codictator 0.1.2 → 0.1.3

package/dist/builtin-packs/core/fixtures/conventional-commit/passing/basic/case.json

@@ -5,6 +5,6 @@
 	"trigger": "commit subject with no type prefix",
 	"expectRules": [],
 	"files": {
-		"commit.txt": "subject: fix(core): drop dead export\n"
+		"sample.txt": "subject: fix(core): drop dead export\n"
 	}
 }

package/dist/builtin-packs/core/fixtures/conventional-commit/violating/basic/case.json

@@ -5,6 +5,6 @@
 	"trigger": "commit subject with no type prefix",
 	"expectRules": ["core/conventional-commit"],
 	"files": {
-		"commit.txt": "subject: fixed stuff\n"
+		"sample.txt": "subject: fixed stuff\n"
 	}
 }

package/dist/builtin-packs/typescript/fixtures/lint/passing/exported/case.json

@@ -0,0 +1,8 @@
+{
+	"expectation": "passing",
+	"expectRules": [],
+	"files": { "sample.ts": "export const MS_PER_DAY = 86_400_000;\n" },
+	"rule": "ts/lint",
+	"section": "§6.1",
+	"trigger": "exported binding used cross-file, not in its own file"
+}

package/dist/builtin-packs/typescript/pack.json

@@ -31,7 +31,7 @@
 			"params": {},
 			"ratchet": false,
 			"measureVersion": 1,
-			"fixtures": { "violating": ["basic"], "passing": ["basic"] }
+			"fixtures": { "violating": ["basic"], "passing": ["basic", "exported"] }
 		},
 		{
 			"id": "ts/no-phantom-import",

package/dist/cli/gate-scope.d.ts

@@ -7,4 +7,5 @@ export interface GateScope {
     readonly note: string;
     readonly proposedContent?: string;
 }
+export declare function addedLines(diff: string): string;
 export declare function evaluateGateScope(ports: CommandPorts, packIds: ReadonlyArray<string>, scope: GateScope, now: string, configHash: string): Promise<Result<Array<Finding>>>;

package/dist/cli/gate-scope.js

@@ -51,6 +51,17 @@ function mergeGateFindings(first, second) {
     }
     return merged.sort(compareGateFindings);
 }
+// BUG-0022 + SPEC §4.7.1: the L3 gate judges added lines only, so a commit
+// deleting a flagged literal passes while staging one still blocks. A diff
+// carries its removed lines as `-` rows; scanning the raw diff would match
+// those and make the removal uncommittable.
+export function addedLines(diff) {
+    return diff
+        .split("\n")
+        .filter((line) => line.startsWith("+") && !line.startsWith("+++"))
+        .map((line) => line.slice(1))
+        .join("\n");
+}
 // BUG-0014 + SPEC §4.3.2: the gate evaluation over a diff scope. The
 // pre-tool leg keeps today's fail-closed local verdict byte for byte; the
 // review leg adds the diff-sound review subset over the same files, so the

