commandmate 0.46.1 → 0.47.2

package/dist/server/src/lib/verification/scope-gate-format.js

@@ -0,0 +1,100 @@
+"use strict";
+/**
+ * `log_tail` formatting for the built-in `scope` gate (Issue #3647: split out of
+ * scope-gate.ts, which re-exports everything public here).
+ *
+ * @module lib/verification/scope-gate-format
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SCOPE_PATTERN_ARROW = exports.MAX_REPORTED_VIOLATIONS = void 0;
+exports.formatPatterns = formatPatterns;
+exports.formatDecidedPath = formatDecidedPath;
+exports.formatAdmitted = formatAdmitted;
+exports.formatAgentStateExcluded = formatAgentStateExcluded;
+exports.formatOrchestratorExcluded = formatOrchestratorExcluded;
+/**
+ * Violations listed in `log_tail` before the rest are summarised as a count.
+ *
+ * A worker that ran in the wrong directory can put thousands of paths out of
+ * scope, and log_tail is stored per gate in SQLite.
+ */
+exports.MAX_REPORTED_VIOLATIONS = 100;
+/**
+ * Separator between a reported path and the pattern that decided it (#1841).
+ *
+ * Mirrored by the CLI's scope-evidence parser (`src/cli/commands/verify.ts`,
+ * SCOPE_PATTERN_ARROW): the gate's report is the only carrier for this evidence
+ * — `verification_gate_results` has columns for a status, an exit code and a log
+ * body, and nothing else — so the two constants have to agree. A round-trip
+ * test feeds a real `evaluateScope` report through that parser rather than
+ * trusting the two copies to be edited together.
+ *
+ * A path containing this exact three-character sequence would split wrongly on
+ * the way back. Nothing prevents such a filename; it is accepted because the
+ * alternative — encoding paths in a log a human reads first — costs every
+ * reader something to protect against a file no repository has.
+ */
+exports.SCOPE_PATTERN_ARROW = '  \u2190 ';
+function formatPatterns(patterns) {
+    return patterns.length > 0 ? patterns.join(', ') : '(none)';
+}
+/**
+ * One reported path, optionally naming the rule that decided it (#1841).
+ *
+ * Admitted paths lead with `+` rather than `-` so the two sections cannot be
+ * confused by a reader — or by a grep — that has only one line in front of it.
+ */
+function formatDecidedPath(marker, path, pattern) {
+    if (pattern === null)
+        return `  ${marker} ${path}`;
+    return `  ${marker} ${path}${exports.SCOPE_PATTERN_ARROW}${pattern}`;
+}
+/**
+ * The `admitted:` section: what this run was allowed to change, and by which
+ * rule (#1841).
+ *
+ * With an `allow` of exact paths the pattern *is* the file and this adds
+ * nothing, but #1546 made globs legal, and `src/**` leaves no record of what it
+ * actually covered on the day it ran. The contract is the claim; this is the
+ * evidence for it, and it has to survive in `log_tail` because the run's own
+ * working tree will have moved on by the time anyone asks.
+ *
+ * Capped by the same rule as the violations, for the same reason (log_tail is
+ * stored per gate in SQLite), and the truncation is stated rather than silent —
+ * a list that stops at 100 with no marker reads as a complete one.
+ */
+function formatAdmitted(admitted) {
+    if (admitted.length === 0)
+        return [];
+    const listed = admitted.slice(0, exports.MAX_REPORTED_VIOLATIONS);
+    const remainder = admitted.length - listed.length;
+    return [
+        'admitted:',
+        ...listed.map((entry) => formatDecidedPath('+', entry.path, entry.pattern)),
+        // Worded `(+N more)` rather than the violations' `... and N more`: the two
+        // sections are capped independently and a reader scanning a truncated
+        // report should not have to work out which count belongs to which list.
