copilot-operator 0.1.7 → 0.1.9

package/dist/src/session/handoff.js

@@ -0,0 +1,42 @@
+export function composeHandoff(task, notRun = []) {
+    const failedChecks = (task.checkResults ?? []).filter((c) => !c.passed);
+    const openFindings = task.review?.verdict === 'fail' ? (task.review.findings ?? []).filter((f) => f.about !== 'task') : [];
+    const vcs = task.vcs ?? {};
+    const knownIssues = [
+        ...failedChecks.map((c) => `check failed: ${c.name} — ${c.detail}`),
+        ...openFindings.map((f) => `review finding${f.id ? ` ${f.id}` : ''}: ${f.what}${f.where ? ` (${f.where})` : ''}`),
+        ...(task.checkResults ?? [])
+            .filter((c) => c.passed && /still there after being pointed out once/.test(c.detail))
+            .map((c) => `committed with a finding left in place: ${c.name}`),
+        ...(vcs.suspicious ?? []).map((s) => `committed although it looks like ${s.reason}: ${s.path}`),
+        ...(vcs.foreignCommits ?? []).map((c) => `a commit on the branch the runner did not make: ${c}`),
+        ...(task.scopeReverted?.length ? [`put back because outside the task's scope: ${task.scopeReverted.join(', ')}`] : []),
+        ...(task.deviations ?? []).map((d) => `did not follow "${d.instruction}" as written: ${d.did}`),
+    ];
+    const manual = [];
+    if (vcs.problem)
+        manual.push(`version control: ${vcs.problem}`);
+    if (vcs.commit && vcs.branch)
+        manual.push(`push ${vcs.branch} when you are ready — the runner never pushes`);
+    if (task.status === 'blocked')
+        manual.push(`unblock it: ${task.reason ?? 'see the reason'}`);
+    if (task.status === 'limit-reached' || task.status === 'aborted')
+        manual.push('continue it in the same chat from the register, or run it again');
+    if (task.status === 'failed')
+        manual.push('read why it failed, fix the prompt or the checks, and queue it again');
+    if (openFindings.length > 0)
+        manual.push(`${openFindings.length} review finding(s) are open`);
+    if ((vcs.suspicious?.length ?? 0) > 0 || (vcs.foreignCommits?.length ?? 0) > 0)
+        manual.push('look at the committed files and commits listed above');
+    return {
+        outcome: { status: task.status, ...(task.reason ? { reason: task.reason } : {}) },
+        changedFiles: (vcs.files ?? []).map((f) => ({ path: f.path, added: f.added, removed: f.removed })),
+        validation: (task.checkResults ?? []).map((c) => ({ name: c.name, passed: c.passed })),
+        ...(task.review ? { review: { verdict: task.review.verdict, open: openFindings.length } } : {}),
+        knownIssues,
+        evidence: { ...(task.runId ? { runId: task.runId } : {}), checks: task.checkResults?.length ?? 0, reviewRounds: task.review?.rounds ?? 0 },
+        vcs: { ...(vcs.branch ? { branch: vcs.branch } : {}), ...(vcs.commit ? { commit: vcs.commit } : {}), pushed: false, ...(vcs.problem ? { problem: vcs.problem } : {}) },
+        manual,
+        notExecuted: notRun.slice(0, 30).map((n) => `${n.command} — ${n.why}`),
+    };
+}

