? AND target_type IN ('item', 'task', 'plan_doc')
+     ORDER BY created_at ASC`,
+    [itemUid]
+  );
+  if (!result[0]) return [];
+  return result[0].values.map((r) => ({
+    uid: r[0],
+    taskUid: r[1],
+    kind: r[2],
+    value: r[3],
+    label: r[4] ?? void 0,
+    contentType: r[5] ?? void 0,
+    author: r[6],
+    authorType: r[7],
+    createdAt: r[8],
+    role: r[9] ?? null,
+    sha256: r[10] ?? null
+  }));
+}
+function listPlanDocAttachments(docUid) {
+  const result = (0, import_database.getDb)().exec(
+    `SELECT uid, target_uid, kind, value, label, content_type, author, author_type, created_at
+     FROM attachments WHERE target_type = 'plan_doc' AND target_uid = ? ORDER BY created_at ASC`,
+    [docUid]
+  );
+  if (!result[0]) return [];
+  return result[0].values.map((r) => ({
+    uid: r[0],
+    docUid: r[1],
+    kind: r[2],
+    value: r[3],
+    label: r[4] ?? void 0,
+    contentType: r[5] ?? void 0,
+    author: r[6],
+    authorType: r[7],
+    createdAt: r[8]
+  }));
+}
+function deleteAttachment(uid) {
+  const db = (0, import_database.getDb)();
+  const before = db.exec(`SELECT uid FROM attachments WHERE uid = ?`, [uid]);
+  if (!before[0]?.values[0]) return false;
+  db.run(`DELETE FROM attachments WHERE uid = ?`, [uid]);
+  (0, import_persistence.markDirty)();
+  return true;
+}
+const ATTACHMENT_KINDS = ["url", "image", "video", "file_ref", "code_block", "transcript"];
+function validateImportedAttachment(raw, targetUid) {
+  const kind = raw.kind;
+  if (!ATTACHMENT_KINDS.includes(kind)) return { refused: `unknown kind ${String(raw.kind)}` };
+  if (typeof raw.value !== "string" || raw.value.length === 0) return { refused: "no value" };
+  const value = raw.value;
+  if (value.includes("\0")) return { refused: "value contains a NUL byte" };
+  if (kind === "url") {
+    if (!/^https?:\/\//i.test(value)) return { refused: "a url must be http(s)" };
+  } else if (kind === "image" || kind === "video" || kind === "file_ref") {
+    if (value.startsWith("userdata://")) {
+      if (!value.startsWith(`userdata://attachments/${targetUid}/`) || value.includes("..")) {
+        return { refused: "points into the data directory outside this item's uploads" };
+      }
+    } else if ((0, import_material_place.isPlacePath)(value)) {
+      if (value.slice("plans://".length).split(/[\\/]/).some((seg) => seg === ".." || seg === "")) {
+        return { refused: "path leaves the plans folder" };
+      }
+    } else if (import_node_path.default.isAbsolute(value) || /^[a-z][a-z0-9+.-]*:/i.test(value)) {
+      return { refused: "absolute paths and URLs are not file references; use a path inside the project" };
+    } else if (import_node_path.default.normalize(value).split(/[\\/]/).includes("..")) {
+      return { refused: "path leaves the project" };
+    }
+  }
+  const ct = typeof raw.contentType === "string" ? raw.contentType.toLowerCase() : null;
+  return { kind, value, contentType: ct && ALLOWED_ATTACHMENT_TYPES.has(ct) ? ct : null };
+}
+function upsertAttachment(input) {
+  const db = (0, import_database.getDb)();
+  const role = input.kind === "file_ref" && input.role && ["material", "output", "evidence"].includes(input.role) ? input.role : null;
+  const exists = db.exec(`SELECT target_type, target_uid FROM attachments WHERE uid = ?`, [input.uid])[0]?.values[0];
+  if (exists) {