+        ...(remainder > 0 ? [`  ... (+${remainder} more)`] : []),
+    ];
+}
+/** The `excluded:` section naming agent-managed state files left out (#3126). */
+function formatAgentStateExcluded(excluded) {
+    if (excluded.length === 0)
+        return [];
+    const listed = excluded.slice(0, exports.MAX_REPORTED_VIOLATIONS);
+    const remainder = excluded.length - listed.length;
+    return [
+        'excluded (agent-managed state files, not counted as change):',
+        ...listed.map((path) => `  ~ ${path}`),
+        ...(remainder > 0 ? [`  ... (+${remainder} more)`] : []),
+    ];
+}
+/** The `excluded:` section naming orchestrator-only committed paths (#3588). */
+function formatOrchestratorExcluded(excluded) {
+    if (excluded.length === 0)
+        return [];
+    return [
+        'excluded (changed only by orchestrator commits, not counted as change):',
+        ...excluded.map((path) => `  ~ ${path}`),
+    ];
+}

package/dist/server/src/lib/verification/scope-gate-glob.js

@@ -0,0 +1,185 @@
+"use strict";
+/**
+ * Scope glob matching for the built-in `scope` gate (Issue #3647: split out of
+ * scope-gate.ts, which re-exports everything public here).
+ *
+ * @module lib/verification/scope-gate-glob
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ScopeMatcher = exports.SCOPE_EXEMPT_CONTRACT_PATH = exports.SCOPE_EXEMPT_ALWAYS_ALLOWED = exports.ALWAYS_ALLOWED_PREFIX = void 0;
+/**
+ * Paths that are in scope no matter what the contract says.
+ *
+ * The contract file lives here, so a contract whose own `allow` list forgot to
+ * mention `.commandmate/` would fail the moment it was committed — the scope
+ * declaration would make its own storage a violation. The exemption covers the
+ * `allow` requirement only; an explicit `deny` still applies, because a deny is
+ * a deliberate prohibition and silently ignoring one is worse than the accident
+ * this exemption prevents.
+ */
+exports.ALWAYS_ALLOWED_PREFIX = '.commandmate/';
+/**
+ * Stand-ins for the two ways a path is admitted without matching `allow`.
+ *
+ * Parenthesised so they cannot be mistaken for a pattern the contract declared:
+ * a reader who greps the contract for `(exempt: .commandmate/)` should find
+ * nothing, because nothing there put it in scope.
+ */
+exports.SCOPE_EXEMPT_ALWAYS_ALLOWED = `(exempt: ${exports.ALWAYS_ALLOWED_PREFIX})`;
+exports.SCOPE_EXEMPT_CONTRACT_PATH = '(exempt: contract path)';
+// =============================================================================
+// Glob matching
+// =============================================================================
+/**
+ * Translate a scope glob into an anchored regular expression.
+ *
+ * Deliberately a small, documented subset rather than a glob library. The
+ * semantics are fixed in docs/design/task-contract.md §2.2:
+ *
+ * - `**` as a whole path segment crosses directory boundaries, including zero of
+ *   them: `a/**` matches `a/b` and `a/b/c`, `**\/*.ts` matches `x.ts`.
+ * - `*` and `?` never cross `/`. Leading dots are ordinary characters, so
+ *   `.github/**` and `*.md` behave the way they read.
+ * - `{a,b}` is alternation, nestable. Unbalanced braces are literal, as in a
+ *   shell — `src/{a` is a path with a brace in it, not a syntax error.
+ * - `[` and `]` are **literal**. This repository routes through
+ *   `src/app/proxy/[...path]/`, and treating those as character classes would
+ *   make the pattern that names them match nothing at all — a silent no-match is
+ *   the failure mode this gate exists to avoid.
+ * - A pattern that matches a directory also matches everything beneath it, so
+ *   `src/lib`, `src/lib/` and `src/lib/**` all mean the same thing. Without this
+ *   rule, `allow: ["src/lib/verification"]` — the way people write a directory —
+ *   would put every file inside it out of scope.