package/dist/src/session/interruption.js

@@ -0,0 +1,104 @@
+/**
+ * Where an attempt was when the bot stopped under it — the power went, the machine shut down,
+ * `npm start` was stopped with Ctrl+C, the process crashed — read back from what it had written.
+ *
+ * Nothing in memory survives that, but the run folder does, and it was written as the work went:
+ * the transcript has every reply and every step as it was proposed, started and finished, and each
+ * step's output is in its own log under `steps/`. So the last reply the chat sent, which of the
+ * steps it asked for had finished (and how), which one was cut off while it ran, which never ran,
+ * and whether their results had already gone back to the chat — all of that is on disk. It is what
+ * the chat needs to be told to carry on rather than start over, and what the operator needs to see
+ * to trust that it can.
+ */
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { parseStepLog } from './story.js';
+const TAIL_CHARS = 1200;
+/** Reads an attempt's run folder; null when there is no transcript to read. */
+export async function readInterruption(runDir) {
+    const raw = await readFile(join(runDir, 'transcript.jsonl'), 'utf8').catch(() => null);
+    if (raw === null)
+        return null;
+    const events = [];
+    for (const line of raw.split('\n')) {
+        if (!line.trim())
+            continue;
+        try {
+            events.push(JSON.parse(line));
+        }
+        catch {
+            // A line cut in half by the stop itself: the rest is still good.
+        }
+    }
+    const lastActivity = events.at(-1)?.at;
+    let replyAt = -1;
+    for (let i = events.length - 1; i >= 0; i -= 1) {
+        if (events[i].type === 'reply-parsed') {
+            replyAt = i;
+            break;
+        }
+    }
+    if (replyAt < 0)
+        return { lastActivity, iteration: 0, steps: [], resultsSent: false };
+    const reply = events[replyAt];
+    const iteration = Number(reply.iteration) || 0;
+    const after = events.slice(replyAt + 1);
+    const count = Number(reply.steps) || 0;
+    const steps = [];
+    for (let id = 1; id <= count; id += 1) {
+        const finished = after.find((e) => e.type === 'step-finished' && e.id === id);
+        const skipped = after.find((e) => e.type === 'step-skipped' && e.id === id);
+        const started = after.some((e) => e.type === 'step-started' && e.id === id);
+        const proposed = after.find((e) => e.type === 'step-proposed' && e.id === id);
+        const state = finished ? 'finished' : skipped ? 'skipped' : started ? 'cut' : 'not-run';
+        const step = { id, state };
+        if (typeof proposed?.description === 'string')
+            step.command = proposed.description;
+        if (finished) {
+            step.outcome = String(finished.outcome ?? '');
+            if (typeof finished.exitCode === 'number')
+                step.exitCode = finished.exitCode;
+        }
+        if (state === 'finished' || state === 'cut') {
+            const log = await readFile(join(runDir, 'steps', `${iteration}-${id}.log`), 'utf8').catch(() => '');
+            const output = parseStepLog(log).output;
+            if (output)
+                step.outputTail = output.length > TAIL_CHARS ? `…${output.slice(-TAIL_CHARS)}` : output;
+        }
+        steps.push(step);
+    }
+    // Sent back only when the results were written *and* a message went out after them.
+    const reportAt = after.findIndex((e) => e.type === 'report-written' && Number(e.iteration) === iteration);
+    const resultsSent = reportAt >= 0 && after.slice(reportAt + 1).some((e) => e.type === 'message-sent');
+    return { lastActivity, iteration, replyStatus: typeof reply.status === 'string' ? reply.status : undefined, steps, resultsSent };
+}
+/**
+ * What the chat is told about it, in the continuation message: which steps ran, with the end of
+ * their output, which was cut off, which never ran — or that the results were already sent.
+ */
+export function describeInterruption(i) {
+    if (i.iteration === 0)
+        return 'It stopped before your first reply arrived, so nothing of this task had been run yet.';
+    if (i.resultsSent) {
+        return `The results of the steps from your last reply were already sent to you (above), and your answer to them was not received. Carry on from those results.`;
+    }
+    if (i.replyStatus === 'done' && i.steps.length === 0) {
+        return 'Your last reply reported the task done; the runner was checking it when it stopped. If nothing is left, reply again with your summary.';
+    }
+    if (i.steps.length === 0)
+        return 'Your last reply asked for no steps.';
+    const lines = [`Of the ${i.steps.length} step(s) in your last reply:`];
+    for (const s of i.steps) {
+        const what = s.state === 'finished'
+            ? `ran to the end (exit ${s.exitCode ?? '?'})`
+            : s.state === 'cut'
+                ? 'was running when the runner stopped — it may have done only part of its work; check its effect before relying on it'
+                : s.state === 'skipped'
+                    ? 'was not run (refused or skipped)'
+                    : 'did not run';
+        lines.push(`- step ${s.id} ${what}.`);
+        if (s.outputTail)
+            lines.push('  Its output ended with:', '  ```', ...s.outputTail.split('\n').map((l) => `  ${l}`), '  ```');
+    }
+    return lines.join('\n');
+}