+    if (exists[0] !== input.targetType || exists[1] !== input.targetUid) return false;
+    db.run(
+      `UPDATE attachments SET kind = ?, value = ?, label = ?, content_type = ?, author = ?, author_type = ?, created_at = ? WHERE uid = ?`,
+      [
+        input.kind,
+        input.value,
+        input.label ?? null,
+        input.contentType ?? null,
+        input.author,
+        input.authorType,
+        input.createdAt,
+        input.uid
+      ]
+    );
+    if (role) db.run(`UPDATE attachments SET role = ? WHERE uid = ?`, [role, input.uid]);
+  } else {
+    db.run(
+      `INSERT INTO attachments (uid, target_type, target_uid, kind, value, label, content_type, author, author_type, created_at, role)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+      [
+        input.uid,
+        input.targetType,
+        input.targetUid,
+        input.kind,
+        input.value,
+        input.label ?? null,
+        input.contentType ?? null,
+        input.author,
+        input.authorType,
+        input.createdAt,
+        role
+      ]
+    );
+  }
+  (0, import_persistence.markDirty)();
+  return true;
+}
+function guessExtensionFromContentType(contentType) {
+  if (!contentType) return null;
+  const m = contentType.match(/^(?:image|video)\/([a-z0-9+.-]+)/i);
+  if (!m) return null;
+  const sub = m[1].toLowerCase();
+  if (sub === "jpeg") return "jpg";
+  if (sub === "svg+xml") return "svg";
+  if (sub === "quicktime") return "mov";
+  if (sub === "x-matroska") return "mkv";
+  return sub;
+}
+function guessExtensionFromValue(value) {
+  const m = value.match(/\.([a-z0-9]{2,5})$/i);
+  return m ? m[1].toLowerCase() : null;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  addAttachment,
+  deleteAttachment,
+  listItemAttachments,
+  listPlanDocAttachments,
+  listTaskAttachments,
+  resolveAttachmentLocation,
+  servedContentType,
+  upsertAttachment,
+  validateImportedAttachment
+});

package/src/backend/services/task-grounding.js

@@ -0,0 +1,60 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var task_grounding_exports = {};
+__export(task_grounding_exports, {
+  gradeCriterion: () => gradeCriterion,
+  taskGrounding: () => taskGrounding
+});
+module.exports = __toCommonJS(task_grounding_exports);
+var import_criteria_service = require("./criteria-service");
+var import_criterion_loop_service = require("./criterion-loop-service");
+var import_plan_item_service = require("./plan-item-service");
+var import_artefact_service = require("./artefact-service");
+var import_grounding_line = require("../../shared/lib/grounding-line");
+function gradeCriterion(c, check) {
+  if (c.state === "stale") return { grade: "changed", why: "a file it was approved on has changed since" };
+  if (c.state === "sent_back") return { grade: "sent_back", why: "a person sent it back" };
+  const failures = check ? check.findings.filter((f) => f.status === "fail").map((f) => f.message) : [];
+  if (check && !check.ok) {
+    const older = check.findings.find((f) => f.status === "fail" && f.reason === "tests_older");
+    if (older) return { grade: "tests_older", why: older.message };
+    if (!c.submitted && c.state === "open") return { grade: "no_evidence", why: failures[0] ?? "nothing offered yet" };
+    return { grade: "failing", why: failures[0] ?? "its checks fail" };
+  }
+  if (c.state === "met") return { grade: "grounded", why: check ? "met, and its checks still pass" : "met" };