+ */
+function globToRegExp(rawPattern) {
+    // A trailing slash carries no information once the rule above applies.
+    const pattern = rawPattern.replace(/\/+$/, '');
+    const bracesBalanced = hasBalancedBraces(pattern);
+    let source = '';
+    let depth = 0;
+    let i = 0;
+    while (i < pattern.length) {
+        const char = pattern[i];
+        if (char === '*') {
+            let end = i;
+            while (pattern[end] === '*')
+                end += 1;
+            const isGlobstar = end - i > 1;
+            const atSegmentStart = i === 0 || pattern[i - 1] === '/';
+            if (isGlobstar && atSegmentStart && pattern[end] === '/') {
+                // Consume the following slash too: `a/**/b` has to match `a/b`.
+                source += '(?:[^/]*/)*';
+                i = end + 1;
+                continue;
+            }
+            if (isGlobstar && atSegmentStart && end === pattern.length) {
+                source += '.*';
+                i = end;
+                continue;
+            }
+            // `**` that is not a whole segment (`a**b`) cannot mean "cross
+            // directories" without also matching `a/x/b`, which the pattern does not
+            // say. Collapse it to a single-segment wildcard.
+            source += '[^/]*';
+            i = end;
+            continue;
+        }
+        if (char === '?') {
+            source += '[^/]';
+            i += 1;
+            continue;
+        }
+        if (bracesBalanced && char === '{') {
+            depth += 1;
+            source += '(?:';
+            i += 1;
+            continue;
+        }
+        if (bracesBalanced && char === '}' && depth > 0) {
+            depth -= 1;
+            source += ')';
+            i += 1;
+            continue;
+        }
+        if (bracesBalanced && char === ',' && depth > 0) {
+            source += '|';
+            i += 1;
+            continue;
+        }
+        source += char.replace(/[.*+?^${}()|[\]\\]/, '\\$&');
+        i += 1;
+    }
+    return new RegExp(`^${source}(?:/.*)?$`);
+}
+function hasBalancedBraces(pattern) {
+    let depth = 0;
+    for (const char of pattern) {
+        if (char === '{')
+            depth += 1;
+        else if (char === '}') {
+            depth -= 1;
+            if (depth < 0)
+                return false;
+        }
+    }
+    return depth === 0;
+}
+function compilePattern(pattern) {
+    return { pattern, regexp: globToRegExp(pattern) };
+}
+/**
+ * A scope declaration compiled once per run.
+ *
+ * Compiling per pattern per file would rebuild the same regexes for every one of
+ * potentially thousands of changed paths.
+ */
+class ScopeMatcher {
+    contractPath;
+    allow;
+    deny;
+    /**
+     * @param contractPath the contract's own path, exempted alongside
+     *        {@link ALWAYS_ALLOWED_PREFIX} for contracts kept outside `.commandmate/`
+     */
+    constructor(scope, contractPath = null) {
+        this.contractPath = contractPath;
+        this.allow = scope.allow.map(compilePattern);
+        this.deny = scope.deny.map(compilePattern);
+    }
+    /**
+     * Which declared rule decided `path`, and which way (#1841).
+     *
+     * The **first** matching pattern is reported, in the contract's declaration
+     * order, on both sides. Reporting the last would name a rule the reader
+     * cannot use: `allow: ["src/**", "src/lib/**"]` admits `src/lib/a.ts` under
+     * the first entry, and deleting the second changes nothing about the verdict.
+     *
+     * `path` is a repository-root-relative POSIX path as git reports it.