package/dist/src/session/metrics.js

@@ -0,0 +1,95 @@
+const ENDED = ['done', 'failed', 'blocked', 'aborted', 'limit-reached'];
+function attemptsOf(task) {
+    const all = [...(task.attempts ?? [])];
+    if (ENDED.includes(task.status))
+        all.push(task);
+    return all.filter((a) => ENDED.includes(a.status));
+}
+function modelOf(session) {
+    return (session.modelInUse ?? '').trim() || (session.model ?? '').trim() || '(the chat default)';
+}
+function row(group, tasks) {
+    const r = {
+        group,
+        tasks: 0,
+        attempts: 0,
+        firstPass: { n: 0, of: 0 },
+        doneInTheEnd: { n: 0, of: 0 },
+        ended: {},
+        freshRetries: 0,
+        manualInterventions: 0,
+        falseCompletion: { n: 0, of: 0 },
+        reviewRejection: { n: 0, of: 0 },
+        repeatedCommands: { n: 0, of: 0 },
+        scopeViolation: { n: 0, of: 0 },
+        noProgress: { n: 0, of: 0 },
+        unrelatedDiff: { n: 0, of: 0 },
+        resumed: { n: 0, of: 0 },
+        withStats: 0,
+    };
+    for (const task of tasks) {
+        const list = attemptsOf(task);
+        if (list.length === 0)
+            continue;
+        r.tasks += 1;
+        r.attempts += list.length;
+        r.firstPass.of += 1;
+        if (list[0].status === 'done')
+            r.firstPass.n += 1;
+        const last = list[list.length - 1];
+        r.doneInTheEnd.of += 1;
+        if (last.status === 'done')
+            r.doneInTheEnd.n += 1;
+        r.ended[last.status] = (r.ended[last.status] ?? 0) + 1;
+        list.forEach((a, i) => {
+            if (a.freshRetry)
+                r.freshRetries += 1;
+            else if (i > 0)
+                r.manualInterventions += 1;
+            r.unrelatedDiff.of += 1;
+            if ((a.vcs?.suspicious?.length ?? 0) > 0 || (a.vcs?.foreignCommits?.length ?? 0) > 0)
+                r.unrelatedDiff.n += 1;
+            if ((a.scope?.length ?? 0) > 0) {
+                r.scopeViolation.of += 1;
+                if ((a.scopeReverted?.length ?? 0) > 0)
+                    r.scopeViolation.n += 1;
+            }
+            if (a.continuing) {
+                r.resumed.of += 1;
+                if (a.status === 'done')
+                    r.resumed.n += 1;
+            }
+            if (a.review && a.review.verdict !== 'skipped') {
+                r.reviewRejection.of += 1;
+                if ((a.stats?.reviewRejections ?? 0) > 0 || a.review.verdict === 'fail' || (a.review.rounds ?? 0) > 1)
+                    r.reviewRejection.n += 1;
+            }
+            if (!a.stats)
+                return;
+            r.withStats += 1;
+            r.manualInterventions += a.stats.operatorStops;
+            r.falseCompletion.of += 1;
+            if (a.stats.doneRejected > 0)
+                r.falseCompletion.n += 1;
+            r.repeatedCommands.of += 1;
+            if (a.stats.repeatsRefused > 0)
+                r.repeatedCommands.n += 1;
+            r.noProgress.of += 1;
+            if (a.stats.stoppedFor === 'no-progress')
+                r.noProgress.n += 1;
+        });
+    }
+    return r;
+}
+/** All tasks, then one row per model the sessions ran on, busiest first. */
+export function computeMetrics(sessions, now = new Date()) {
+    const all = sessions.flatMap((s) => s.tasks);
+    const byModel = new Map();
+    for (const s of sessions)
+        byModel.set(modelOf(s), [...(byModel.get(modelOf(s)) ?? []), ...s.tasks]);
+    const models = [...byModel.entries()]
+        .map(([group, tasks]) => row(group, tasks))
+        .filter((r) => r.tasks > 0)
+        .sort((a, b) => b.tasks - a.tasks);
+    return { rows: [row('all', all), ...(models.length > 1 ? models : [])], computedAt: now.toISOString() };
+}

