commandmate 0.45.0 → 0.46.0

package/.next/server/chunks/2283.js

@@ -1,15 +1,17 @@
-"use strict";exports.id=2283,exports.ids=[2283],exports.modules={2412:(a,b,c)=>{c.d(b,{Qb:()=>f,tR:()=>g});var d=c(46065);let e=Symbol("default-branch-unresolved");async function f(a){let b=await (0,d.Bc)(["symbolic-ref","refs/remotes/origin/HEAD","--short"],a);if(null===b)return e;let c=b.trim();return c.startsWith("origin/")?c.slice(7):null}async function g(a){let b=await f(a);return"string"==typeof b?b:null}},52283:(a,b,c)=>{c.d(b,{Wb:()=>_,on:()=>ah,AT:()=>at});var d=c(79646),e=c(29021),f=c(88807),g=c(56791),h=c(48524),i=c(2412),j=c(72626),k=c(81099),l=c(11501),m=c(52767),n=c(74985),o=c(77142),p=c(49987),q=c(53604);let r="skipped: the verification run was cancelled.";var s=c(55511),t=c(33873),u=c.n(t),v=c(96210),w=c(52710);function x(a){try{if(!(0,e.lstatSync)(a).isFile())return null;return(0,e.readFileSync)(a)}catch{return null}}function y(a){let b,c=new Set,d=u().join(a,v.pg);try{b=(0,e.readdirSync)(d)}catch{return c}for(let d of b){var f;if(!v.X0.test(d)||!(d.length<=v.cj))continue;let b=`${v.pg}/${d}`,e=x(u().join(a,b,w.zi));if(null===e)continue;let g=(0,w.q$)(e);if(null===g||g.skill_id!==d)continue;let h=new Set(v.y2.map(a=>`${a}/${d}`)),i=(0,w.Pw)(g);if(i[0]===b)for(let b of i){if("string"!=typeof b||!h.has(b))continue;let d=x(u().join(a,b,w.zi));for(let h of(null!==d&&d.equals(e)&&c.add(`${b}/${w.zi}`),g.files)){if(!h||"string"!=typeof h.path||"string"!=typeof h.sha256||!(!(""===(f=h.path)||f.startsWith("/")||f.includes("\\"))&&f.split("/").every(a=>""!==a&&"."!==a&&".."!==a))||h.path===w.zi)continue;let d=x(u().join(a,b,h.path));null!==d&&(0,s.createHash)("sha256").update(d).digest("hex")===h.sha256.toLowerCase()&&c.add(`${b}/${h.path}`)}}}return c}let z=[".commandcode/settings.local.json"],A=[".commandcode/taste/"];function B(a){return!!z.includes(a)||A.some(b=>a.startsWith(b)&&!a.slice(b.length).split("/").includes(".."))}function C(a){return"??"===a.status&&a.paths.every(B)}let D=".commandmate/",E=`(exempt: ${D})`,F=".commandmate/tasks/";function G(a){return a.startsWith(F)}function H(a){return{pattern:a,regexp:function(a){let b=a.replace(/\/+$/,""),c=function(a){let b=0;for(let c of a)if("{"===c)b+=1;else if("}"===c&&(b-=1)<0)return!1;return 0===b}(b),d="",e=0,f=0;for(;f<b.length;){let a=b[f];if("*"===a){let a=f;for(;"*"===b[a];)a+=1;let c=a-f>1,e=0===f||"/"===b[f-1];if(c&&e&&"/"===b[a]){d+="(?:[^/]*/)*",f=a+1;continue}if(c&&e&&a===b.length){d+=".*",f=a;continue}d+="[^/]*",f=a;continue}if("?"===a){d+="[^/]",f+=1;continue}if(c&&"{"===a){e+=1,d+="(?:",f+=1;continue}if(c&&"}"===a&&e>0){e-=1,d+=")",f+=1;continue}if(c&&","===a&&e>0){d+="|",f+=1;continue}d+=a.replace(/[.*+?^${}()|[\]\\]/,"\\$&"),f+=1}return RegExp(`^${d}(?:/.*)?$`)}(a)}}class I{constructor(a,b=null){this.contractPath=b,this.allow=a.allow.map(H),this.deny=a.deny.map(H)}classify(a){let b=this.deny.find(b=>b.regexp.test(a));if(b)return{admitted:!1,pattern:b.pattern};if(a.startsWith(D))return{admitted:!0,pattern:E};if(a===this.contractPath)return{admitted:!0,pattern:"(exempt: contract path)"};let c=this.allow.find(b=>b.regexp.test(a));return c?{admitted:!0,pattern:c.pattern}:{admitted:!1,pattern:null}}isViolation(a){return!this.classify(a).admitted}}function J(a,b){return new Promise(c=>{let e="",f="",g=(0,d.spawn)("git",a,{cwd:b,stdio:["ignore","pipe","pipe"]});g.stdout?.on("data",a=>{e+=a.toString("utf8")}),g.stderr?.on("data",a=>{f+=a.toString("utf8")}),g.on("error",a=>c({code:null,stdout:"",stderr:a.message})),g.on("close",a=>c({code:a,stdout:e,stderr:f}))})}function K(a){let b=a.split("\0"),c=[],d=0;for(;d<b.length;){let a=b[d];if(d+=1,a.length<4)continue;let e=[a.slice(3)],[f,g]=a;if("R"===f||"C"===f||"R"===g||"C"===g){let a=b[d];d+=1,a&&e.push(a)}c.push({status:a.slice(0,2),paths:e})}return c}function L(a,b){return"??"===a.status&&a.paths.every(a=>b.has(a))}async function M(a,b){let c=await J(["merge-base",b,"HEAD"],a);if(0!==c.code||""===c.stdout.trim())return{error:`'git merge-base ${b} HEAD' failed; base ref is unreachable from this worktree.`+(c.stderr.trim()?`
-${c.stderr.trim()}`:"")};let d=c.stdout.trim(),e=await J(["diff","--name-only","-z","--no-renames",d,"HEAD"],a);if(0!==e.code)return{error:`'git diff --name-only ${d} HEAD' failed.`+(e.stderr.trim()?`
-${e.stderr.trim()}`:"")};let f=await J(["status","--porcelain","-z","--untracked-files=all"],a);if(0!==f.code)return{error:"'git status --porcelain' failed."+(f.stderr.trim()?`
-${f.stderr.trim()}`:"")};let g=y(a),h=new Set,i=K(f.stdout).filter(a=>!L(a,g)&&(!C(a)||(a.paths.forEach(a=>h.add(a)),!1)));return{paths:[...new Set([...e.stdout.split("\0").filter(a=>""!==a),...i.flatMap(a=>a.paths)].filter(a=>!G(a)))].sort(),mergeBase:d,agentStateExcluded:[...h].sort()}}function N(a){return a.length>0?a.join(", "):"(none)"}function O(a,b,c){return null===c?`  ${a} ${b}`:`  ${a} ${b}  \u2190 ${c}`}async function P(a,b,c,d,e=null){let f=Date.now(),g=(a,b,c)=>({status:a,exitCode:c,startedAt:f,durationMs:Date.now()-f,logTail:b});if(!b)return g("skipped","scope: no contract is attached to this run, so no scope is declared to check.",null);if(!c)return g("skipped","scope: the contract sets success.requireScopeClean: false.",null);if(!d)return g("error","scope: no base ref, so there is nothing to diff against. Set options.baseRef in .commandmate/verify.yaml; origin/HEAD did not resolve a default branch.",null);let h=await M(a,d);if("error"in h)return g("error",`scope: ${h.error}`,null);let i=new I(b,e),j=[],k=[],l=new Map;for(let a of h.paths){let b=i.classify(a);if(b.admitted){j.push({path:a,pattern:b.pattern});continue}k.push(a),null!