+  if (!check) return c.submitted ? { grade: "waiting", why: "submitted; its checks could not run here" } : { grade: "no_evidence", why: "nothing offered yet" };
+  if (c.kind === "manual") return { grade: "waiting", why: c.submitted ? "submitted; only a person can judge it" : "only a person can judge it" };
+  if (c.state === "submitted") return { grade: "waiting", why: "its checks pass; a person decides" };
+  return { grade: "grounded", why: "its checks pass on the evidence there" };
+}
+async function taskGrounding(itemUid) {
+  if (!(0, import_plan_item_service.getItem)(itemUid)) return null;
+  await (0, import_artefact_service.refreshArtefactHashes)(itemUid).catch(() => []);
+  const graded = [];
+  for (const c of (0, import_criteria_service.listCriteria)(itemUid)) {
+    const check = await (0, import_criterion_loop_service.checkCriterion)(c.uid).catch(() => null);
+    const { grade, why } = gradeCriterion({ ...c, submitted: (c.latestSubmission?.length ?? 0) > 0 }, check);
+    graded.push({ uid: c.uid, text: c.text, grade, why });
+  }
+  return { itemUid, ...(0, import_grounding_line.groundingLine)(graded.map((g) => g.grade)), criteria: graded };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  gradeCriterion,
+  taskGrounding
+});

package/src/backend/services/task-records/check-run-record.js

@@ -0,0 +1,146 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var check_run_record_exports = {};
+__export(check_run_record_exports, {
+  CHECK_RUN_LIMITS: () => CHECK_RUN_LIMITS,
+  MAX_CHECK_RUN_BYTES: () => MAX_CHECK_RUN_BYTES,
+  checkRunBytes: () => checkRunBytes,
+  outcomeWords: () => outcomeWords,
+  parseCheckRun: () => parseCheckRun,
+  serializeCheckRun: () => serializeCheckRun
+});
+module.exports = __toCommonJS(check_run_record_exports);
+var import_yaml = require("yaml");
+var import_signing = require("./signing");
+var import_run_record = require("./run-record");
+var import_agent_review = require("../../../shared/lib/agent-review");
+const KIND = "check-run";
+const MAX_CHECK_RUN_BYTES = 512 * 1024;
+const MAX_SAYS = 200;
+const MAX_FINDINGS = 1e3;
+const MAX_DIRTY = 500;
+const WRITER = /^[a-f0-9]{8,32}$/;
+const SHA = /^[a-f0-9]{40}$/;
+const text = (v, max) => typeof v === "string" && v.length > 0 ? v.slice(0, max) : null;
+const count = (v) => Number.isSafeInteger(v) && v >= 0 ? v : 0;
+function bodyOf(r) {
+  return {
+    kind: KIND,
+    writer: r.writer,
+    name: r.name,
+    counter: r.counter,
+    at: new Date(r.at).toISOString(),
+    by: r.by,
+    ranIn: r.ranIn,
+    commit: r.commit,
+    dirty: r.dirty,
+    base: r.base,
+    rulebook: r.rulebook,
+    scope: r.scope,
+    strict: r.strict,
+    outcome: r.outcome,
+    says: r.says,
+    findings: r.findings.map((f) => ({ rule: f.rule, suite: f.suite, path: f.path, imports: f.imports, strength: f.strength, failing: f.failing, words: f.words, fix: f.fix })),
+    // Only when present, so a rule check's record (and its signature) is as before.
+    ...r.review ? { review: r.review } : {}
+  };
+}
+function checkRunBytes(r) {
+  return (0, import_signing.canonicalJson)(bodyOf(r));
+}
+function serializeCheckRun(r, signature) {
+  const body = signature ? { ...bodyOf(r), signature } : bodyOf(r);
+  return `# CodeTrellis: one device's latest check run, where it ran, and what it said.