package/dist/src/session/store.js

@@ -251,6 +251,8 @@ export class SessionStore {
             ...(input.reviewEnabled === false ? { reviewEnabled: false } : {}),
             // Only `true` is worth storing: a task may change files unless a plan said otherwise.
             ...(input.readOnly === true ? { readOnly: true } : {}),
+            // Stored only when it limits something: absent means anywhere, as before scopes existed.
+            ...((input.scope ?? []).filter((p) => p.trim()).length > 0 ? { scope: (input.scope ?? []).map((p) => p.trim()).filter(Boolean) } : {}),
         };
         await this.updateSession(sessionId, (s) => {
             s.tasks.push(task);
@@ -292,18 +294,30 @@ export class SessionStore {
      * the old attempt is untouched too, because the next attempt gets a folder of its own.
      */
     /**
-     * Queues a task that stopped at the runner's limit to carry on where it stopped: the same
+     * Queues a task that stopped before it finished to carry on where it stopped: the same
      * conversation, the same branch, a fresh count of messages. The attempt that stopped is kept on
      * the record like any other.
+     *
+     * Two kinds of stop qualify. The runner's limit (`limit-reached`), and a stop that was not the
+     * task's doing (`aborted`): the bot itself stopping under it — power, a shutdown, Ctrl+C, a crash,
+     * recorded in `interruption` at the next start — or the operator stopping it. A task that failed,
+     * blocked or was not done has a verdict on its work, and carrying that work on would carry the
+     * verdict's cause on with it; those are run again.
      */
     async continueTask(sessionId, taskId) {
         const current = (await this.getSession(sessionId))?.tasks.find((x) => x.id === taskId);
         if (!current)
             throw new Error(`Task ${taskId} does not exist in session ${sessionId}.`);
-        if (current.status !== 'limit-reached') {
-            throw new Error('Only a task that stopped at the runner\'s limit can be continued; run this one again instead.');
+        if (current.status !== 'limit-reached' && current.status !== 'aborted') {
+            throw new Error('Only a task that stopped before it finished can be continued; run this one again instead.');
         }
-        return await this.rerunTask(sessionId, taskId, {}, { fromAttempt: current.attempt ?? 1, stoppedBecause: current.reason });
+        const how = current.status === 'limit-reached' ? 'limit' : current.interruption ? 'interrupted' : 'stopped';
+        return await this.rerunTask(sessionId, taskId, {}, {
+            fromAttempt: current.attempt ?? 1,
+            stoppedBecause: current.reason,
+            how,
+            ...(current.interruption ? { interruption: current.interruption } : {}),
+        });
     }
     async rerunTask(sessionId, taskId, patch = {}, 
     /** Present when the new attempt carries on from the last one (see `continueTask`). */
@@ -340,6 +354,12 @@ export class SessionStore {
                     checks: t.checks,
                     vcsPlan: t.vcsPlan,
                     review: t.review,
+                    stats: t.stats,
+                    continuing: t.continuing,
+                    buildsOn: t.buildsOn,
+                    freshRetry: t.freshRetry,
+                    scope: t.scope,
+                    scopeReverted: t.scopeReverted,
                     vcs: t.vcs,
                 },
             ];
@@ -359,6 +379,8 @@ export class SessionStore {
             t.iterations = 0;
             t.continuing = continuing;
             t.buildsOn = buildsOn;
+            // Where the attempt that stopped had got to belongs to that attempt; the next one starts clean.
+            t.interruption = undefined;
             // Cleared so the next run starts from nothing and gets its own run folder.
             t.runId = undefined;
             t.runGroup = undefined;
@@ -376,6 +398,12 @@ export class SessionStore {
             // the one thing a new attempt should inherit.
             t.deviations = undefined;
             t.disputes = undefined;
+            // Counts, the ending and what was put back belong to the attempt above too. A fresh-chat retry
+            // marks itself again after this, in the runner.
+            t.stats = undefined;
+            t.handoff = undefined;
+            t.scopeReverted = undefined;
+            t.freshRetry = undefined;
             // The branch of the finished attempt stays in the repository and stays on the record
             // above; the next attempt gets its own, cut from the same commit this one started at.
             t.vcs = undefined;
@@ -407,7 +435,9 @@ export class SessionStore {
             for (const t of stuck) {
                 t.status = 'aborted';
                 t.finishedAt = t.finishedAt ?? new Date().toISOString();
-                t.reason = 'The operator stopped while this task was in progress, so it never finished. Nothing was resumed.';
+                t.reason =
+                    'The bot stopped while this task was in progress (the program was closed, the machine went off, or it crashed), so it never finished. ' +
+                        'Its work so far is kept; "Continue in the same chat" carries it on where it stopped.';
                 recovered.push({ sessionId: session.id, taskId: t.id, title: t.title });
             }
             session.status = 'idle';

