dd-trace 6.8.0 → 6.9.0

package/ci/test-optimization-validation/runner-contract.js

@@ -7,10 +7,10 @@ const { environmentNamesEqual, setEnvironmentValue } = require('./environment')
 
 const RUNNER_OPTIONS = {
   cucumber: {
-    flags: new Set(),
+    flags: new Set(['--backtrace', '--fail-fast', '--no-strict', '--strict']),
     values: new Set([
       '-p', '--config', '--import', '--language', '--loader', '--profile', '--require', '--require-module',
-      '--world-parameters',
+      '--parallel', '--world-parameters',
     ]),
   },
   cypress: {
@@ -18,7 +18,7 @@ const RUNNER_OPTIONS = {
     values: new Set(['--browser', '--config-file']),
   },
   jest: {
-    flags: new Set(['--detectLeaks']),
+    flags: new Set(['--color', '--colors', '--detectLeaks']),
     values: new Set(['-c', '--config', '--env', '--runner', '--testEnvironment']),
   },
   mocha: {
@@ -128,17 +128,6 @@ function getRunnerContract (framework, command, projectRoot, repositoryRoot, pla
     }
   }
   const omittedOptions = getOmittedRunnerOptions(framework, invocation)
-  if (framework === 'cucumber') {
-    const language = getOptionValue(invocation, '--language')
-    if (language && language !== 'en') {
-      return {
-        environment: {},
-        error: `--language ${language} is not supported by the validator-generated English scenarios`,
-        inputFiles: [],
-        runnerArgs: [],
-      }
-    }
-  }
 
   const environment = getRunnerEnvironment(invocation, platform)
   const environmentError = getRunnerEnvironmentError(environment, platform)
@@ -167,6 +156,23 @@ function getRunnerContract (framework, command, projectRoot, repositoryRoot, pla
   }
 }
 
+function getRunnerConfigurationContract (framework, runnerArgs, environment, projectRoot, repositoryRoot) {
+  const runnerArgsError = getRunnerArgsError(framework, runnerArgs)
+  if (runnerArgsError) {
+    return {
+      environment: {},
+      error: `runner arguments ${runnerArgsError}`,
+      inputFiles: [],
+      runnerArgs: [],
+    }
+  }
+  const inputs = getRunnerInputs(runnerArgs, environment, projectRoot, repositoryRoot)
+  if (inputs.error) {
+    return { environment: {}, error: inputs.error, inputFiles: [], runnerArgs: [] }
+  }
+  return { environment, inputFiles: inputs.files, runnerArgs }
+}
+
 /**
  * Rejects shell-expanded allowlisted environment assignments before command tokenization.
  *
@@ -239,7 +245,7 @@ function getRunnerSearchRoots (framework, command, projectRoot, repositoryRoot)
  */
 function addRunnerSearchRoot (roots, value, projectRoot, repositoryRoot, directory) {
   if (typeof value !== 'string' || !value) return
-  const literal = value.split(/[*?{[]/, 1)[0].replace(/[\\/]+$/, '')
+  const literal = value.split(/[*?{[]/, 1)[0].replace(/(?<![\\/])[\\/]+$/, '')
   if (!literal) return
   const candidate = path.resolve(projectRoot, literal)
   const searchRoot = directory || !path.extname(candidate) ? candidate : path.dirname(candidate)
@@ -305,17 +311,24 @@ function getUnknownRunnerOption (framework, invocation) {
 
 function getOmittedRunnerOptions (framework, invocation) {
   const omitted = OMITTED_RUNNER_OPTIONS[framework] || new Set()
+  const ignored = IGNORED_RUNNER_OPTIONS[framework] || { flags: new Set(), values: new Set() }
   return [...new Set(invocation.tokens
     .slice(invocation.runnerIndex + 1)
-    .filter(token => token.startsWith('-') && omitted.has(token.split('=', 1)[0])))]
+    .filter(token => {
+      if (!token.startsWith('-')) return false
+      const option = token.split('=', 1)[0]
+      return omitted.has(option) || ignored.flags.has(option) || ignored.values.has(option)
+    })
+    .map(token => token.split('=', 1)[0]))]
 }
 