package/dist/cli/git-hook.js

@@ -4,9 +4,10 @@
 // the change with the gate rule subset `verify` loads over staged scopes —
 // new scope plumbing, no new detection logic. commit-msg appends
 // the Codictator-L3 trailer §4.14.2 checks at L4.
+import path from "node:path";
 import { ENGINE_VERSION, HOOK_MARKER } from "../features/config/index.js";
 import { err, makeError, ok, readHostText, writeHostText, } from "../kernel/index.js";
-import { evaluateGateScope } from "./gate-scope.js";
+import { addedLines, evaluateGateScope } from "./gate-scope.js";
 import { printFinding } from "./inspect.js";
 import { commandEnv, fail, loadRepoConfig, MIN_NODE_MAJOR, needRoot, nodeMajor, nodeTooOldMessage, printHuman, printJson, reportError, usageError, } from "./shared.js";
 const GIT_TIMEOUT_MS = 30000;
@@ -53,7 +54,7 @@ async function evaluateGitChange(ports, req, hook, packIds, files, content, now,
     const evaluated = await evaluateGateScope(ports, packIds, {
         files: [...files],
         note: hook,
-        ...(content === "" ? {} : { proposedContent: content }),
+        ...(content === "" ? {} : { proposedContent: addedLines(content) }),
     }, now, configHash);
     if (!evaluated.ok) {
         return reportError(evaluated.error, req.json);
@@ -77,16 +78,20 @@ async function runPreCommit(req, ports, packIds, now, configHash) {
     }
     return evaluateGitChange(ports, req, "pre-commit", packIds, staged.value, diff.value, now, configHash);
 }
-// SPEC §4.14.4: git hands commit-msg an absolute COMMIT_EDITMSG path, which
-// in a linked worktree lives under the main repo's .git/worktrees/<name>/
-// dir, outside the worktree root. The confined Fs port rejects absolute
-// paths (CDX-E701), so the hook uses kernel-owned host I/O; an unreadable
-// or unwritable message file blocks fail-closed.
+// SPEC §4.14.4: git hands commit-msg the COMMIT_EDITMSG path, absolute in a
+// linked worktree (under the main repo's .git/worktrees/<name>/ dir, outside
+// the worktree root) but relative to the repo root (`.git/COMMIT_EDITMSG`)
+// in the main worktree. The confined Fs port rejects absolute paths
+// (CDX-E701), so the hook uses kernel-owned host I/O — which itself
+// requires absolute paths — resolving a relative handoff against the
+// invocation cwd first; an unreadable or unwritable message file blocks
+// fail-closed.
 async function runCommitMsg(req, configHash) {
     if (req.args.length !== 2 || req.args[1] === undefined) {
         return usageError("usage: codictator git commit-msg <file>");
     }
-    const file = req.args[1];
+    const raw = req.args[1];
+    const file = path.isAbsolute(raw) ? raw : path.resolve(req.cwd, raw);
     const trailer = `Codictator-L3: ${configHash.slice(0, 12)}`;
     const read = await readHostText(file);
     if (!read.ok) {

package/dist/cli/plan-launcher.d.ts

@@ -1 +1,2 @@
 export declare const LAUNCHER_TEXT: string;
+export type LauncherText = typeof LAUNCHER_TEXT;