+     */
+    classify(path) {
+        const denied = this.deny.find((entry) => entry.regexp.test(path));
+        if (denied)
+            return { admitted: false, pattern: denied.pattern };
+        if (path.startsWith(exports.ALWAYS_ALLOWED_PREFIX)) {
+            return { admitted: true, pattern: exports.SCOPE_EXEMPT_ALWAYS_ALLOWED };
+        }
+        if (path === this.contractPath) {
+            return { admitted: true, pattern: exports.SCOPE_EXEMPT_CONTRACT_PATH };
+        }
+        const allowed = this.allow.find((entry) => entry.regexp.test(path));
+        return allowed
+            ? { admitted: true, pattern: allowed.pattern }
+            : { admitted: false, pattern: null };
+    }
+    /**
+     * Whether `path` is a scope violation.
+     *
+     * Delegates to {@link classify} rather than repeating the rules: the verdict
+     * and the evidence for it must never be able to disagree, and two copies of
+     * "deny wins, then the exemptions, then allow" is exactly how they would.
+     */
+    isViolation(path) {
+        return !this.classify(path).admitted;
+    }
+}
+exports.ScopeMatcher = ScopeMatcher;

package/dist/server/src/lib/verification/scope-gate.js

@@ -30,7 +30,7 @@
  * @module lib/verification/scope-gate
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SCOPE_SKIP_NOT_REQUIRED = exports.SCOPE_SKIP_NO_CONTRACT = exports.ScopeMatcher = exports.ORCHESTRATOR_FOLD_TRAILER_VALUE = exports.ORCHESTRATOR_FOLD_TRAILER_KEY = exports.ORCHESTRATOR_FILES = exports.CONTRACT_DIR_PREFIX = exports.SCOPE_EXEMPT_CONTRACT_PATH = exports.SCOPE_EXEMPT_ALWAYS_ALLOWED = exports.SCOPE_PATTERN_ARROW = exports.ALWAYS_ALLOWED_PREFIX = exports.SCOPE_ALLOW_GUIDANCE = exports.MAX_REPORTED_VIOLATIONS = void 0;
+exports.SCOPE_SKIP_NOT_REQUIRED = exports.SCOPE_SKIP_NO_CONTRACT = exports.ORCHESTRATOR_FOLD_TRAILER_VALUE = exports.ORCHESTRATOR_FOLD_TRAILER_KEY = exports.ORCHESTRATOR_FILES = exports.CONTRACT_DIR_PREFIX = exports.SCOPE_ALLOW_GUIDANCE = exports.ScopeMatcher = exports.SCOPE_EXEMPT_CONTRACT_PATH = exports.SCOPE_EXEMPT_ALWAYS_ALLOWED = exports.ALWAYS_ALLOWED_PREFIX = exports.SCOPE_PATTERN_ARROW = exports.MAX_REPORTED_VIOLATIONS = void 0;
 exports.isOrchestratorOnlyCommit = isOrchestratorOnlyCommit;
 exports.parseBranchCommits = parseBranchCommits;
 exports.isFoldCommit = isFoldCommit;
@@ -46,13 +46,16 @@ exports.evaluateScope = evaluateScope;
 const child_process_1 = require("child_process");
 const receipt_owned_paths_1 = require("../../lib/skills/receipt-owned-paths");
 const agent_state_paths_1 = require("../../lib/skills/agent-state-paths");
-/**
- * Violations listed in `log_tail` before the rest are summarised as a count.
- *
- * A worker that ran in the wrong directory can put thousands of paths out of
- * scope, and log_tail is stored per gate in SQLite.