-function getOptionValue (invocation, expected) {
-  const tokens = invocation.tokens.slice(invocation.runnerIndex + 1)
-  for (let index = 0; index < tokens.length; index++) {
-    if (tokens[index].split('=', 1)[0] !== expected) continue
-    return tokens[index].includes('=') ? tokens[index].slice(tokens[index].indexOf('=') + 1) : tokens[index + 1]
+function getArgumentOptionValues (args, expected) {
+  const values = []
+  for (let index = 0; index < args.length; index++) {
+    if (args[index].split('=', 1)[0] !== expected) continue
+    values.push(args[index].includes('=') ? args[index].slice(args[index].indexOf('=') + 1) : args[index + 1])
   }
+  return values
 }
 
 /**
@@ -361,7 +374,8 @@ function getRunnerArgsError (framework, args) {
     }
     const option = token.split('=', 1)[0]
     if (options.flags.has(option)) {
-      if (token !== option && !/^--detectLeaks=(?:true|false)$/.test(token)) {
+      if (token !== option &&
+        !/^--(?:color|colors|detectLeaks)=(?:true|false)$/.test(token)) {
         return `contain an invalid value for ${option}`
       }
       continue
@@ -376,6 +390,13 @@ function getRunnerArgsError (framework, args) {
       return `contain a missing or unsafe value for ${option}`
     }
   }
+
+  if (framework === 'cucumber') {
+    const language = getArgumentOptionValues(args, '--language').find(value => value !== 'en')
+    if (language) {
+      return `--language ${language} is not supported by the validator-generated English scenarios`
+    }
+  }
 }
 
 /**
@@ -411,10 +432,12 @@ function getRunnerInputError (args, environment, projectRoot, repositoryRoot, co
   if (inputs.error) return inputs.error
 
   const approved = new Set()
-  for (const filename of configFiles || []) {
-    try {
-      approved.add(fs.realpathSync(filename))
-    } catch {}
+  if (configFiles) {
+    for (const filename of configFiles) {
+      try {
+        approved.add(fs.realpathSync(filename))
+      } catch {}
+    }
   }
   const unbound = inputs.files.find(filename => !approved.has(filename))
   if (unbound) return `references an input that is not approval-bound: ${unbound}`
@@ -439,26 +462,34 @@ function getFrameworkInvocation (command, framework) {
   })
   if (runnerIndex === -1) return
 
-  const prefix = tokens.slice(0, runnerIndex)
-  const firstCommand = prefix.find(token => !/^[A-Za-z_][A-Za-z0-9_]*=/.test(token))
-  if (firstCommand && !RUNNER_LAUNCHERS.has(path.basename(firstCommand).toLowerCase())) {
-    return {
-      error: `runner launch wrapper ${path.basename(firstCommand)} is not allowlisted`,
-      runnerIndex,
-      tokens,
-    }
-  }
-  for (const token of prefix) {
-    if (RUNNER_LAUNCHERS.has(path.basename(token).toLowerCase())) continue
+  const prefixError = getRunnerPrefixError(tokens.slice(0, runnerIndex))
+  if (prefixError) return { error: prefixError, runnerIndex, tokens }
+  return { runnerIndex, tokens }
+}
+
+function getRunnerPrefixError (prefix) {
+  let coverageLauncher = false
+  for (let index = 0; index < prefix.length; index++) {
+    const token = prefix[index]
     if (/^[A-Za-z_][A-Za-z0-9_]*=[^;&|`]*$/.test(token)) continue
-    return {
-      error: 'runner launch wrapper contains options or positional arguments whose semantics the validator does not ' +
-        'preserve',
-      runnerIndex,
-      tokens,
+
+    const basename = path.basename(token).toLowerCase()
+    if (RUNNER_LAUNCHERS.has(basename)) {
+      coverageLauncher = basename === 'c8' || basename === 'nyc'
+      continue
     }
+    if (coverageLauncher && /^(?:-r|--reporter)=\S+$/.test(token)) continue
+    if (coverageLauncher && /^(?:-r|--reporter)$/.test(token) &&
+      prefix[index + 1] && !prefix[index + 1].startsWith('-')) {
+      index++
+      continue
+    }
+    if (!prefix.some(candidate => RUNNER_LAUNCHERS.has(path.basename(candidate).toLowerCase()))) {
+      return `runner launch wrapper ${path.basename(token)} is not allowlisted`
+    }
+    return 'runner launch wrapper contains options or positional arguments whose semantics the validator does not ' +
+      'preserve'
   }
-  return { runnerIndex, tokens }
 }
 