package/dist/cli/plan-launcher.js

@@ -20,7 +20,11 @@ export const LAUNCHER_TEXT = [
     "// any newer syntax could load, and only node: built-ins are imported. It",
     "// sets CODICTATOR_HOOK=1 in the engine process, then resolves the engine at",
     "// <root>/node_modules/codictator/dist/cli/main.js else",
-    "// <root>/.codictator/tool/node_modules/codictator/dist/cli/main.js. A",
+    "// <root>/.codictator/tool/node_modules/codictator/dist/cli/main.js. The",
+    "// launcher reads the resolved engine's manifest version and passes it",
+    "// as main's third argument, so hook validation sees the installed",
+    "// version (SPEC §4.2.1 EC-11); an unreadable manifest falls back to",
+    "// the two-argument call. A",
     "// missing engine answers the harness's embedded static CDX-E003 block",
     "// reply; outside hook it prints CDX-E003 and exits 6. Git hooks arrive",
     "// as a `git` first word and route to the engine like hook words do, so",
@@ -28,7 +32,7 @@ export const LAUNCHER_TEXT = [
     "// Version arbitration",
     "// between the root and tool-dir engines (SPEC §4.19 EC-6) belongs to the",
     "// phase 9 CLI: until then the first candidate that exists wins.",
-    launcherImport("import { existsSync }", "fs"),
+    launcherImport("import { existsSync, readFileSync }", "fs"),
     launcherImport("import path", "path"),
     launcherImport("import { fileURLToPath, pathToFileURL }", "url"),
     "",
@@ -141,6 +145,48 @@ export const LAUNCHER_TEXT = [
     "\treturn null;",
     "}",
     "",
+    "// SPEC §4.2.1 EC-11: the engine entry validates config.codictator",
+    "// against the installed engine version, so the launcher extracts it",
+    "// from the resolved engine's own manifest text and passes it as",
+    "// main's third argument. A version-field scan keeps JSON parsing in",
+    "// the kernel per §10.3 item 6 (and a regex literal would confuse the",
+    "// blankCode lexer the ts/lint gate runs on); any unreadable or",
+    "// version-less manifest answers null and the caller falls back to",
+    "// the two-argument call, which keeps the pinned placeholder —",
+    "// fail-closed downstream, never an allow.",
+    "function installedEngineVersion(enginePath) {",
+    "\ttry {",
+    "\t\tconst manifestPath = path.join(",
+    "\t\t\tpath.dirname(path.dirname(path.dirname(enginePath))),",
+    `\t\t\t"package.json",`,
+    "\t\t);",
+    `\t\tconst text = readFileSync(manifestPath, "utf8");`,
+    '\t\tconst marker = "\\"version\\":";',
+    "\t\tconst at = text.indexOf(marker);",
+    "\t\tif (at === -1) {",
+    "\t\t\treturn null;",
+    "\t\t}",
+    "\t\tlet index = at + marker.length;",
+    '\t\twhile (text[index] === " " || text[index] === "\\t" || text[index] === "\\n" || text[index] === "\\r") {',
+    "\t\t\tindex += 1;",
+    "\t\t}",
+    '\t\tif (text[index] !== "\\"") {',
+    "\t\t\treturn null;",
+    "\t\t}",
+    '\t\tconst end = text.indexOf("\\"", index + 1);',
+    "\t\tif (end === -1) {",
+    "\t\t\treturn null;",
+    "\t\t}",
+    "\t\tconst version = text.slice(index + 1, end);",
+    '\t\tif (version === "") {',
+    "\t\t\treturn null;",
+    "\t\t}",
+    "\t\treturn version;",
+    "\t} catch (ignored) {",
+    "\t\treturn null;",
+    "\t}",
+    "}",
+    "",
     "function reportMissing(harness) {",
     "\tconst missing = staticReply(",
     "\t\tharness,",
@@ -175,7 +221,11 @@ export const LAUNCHER_TEXT = [
     `\t\t\t\tif (engine === null || typeof engine.main !== "function") {`,
     `\t\t\t\t\tthrow new Error("engine entry has no main");`,
     "\t\t\t\t}",
-    "\t\t\t\treturn engine.main(args, process.cwd());",
+    "\t\t\t\tconst version = installedEngineVersion(enginePath);",
+    "\t\t\t\tif (version === null) {",
+    "\t\t\t\t\treturn engine.main(args, process.cwd());",
+    "\t\t\t\t}",
+    "\t\t\t\treturn engine.main(args, process.cwd(), version);",
     "\t\t\t},",
     "\t\t\t(error) => {",
     "\t\t\t\tthrow error;",

package/dist/cli/task-advance.js

@@ -87,31 +87,31 @@ async function taskMutate(req, root, sub) {
     }
     return taskClose(req, root, id);
 }
-// SPEC §4.19.2 + §4.12: task lifecycle reads and writes; only ack is
-// human-only, and only it clears an escalation.
-export async function handleTask(req) {
-    const root = await needTaskRoot(req);
-    if (typeof root !== "string") {
-        return root;
-    }
-    const sub = req.args[0] ?? "";
-    if (sub === "new") {
-        return taskNew(req, root);
-    }
-    if (sub === "show") {
-        return taskShow(req, root);
-    }
+const SINGLE_SUBCOMMANDS = {
+    new: (req, root) => taskNew(req, root),
+    show: (req, root) => taskShow(req, root),
+    checkpoint: (req, root) => taskCheckpoint(req, root),
+};
+async function runTaskSub(req, root, sub) {
     if (sub === "phase" && req.args[1] === "next") {
         return taskPhaseNext(req, root);
     }
-    if (sub === "checkpoint") {
-        return taskCheckpoint(req, root);
+    const single = SINGLE_SUBCOMMANDS[sub];
+    if (single !== undefined) {
+        return single(req, root);
     }
     if (sub === "ack" || sub === "amend" || sub === "close") {
         return taskMutate(req, root, sub);
     }
     return usageError("usage: codictator task <new|show|amend|phase next|checkpoint|close|ack> ...");
 }
+export async function handleTask(req) {
+    const root = await needTaskRoot(req);
+    if (typeof root !== "string") {
+        return root;
+    }
+    return runTaskSub(req, root, req.args[0] ?? "");
+}
 async function taskShow(req, root) {
     const ids = await listTaskIds(root);
     if (req.args.length === 1) {