package/dist/src/session/story.js

@@ -51,7 +51,7 @@ function sectionsOf(log) {
     return out;
 }
 /** A step log: two header lines, the output, one footer line. */
-function parseStepLog(text) {
+export function parseStepLog(text) {
     const lines = text.split('\n');
     const command = lines[1]?.replace(/^# /, '') ?? '';
     const footer = lines.map((l) => l.match(/^# outcome=(\S+) exit=(-?\d+) durationMs=(\d+)/)).filter(Boolean).pop();

package/dist/src/transport/chatTransport.js

@@ -0,0 +1,32 @@
+/**
+ * What the runner, the reviewer and the API need from a chat, and where that chat comes from.
+ *
+ * Everything that talks to Copilot goes through `CopilotTransport`, which drives a real Edge window
+ * signed in to Microsoft 365. That is the product, and it is also why nothing above the transport
+ * could be tested end to end: every run opened a browser, signed in and spent the operator's hourly
+ * message allowance. The loop itself — send, read the reply, run the steps, report back, stop at the
+ * limit, carry on after an interruption, commit on the right branch — never touches the page, only
+ * these few methods. So the rest of the code asks for a `ChatTransport` and gets one from
+ * `createTransport`, and the automated checks put a scripted chat in its place (test/support/fakeChat.ts)
+ * that answers from a script and never opens a window.
+ *
+ * The type is a `Pick` of the real class rather than an interface written out by hand, so the two
+ * cannot drift apart: a method that changes its signature in `CopilotTransport` changes it here, and
+ * the scripted chat stops compiling instead of passing checks against a shape the product no longer has.
+ *
+ * Deliberately, nothing outside the code can swap the chat: no environment variable, no setting, no
+ * command-line flag. A scripted chat hands the runner steps to execute, and a switch that a file or
+ * an environment could flip would be a way to make the bot run commands nobody reviewed. Only code
+ * running in this process — a check script — can call `setTransportFactory`.
+ */
+import { CopilotTransport } from './copilotTransport.js';
+const realChat = (opts) => new CopilotTransport(opts);
+let factory = realChat;
+/** A chat for these options: the real Copilot window, unless a check has put a scripted one in. */
+export function createTransport(opts) {
+    return factory(opts);
+}
+/** For checks only: every chat opened from now on comes from `f`. `null` puts the real one back. */
+export function setTransportFactory(f) {
+    factory = f ?? realChat;
+}