==b.pattern&&l.set(a,b.pattern)}let m=[`scope: baseRef=${d} changed=${h.paths.length} violations=${k.length}`,`allow: ${N(b.allow)}`,`deny: ${N(b.deny)}`,...function(a){if(0===a.length)return[];let b=a.slice(0,100),c=a.length-b.length;return["admitted:",...b.map(a=>O("+",a.path,a.pattern)),...c>0?[`  ... (+${c} more)`]:[]]}(j),...function(a){if(0===a.length)return[];let b=a.slice(0,100),c=a.length-b.length;return["excluded (agent-managed state files, not counted as change):",...b.map(a=>`  ~ ${a}`),...c>0?[`  ... (+${c} more)`]:[]]}(h.agentStateExcluded)].join("\n");if(0===k.length)return g("passed",m,0);let n=k.slice(0,100),o=k.length-n.length;return g("failed",[m,"out of scope:",...n.map(a=>O("-",a,l.get(a)??null)),...o>0?[`  ... and ${o} more`]:[],"To allow this diff, add the paths above to the contract's scope.allow (the issue's target-file list) and re-send the task (`send --contract`) — scope is judged from the send-time snapshot, so editing the contract file alone changes nothing. A path matching deny: is a deliberate prohibition; revert it instead."].join("\n"),1)}var Q=c(90384),R=c(62171),S=c(85322);let T=(0,j.h)("lib/verification/gate-runner"),U="git diff --name-only / status --porcelain \xd7 contract scope",V="lsof -iTCP -sTCP:LISTEN / tmux list-sessions / $HOME / ~/.commandmate \xd7 task-start snapshot",W="[mutex]",X="[flaky]";function Y(a,b){return`--- ${X} run ${a}/2: ${b.status} exit=${$(b.exitCode)} duration=${Z(b.durationMs)} ---`}function Z(a){return`${(a/1e3).toFixed(1)}s`}function $(a){return null===a?"n/a":String(a)}class _ extends Error{constructor(a,b){super(`Verification run ${b} is already running for worktree '${a}'`),this.name="VerificationConflictError",this.worktreeId=a,this.runningRunId=b}}let aa=0,ab=[],ac=new Map,ad=`${r} This gate was terminated before it reached a verdict.`,ae=`${r} The run stopped before this gate started.`;class af{get cancelled(){return this.latched}register(a){return this.latched?(a(),()=>{}):(this.killers.add(a),()=>{this.killers.delete(a)})}cancel(){for(let a of(this.latched=!0,[...this.killers]))a()}constructor(){this.latched=!1,this.killers=new Set}}let ag=new Map;async function ah(a){let b,c=ag.get(a),d=ac.get(a);if(!c||!d)return{kind:"not-running"};c.cancel();let e=await Promise.race([d,new Promise(a=>{b=setTimeout(()=>a(null),8e3),b.unref?.()})]);return b&&clearTimeout(b),null===e?{kind:"requested"}:{kind:"cancelled",status:e}}class ai{constructor(a){this.maxBytes=a,this.chunks=[],this.size=0}append(a){if(!(this.maxBytes<=0)&&0!==a.length){for(this.chunks.push(a),this.size+=a.length;this.chunks.length>0&&this.size-this.chunks[0].length>=this.maxBytes;)this.size-=this.chunks.shift().length;if(this.size>this.maxBytes){let a=this.size-this.maxBytes;this.chunks[0]=this.chunks[0].subarray(a),this.size-=a}}}toString(){return 0===this.chunks.length?"":Buffer.concat(this.chunks).toString("utf8")}}function aj(a,b,c,e,f,g){return new Promise(h=>{let i,j,k=Date.now(),l=new ai(e),m=!1,n=!1,o=!1,p=(0,d.spawn)(a,{shell:!0,cwd:b,env:function(a){let b={...process.env,CI:"true",...a};return delete b.NODE_ENV,b}(f),detached:!0,stdio:["ignore","pipe","pipe"]});p.stdout?.on("data",a=>l.append(a)),p.stderr?.on("data",a=>l.append(a));let q=a=>{if(void 0!==p.pid)try{process.kill(-p.pid,a)}catch{try{p.kill(a)}catch{}}},r=g?.register(()=>{o=!0,q("SIGTERM"),j=setTimeout(()=>q("SIGKILL"),5e3),j.unref?.()}),s=a=>{m||(m=!0,clearTimeout(t),i&&clearTimeout(i),j&&clearTimeout(j),r?.(),h({...a,startedAt:k,durationMs:Date.now()-k}))},t=setTimeout(()=>{n=!0,q("SIGTERM"),i=setTimeout(()=>q("SIGKILL"),5e3),i.unref?.()},1e3*c);t.unref?.(),p.on("error",a=>{s({status:"error",exitCode:null,logTail:`${l.toString()}
+"use strict";exports.id=2283,exports.ids=[2283],exports.modules={2412:(a,b,c)=>{c.d(b,{Qb:()=>f,tR:()=>g});var d=c(46065);let e=Symbol("default-branch-unresolved");async function f(a){let b=await (0,d.Bc)(["symbolic-ref","refs/remotes/origin/HEAD","--short"],a);if(null===b)return e;let c=b.trim();return c.startsWith("origin/")?c.slice(7):null}async function g(a){let b=await f(a);return"string"==typeof b?b:null}},52283:(a,b,c)=>{c.d(b,{Wb:()=>ad,on:()=>al,AT:()=>ax});var d=c(79646),e=c(29021),f=c(88807),g=c(56791),h=c(48524),i=c(2412),j=c(72626),k=c(81099),l=c(11501),m=c(52767),n=c(74985),o=c(77142),p=c(49987),q=c(53604);let r="skipped: the verification run was cancelled.";var s=c(55511),t=c(33873),u=c.n(t),v=c(96210),w=c(52710);function x(a){try{if(!(0,e.lstatSync)(a).isFile())return null;return(0,e.readFileSync)(a)}catch{return null}}function y(a){let b,c=new Set,d=u().join(a,v.pg);try{b=(0,e.readdirSync)(d)}catch{return c}for(let d of b){var f;if(!v.X0.test(d)||!(d.length<=v.cj))continue;let b=`${v.pg}/${d}`,e=x(u().join(a,b,w.zi));if(null===e)continue;let g=(0,w.q$)(e);if(null===g||g.skill_id!==d)continue;let h=new Set(v.y2.map(a=>`${a}/${d}`)),i=(0,w.Pw)(g);if(i[0]===b)for(let b of i){if("string"!=typeof b||!h.has(b))continue;let d=x(u().join(a,b,w.zi));for(let h of(null!==d&&d.equals(e)&&c.add(`${b}/${w.zi}`),g.files)){if(!h||"string"!=typeof h.path||"string"!=typeof h.sha256||!(!