- */
-exports.MAX_REPORTED_VIOLATIONS = 100;
+const scope_gate_format_1 = require("./scope-gate-format");
+const scope_gate_glob_1 = require("./scope-gate-glob");
+var scope_gate_format_2 = require("./scope-gate-format");
+Object.defineProperty(exports, "MAX_REPORTED_VIOLATIONS", { enumerable: true, get: function () { return scope_gate_format_2.MAX_REPORTED_VIOLATIONS; } });
+Object.defineProperty(exports, "SCOPE_PATTERN_ARROW", { enumerable: true, get: function () { return scope_gate_format_2.SCOPE_PATTERN_ARROW; } });
+var scope_gate_glob_2 = require("./scope-gate-glob");
+Object.defineProperty(exports, "ALWAYS_ALLOWED_PREFIX", { enumerable: true, get: function () { return scope_gate_glob_2.ALWAYS_ALLOWED_PREFIX; } });
+Object.defineProperty(exports, "SCOPE_EXEMPT_ALWAYS_ALLOWED", { enumerable: true, get: function () { return scope_gate_glob_2.SCOPE_EXEMPT_ALWAYS_ALLOWED; } });
+Object.defineProperty(exports, "SCOPE_EXEMPT_CONTRACT_PATH", { enumerable: true, get: function () { return scope_gate_glob_2.SCOPE_EXEMPT_CONTRACT_PATH; } });
+Object.defineProperty(exports, "ScopeMatcher", { enumerable: true, get: function () { return scope_gate_glob_2.ScopeMatcher; } });
 /**
  * Actionable coda appended to every scope failure report (#1683).
  *
@@ -69,42 +72,6 @@ exports.SCOPE_ALLOW_GUIDANCE = "To allow this diff, add the paths above to the c
     'is judged from the send-time snapshot, so editing the contract file alone ' +
     'changes nothing. A path matching deny: is a deliberate prohibition; revert ' +
     'it instead.';
-/**
- * Paths that are in scope no matter what the contract says.
- *
- * The contract file lives here, so a contract whose own `allow` list forgot to
- * mention `.commandmate/` would fail the moment it was committed — the scope
- * declaration would make its own storage a violation. The exemption covers the
- * `allow` requirement only; an explicit `deny` still applies, because a deny is
- * a deliberate prohibition and silently ignoring one is worse than the accident
- * this exemption prevents.
- */
-exports.ALWAYS_ALLOWED_PREFIX = '.commandmate/';
-/**
- * Separator between a reported path and the pattern that decided it (#1841).
- *
- * Mirrored by the CLI's scope-evidence parser (`src/cli/commands/verify.ts`,
- * SCOPE_PATTERN_ARROW): the gate's report is the only carrier for this evidence
- * — `verification_gate_results` has columns for a status, an exit code and a log
- * body, and nothing else — so the two constants have to agree. A round-trip
- * test feeds a real `evaluateScope` report through that parser rather than
- * trusting the two copies to be edited together.
- *
- * A path containing this exact three-character sequence would split wrongly on
- * the way back. Nothing prevents such a filename; it is accepted because the
- * alternative — encoding paths in a log a human reads first — costs every
- * reader something to protect against a file no repository has.
- */
-exports.SCOPE_PATTERN_ARROW = '  \u2190 ';
-/**
- * Stand-ins for the two ways a path is admitted without matching `allow`.
- *
- * Parenthesised so they cannot be mistaken for a pattern the contract declared:
- * a reader who greps the contract for `(exempt: .commandmate/)` should find
- * nothing, because nothing there put it in scope.
- */
-exports.SCOPE_EXEMPT_ALWAYS_ALLOWED = `(exempt: ${exports.ALWAYS_ALLOWED_PREFIX})`;
-exports.SCOPE_EXEMPT_CONTRACT_PATH = '(exempt: contract path)';
 /**
  * Execution contracts, dropped from both gates' change sets entirely (#1580).
  *
@@ -209,162 +176,6 @@ function isContractPath(path) {
     return path.startsWith(exports.CONTRACT_DIR_PREFIX);
 }
 // =============================================================================
-// Glob matching
-// =============================================================================
-/**
- * Translate a scope glob into an anchored regular expression.
- *
- * Deliberately a small, documented subset rather than a glob library. The
- * semantics are fixed in docs/design/task-contract.md §2.2:
- *
- * - `**` as a whole path segment crosses directory boundaries, including zero of
- *   them: `a/**` matches `a/b` and `a/b/c`, `**\/*.ts` matches `x.ts`.