+${(0, import_yaml.stringify)(body, { lineWidth: 0 })}`;
+}
+function parseCheckRun(source) {
+  if (Buffer.byteLength(source, "utf8") > MAX_CHECK_RUN_BYTES) return { error: "larger than a check-run record can be" };
+  let raw;
+  try {
+    raw = (0, import_yaml.parse)(source, { maxAliasCount: 0 });
+  } catch {
+    return { error: "not YAML" };
+  }
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return { error: "not a record" };
+  const { signature: rawSignature, ...r } = raw;
+  if (r.kind !== KIND) return { error: "not a check-run record" };
+  const writer = typeof r.writer === "string" && WRITER.test(r.writer) ? r.writer : null;
+  if (!writer) return { error: "no writer" };
+  const counter = Number.isSafeInteger(r.counter) && r.counter > 0 ? r.counter : null;
+  if (!counter) return { error: "no counter" };
+  const at = typeof r.at === "string" ? Date.parse(r.at) : NaN;
+  if (!Number.isFinite(at)) return { error: "no time" };
+  const by = r.by && typeof r.by === "object" ? r.by : {};
+  const o = r.outcome && typeof r.outcome === "object" ? r.outcome : {};
+  const findings = [];
+  for (const f of Array.isArray(r.findings) ? r.findings.slice(0, MAX_FINDINGS) : []) {
+    const ff = f && typeof f === "object" ? f : {};
+    const rule = text(ff.rule, 63);
+    const imports = text(ff.imports, 300);
+    if (!rule || !imports || !(0, import_run_record.isRunPath)(ff.path)) continue;
+    findings.push({
+      rule,
+      suite: text(ff.suite, 63) ?? "architecture",
+      path: ff.path,
+      imports,
+      strength: ff.strength === "warn" ? "warn" : "block",
+      failing: ff.failing === true,
+      words: text(ff.words, 500) ?? rule,
+      fix: text(ff.fix, 500)
+    });
+  }
+  return {
+    signed: { bytes: (0, import_signing.canonicalJson)(r), signature: (0, import_signing.parseSignature)(rawSignature) },
+    record: {
+      writer,
+      name: text(r.name, 120) ?? "someone",
+      counter,
+      at,
+      by: { author: text(by.author, 120) ?? "someone", authorType: text(by.authorType, 40) ?? "unknown" },
+      ranIn: text(r.ranIn, 80) ?? "somewhere",
+      commit: typeof r.commit === "string" && SHA.test(r.commit) ? r.commit : null,
+      dirty: (Array.isArray(r.dirty) ? r.dirty : []).filter(import_run_record.isRunPath).slice(0, MAX_DIRTY),
+      base: text(r.base, 200),
+      rulebook: typeof r.rulebook === "string" && SHA.test(r.rulebook) ? r.rulebook : null,
+      scope: text(r.scope, 300),
+      strict: r.strict === true,
+      outcome: { ok: o.ok === true, files: count(o.files), blocks: count(o.blocks), warns: count(o.warns) },
+      says: (Array.isArray(r.says) ? r.says : []).map((s) => text(s, 1e3)).filter((s) => !!s).slice(0, MAX_SAYS),
+      findings,
+      ...(0, import_agent_review.parseAgentReview)(r.review) ? { review: (0, import_agent_review.parseAgentReview)(r.review) } : {}
+    }
+  };
+}
+function outcomeWords(o) {
+  if (o.ok && o.warns === 0) return "\u2713 conforms";
+  const parts = [
+    o.blocks ? `\u2717 ${o.blocks} ${o.blocks === 1 ? "blocks" : "block"}` : null,
+    o.warns ? `\u26A0 ${o.warns} ${o.warns === 1 ? "warns" : "warn"}` : null
+  ].filter(Boolean);
+  return o.ok ? `\u2713 conforms \xB7 ${parts.join(" \xB7 ")}` : parts.join(" \xB7 ");
+}
+const CHECK_RUN_LIMITS = { MAX_SAYS, MAX_FINDINGS, MAX_DIRTY };
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  CHECK_RUN_LIMITS,
+  MAX_CHECK_RUN_BYTES,
+  checkRunBytes,
+  outcomeWords,
+  parseCheckRun,
+  serializeCheckRun
+});

package/src/backend/services/task-records/check-runs.js

@@ -0,0 +1,115 @@
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var check_runs_exports = {};
+__export(check_runs_exports, {
+  CHECK_RUNS_DIR: () => CHECK_RUNS_DIR,
+  myCheckRunCount: () => myCheckRunCount,