(""===(f=h.path)||f.startsWith("/")||f.includes("\\"))&&f.split("/").every(a=>""!==a&&"."!==a&&".."!==a))||h.path===w.zi)continue;let d=x(u().join(a,b,h.path));null!==d&&(0,s.createHash)("sha256").update(d).digest("hex")===h.sha256.toLowerCase()&&c.add(`${b}/${h.path}`)}}}return c}let z=[".commandcode/settings.local.json"],A=[".commandcode/taste/"];function B(a){return!!z.includes(a)||A.some(b=>a.startsWith(b)&&!a.slice(b.length).split("/").includes(".."))}function C(a){return"??"===a.status&&a.paths.every(B)}let D=".commandmate/",E=`(exempt: ${D})`,F=".commandmate/tasks/",G=["docs/module-reference.md"];function H(a){return a.startsWith(F)}function I(a){return{pattern:a,regexp:function(a){let b=a.replace(/\/+$/,""),c=function(a){let b=0;for(let c of a)if("{"===c)b+=1;else if("}"===c&&(b-=1)<0)return!1;return 0===b}(b),d="",e=0,f=0;for(;f<b.length;){let a=b[f];if("*"===a){let a=f;for(;"*"===b[a];)a+=1;let c=a-f>1,e=0===f||"/"===b[f-1];if(c&&e&&"/"===b[a]){d+="(?:[^/]*/)*",f=a+1;continue}if(c&&e&&a===b.length){d+=".*",f=a;continue}d+="[^/]*",f=a;continue}if("?"===a){d+="[^/]",f+=1;continue}if(c&&"{"===a){e+=1,d+="(?:",f+=1;continue}if(c&&"}"===a&&e>0){e-=1,d+=")",f+=1;continue}if(c&&","===a&&e>0){d+="|",f+=1;continue}d+=a.replace(/[.*+?^${}()|[\]\\]/,"\\$&"),f+=1}return RegExp(`^${d}(?:/.*)?$`)}(a)}}class J{constructor(a,b=null){this.contractPath=b,this.allow=a.allow.map(I),this.deny=a.deny.map(I)}classify(a){let b=this.deny.find(b=>b.regexp.test(a));if(b)return{admitted:!1,pattern:b.pattern};if(a.startsWith(D))return{admitted:!0,pattern:E};if(a===this.contractPath)return{admitted:!0,pattern:"(exempt: contract path)"};let c=this.allow.find(b=>b.regexp.test(a));return c?{admitted:!0,pattern:c.pattern}:{admitted:!1,pattern:null}}isViolation(a){return!this.classify(a).admitted}}function K(a,b){return new Promise(c=>{let e="",f="",g=(0,d.spawn)("git",a,{cwd:b,stdio:["ignore","pipe","pipe"]});g.stdout?.on("data",a=>{e+=a.toString("utf8")}),g.stderr?.on("data",a=>{f+=a.toString("utf8")}),g.on("error",a=>c({code:null,stdout:"",stderr:a.message})),g.on("close",a=>c({code:a,stdout:e,stderr:f}))})}function L(a){return a.split("\0").filter(a=>""!==a)}function M(a){let b=a.split("\0"),c=[],d=0;for(;d<b.length;){let a=b[d];if(d+=1,a.length<4)continue;let e=[a.slice(3)],[f,g]=a;if("R"===f||"C"===f||"R"===g||"C"===g){let a=b[d];d+=1,a&&e.push(a)}c.push({status:a.slice(0,2),paths:e})}return c}function N(a,b){return"??"===a.status&&a.paths.every(a=>b.has(a))}async function O(a,b){let c=await K(["log","-z","--format=%H%x1f%P%x1f%(trailers:key=Orchestrator-Fold,valueonly,unfold,separator=%x1e)",`${b}..HEAD`],a);if(0!==c.code)return{error:`'git log ${b}..HEAD' failed.`+(c.stderr.trim()?`
+${c.stderr.trim()}`:"")};let d=function(a){let b=[];for(let c of a.split("\0")){let a=c.indexOf("\x1f"),d=c.indexOf("\x1f",a+1);if(a<=0||d<0)continue;let e=c.slice(d+1);b.push({sha:c.slice(0,a),parents:c.slice(a+1,d).split(" ").filter(Boolean),foldTrailers:""===e?[]:e.split("\x1e")})}return b}(c.stdout);if(!d.some(a=>a.foldTrailers.length>0))return{changes:[]};let e=[];for(let b of d){if(1!==b.parents.length)continue;let c=await K(["diff-tree","--no-commit-id","--name-only","-z","--no-renames","-r",b.sha],a);if(0!==c.code)return{error:`'git diff-tree ${b.sha}' failed.`+(c.stderr.trim()?`
+${c.stderr.trim()}`:"")};let d=L(c.stdout);e.push({sha:b.sha,files:d,fold:function(a,b){var c;return 1===a.parents.length&&a.foldTrailers.includes("module-reference")&&(c=b).length>0&&c.every(a=>G.includes(a))}(b,d)})}return{changes:e}}async function P(a,b){let c=await O(a,b);return"error"in c?c:{paths:function(a){let b=new Set,c=new Set;for(let d of a){let a=d.fold?b:c;d.files.forEach(b=>a.add(b))}return new Set([...b].filter(a=>!c.has(a)))}(c.changes)}}async function Q(a,b){let c=await K(["merge-base",b,"HEAD"],a);if(0!==c.code||""===c.stdout.trim())return{error:`'git merge-base ${b} HEAD' failed; base ref is unreachable from this worktree.`+(c.stderr.trim()?`
+${c.stderr.trim()}`:"")};let d=c.stdout.trim(),e=await K(["diff","--name-only","-z","--no-renames",d,"HEAD"],a);if(0!==e.code)return{error:`'git diff --name-only ${d} HEAD' failed.`+(e.stderr.trim()?`
+${e.stderr.trim()}`:"")};let f=await P(a,d);if("error"in f)return f;let g=new Set,h=L(e.stdout).filter(a=>!f.paths.has(a)||(g.add(a),!1)),i=await K(["status","--porcelain","-z","--untracked-files=all"],a);if(0!==i.code)return{error:"'git status --porcelain' failed."+(i.stderr.trim()?`
+${i.stderr.trim()}`:"")};let j=y(a),k=new Set,l=new Set([...h,...M(i.stdout).filter(a=>!N(a,j)&&(!C(a)||(a.paths.forEach(a=>k.add(a)),!1))).flatMap(a=>a.paths)].filter(a=>!H(a)));return{paths:[...l].sort(),mergeBase:d,agentStateExcluded:[...k].sort(),orchestratorExcluded:[...g].filter(a=>!l.has(a)).sort()}}function R(a){return a.length>0?a.join(", "):"(none)"}function S(a,b,c){return null===c?`  ${a} ${b}`:`  ${a} ${b}  \u2190 ${c}`}async function T(a,b,c,d,e=null){var f;let g=Date.now(),h=(a,b,c)=>({status:a,exitCode:c,startedAt:g,durationMs:Date.now()-g,logTail:b});if(!b)return h("skipped","scope: no contract is attached to this run, so no scope is declared to check.",null);if(!c)return h("skipped","scope: the contract sets success.requireScopeClean: false.",null);if(!d)return h("error","scope: no base ref, so there is nothing to diff against. Set options.baseRef in .commandmate/verify.yaml; origin/HEAD did not resolve a default branch.",null);let i=await Q(a,d);if("error"in i)return h("error",`scope: ${i.error}`,null);let j=new J(b,e),k=[],l=[],m=new Map;for(let a of i.paths){let b=j.classify(a);if(b.admitted){k.push({path:a,pattern:b.pattern});continue}l.push(a),null!