- * - `*` and `?` never cross `/`. Leading dots are ordinary characters, so
- *   `.github/**` and `*.md` behave the way they read.
- * - `{a,b}` is alternation, nestable. Unbalanced braces are literal, as in a
- *   shell — `src/{a` is a path with a brace in it, not a syntax error.
- * - `[` and `]` are **literal**. This repository routes through
- *   `src/app/proxy/[...path]/`, and treating those as character classes would
- *   make the pattern that names them match nothing at all — a silent no-match is
- *   the failure mode this gate exists to avoid.
- * - A pattern that matches a directory also matches everything beneath it, so
- *   `src/lib`, `src/lib/` and `src/lib/**` all mean the same thing. Without this
- *   rule, `allow: ["src/lib/verification"]` — the way people write a directory —
- *   would put every file inside it out of scope.
- */
-function globToRegExp(rawPattern) {
-    // A trailing slash carries no information once the rule above applies.
-    const pattern = rawPattern.replace(/\/+$/, '');
-    const bracesBalanced = hasBalancedBraces(pattern);
-    let source = '';
-    let depth = 0;
-    let i = 0;
-    while (i < pattern.length) {
-        const char = pattern[i];
-        if (char === '*') {
-            let end = i;
-            while (pattern[end] === '*')
-                end += 1;
-            const isGlobstar = end - i > 1;
-            const atSegmentStart = i === 0 || pattern[i - 1] === '/';
-            if (isGlobstar && atSegmentStart && pattern[end] === '/') {
-                // Consume the following slash too: `a/**/b` has to match `a/b`.
-                source += '(?:[^/]*/)*';
-                i = end + 1;
-                continue;
-            }
-            if (isGlobstar && atSegmentStart && end === pattern.length) {
-                source += '.*';
-                i = end;
-                continue;
-            }
-            // `**` that is not a whole segment (`a**b`) cannot mean "cross
-            // directories" without also matching `a/x/b`, which the pattern does not
-            // say. Collapse it to a single-segment wildcard.
-            source += '[^/]*';
-            i = end;
-            continue;
-        }
-        if (char === '?') {
-            source += '[^/]';
-            i += 1;
-            continue;
-        }
-        if (bracesBalanced && char === '{') {
-            depth += 1;
-            source += '(?:';
-            i += 1;
-            continue;
-        }
-        if (bracesBalanced && char === '}' && depth > 0) {
-            depth -= 1;
-            source += ')';
-            i += 1;
-            continue;
-        }
-        if (bracesBalanced && char === ',' && depth > 0) {
-            source += '|';
-            i += 1;
-            continue;
-        }
-        source += char.replace(/[.*+?^${}()|[\]\\]/, '\\$&');
-        i += 1;
-    }
-    return new RegExp(`^${source}(?:/.*)?$`);
-}
-function hasBalancedBraces(pattern) {
-    let depth = 0;
-    for (const char of pattern) {
-        if (char === '{')
-            depth += 1;
-        else if (char === '}') {
-            depth -= 1;
-            if (depth < 0)
-                return false;
-        }
-    }
-    return depth === 0;
-}
-function compilePattern(pattern) {
-    return { pattern, regexp: globToRegExp(pattern) };
-}
-/**
- * A scope declaration compiled once per run.
- *
- * Compiling per pattern per file would rebuild the same regexes for every one of
- * potentially thousands of changed paths.
- */
-class ScopeMatcher {
-    contractPath;
-    allow;
-    deny;
-    /**
-     * @param contractPath the contract's own path, exempted alongside
-     *        {@link ALWAYS_ALLOWED_PREFIX} for contracts kept outside `.commandmate/`
-     */
-    constructor(scope, contractPath = null) {
-        this.contractPath = contractPath;
-        this.allow = scope.allow.map(compilePattern);
-        this.deny = scope.deny.map(compilePattern);
-    }
-    /**
-     * Which declared rule decided `path`, and which way (#1841).