package/dist/features/adapters/claude-shaped.d.ts

@@ -1,3 +1,4 @@
 import type { Result } from "../../kernel/index.ts";
 import type { HookEvent, ToolKind } from "./contract.ts";
+export declare function readString(record: Record<string, unknown>, keys: ReadonlyArray<string>): string | undefined;
 export declare function parseClaudeShapedEvent(harness: string, event: string, raw: unknown, table: Readonly<Record<string, ToolKind>>): Result<HookEvent>;

package/dist/features/adapters/claude-shaped.js

@@ -4,10 +4,9 @@
 // leaks (§9.2).
 import { err, makeError, ok } from "../../kernel/index.js";
 import { normalizeToolName } from "./contract.js";
-function isRecord(value) {
-    return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function readString(record, keys) {
+// SPEC §4.5.3: first non-empty string under any of the keys. Shared with
+// the sibling adapters, so the field readers never drift apart.
+export function readString(record, keys) {
     for (const key of keys) {
         const value = record[key];
         if (typeof value === "string" && value.length > 0) {
@@ -16,6 +15,9 @@ function readString(record, keys) {
     }
     return undefined;
 }
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
 function readToolInput(raw) {
     for (const key of ["tool_input", "toolInput", "input", "args"]) {
         const value = raw[key];
@@ -42,34 +44,30 @@ function collectPaths(input) {
     }
     return [...found].sort();
 }
+// SPEC §4.5.3: event names map to triggers through one table, so adding a
+// harness alias is a row, not a branch.
+const CLAUDE_EVENT_TABLE = {
+    PreToolUse: "pre-tool",
+    "tool.pre.write": "pre-tool",
+    "tool.pre.shell": "pre-tool",
+    "tool.pre.read": "pre-tool",
+    "tool.pre.search": "pre-tool",
+    "tool.pre.other": "pre-tool",
+    PostToolUse: "post-tool",
+    "tool.post.write": "post-tool",
+    Stop: "post-tool",
+    stop: "post-tool",
+    SessionStart: "startup",
+    "session.start": "startup",
+    SubagentStart: "startup",
+    "subagent.start": "startup",
+    UserPromptSubmit: "prompt",
+    "prompt.submit": "prompt",
+    PostCompact: "compact",
+    "compact.post": "compact",
+};
 function mapClaudeEvent(event) {
-    switch (event) {
-        case "PreToolUse":
-        case "tool.pre.write":
-        case "tool.pre.shell":
-        case "tool.pre.read":
-        case "tool.pre.search":
-        case "tool.pre.other":
-            return "pre-tool";
-        case "PostToolUse":
-        case "tool.post.write":
-        case "Stop":
-        case "stop":
-            return "post-tool";
-        case "SessionStart":
-        case "session.start":
-        case "SubagentStart":
-        case "subagent.start":
-            return "startup";
-        case "UserPromptSubmit":
-        case "prompt.submit":
-            return "prompt";
-        case "PostCompact":
-        case "compact.post":
-            return "compact";
-        default:
-            return undefined;
-    }
+    return CLAUDE_EVENT_TABLE[event];
 }
 function blockError(harness, detail) {
     return makeError("CDX-E303", `unparseable ${harness} hook payload: ${detail}`, "Check the harness hook configuration, then retry the tool call.");