+  readTeammateCheckRuns: () => readTeammateCheckRuns,
+  writeCheckRunRecord: () => writeCheckRunRecord
+});
+module.exports = __toCommonJS(check_runs_exports);
+var import_node_fs = __toESM(require("node:fs"));
+var import_node_path = __toESM(require("node:path"));
+var import_confined_fs = require("../confined-fs");
+var import_cloud_files = require("../cloud-files");
+var import_check_runs = require("../check-runs");
+var import_check_run_record = require("./check-run-record");
+var import_test_runs = require("./test-runs");
+var import_trust = require("./trust");
+const CHECK_RUNS_DIR = import_node_path.default.join(import_test_runs.RUNS_DIR, "checks");
+const FILE = /^([a-f0-9]{8,32})-(\d{1,9})\.yaml$/;
+const MAX_FILES = 2e3;
+function filesIn(dir) {
+  try {
+    return import_node_fs.default.readdirSync(dir, { withFileTypes: true }).filter((e) => e.isFile() && FILE.test(e.name)).slice(0, MAX_FILES).map((e) => {
+      const m = FILE.exec(e.name);
+      return { name: e.name, writer: m[1], counter: Number(m[2]) };
+    });
+  } catch {
+    return [];
+  }
+}
+function writeCheckRunRecord(where, run) {
+  const dir = import_node_path.default.join(where.home, CHECK_RUNS_DIR);
+  const mine = filesIn(dir).filter((f) => f.writer === where.me);
+  let counter = Math.max(0, ...mine.map((f) => f.counter)) + 1;
+  while (import_node_fs.default.existsSync(import_node_path.default.join(dir, `${where.me}-${counter}.yaml`))) counter++;
+  const { projectRoot: _root, ...rest } = run;
+  const record = { ...rest, writer: where.me, name: where.name, counter };
+  const signature = (0, import_trust.signRecord)(where.projectRoot, where.home, record, (0, import_check_run_record.checkRunBytes)(record));
+  const file = (0, import_confined_fs.writeFileWithin)(where.home, import_node_path.default.join(dir, `${where.me}-${counter}.yaml`), (0, import_check_run_record.serializeCheckRun)(record, signature), "check-run record");
+  for (const f of mine) {
+    try {
+      (0, import_confined_fs.removeWithin)(where.home, import_node_path.default.join(dir, f.name), {}, "check-run record");
+    } catch {
+    }
+  }
+  return file;
+}
+function readTeammateCheckRuns(projectRoot, home, me) {
+  const dir = import_node_path.default.join(home, CHECK_RUNS_DIR);
+  const known = (0, import_check_runs.knownCheckRunCounters)(projectRoot);
+  const newest = /* @__PURE__ */ new Map();
+  for (const f of filesIn(dir)) {
+    if (f.writer === me) continue;
+    const at = newest.get(f.writer);
+    if (!at || f.counter > at.counter) newest.set(f.writer, f);
+  }
+  let added = 0;
+  let ctx = null;
+  for (const [writer, f] of newest) {
+    if ((known.get(writer) ?? 0) >= f.counter) continue;
+    const file = import_node_path.default.join(dir, f.name);
+    if ((0, import_cloud_files.isPlaceholder)(file)) continue;
+    let text;
+    try {
+      text = (0, import_confined_fs.readTextWithin)(home, file, "check-run record");
+    } catch {
+      continue;
+    }
+    const parsed = (0, import_check_run_record.parseCheckRun)(text);
+    if (!("record" in parsed)) continue;
+    const r = parsed.record;
+    if (r.writer !== writer || r.counter !== f.counter) continue;
+    ctx ??= (0, import_trust.checkContext)(projectRoot);
+    const v = (0, import_trust.verifyTaskRecord)(r, parsed.signed, ctx);
+    (0, import_check_runs.putTeammateCheckRun)(projectRoot, r, v.verified ? { verified: true, how: v.how, who: v.who } : { verified: false, why: v.why });
+    added++;
+  }
+  return added;
+}
+function myCheckRunCount(home, me) {
+  return home ? filesIn(import_node_path.default.join(home, CHECK_RUNS_DIR)).filter((f) => f.writer === me).length : 0;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  CHECK_RUNS_DIR,
+  myCheckRunCount,
+  readTeammateCheckRuns,
+  writeCheckRunRecord
+});