-     *
-     * The **first** matching pattern is reported, in the contract's declaration
-     * order, on both sides. Reporting the last would name a rule the reader
-     * cannot use: `allow: ["src/**", "src/lib/**"]` admits `src/lib/a.ts` under
-     * the first entry, and deleting the second changes nothing about the verdict.
-     *
-     * `path` is a repository-root-relative POSIX path as git reports it.
-     */
-    classify(path) {
-        const denied = this.deny.find((entry) => entry.regexp.test(path));
-        if (denied)
-            return { admitted: false, pattern: denied.pattern };
-        if (path.startsWith(exports.ALWAYS_ALLOWED_PREFIX)) {
-            return { admitted: true, pattern: exports.SCOPE_EXEMPT_ALWAYS_ALLOWED };
-        }
-        if (path === this.contractPath) {
-            return { admitted: true, pattern: exports.SCOPE_EXEMPT_CONTRACT_PATH };
-        }
-        const allowed = this.allow.find((entry) => entry.regexp.test(path));
-        return allowed
-            ? { admitted: true, pattern: allowed.pattern }
-            : { admitted: false, pattern: null };
-    }
-    /**
-     * Whether `path` is a scope violation.
-     *
-     * Delegates to {@link classify} rather than repeating the rules: the verdict
-     * and the evidence for it must never be able to disagree, and two copies of
-     * "deny wins, then the exemptions, then allow" is exactly how they would.
-     */
-    isViolation(path) {
-        return !this.classify(path).admitted;
-    }
-}
-exports.ScopeMatcher = ScopeMatcher;
-// =============================================================================
 // Changed-path collection
 // =============================================================================
 /** Run a git plumbing command. No shell: every argument here is code-supplied. */
@@ -572,69 +383,6 @@ async function collectChangedPaths(worktreePath, baseRef) {
 // =============================================================================
 // Gate evaluation
 // =============================================================================
-function formatPatterns(patterns) {
-    return patterns.length > 0 ? patterns.join(', ') : '(none)';
-}
-/**
- * One reported path, optionally naming the rule that decided it (#1841).
- *
- * Admitted paths lead with `+` rather than `-` so the two sections cannot be
- * confused by a reader — or by a grep — that has only one line in front of it.
- */
-function formatDecidedPath(marker, path, pattern) {
-    if (pattern === null)
-        return `  ${marker} ${path}`;
-    return `  ${marker} ${path}${exports.SCOPE_PATTERN_ARROW}${pattern}`;
-}
-/**
- * The `admitted:` section: what this run was allowed to change, and by which
- * rule (#1841).
- *
- * With an `allow` of exact paths the pattern *is* the file and this adds
- * nothing, but #1546 made globs legal, and `src/**` leaves no record of what it
- * actually covered on the day it ran. The contract is the claim; this is the
- * evidence for it, and it has to survive in `log_tail` because the run's own
- * working tree will have moved on by the time anyone asks.
- *
- * Capped by the same rule as the violations, for the same reason (log_tail is
- * stored per gate in SQLite), and the truncation is stated rather than silent —
- * a list that stops at 100 with no marker reads as a complete one.
- */
-function formatAdmitted(admitted) {
-    if (admitted.length === 0)
-        return [];
-    const listed = admitted.slice(0, exports.MAX_REPORTED_VIOLATIONS);
-    const remainder = admitted.length - listed.length;
-    return [
-        'admitted:',
-        ...listed.map((entry) => formatDecidedPath('+', entry.path, entry.pattern)),
-        // Worded `(+N more)` rather than the violations' `... and N more`: the two
-        // sections are capped independently and a reader scanning a truncated
-        // report should not have to work out which count belongs to which list.