package/dist/src/vcs/contentIntegrity.js

@@ -0,0 +1,174 @@
+/**
+ * What the text a task wrote should not contain, checked before it is committed.
+ *
+ * `commitHygiene.ts` looks at which files would be committed. This looks inside them, because the
+ * damage a Windows shell does to text is invisible to a formatter and to a reviewer reading a diff
+ * in a browser: PowerShell 5.1's `Set-Content -Encoding utf8` puts a byte-order mark in front of a
+ * JSON file and `JSON.parse` then refuses it; text read in one code page and written in another
+ * comes out as `é` or, for Cyrillic, `а` and `Р°`; a decoder that gave up leaves `�`; a terminal's
+ * colour codes pasted into a file leave ESC characters; one file ends up half CRLF and half LF.
+ * Also a private key or an access token written into a file, which a path check cannot see.
+ *
+ * Every finding is about what THIS task did. A file is compared with the same file at the commit the
+ * task started from, and a kind of problem already there is not reported: a repository that has
+ * always had CRLF and LF mixed in one file is not this task's fault, and blaming it would send the
+ * chat to "fix" a file it was never asked to touch.
+ *
+ * Used as a check the runner adds by itself when it is going to commit (`content-clean`, see
+ * `checks.ts`), with the same rule as the path check: pointed out to the chat once; a second "done"
+ * with the problem still there is committed and the finding stays on the task where a person sees it.
+ */
+import { readFile, stat } from 'node:fs/promises';
+import { join } from 'node:path';
+import { gitBytes } from './git.js';
+import { looksGenerated } from './commitHygiene.js';
+/** Written files larger than this are almost always generated output. */
+export const OVERSIZED_BYTES = 1024 * 1024;
+/** Files that are binary by nature: their bytes are not text and are not looked into. */
+const BINARY_EXTENSIONS = new Set([
+    'png', 'jpg', 'jpeg', 'gif', 'bmp', 'ico', 'webp', 'tif', 'tiff', 'avif', 'psd',
+    'pdf', 'zip', '7z', 'gz', 'tgz', 'bz2', 'xz', 'rar', 'jar', 'war', 'nupkg',
+    'woff', 'woff2', 'ttf', 'otf', 'eot',
+    'exe', 'dll', 'so', 'dylib', 'bin', 'obj', 'o', 'a', 'lib', 'pdb', 'class', 'wasm',
+    'mp3', 'mp4', 'wav', 'ogg', 'webm', 'mov', 'avi',
+    'doc', 'docx', 'xls', 'xlsx', 'ppt', 'pptx', 'odt', 'ods',
+    'sqlite', 'db', 'mdb', 'pfx', 'p12', 'der',
+]);
+/**
+ * Text formats where a byte-order mark breaks the reader: JSON.parse, a shell's shebang line, YAML
+ * and TOML parsers, Node's module loader for the first line. A BOM in these is reported even in a
+ * new file; in any other text file only when the file had none before.
+ */
+const BOM_BREAKS = new Set(['json', 'jsonc', 'js', 'mjs', 'cjs', 'ts', 'mts', 'cts', 'tsx', 'jsx', 'sh', 'bash', 'yml', 'yaml', 'toml', 'py', 'env', 'html', 'css', 'scss', 'md']);
+function extensionOf(path) {
+    const name = path.replace(/\\/g, '/').split('/').pop() ?? '';
+    const dot = name.lastIndexOf('.');
+    return dot > 0 ? name.slice(dot + 1).toLowerCase() : '';
+}
+/*
+ * Mojibake: UTF-8 bytes decoded in a single-byte code page and written back as UTF-8.
+ *
+ * Latin text through Windows-1252 turns "é" into "é" and "’" into "’". Cyrillic through
+ * Windows-1252 turns "а" into "а"; through Windows-1251, into "Р°". The second character is what
+ * gives it away: it is one of the characters the code page puts at bytes 0x80–0xBF, which real text
+ * almost never places right after "Ã", "Ð", "Ñ", "Р" or "С". Plain "Ра" (Cyrillic Р then а) is
+ * ordinary Bulgarian and does not match, because "а" is not in that range.
+ */
+const CP1252_HIGH = '€‚ƒ„…†‡ˆ‰Š‹ŒŽ‘’“”•–—˜™š›œžŸ -¿';
+const CP1251_HIGH = 'ЂЃ‚ѓ„…†‡€‰Љ‹ЊЌЋЏђ‘’“”•–—™љ›њќћџ ЎўЈ¤Ґ¦§Ё©Є«¬­®Ї°±Ііґµ¶·ё№є»јЅѕї';
+const MOJIBAKE = new RegExp(`[ÃÂÐÑâ][${CP1252_HIGH}]|[РС][${CP1251_HIGH}]`, 'g');
+/** Control characters other than tab, line feed and carriage return; NUL is counted as binary. */
+const CONTROL = /[\u0001-\u0008\u000B\u000C\u000E-\u001F\u007F]/g;
+/*
+ * Credentials by their shape. Only formats that are unambiguous — a private key block, and tokens
+ * whose prefix is the issuer's own — so a test fixture that says `password = "secret"` is not one.
+ */
+const SECRETS = [
+    [/-----BEGIN (?:RSA |EC |DSA |OPENSSH |ENCRYPTED |PGP )?PRIVATE KEY(?: BLOCK)?-----/, 'a private key'],
+    [/\bAKIA[0-9A-Z]{16}\b/, 'an AWS access key id'],
+    [/\bgh[pousr]_[A-Za-z0-9]{36,}\b/, 'a GitHub token'],
+    [/\bgithub_pat_[A-Za-z0-9_]{50,}\b/, 'a GitHub token'],
+    [/\bxox[abposr]-[A-Za-z0-9-]{10,}\b/, 'a Slack token'],
+    [/\bsk-(?:ant-|proj-)?[A-Za-z0-9_-]{32,}\b/, 'an API secret key'],
+    [/AccountKey=[A-Za-z0-9+/=]{40,}/, 'an Azure storage account key'],
+    [/\bAIza[0-9A-Za-z_-]{35}\b/, 'a Google API key'],
+];
+/** Every kind of problem a file's bytes show, with a short description of each. */
+export function traitsOf(path, bytes) {