package/dist/features/adapters/copilot.js

@@ -1,4 +1,9 @@
+// SPEC §4.5.4: the GitHub Copilot adapter (CLI, cloud agent, VS Code
+// agent). Parse, reply and staticBlock are pure; hookIoVerified stays false
+// until a first-party capture lands (§4.5.7), and the hooks-file schema
+// below follows the SPEC row verbatim for the same reason.
 import { err, makeError, ok, stableStringify } from "../../kernel/index.js";
+import { readString } from "./claude-shaped.js";
 import { normalizeToolName } from "./contract.js";
 import { COPILOT_CAPABILITIES } from "./copilot-capabilities.js";
 // SPEC §4.5.4 with §4.5.5: hook entries carry timeoutSec; the runtime budget
@@ -31,40 +36,28 @@ const COPILOT_TOOL_TABLE = {
 export function normalizeCopilotToolName(name) {
     return normalizeToolName(COPILOT_TOOL_TABLE, name);
 }
+// SPEC §4.5.4: event names map to triggers through one table, so adding a
+// harness alias is a row, not a branch.
+const COPILOT_EVENT_TABLE = {
+    preToolUse: "pre-tool",
+    "tool.pre.write": "pre-tool",
+    "tool.pre.shell": "pre-tool",
+    "tool.pre.read": "pre-tool",
+    "tool.pre.search": "pre-tool",
+    "tool.pre.other": "pre-tool",
+    postToolUse: "post-tool",
+    "tool.post.write": "post-tool",
+    sessionStart: "startup",
+    "session.start": "startup",
+    userPromptSubmitted: "prompt",
+    "prompt.submit": "prompt",
+};
 function mapCopilotEvent(event) {
-    switch (event) {
-        case "preToolUse":
-        case "tool.pre.write":
-        case "tool.pre.shell":
-        case "tool.pre.read":
-        case "tool.pre.search":
-        case "tool.pre.other":
-            return "pre-tool";
-        case "postToolUse":
-        case "tool.post.write":
-            return "post-tool";
-        case "sessionStart":
-        case "session.start":
-            return "startup";
-        case "userPromptSubmitted":
-        case "prompt.submit":
-            return "prompt";
-        default:
-            return undefined;
-    }
+    return COPILOT_EVENT_TABLE[event];
 }
 function isRecord(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function readString(record, keys) {
-    for (const key of keys) {
-        const value = record[key];
-        if (typeof value === "string" && value.length > 0) {
-            return value;
-        }
-    }
-    return undefined;
-}
 function blockError(detail) {
     return makeError("CDX-E303", `unparseable copilot hook payload: ${detail}`, "Check the harness hook configuration, then retry the tool call.");
 }

package/dist/features/audit/append.js

@@ -87,18 +87,23 @@ function fitLine(event, now, id) {
         return err(e801("append event", "a single event without a message exceeds 64 KB"));
     }
     const empty = stableLineStringify(withOptionals(base, event, ""));
-    let allowance = MAX_LINE_BYTES - byteLength(empty) - 2;
+    const allowance = MAX_LINE_BYTES - byteLength(empty) - 2;
+    return truncateToFit(base, event, message, allowance);
+}
+// Halve the budget until the marked message fits, else fail closed.
+function truncateToFit(base, event, message, allowance) {
+    let budget = allowance;
     for (let round = 0; round < 32; round += 1) {
-        if (allowance < 0) {
+        if (budget < 0) {
             return err(e801("append event", "the message cannot be truncated to fit 64 KB"));
         }
-        const kept = truncateUtf8(message, allowance);
+        const kept = truncateUtf8(message, budget);
         const omitted = byteLength(message) - byteLength(kept);
         const candidate = stableLineStringify(withOptionals(base, event, `${kept}[truncated ${omitted} bytes]`));
         if (byteLength(candidate) <= MAX_LINE_BYTES) {
             return ok(candidate);
         }
-        allowance = Math.floor(allowance / 2);
+        budget = Math.floor(budget / 2);
     }
     return err(e801("append event", "the message cannot be truncated to fit 64 KB"));
 }