==b.pattern&&m.set(a,b.pattern)}let n=[`scope: baseRef=${d} changed=${i.paths.length} violations=${l.length}`,`allow: ${R(b.allow)}`,`deny: ${R(b.deny)}`,...function(a){if(0===a.length)return[];let b=a.slice(0,100),c=a.length-b.length;return["admitted:",...b.map(a=>S("+",a.path,a.pattern)),...c>0?[`  ... (+${c} more)`]:[]]}(k),...function(a){if(0===a.length)return[];let b=a.slice(0,100),c=a.length-b.length;return["excluded (agent-managed state files, not counted as change):",...b.map(a=>`  ~ ${a}`),...c>0?[`  ... (+${c} more)`]:[]]}(i.agentStateExcluded),...0===(f=i.orchestratorExcluded).length?[]:["excluded (changed only by orchestrator commits, not counted as change):",...f.map(a=>`  ~ ${a}`)]].join("\n");if(0===l.length)return h("passed",n,0);let o=l.slice(0,100),p=l.length-o.length;return h("failed",[n,"out of scope:",...o.map(a=>S("-",a,m.get(a)??null)),...p>0?[`  ... and ${p} more`]:[],"To allow this diff, add the paths above to the contract's scope.allow (the issue's target-file list) and re-send the task (`send --contract`) — scope is judged from the send-time snapshot, so editing the contract file alone changes nothing. A path matching deny: is a deliberate prohibition; revert it instead."].join("\n"),1)}var U=c(90384),V=c(62171),W=c(85322);let X=(0,j.h)("lib/verification/gate-runner"),Y="git diff --name-only / status --porcelain \xd7 contract scope",Z="lsof -iTCP -sTCP:LISTEN / tmux list-sessions / $HOME / ~/.commandmate \xd7 task-start snapshot",$="[mutex]",_="[flaky]";function aa(a,b){return`--- ${_} run ${a}/2: ${b.status} exit=${ac(b.exitCode)} duration=${ab(b.durationMs)} ---`}function ab(a){return`${(a/1e3).toFixed(1)}s`}function ac(a){return null===a?"n/a":String(a)}class ad extends Error{constructor(a,b){super(`Verification run ${b} is already running for worktree '${a}'`),this.name="VerificationConflictError",this.worktreeId=a,this.runningRunId=b}}let ae=0,af=[],ag=new Map,ah=`${r} This gate was terminated before it reached a verdict.`,ai=`${r} The run stopped before this gate started.`;class aj{get cancelled(){return this.latched}register(a){return this.latched?(a(),()=>{}):(this.killers.add(a),()=>{this.killers.delete(a)})}cancel(){for(let a of(this.latched=!0,[...this.killers]))a()}constructor(){this.latched=!1,this.killers=new Set}}let ak=new Map;async function al(a){let b,c=ak.get(a),d=ag.get(a);if(!c||!d)return{kind:"not-running"};c.cancel();let e=await Promise.race([d,new Promise(a=>{b=setTimeout(()=>a(null),8e3),b.unref?.()})]);return b&&clearTimeout(b),null===e?{kind:"requested"}:{kind:"cancelled",status:e}}class am{constructor(a){this.maxBytes=a,this.chunks=[],this.size=0}append(a){if(!(this.maxBytes<=0)&&0!==a.length){for(this.chunks.push(a),this.size+=a.length;this.chunks.length>0&&this.size-this.chunks[0].length>=this.maxBytes;)this.size-=this.chunks.shift().length;if(this.size>this.maxBytes){let a=this.size-this.maxBytes;this.chunks[0]=this.chunks[0].subarray(a),this.size-=a}}}toString(){return 0===this.chunks.length?"":Buffer.concat(this.chunks).toString("utf8")}}function an(a,b,c,e,f,g){return new Promise(h=>{let i,j,k=Date.now(),l=new am(e),m=!1,n=!1,o=!1,p=(0,d.spawn)(a,{shell:!0,cwd:b,env:function(a){let b={...process.env,CI:"true",...a};return delete b.NODE_ENV,b}(f),detached:!0,stdio:["ignore","pipe","pipe"]});p.stdout?.on("data",a=>l.append(a)),p.stderr?.on("data",a=>l.append(a));let q=a=>{if(void 0!==p.pid)try{process.kill(-p.pid,a)}catch{try{p.kill(a)}catch{}}},r=g?.register(()=>{o=!0,q("SIGTERM"),j=setTimeout(()=>q("SIGKILL"),5e3),j.unref?.()}),s=a=>{m||(m=!0,clearTimeout(t),i&&clearTimeout(i),j&&clearTimeout(j),r?.(),h({...a,startedAt:k,durationMs:Date.now()-k}))},t=setTimeout(()=>{n=!0,q("SIGTERM"),i=setTimeout(()=>q("SIGKILL"),5e3),i.unref?.()},1e3*c);t.unref?.(),p.on("error",a=>{s({status:"error",exitCode:null,logTail:`${l.toString()}
 [gate could not be spawned: ${a.message}]`.trim()})}),p.on("close",(a,b)=>n?void s({status:"timeout",exitCode:null,logTail:`${l.toString()}
 [gate exceeded ${c}s and was terminated (${b??"exited"})]`.trim()}):o?void s({status:"skipped",exitCode:null,logTail:`${l.toString()}
-${ad} (${b??"exited"})`.trim()}):void s({status:0===a?"passed":"failed",exitCode:a,logTail:l.toString()||null}))})}async function ak(a,b,c,d,e){let f=a.mutex;if(!f)return aj(a.command,b,a.timeoutSec,c,d,e);let g=await (0,p.xL)(f,{timeoutMs:1e3*a.timeoutSec,shouldAbandon:()=>e.cancelled});if(!g.acquired)return{status:"skipped",exitCode:null,startedAt:Date.now(),durationMs:0,logTail:g.abandoned?ae:function(a,b,c){var d;if(c.acquired)throw Error("mutexWaitTimeoutLog called for an acquired lock");let e=c.heldBy?` (held by ${c.heldBy})`:"";return`reason=mutex-wait waited=${Z(c.waitedMs)}
-${W} name=${b} lock=${d=b,(0,p.M)(d,(0,p.H)())}${e}