+    const t = {};
+    if (bytes.length > OVERSIZED_BYTES)
+        t.oversized = `${(bytes.length / 1024 / 1024).toFixed(1)} MB, far more than anyone writes by hand`;
+    // A NUL in the first 8 KB is how git itself decides a file is binary.
+    if (bytes.subarray(0, 8192).includes(0)) {
+        t['binary-in-text'] = 'NUL bytes in what should be a text file';
+        return t;
+    }
+    if (bytes.length >= 3 && bytes[0] === 0xef && bytes[1] === 0xbb && bytes[2] === 0xbf)
+        t.bom = 'starts with a UTF-8 byte-order mark';
+    const text = bytes.toString('utf8');
+    const replacement = (text.match(/�/g) ?? []).length;
+    if (replacement > 0)
+        t['replacement-char'] = `${replacement} "�" (text that was decoded with the wrong encoding, or invalid UTF-8)`;
+    const mojibake = text.match(MOJIBAKE) ?? [];
+    // Two or more, so one stray pair in a legitimate string does not count.
+    if (mojibake.length >= 2)
+        t.mojibake = `${mojibake.length} sequences such as "${mojibake.slice(0, 3).join('", "')}" (UTF-8 read in another code page)`;
+    const control = (text.match(CONTROL) ?? []).length;
+    if (control > 0)
+        t['control-chars'] = `${control} control character(s)${text.includes('\u001B[') ? ', including terminal colour codes' : ''}`;
+    const crlf = (text.match(/\r\n/g) ?? []).length;
+    const lf = (text.match(/(?<!\r)\n/g) ?? []).length;
+    if (crlf > 0 && lf > 0)
+        t['mixed-line-endings'] = `${crlf} CRLF and ${lf} LF line ending(s) in one file`;
+    for (const [re, what] of SECRETS) {
+        if (re.test(text)) {
+            t.secret = `what looks like ${what}`;
+            break;
+        }
+    }
+    return t;
+}
+/**
+ * The problems `now` has that `before` did not. `before` is null for a file the task created.
+ *
+ * A BOM in a new file counts only for formats it breaks; in a changed file, whenever the file had
+ * none. Size counts only when the file crossed the line in this task.
+ */
+export function newProblems(path, now, before) {
+    const ext = extensionOf(path);
+    if (BINARY_EXTENSIONS.has(ext))
+        return [];
+    const had = before ? traitsOf(path, before) : {};
+    const has = traitsOf(path, now);
+    const out = [];
+    for (const [kind, detail] of Object.entries(has)) {
+        if (had[kind])
+            continue;
+        if (kind === 'bom' && !before && !BOM_BREAKS.has(ext))
+            continue;
+        out.push({ path, kind, detail });
+    }
+    return out;
+}
+/** The problems the task added to these working-tree paths, compared with `baseCommit`. */
+export async function scanChanges(dir, paths, baseCommit, limit = 400) {
+    const found = [];
+    for (const rel of paths.slice(0, limit)) {
+        if (rel.endsWith('/') || looksGenerated(rel))
+            continue;
+        const abs = join(dir, rel);
+        const info = await stat(abs).catch(() => null);
+        if (!info?.isFile())
+            continue;
+        if (BINARY_EXTENSIONS.has(extensionOf(rel)))
+            continue;
+        // A very large file is not read: its size is the finding, compared with the size it had before.
+        if (info.size > OVERSIZED_BYTES * 4) {
+            const was = baseCommit ? await gitBytes(dir, ['cat-file', '-s', `${baseCommit}:${rel.replace(/\\/g, '/')}`]) : null;
+            const wasSize = was?.ok ? Number(was.stdout.toString('utf8').trim()) : 0;
+            if (wasSize <= OVERSIZED_BYTES) {
+                found.push({ path: rel, kind: 'oversized', detail: `${(info.size / 1024 / 1024).toFixed(1)} MB, far more than anyone writes by hand` });
+            }
+            continue;
+        }
+        const now = await readFile(abs).catch(() => null);
+        if (!now)
+            continue;
+        let before = null;
+        if (baseCommit) {
+            const shown = await gitBytes(dir, ['show', `${baseCommit}:${rel.replace(/\\/g, '/')}`]);
+            before = shown.ok ? shown.stdout : null;
+        }
+        found.push(...newProblems(rel, now, before));
+    }
+    return found;
+}
+/** What the chat is told, once, before the commit. */
+export function integrityDetail(found) {
+    const list = found.slice(0, 20).map((f) => `${f.path}: ${f.detail}`).join('; ');
+    return (`${found.length} problem(s) in the text of files this task changed, none of them there before it: ${list}` +
+        `${found.length > 20 ? `; and ${found.length - 20} more` : ''}. Write the files again as UTF-8 without a byte-order mark ` +
+        '(in PowerShell 5.1 use [IO.File]::WriteAllText with New-Object Text.UTF8Encoding($false), not Set-Content -Encoding utf8), ' +
+        'one kind of line ending per file, no terminal colour codes, and no credentials — load those from the environment. ' +
+        'If one of these is intended, leave it and say why in your summary: it will be committed and the finding kept on the task.');
+}