package/dist/features/audit/surfaces.js

@@ -27,6 +27,20 @@ function helpersLine(helpers) {
     });
     return `helpers: ${parts.join(", ")}`;
 }
+// SPEC §4.18.3: trailing status rows with their fallbacks, so the screen
+// builder stays a straight-line assembly.
+function tailStatusLines(input) {
+    return [
+        `task: ${input.task ?? "none active"}`,
+        `waivers: ${input.waivers ?? "none in force"}`,
+        `ratchet: ${input.ratchet ?? "no baseline history"}`,
+        `deps: ${input.deps ?? "freshness unknown"}`,
+        `integrity: ${input.integrity ?? "unverified"}`,
+        `escalations: ${input.escalations ?? "none open"}`,
+        `remediation: ${input.remediation ?? "no plan"}`,
+        `events: ${input.events} observed, ${input.corrupt} corrupt${input.gap ? "; gap in coverage, log was deleted mid-session" : ""}`,
+    ];
+}
 // SPEC §4.18.3: one screen with engine, packs, harness states, helper
 // tools, task, waivers, ratchet, deps, integrity, escalations and
 // remediation progress.
@@ -43,14 +57,7 @@ export function buildStatusText(input) {
         lines.push(`- ${harness.harness}: ${harness.state} (${harness.layers})`);
     }
     lines.push(helpersLine(input.helpers));
-    lines.push(`task: ${input.task ?? "none active"}`);
-    lines.push(`waivers: ${input.waivers ?? "none in force"}`);
-    lines.push(`ratchet: ${input.ratchet ?? "no baseline history"}`);
-    lines.push(`deps: ${input.deps ?? "freshness unknown"}`);
-    lines.push(`integrity: ${input.integrity ?? "unverified"}`);
-    lines.push(`escalations: ${input.escalations ?? "none open"}`);
-    lines.push(`remediation: ${input.remediation ?? "no plan"}`);
-    lines.push(`events: ${input.events} observed, ${input.corrupt} corrupt${input.gap ? "; gap in coverage, log was deleted mid-session" : ""}`);
+    lines.push(...tailStatusLines(input));
     return lines.join("\n");
 }
 // SPEC §4.18.3: the same status as data for the extension (--json).

package/dist/features/ci/protection.js

@@ -13,25 +13,46 @@ function block(ruleId, message, remediation) {
 }
 // SPEC §4.15.2: reported not required → block; unreadable → advise (PRD
 // §11.1). The same read feeds core/branch-protection below.
-export function evaluateProtection(read) {
-    if (read === undefined || !read.readable) {
-        return [
-            advise("core/ci-required-check", "cannot confirm the verify check is required: branch protection is unreadable", "Grant the workflow read access to rulesets/branch protection, or confirm the required check by hand (EC-1, EC-6)."),
-            advise("core/branch-protection", "cannot confirm force-push, deletion and squash settings: branch protection is unreadable", "Grant the workflow read access to the repo settings and rulesets, or confirm them by hand (§4.15.2)."),
-        ];
-    }
-    const findings = [];
+function unreadableFindings() {
+    return [
+        advise("core/ci-required-check", "cannot confirm the verify check is required: branch protection is unreadable", "Grant the workflow read access to rulesets/branch protection, or confirm the required check by hand (EC-1, EC-6)."),
+        advise("core/branch-protection", "cannot confirm force-push, deletion and squash settings: branch protection is unreadable", "Grant the workflow read access to the repo settings and rulesets, or confirm them by hand (§4.15.2)."),
+    ];
+}
+function requiredCheckFinding(read) {
     if (read.verifyRequired !== true) {
-        findings.push(block("core/ci-required-check", "the verify check is not a required check on the default branch", "Add verify to the required checks of the branch ruleset (§4.15 EC-7)."));
+        return block("core/ci-required-check", "the verify check is not a required check on the default branch", "Add verify to the required checks of the branch ruleset (§4.15 EC-7).");
     }
+    return undefined;
+}
+function squashFinding(read) {
     const squashExcluded = read.allowSquashMerge === false ||
         (read.rulesetMergeMethods !== undefined &&
             !read.rulesetMergeMethods.includes("squash"));
     if (!squashExcluded) {
-        findings.push(block("core/branch-protection", "squash merging is allowed and no ruleset excludes it", "Set allow_squash_merge to false and exclude squash from the ruleset allowed_merge_methods (§4.9.3, EC-11, S33)."));
+        return block("core/branch-protection", "squash merging is allowed and no ruleset excludes it", "Set allow_squash_merge to false and exclude squash from the ruleset allowed_merge_methods (§4.9.3, EC-11, S33).");
     }
+    return undefined;
+}
+function hardeningFinding(read) {
     if (read.forcePushBlocked !== true || read.deletionBlocked !== true) {
-        findings.push(block("core/branch-protection", "force-push or deletion is not blocked on the default branch", "Block force-pushes and deletions on the default branch in settings and rulesets (§4.15.2)."));
+        return block("core/branch-protection", "force-push or deletion is not blocked on the default branch", "Block force-pushes and deletions on the default branch in settings and rulesets (§4.15.2).");
+    }
+    return undefined;
+}
+export function evaluateProtection(read) {
+    if (read === undefined || !read.readable) {
+        return unreadableFindings();
+    }
+    const findings = [];
+    for (const maybe of [
+        requiredCheckFinding(read),
+        squashFinding(read),
+        hardeningFinding(read),
+    ]) {
+        if (maybe !== undefined) {
+            findings.push(maybe);
+        }
     }
     return findings;
 }
@@ -51,10 +72,13 @@ export function resolveBaseRef(input) {
         input.before !== zero) {
         return ok(input.before);
     }
+    return ok(baseFromDefault(input));
+}
+function baseFromDefault(input) {
     if (input.eventName === "push") {
-        return ok(`merge-base(${input.defaultBranch ?? "main"},HEAD)`);
+        return `merge-base(${input.defaultBranch ?? "main"},HEAD)`;
     }
-    return ok(input.pullBaseSha ?? `merge-base(${input.defaultBranch ?? "main"},HEAD)`);
+    return (input.pullBaseSha ?? `merge-base(${input.defaultBranch ?? "main"},HEAD)`);
 }
 function usesRef(uses) {
     const at = uses.indexOf("@");