-Gate '${a.id}' declares mutex '${b}' and the machine-wide lock stayed held for its whole ${a.timeoutSec}s budget, so the command was never started. This is a resource conflict, not a verdict on the work: re-run once the other run finishes, or raise the gate's timeoutSec.`}(a,f,g)};try{var h,i,j;if(e.cancelled){let a=Date.now();return{status:"skipped",exitCode:null,startedAt:a,durationMs:0,logTail:ae}}let k=await aj(a.command,b,a.timeoutSec,c,d,e);return{...k,logTail:(h=g.waitedMs,i=g.handle.path,j=k.logTail,am(`${W} name=${f} waited=${Z(h)} lock=${i}`,j))}}finally{g.handle.release()}}async function al(a,b,c,d,e){let f=await ak(a,b,c,d,e);if(1!==a.retryOnFail||"failed"!==f.status)return f;let g=await ak(a,b,c,d,e);return"passed"!==g.status&&"failed"!==g.status?{...f,logTail:am(`${X} retry reached no verdict (${g.status}); the first run's result stands. Retry log:
-`+(g.logTail??"(no output)"),f.logTail)}:function(a,b,c){let d="passed"===c.status?"flaky":"fail",e="flaky"===d&&!0===a.flakyIsPass,f=e?c:"flaky"===d?b:c,g=`${X} runs=2 outcome=${d} exit=${$(b.exitCode)},${$(c.exitCode)} duration=${Z(b.durationMs)},${Z(c.durationMs)} verdict=${e?"pass":"fail"}`,h=[Y(1,b),b.logTail??"",Y(2,c),c.logTail??""].join("\n");return{status:e?"passed":"failed",exitCode:f.exitCode,startedAt:b.startedAt,durationMs:b.durationMs+c.durationMs,logTail:`${g}
-${h}`}}(a,f,g)}function am(a,b){return b?`${a}
-${b}`:a}function an(a,b){return new Promise(c=>{let e="",f=(0,d.spawn)("git",a,{cwd:b,stdio:["ignore","pipe","ignore"]});f.stdout?.on("data",a=>{e+=a.toString("utf8")}),f.on("error",()=>c({code:null,stdout:""})),f.on("close",a=>c({code:a,stdout:e}))})}async function ao(a,b,c,d){let e=Date.now(),f=(a,b,c)=>({status:a,exitCode:c,startedAt:e,durationMs:Date.now()-e,logTail:b});if(!b)return f("error",`work-evidence: no base ref. Set options.baseRef in ${Q.aT}; origin/HEAD did not resolve a default branch.`,null);let g=await an(["merge-base",b,"HEAD"],a);if(0!==g.code||""===g.stdout.trim())return f("error",`work-evidence: 'git merge-base ${b} HEAD' failed; base ref is unreachable from this worktree.`,null);let h=g.stdout.trim(),i=await an(["rev-list","--count",`${h}..HEAD`,"--",":(top)",`:(exclude,top)${F}`],a);if(0!==i.code)return f("error",`work-evidence: 'git rev-list --count ${h}..HEAD' failed.`,null);let j=Number.parseInt(i.stdout.trim(),10),k=await an(["status","--porcelain","-z","--untracked-files=all"],a);if(0!==k.code)return f("error","work-evidence: 'git status --porcelain' failed.",null);let l=y(a),m=0,n=new Set,o=K(k.stdout).filter(a=>!!a.paths.some(a=>!G(a))&&(L(a,l)?(m+=1,!1):!C(a)||(a.paths.forEach(a=>n.add(a)),!1))).length,p=`work-evidence: baseRef=${b} commits=${j} uncommitted=${o}`+(c.required?" requireCommit=true":"")+" (contract files excluded)"+(m>0?` (${m} CommandMate-installed Skill file(s) excluded)`:"")+(n.size>0?` (agent-managed state file(s) excluded: ${[...n].sort().join(", ")})`:"");if(!Number.isFinite(j)||0===j&&0===o){let a=Number.isFinite(j)?d.fileCount():null;return null===a||0===a?f("failed",`${p}
-No commits and no uncommitted changes: nothing to verify.`,1):f("passed",`${p}
-${d.label}: ${a} file(s) changed. git found nothing; the agent did.`,0)}return c.required&&0===j?f("failed",`${p}
-${c.sources.join(" and ")} requires a commit: uncommitted changes are not work evidence, commit them.`,1):f("passed",p,0)}async function ap(a,b){if(a.options.baseRef)return a.options.baseRef;let c=await (0,i.tR)(b);return c?`origin/${c}`:null}async function aq(a,b,c,d,f,h,i,j,k,m,o,p){var r,s;let{maxLogTailBytes:t,skipInPrimaryCheckout:u}=h.options,{runWorkEvidence:v,gates:w}=i,x={label:"opencode session diff",fileCount:()=>void 0!==f&&(f===S.k||(0,g.getAgentInstances)(a,c).some(a=>a.id===f&&a.cliTool===S.k))?(0,R.pw)(c,f):null},y=(0,l.fc)(k?.contract??null,h),z=null,A=()=>z??={CM_WORKTREE_ID:c,CM_WORKTREE_INDEX:String((0,q.Cr)(c))},B=(b,c)=>((0,g.finishGateResult)(a,b,{status:c.status,exitCode:c.exitCode,durationMs:c.durationMs,logTail:c.logTail,executionWindow:{startedAt:c.startedAt,finishedAt:c.startedAt+c.durationMs}}),c),C=async(c,d,e,f)=>B((0,g.createGateResult)(a,b,{gateId:c,command:d,source:e}).id,await f()),D=(c,d,e,f)=>{let h={status:"skipped",exitCode:null,startedAt:Date.now(),durationMs:0,logTail:f};return B((0,g.createGateResult)(a,b,{gateId:c,command:d,source:e}).id,h)},E=[],F=(a,b)=>{for(let c of(b.scope&&D(Q.le,U,"builtin",a),b.envClean&&D(Q.Q5,V,"builtin",a),b.gates))D(c.id,c.command,c.source,a)},G=a=>(F(ae,a),"cancelled");if(v){let a=await C(Q.uz,"git merge-base / rev-list / status --porcelain (excluding contract files)","builtin",()=>ao(d,j,y,x));if("passed"!==a.status)return F("skipped: the work-evidence gate did not pass.",{scope:"off"!==i.scope,envClean:i.runEnvClean,gates:w}),"failed"===a.status?"not_started":"error";if(E.push(a.status),p.cancelled)return G({scope:"off"!==i.scope,envClean:i.runEnvClean,gates:w})}if("off"!==i.scope){let a=m?D(Q.le,U,"builtin",(r=m.id,s=m.status,`scope: task ${r} declares a scope for this worktree, but it is ${s} and this run was not attached to it, so its scope was NOT judged. \`wait --verify\` attaches only to an in-flight task; to re-verify a finished task, run \`commandmate verify <worktree> --task ${r}\`.`)):await C(Q.le,U,"builtin",()=>P(d,k?.contract.scope??null,k?.contract.success.requireScopeClean??!1,j,k?.contractPath??null)),b="explicit"===i.scope||null!==m;if(("skipped"!