package/dist/src/vcs/git.js

@@ -17,6 +17,8 @@
  */
 import { execFile } from 'node:child_process';
 import { existsSync } from 'node:fs';
+import { readFile, stat } from 'node:fs/promises';
+import { createHash } from 'node:crypto';
 import { join } from 'node:path';
 /**
  * Settings every git the runner starts is given, ahead of the command.
@@ -321,6 +323,46 @@ export async function commitSubject(dir, commit) {
     return r.ok ? r.stdout.trim() : '';
 }
 /** One line per commit, newest first, for showing what a task produced. */
+/**
+ * One hash for the whole working tree as it differs from HEAD: tracked changes, staged or not, and
+ * every untracked file that is not ignored, with its contents. Two equal fingerprints mean no file
+ * changed in between, which is what `orchestrator/progress.ts` needs to tell a loop from work.
+ * Null when there is no HEAD to compare with.
+ */
+export async function treeFingerprint(dir) {
+    const diff = await gitBytes(dir, ['diff', 'HEAD', '--binary', '--no-ext-diff', '--no-textconv'], 60_000, 64 * 1024 * 1024);
+    if (!diff.ok)
+        return null;
+    const hash = createHash('sha256').update(diff.stdout);
+    const others = await gitBytes(dir, ['ls-files', '--others', '--exclude-standard', '-z']);
+    const names = others.ok ? others.stdout.toString('utf8').split('\0').filter(Boolean).sort().slice(0, 5000) : [];
+    for (const name of names) {
+        hash.update(`\0${name}\0`);
+        const info = await stat(join(dir, name)).catch(() => null);
+        if (!info?.isFile())
+            continue;
+        // A very large file is known by its size and time rather than read.
+        if (info.size > 8 * 1024 * 1024)
+            hash.update(`${info.size}:${info.mtimeMs}`);
+        else
+            hash.update(await readFile(join(dir, name)).catch(() => Buffer.alloc(0)));
+    }
+    return hash.digest('hex');
+}
+/** The identity the runner commits under (see `commitAll`). */
+export const RUNNER_EMAIL = 'copilot-operator@localhost';
+/** Whether `ancestor` is reachable from `ref`: false when the branch was reset or rewritten past it. */
+export async function isAncestor(dir, ancestor, ref = 'HEAD') {
+    const r = await git(dir, ['merge-base', '--is-ancestor', ancestor, ref]);
+    return r.ok;
+}
+/** Commits between the two that the runner did not make, as `<short sha> <author email> <subject>`. */
+export async function foreignCommits(dir, fromCommit, toRef = 'HEAD') {
+    const r = await git(dir, ['log', '--format=%h %ae %s', `${fromCommit}..${toRef}`]);
+    if (!r.ok || !r.stdout)
+        return [];
+    return r.stdout.split('\n').filter((line) => line.split(' ')[1] !== RUNNER_EMAIL);
+}
 export async function commitsBetween(dir, fromCommit, toRef = 'HEAD') {
     const r = await git(dir, ['log', '--oneline', `${fromCommit}..${toRef}`]);
     return r.ok && r.stdout ? r.stdout.split('\n') : [];