 /**
@@ -612,6 +643,10 @@ function resolveInputFile (input, projectRoot) {
   if (!input.module || path.isAbsolute(input.value) || input.value.startsWith('.')) {
     return path.resolve(projectRoot, input.value)
   }
+  const projectRelative = path.resolve(projectRoot, input.value)
+  try {
+    return require.resolve(projectRelative)
+  } catch {}
   try {
     return require.resolve(input.value, { paths: [projectRoot] })
   } catch {}
@@ -657,6 +692,7 @@ function isPathInside (root, filename) {
 module.exports = {
   getProjectNodeRunner,
   getRunnerArgsError,
+  getRunnerConfigurationContract,
   getRunnerContract,
   getRunnerEnvironmentError,
   getRunnerInputError,

package/ci/test-optimization-validation/scenarios/basic-reporting.js

@@ -111,7 +111,7 @@ async function runBasicReporting ({ framework, out, options }) {
     }
 
     if (!run.offline.initialized || !evidence.settingsLoadedFromCache) {
-      return failWithDebugRerun({
+      return failBasicWithDebugRerun({
         command,
         diagnosis: run.offline.initialized
           ? 'The clean test passed, but Test Optimization did not load the validator-owned offline settings.'
@@ -131,7 +131,7 @@ async function runBasicReporting ({ framework, out, options }) {
     }
 
     if (run.result.exitCode !== 0) {
-      evidence.commandFailure = classifyFailure(framework, run.result)
+      evidence.commandFailure = classifyFailure(framework, run.result, run.events)
       const confirmation = await runCleanConfirmation({ command, framework, options, out })
       evidence.cleanConfirmation = confirmation.evidence
       if (!confirmation.evidence.matchesPreflight) {
@@ -144,7 +144,7 @@ async function runBasicReporting ({ framework, out, options }) {
           confirmation.artifacts
         )
       }
-      const result = await failWithDebugRerun({
+      const result = await failBasicWithDebugRerun({
         command,
         diagnosis: complete
           ? `The test passed twice without Datadog but exited ${run.result.exitCode} when initialized, after ` +
@@ -169,7 +169,7 @@ async function runBasicReporting ({ framework, out, options }) {
     }
 
     const missing = getMissingLevels(evidence)
-    return failWithDebugRerun({
+    return failBasicWithDebugRerun({
       command,
       diagnosis: 'The direct test passed cleanly and while initialized, but no complete Test Optimization event ' +
         `hierarchy was captured. Missing levels: ${missing.join(', ')}. This is a possible dd-trace adapter bug.`,
@@ -194,6 +194,50 @@ async function runBasicReporting ({ framework, out, options }) {
   }
 }
 