==a.status||b)&&E.push(a.status),p.cancelled)return G({scope:!1,envClean:i.runEnvClean,gates:w})}if(i.runEnvClean){let a=await C(Q.Q5,V,"builtin",()=>(0,n.uT)({worktreeId:o.worktreeId,worktreePath:d,taskId:o.taskId,baseline:o.baseline,sources:o.decision.sources,ignoreHomeEntries:h.options.envCleanIgnoreHomeEntries}));if(E.push(a.status),p.cancelled)return G({scope:!1,envClean:!1,gates:w})}let H=u&&function(a,b){try{return(0,e.realpathSync)(a)===(0,e.realpathSync)(b)}catch{return!1}}(d,process.cwd());for(let[a,b]of w.entries()){if(p.cancelled)return G({scope:!1,envClean:!1,gates:w.slice(a)});if(H){E.push(D(b.id,b.command,b.source,"skipped: worktreePath is the server process working directory and options.skipInPrimaryCheckout is true.").status);continue}let c=await C(b.id,b.command,b.source,()=>al(b,d,t,A(),p));E.push(c.status)}return p.cancelled?"cancelled":E.some(a=>"failed"===a||"timeout"===a||"error"===a)?"failed":E.some(a=>"skipped"===a)?"error":"passed"}function ar(a,b,c,d){try{(0,m.g)(a,b,c,void 0===d?void 0:{runId:d})}catch(a){T.warn("task-transition-failed",{taskId:b,event:c,error:a instanceof Error?a.message:String(a)})}}function as(a,b,c,d,e){let f;try{f=(0,g.getVerificationRun)(a,c)?.gates.filter(a=>"passed"!==a.status&&"skipped"!==a.status).map(a=>a.gateId)}catch{}(0,k.notifyVerificationFailurePush)({worktreeId:b.worktreeId,runId:c,taskId:d,status:e,trigger:b.trigger,instanceId:b.instanceId??null,failedGateIds:f}).catch(()=>{})}async function at(a){let b=(0,f.getDbInstance)(),c=(0,g.getRunningVerificationRun)(b,a.worktreeId);if(c)throw new _(a.worktreeId,c.id);let d=void 0!==a.taskId?(0,g.getTask)(b,a.taskId):(0,h.Zj)(b,a.worktreeId),e=function(a,b,c){if(null!==c||void 0!==b.taskId)return null;let[d]=(0,g.listTasks)(a,b.worktreeId,1);return d&&"pending"!==d.status&&d.contract.success.requireScopeClean?d:null}(b,a,d),i=a.taskId??d?.id??null,j=a.gateIds??(d?(0,l.Ky)(d.contract)??void 0:void 0),k=null,m=null;try{(k=(0,Q.yR)(a.worktreePath))||(m=`${Q.aT} not found in ${a.worktreePath}. Declare the repository verification gates there before running verification.`)}catch(a){m=a instanceof Q.Yp?a.message:`Failed to read ${Q.aT}: ${a.message}`}let p=(0,n.Uq)(d?.contract??null,k),q={workEvidence:d?.contract.success.requireWorkEvidence??!1,scope:(d?.contract.success.requireScopeClean??!1)||null!==e,envClean:p.required},r=null;if(k&&!m){let a=function(a,b){let c=a.gates.map(a=>({...a,source:"verify.yaml"})),d=new Set(c.map(a=>a.id)),e=b.filter(a=>d.has(a.id)).map(a=>a.id);return e.length>0?`Contract gate id(s) ${e.join(", ")} are already declared in ${Q.aT}. A contract may add gates, never redefine the repository's own.`:[...c,...b.map(a=>({...a,source:"contract"}))]}(k,d?(0,l.cI)(d.contract):[]);if("string"==typeof a)m=a;else{let b=function(a,b,c){if(!b)return{runWorkEvidence:!0,scope:"implicit",runEnvClean:c.envClean,gates:a};let d=new Set([Q.uz,Q.le,Q.Q5,...a.map(a=>a.id)]),e=b.filter(a=>!d.has(a));if(e.length>0)return`Unknown gate id(s): ${e.join(", ")}. Declared gates: ${[...d].join(", ")}.`;let f=new Set(b),g={runWorkEvidence:f.has(Q.uz)||c.workEvidence,scope:f.has(Q.le)||c.scope?"explicit":"off",runEnvClean:f.has(Q.Q5)||c.envClean,gates:a.filter(a=>f.has(a.id))};return g.runWorkEvidence||"off"!==g.scope||g.runEnvClean||0!==g.gates.length?g:"gateIds selected no gates; a run with no gates has nothing to report."}(a,j,q);"string"==typeof b?m=b:r=b}}let s=k?await ap(k,a.worktreePath):null,t=(0,g.createVerificationRun)(b,{worktreeId:a.worktreeId,trigger:a.trigger,instanceId:a.instanceId??null,taskId:i,baseRef:s});if(!k||!r){let c=Date.now(),e=(0,g.createGateResult)(b,t.id,{gateId:"config",command:Q.aT,source:"builtin"});return(0,g.finishGateResult)(b,e.id,{status:"error",exitCode:null,durationMs:0,logTail:m,executionWindow:{startedAt:c,finishedAt:c}}),(0,g.finishVerificationRun)(b,t.id,"error"),T.warn("verification-config-unusable",{runId:t.id,worktreeId:a.worktreeId}),as(b,a,t.id,i,"error"),d&&(ar(b,d.id,"verify_started",t.id),ar(b,d.id,"verify_failed",t.id)),{runId:t.id}}d&&ar(b,d.id,"verify_started",t.id);let u=new af;ag.set(t.id,u);let v=k,w=r,x={worktreeId:a.worktreeId,taskId:i,baseline:w.runEnvClean&&i?(0,o.g9)(i):null,decision:p},y=(async()=>{await (aa<2?(aa+=1,Promise.resolve()):new Promise(a=>{ab.push(a)}));let c="error";try{if(u.cancelled)return c="cancelled",(0,g.finishVerificationRun)(b,t.id,"cancelled"),"cancelled";let f=await aq(b,t.id,a.worktreeId,a.worktreePath,a.instanceId,v,w,s,d,e,x,u);return c=f,(0,g.finishVerificationRun)(b,t.id,f),f}catch(a){T.error("verification-run-crashed",{runId:t.id,error:a instanceof Error?a.message:String(a)});try{(0,g.finishVerificationRun)(b,t.id,"error")}catch{}return"error"}finally{d&&ar(b,d.id,function(a){switch(a){case"passed":return"verify_passed";case"not_started":return"verify_not_started";case"cancelled":return"cancel";default:return"verify_failed"}}(c),t.id),as(b,a,t.id,i,c),function(){let a=ab.shift();if(a)return a();aa-=1}(),ac.delete(t.id),ag.delete(t.id)}})();return ac.set(t.id,y),{runId:t.id}}}};
+${ah} (${b??"exited"})`.trim()}):void s({status:0===a?"passed":"failed",exitCode:a,logTail:l.toString()||null}))})}async function ao(a,b,c,d,e){let f=a.mutex;if(!f)return an(a.command,b,a.timeoutSec,c,d,e);let g=await (0,p.xL)(f,{timeoutMs:1e3*a.timeoutSec,shouldAbandon:()=>e.cancelled});if(!g.acquired)return{status:"skipped",exitCode:null,startedAt:Date.now(),durationMs:0,logTail:g.abandoned?ai:function(a,b,c){var d;if(c.acquired)throw Error("mutexWaitTimeoutLog called for an acquired lock");let e=c.heldBy?` (held by ${c.heldBy})`:"";return`reason=mutex-wait waited=${ab(c.waitedMs)}