-        ...(remainder > 0 ? [`  ... (+${remainder} more)`] : []),
-    ];
-}
-/** The `excluded:` section naming agent-managed state files left out (#3126). */
-function formatAgentStateExcluded(excluded) {
-    if (excluded.length === 0)
-        return [];
-    const listed = excluded.slice(0, exports.MAX_REPORTED_VIOLATIONS);
-    const remainder = excluded.length - listed.length;
-    return [
-        'excluded (agent-managed state files, not counted as change):',
-        ...listed.map((path) => `  ~ ${path}`),
-        ...(remainder > 0 ? [`  ... (+${remainder} more)`] : []),
-    ];
-}
-/** The `excluded:` section naming orchestrator-only committed paths (#3588). */
-function formatOrchestratorExcluded(excluded) {
-    if (excluded.length === 0)
-        return [];
-    return [
-        'excluded (changed only by orchestrator commits, not counted as change):',
-        ...excluded.map((path) => `  ~ ${path}`),
-    ];
-}
 /**
  * Reasons the gate has nothing to judge, phrased for `log_tail`.
  *
@@ -688,7 +436,7 @@ async function evaluateScope(worktreePath, scope, requireScopeClean, baseRef, co
     const changed = await collectChangedPaths(worktreePath, baseRef);
     if ('error' in changed)
         return done('error', `scope: ${changed.error}`, null);
-    const matcher = new ScopeMatcher(scope, contractPath);
+    const matcher = new scope_gate_glob_1.ScopeMatcher(scope, contractPath);
     // Every changed path is classified, whether or not it will fit in the report:
     // the cap below is a display rule, and a violation withheld from the listing
     // still counts toward the verdict.
@@ -707,18 +455,18 @@ async function evaluateScope(worktreePath, scope, requireScopeClean, baseRef, co
     }
     const summary = [
         `scope: baseRef=${baseRef} changed=${changed.paths.length} violations=${violations.length}`,
-        `allow: ${formatPatterns(scope.allow)}`,
-        `deny: ${formatPatterns(scope.deny)}`,
-        ...formatAdmitted(admitted),
-        ...formatAgentStateExcluded(changed.agentStateExcluded),
-        ...formatOrchestratorExcluded(changed.orchestratorExcluded),
+        `allow: ${(0, scope_gate_format_1.formatPatterns)(scope.allow)}`,
+        `deny: ${(0, scope_gate_format_1.formatPatterns)(scope.deny)}`,
+        ...(0, scope_gate_format_1.formatAdmitted)(admitted),
+        ...(0, scope_gate_format_1.formatAgentStateExcluded)(changed.agentStateExcluded),
+        ...(0, scope_gate_format_1.formatOrchestratorExcluded)(changed.orchestratorExcluded),
     ].join('\n');
     if (violations.length === 0) {
         // An empty change set passes: work-evidence is the gate that judges "nothing
         // happened", and failing here too would report one problem as two.
         return done('passed', summary, 0);
     }
-    const listed = violations.slice(0, exports.MAX_REPORTED_VIOLATIONS);
+    const listed = violations.slice(0, scope_gate_format_1.MAX_REPORTED_VIOLATIONS);
     const remainder = violations.length - listed.length;
     const report = [
         summary,
@@ -727,7 +475,7 @@ async function evaluateScope(worktreePath, scope, requireScopeClean, baseRef, co
         // contract declared, not which of those entries this path tripped, and a
         // violation the reader must revert reads differently from one they could
         // fix by widening `allow`.
-        ...listed.map((path) => formatDecidedPath('-', path, rejectedBy.get(path) ?? null)),
+        ...listed.map((path) => (0, scope_gate_format_1.formatDecidedPath)('-', path, rejectedBy.get(path) ?? null)),
         ...(remainder > 0 ? [`  ... and ${remainder} more`] : []),
         exports.SCOPE_ALLOW_GUIDANCE,
     ].join('\n');