package/dist/features/deps/npm.js

@@ -17,10 +17,45 @@ function stripWorkspacePrefix(range) {
     }
     return undefined;
 }
+function classifyWorkspaceRange(workspace) {
+    return EXACT_PIN.test(workspace) ? "workspace-exact" : "workspace-range";
+}
+function classifyAliasRange(range) {
+    const at = range.lastIndexOf("@");
+    const version = at < 4 ? "" : range.slice(at + 1);
+    return EXACT_PIN.test(version) ? "alias-exact" : "alias-range";
+}
+function isGitRange(range) {
+    return (range.startsWith("git+") ||
+        range.startsWith("git://") ||
+        range.startsWith("github:"));
+}
+function classifyGitRange(range) {
+    const hash = range.split("#")[1] ?? "";
+    return FULL_SHA.test(hash) ? "git-sha" : "git-unpinned";
+}
+function isTagName(range) {
+    return (range === "*" ||
+        range === "latest" ||
+        range === "" ||
+        /^[a-zA-Z][0-9A-Za-z.-]*$/.test(range));
+}
+function classifyBareRange(range) {
+    if (isGitRange(range)) {
+        return classifyGitRange(range);
+    }
+    if (range.startsWith("http://") || range.startsWith("https://")) {
+        return "tarball-url";
+    }
+    if (EXACT_PIN.test(range)) {
+        return "exact";
+    }
+    return isTagName(range) ? "tag" : "range";
+}
 export function classifyNpmRange(range) {
     const workspace = stripWorkspacePrefix(range);
     if (workspace !== undefined) {
-        return EXACT_PIN.test(workspace) ? "workspace-exact" : "workspace-range";
+        return classifyWorkspaceRange(workspace);
     }
     if (range.startsWith("file:")) {
         return "file";
@@ -28,30 +63,10 @@ export function classifyNpmRange(range) {
     if (range.startsWith("link:")) {
         return "link";
     }
-    if (range.startsWith("npm:")) {
-        const at = range.lastIndexOf("@");
-        const version = at < 4 ? "" : range.slice(at + 1);
-        return EXACT_PIN.test(version) ? "alias-exact" : "alias-range";
-    }
-    if (range.startsWith("git+") ||
-        range.startsWith("git://") ||
-        range.startsWith("github:")) {
-        const hash = range.split("#")[1] ?? "";
-        return FULL_SHA.test(hash) ? "git-sha" : "git-unpinned";
-    }
-    if (range.startsWith("http://") || range.startsWith("https://")) {
-        return "tarball-url";
-    }
-    if (EXACT_PIN.test(range)) {
-        return "exact";
-    }
-    if (range === "*" ||
-        range === "latest" ||
-        range === "" ||
-        /^[a-zA-Z][0-9A-Za-z.-]*$/.test(range)) {
-        return "tag";
+    if (range.startsWith(`${NPM_ECOSYSTEM}:`)) {
+        return classifyAliasRange(range);
     }
-    return "range";
+    return classifyBareRange(range);
 }
 // SPEC §4.8.5: ranges, tags, *, latest and unpinned git/alias/workspace
 // forms block core/dep-exact-pin. In-repo file:/link: forms, full-SHA git