+async function failBasicWithDebugRerun (input) {
+  const result = await failWithDebugRerun(input)
+  const debug = result.evidence?.debugRerun
+  if (!isSuccessfulDebugRerun(debug, result.evidence?.selector)) return result
+
+  const initialDiagnosis = result.diagnosis
+  delete result.evidence.possibleLibraryBug
+  result.status = 'error'
+  result.diagnosis = 'The first initialized run failed, but the unchanged DD_TRACE_DEBUG=1 rerun exited cleanly ' +
+    'and emitted the complete event hierarchy. Basic Reporting is intermittent, so no library-bug conclusion ' +
+    'was reached.'
+  result.evidence.initialInstrumentedDiagnosis = initialDiagnosis
+  result.evidence.intermittentInstrumentedResult = true
+  result.evidence.recommendation = 'Repeat the approved initialized command without changing its test selection. ' +
+    'If the failure recurs, send both initialized runs and the clean confirmations to engineering.'
+  result.evidence.validationIncomplete = true
+  return result
+}
+
+function isSuccessfulDebugRerun (debug, selector) {
+  return isDebugSelectorVerified(debug, selector) &&
+    debug?.ran === true &&
+    debug.commandExitCode === 0 &&
+    debug.commandTimedOut === false &&
+    debug.offlineExporterInitialized === true &&
+    debug.settingsLoadedFromCache === true &&
+    debug.testSessionEvents > 0 &&
+    debug.testModuleEvents > 0 &&
+    debug.testSuiteEvents > 0 &&
+    debug.testEvents > 0
+}
+
+// A wrapper rerun is comparable only when events identify the approved representative and no other file.
+function isDebugSelectorVerified (debug, selector) {
+  if (selector?.verified !== true) return false
+  if (selector.mode === 'bounded_direct_runner') return true
+  if (selector.mode !== 'instrumented_event_identity' ||
+    typeof selector.expectedTestFile !== 'string' ||
+    debug?.testEventsWithoutSourceFile !== 0 ||
+    debug?.testSourceFileCount !== 1 ||
+    debug?.testSourceFiles?.length !== 1) return false
+  return sourceFilesMatch(debug.testSourceFiles[0], selector.expectedTestFile)
+}
+
 /**
  * Repeats the direct clean command after an initialized-only failure.
  *
@@ -234,10 +278,17 @@ async function runCleanConfirmation ({ command, framework, options, out }) {
  */
 function summarizePreflight (preflight = {}) {
   return {
+    attempts: (preflight.attempts || []).map(attempt => ({
+      exitCode: attempt.exitCode,
+      observedTestCount: attempt.observedTestCount,
+      testFile: attempt.testFile,
+      timedOut: attempt.timedOut === true,
+    })),
     durationMs: preflight.durationMs,
     exitCode: preflight.exitCode,
     observedTestCount: preflight.observedTestCount,
     ran: preflight.ran === true,
+    selectedTestFile: preflight.selectedTestFile,
     selectorVerification: preflight.selectorVerification,
     timedOut: preflight.timedOut === true,
   }
@@ -312,12 +363,15 @@ function normalizeSourceFile (filename) {
  *
  * @param {object} framework framework entry
  * @param {object} result command result
+ * @param {object[]} [events] normalized captured events
  * @returns {object|undefined} blocker
  */
-function classifyFailure (framework, result) {
+function classifyFailure (framework, result, events = []) {
   return getCommandBlocker(result, {
     browserRequired: framework.browserRequired,
     framework: framework.framework,
+    packageJson: framework.project?.packageJson,
+    testsRan: eventsOfType(events, 'test').length > 0,
   })
 }
 