+${$} name=${b} lock=${d=b,(0,p.M)(d,(0,p.H)())}${e}
+Gate '${a.id}' declares mutex '${b}' and the machine-wide lock stayed held for its whole ${a.timeoutSec}s budget, so the command was never started. This is a resource conflict, not a verdict on the work: re-run once the other run finishes, or raise the gate's timeoutSec.`}(a,f,g)};try{var h,i,j;if(e.cancelled){let a=Date.now();return{status:"skipped",exitCode:null,startedAt:a,durationMs:0,logTail:ai}}let k=await an(a.command,b,a.timeoutSec,c,d,e);return{...k,logTail:(h=g.waitedMs,i=g.handle.path,j=k.logTail,aq(`${$} name=${f} waited=${ab(h)} lock=${i}`,j))}}finally{g.handle.release()}}async function ap(a,b,c,d,e){let f=await ao(a,b,c,d,e);if(1!==a.retryOnFail||"failed"!==f.status)return f;let g=await ao(a,b,c,d,e);return"passed"!==g.status&&"failed"!==g.status?{...f,logTail:aq(`${_} retry reached no verdict (${g.status}); the first run's result stands. Retry log:
+`+(g.logTail??"(no output)"),f.logTail)}:function(a,b,c){let d="passed"===c.status?"flaky":"fail",e="flaky"===d&&!0===a.flakyIsPass,f=e?c:"flaky"===d?b:c,g=`${_} runs=2 outcome=${d} exit=${ac(b.exitCode)},${ac(c.exitCode)} duration=${ab(b.durationMs)},${ab(c.durationMs)} verdict=${e?"pass":"fail"}`,h=[aa(1,b),b.logTail??"",aa(2,c),c.logTail??""].join("\n");return{status:e?"passed":"failed",exitCode:f.exitCode,startedAt:b.startedAt,durationMs:b.durationMs+c.durationMs,logTail:`${g}
+${h}`}}(a,f,g)}function aq(a,b){return b?`${a}
+${b}`:a}function ar(a,b){return new Promise(c=>{let e="",f=(0,d.spawn)("git",a,{cwd:b,stdio:["ignore","pipe","ignore"]});f.stdout?.on("data",a=>{e+=a.toString("utf8")}),f.on("error",()=>c({code:null,stdout:""})),f.on("close",a=>c({code:a,stdout:e}))})}async function as(a,b,c,d){let e=Date.now(),f=(a,b,c)=>({status:a,exitCode:c,startedAt:e,durationMs:Date.now()-e,logTail:b});if(!b)return f("error",`work-evidence: no base ref. Set options.baseRef in ${U.aT}; origin/HEAD did not resolve a default branch.`,null);let g=await ar(["merge-base",b,"HEAD"],a);if(0!==g.code||""===g.stdout.trim())return f("error",`work-evidence: 'git merge-base ${b} HEAD' failed; base ref is unreachable from this worktree.`,null);let h=g.stdout.trim(),i=await ar(["rev-list",`${h}..HEAD`,"--",":(top)",`:(exclude,top)${F}`],a);if(0!==i.code)return f("error",`work-evidence: 'git rev-list ${h}..HEAD' failed.`,null);let j=await O(a,h);if("error"in j)return f("error",`work-evidence: ${j.error}`,null);let k=new Set(j.changes.filter(a=>a.fold).map(a=>a.sha)),l=i.stdout.split("\n").filter(a=>""!==a.trim()),m=l.filter(a=>k.has(a)).length,n=l.length-m,o=await ar(["status","--porcelain","-z","--untracked-files=all"],a);if(0!==o.code)return f("error","work-evidence: 'git status --porcelain' failed.",null);let p=y(a),q=0,r=new Set,s=M(o.stdout).filter(a=>!!a.paths.some(a=>!H(a))&&(N(a,p)?(q+=1,!1):!C(a)||(a.paths.forEach(a=>r.add(a)),!1))).length,t=`work-evidence: baseRef=${b} commits=${n} uncommitted=${s}`+(c.required?" requireCommit=true":"")+" (contract files excluded)"+(m>0?` (${m} orchestrator fold commit(s) excluded)`:"")+(q>0?` (${q} CommandMate-installed Skill file(s) excluded)`:"")+(r.size>0?` (agent-managed state file(s) excluded: ${[...r].sort().join(", ")})`:"");if(!Number.isFinite(n)||0===n&&0===s){let a=Number.isFinite(n)?d.fileCount():null;return null===a||0===a?f("failed",`${t}
+No commits and no uncommitted changes: nothing to verify.`,1):f("passed",`${t}
+${d.label}: ${a} file(s) changed. git found nothing; the agent did.`,0)}return c.required&&0===n?f("failed",`${t}
+${c.sources.join(" and ")} requires a commit: uncommitted changes are not work evidence, commit them.`,1):f("passed",t,0)}async function at(a,b){if(a.options.baseRef)return a.options.baseRef;let c=await (0,i.tR)(b);return c?`origin/${c}`:null}async function au(a,b,c,d,f,h,i,j,k,m,o,p){var r,s;let{maxLogTailBytes:t,skipInPrimaryCheckout:u}=h.options,{runWorkEvidence:v,gates:w}=i,x={label:"opencode session diff",fileCount:()=>void 0!==f&&(f===W.k||(0,g.getAgentInstances)(a,c).some(a=>a.id===f&&a.cliTool===W.k))?(0,V.pw)(c,f):null},y=(0,l.fc)(k?.contract??null,h),z=null,A=()=>z??={CM_WORKTREE_ID:c,CM_WORKTREE_INDEX:String((0,q.Cr)(c))},B=(b,c)=>((0,g.finishGateResult)(a,b,{status:c.status,exitCode:c.exitCode,durationMs:c.durationMs,logTail:c.logTail,executionWindow:{startedAt:c.startedAt,finishedAt:c.startedAt+c.durationMs}}),c),C=async(c,d,e,f)=>B((0,g.createGateResult)(a,b,{gateId:c,command:d,source:e}).id,await f()),D=(c,d,e,f)=>{let h={status:"skipped",exitCode:null,startedAt:Date.now(),durationMs:0,logTail:f};return B((0,g.createGateResult)(a,b,{gateId:c,command:d,source:e}).id,h)},E=[],F=(a,b)=>{for(let c of(b.scope&&D(U.le,Y,"builtin",a),b.envClean&&D(U.Q5,Z,"builtin",a),b.gates))D(c.id,c.command,c.source,a)},G=a=>(F(ai,a),"cancelled");if(v){let a=await C(U.uz,"git merge-base / rev-list / status --porcelain (excluding contract files)","builtin",()=>as(d,j,y,x));if("passed"!==a.status)return F("skipped: the work-evidence gate did not pass.",{scope:"off"!==i.scope,envClean:i.runEnvClean,gates:w}),"failed"===a.status?"not_started":"error";if(E.push(a.status),p.cancelled)return G({scope:"off"!==i.scope,envClean:i.runEnvClean,gates:w})}if("off"!==i.scope){let a=m?D(U.le,Y,"builtin",(r=m.id,s=m.status,`scope: task ${r} declares a scope for this worktree, but it is ${s} and this run was not attached to it, so its scope was NOT judged. \`wait --verify\` attaches only to an in-flight task; to re-verify a finished task, run \`commandmate verify <worktree> --task ${r}\`.`)):await C(U.le,Y,"builtin",()=>T(d,k?.contract.scope??null,k?.contract.success.requireScopeClean??!1,j,k?.contractPath??null)),b="explicit"===i.scope||null!==m;if(("skipped"!==a.status||b)&&E.push(a.status),p.cancelled)return G({scope:!1,envClean:i.runEnvClean,gates:w})}if(i.runEnvClean){let a=await C(U.Q5,Z,"builtin",()=>(0,n.uT)({worktreeId:o.worktreeId,worktreePath:d,taskId:o.taskId,baseline:o.baseline,sources:o.decision.sources,ignoreHomeEntries:h.options.envCleanIgnoreHomeEntries}));if(E.push(a.status),p.cancelled)return G({scope:!1,envClean:!1,gates:w})}let H=u&&function(a,b){try{return(0,e.realpathSync)(a)===(0,e.realpathSync)(b)}catch{return!1}}(d,process.cwd());for(let[a,b]of w.entries()){if(p.cancelled)return G({scope:!1,envClean:!1,gates:w.slice(a)});if(H){E.push(D(b.id,b.command,b.source,"skipped: worktreePath is the server process working directory and options.skipInPrimaryCheckout is true.").status);continue}let c=await C(b.id,b.command,b.source,()=>ap(b,d,t,A(),p));E.push(c.status)}return p.cancelled?"cancelled":E.some(a=>"failed"===a||"timeout"===a||"error"===a)?"failed":E.some(a=>"skipped"===a)?"error":"passed"}function av(a,b,c,d){try{(0,m.g)(a,b,c,void 0===d?void 0:{runId:d})}catch(a){X.warn("task-transition-failed",{taskId:b,event:c,error:a instanceof Error?a.message:String(a)})}}function aw(a,b,c,d,e){let f;try{f=(0,g.getVerificationRun)(a,c)?.gates.filter(a=>"passed"!==a.status&&"skipped"!==a.status).map(a=>a.gateId)}catch{}(0,k.notifyVerificationFailurePush)({worktreeId:b.worktreeId,runId:c,taskId:d,status:e,trigger:b.trigger,instanceId:b.instanceId??null,failedGateIds:f}).catch(()=>{})}async function ax(a){let b=(0,f.getDbInstance)(),c=(0,g.getRunningVerificationRun)(b,a.worktreeId);if(c)throw new ad(a.worktreeId,c.id);let d=void 0!==a.taskId?(0,g.getTask)(b,a.taskId):(0,h.Zj)(b,a.worktreeId),e=function(a,b,c){if(null!==c||void 0!==b.taskId)return null;let[d]=(0,g.listTasks)(a,b.worktreeId,1);return d&&"pending"!==d.status&&d.contract.success.requireScopeClean?d:null}(b,a,d),i=a.taskId??d?.id??null,j=a.gateIds??(d?(0,l.Ky)(d.contract)??void 0:void 0),k=null,m=null;try{(k=(0,U.yR)(a.worktreePath))||(m=`${U.aT} not found in ${a.worktreePath}. Declare the repository verification gates there before running verification.`)}catch(a){m=a instanceof U.Yp?a.message:`Failed to read ${U.aT}: ${a.message}`}let p=(0,n.Uq)(d?.contract??null,k),q={workEvidence:d?.contract.success.requireWorkEvidence??!1,scope:(d?.contract.success.requireScopeClean??!1)||null!==e,envClean:p.required},r=null;if(k&&!m){let a=function(a,b){let c=a.gates.map(a=>({...a,source:"verify.yaml"})),d=new Set(c.map(a=>a.id)),e=b.filter(a=>d.has(a.id)).map(a=>a.id);return e.length>0?`Contract gate id(s) ${e.join(", ")} are already declared in ${U.aT}. A contract may add gates, never redefine the repository's own.`:[...c,...b.map(a=>({...a,source:"contract"}))]}(k,d?(0,l.cI)(d.contract):[]);if("string"==typeof a)m=a;else{let b=function(a,b,c){if(!b)return{runWorkEvidence:!0,scope:"implicit",runEnvClean:c.envClean,gates:a};let d=new Set([U.uz,U.le,U.Q5,...a.map(a=>a.id)]),e=b.filter(a=>!d.has(a));if(e.length>0)return`Unknown gate id(s): ${e.join(", ")}. Declared gates: ${[...d].join(", ")}.`;let f=new Set(b),g={runWorkEvidence:f.has(U.uz)||c.workEvidence,scope:f.has(U.le)||c.scope?"explicit":"off",runEnvClean:f.has(U.Q5)||c.envClean,gates:a.filter(a=>f.has(a.id))};return g.runWorkEvidence||"off"!==g.scope||g.runEnvClean||0!==g.gates.length?g:"gateIds selected no gates; a run with no gates has nothing to report."}(a,j,q);"string"==typeof b?m=b:r=b}}let s=k?await at(k,a.worktreePath):null,t=(0,g.createVerificationRun)(b,{worktreeId:a.worktreeId,trigger:a.trigger,instanceId:a.instanceId??null,taskId:i,baseRef:s});if(!k||!r){let c=Date.now(),e=(0,g.createGateResult)(b,t.id,{gateId:"config",command:U.aT,source:"builtin"});return(0,g.finishGateResult)(b,e.id,{status:"error",exitCode:null,durationMs:0,logTail:m,executionWindow:{startedAt:c,finishedAt:c}}),(0,g.finishVerificationRun)(b,t.id,"error"),X.warn("verification-config-unusable",{runId:t.id,worktreeId:a.worktreeId}),aw(b,a,t.id,i,"error"),d&&(av(b,d.id,"verify_started",t.id),av(b,d.id,"verify_failed",t.id)),{runId:t.id}}d&&av(b,d.id,"verify_started",t.id);let u=new aj;ak.set(t.id,u);let v=k,w=r,x={worktreeId:a.worktreeId,taskId:i,baseline:w.runEnvClean&&i?(0,o.g9)(i):null,decision:p},y=(async()=>{await (ae<2?(ae+=1,Promise.resolve()):new Promise(a=>{af.push(a)}));let c="error";try{if(u.cancelled)return c="cancelled",(0,g.finishVerificationRun)(b,t.id,"cancelled"),"cancelled";let f=await au(b,t.id,a.worktreeId,a.worktreePath,a.instanceId,v,w,s,d,e,x,u);return c=f,(0,g.finishVerificationRun)(b,t.id,f),f}catch(a){X.error("verification-run-crashed",{runId:t.id,error:a instanceof Error?a.message:String(a)});try{(0,g.finishVerificationRun)(b,t.id,"error")}catch{}return"error"}finally{d&&av(b,d.id,function(a){switch(a){case"passed":return"verify_passed";case"not_started":return"verify_not_started";case"cancelled":return"cancel";default:return"verify_failed"}}(c),t.id),aw(b,a,t.id,i,c),function(){let a=af.shift();if(a)return a();ae-=1}(),ag.delete(t.id),ak.delete(t.id)}})();return ag.set(t.id,y),{runId:t.id}}}};