package/ci/test-optimization-validation/scenarios/ci-wiring.js

@@ -29,9 +29,10 @@ const RUNNER_PATTERNS = {
  * @param {object} input audit inputs
  * @param {object} input.manifest validation manifest
  * @param {object} input.framework framework entry
+ * @param {Map<string, Buffer|undefined>} [input.projectFileSources] approval-bound project sources
  * @returns {object} CI audit result
  */
-function runCiWiring ({ manifest, framework }) {
+function runCiWiring ({ manifest, framework, projectFileSources }) {
   const contradiction = getFrameworkCiDiscoveryContradiction(framework, manifest)
   if (contradiction) {
     return getIncomplete(framework, contradiction.reason, {
@@ -47,6 +48,32 @@ function runCiWiring ({ manifest, framework }) {
     domain: 'ci_configuration',
     evidenceStrength: 'unknown',
   }
+  if (hasNoSupportedCiConfiguration(manifest, ci)) {
+    return getIncomplete(
+      framework,
+      'No supported CI configuration file was found by bounded repository discovery. The CI audit is incomplete; ' +
+        'this does not prove that the repository has no external CI configuration.',
+      {
+        ...evidence,
+        reasonCode: 'no-supported-ci-configuration',
+        recommendation: 'Identify the CI system and one repository-controlled test job. If CI is configured outside ' +
+          'this repository, review that configuration separately.',
+      }
+    )
+  }
+  if (hasUnavailableRemoteCiCommand(ci)) {
+    return getIncomplete(
+      framework,
+      'The selected CI path delegates test execution to a remote action or reusable workflow whose command is not ' +
+        'available in this repository. The CI audit is incomplete.',
+      {
+        ...evidence,
+        reasonCode: 'remote-ci-command-unavailable',
+        recommendation: 'Review the referenced action or reusable workflow at its pinned revision. Keep the result ' +
+          'incomplete when its final test command and effective environment cannot be bound statically.',
+      }
+    )
+  }
   const missing = getMissingReviewFields(ci)
   if (missing.length > 0) {
     return getIncomplete(
@@ -63,7 +90,7 @@ function runCiWiring ({ manifest, framework }) {
     )
   }
 
-  const source = readCiSource(ci.configFile)
+  const source = readProjectSource(ci.configFile, projectFileSources)
   if (!source) {
     return getIncomplete(framework, 'The recorded CI configuration file is unavailable or too large to verify.', {
       ...evidence,
@@ -87,7 +114,7 @@ function runCiWiring ({ manifest, framework }) {
   }
 
   const command = ci.command.trim()
-  const resolution = getRunnerResolution(command, framework, ci)
+  const resolution = getRunnerResolution(command, framework, ci, projectFileSources)
   const normalizedSource = jobSource.replaceAll('\\', '/')
   const hasInitialization = /dd-trace\/ci\/init(?:\.js)?\b/.test(normalizedSource)
   const matrixRelevant = matrixAffectsCiFacts(jobSource, command)
@@ -138,12 +165,16 @@ function runCiWiring ({ manifest, framework }) {
   if (initialization.status === 'missing' &&
     resolution.status === 'confirmed' &&
     unresolved.relevant.length === 0) {
+    const transportMissing = ciFacts.transport.status === 'missing'
     return getFailure(
       framework,
       'The checksum-bound CI job reaches the selected test framework through a bounded static command path, but ' +
-        'does not configure the dd-trace/ci/init preload. Test Optimization is not initialized in that job.',
+        `does not configure the dd-trace/ci/init preload${
+          transportMissing ? ' and declares no visible Datadog Agent or agentless reporting transport' : ''
+        }. Test Optimization is not configured in that job.`,
       {
         ...evidence,
+        ciConfigurationStatus: 'not_configured',
         ciRemediation: remediation,
         conclusion: 'confirmed_misconfigured',
         evidenceStrength: 'confirmed_static',
@@ -153,17 +184,25 @@ function runCiWiring ({ manifest, framework }) {
   }
 
   if (resolution.status !== 'confirmed') {
-    const partial = initialization.status === 'missing'
-      ? 'The selected job has no visible dd-trace/ci/init preload. '
-      : ''
+    const visibleFacts = []
+    if (initialization.status === 'missing') {
+      visibleFacts.push('The selected job has no visible dd-trace/ci/init preload.')
+    }
+    if (ciFacts.transport.status === 'missing') {
+      visibleFacts.push('The recorded review found no visible Datadog Agent or agentless reporting transport.')
+    }
+    const recommendation = /working directory/i.test(resolution.reason)
+      ? 'Keep the CI job\'s actual working directory. Resolve the repository-root wrapper to the selected test ' +
+        'runner statically; do not substitute the framework package directory merely to make the audit conclusive.'
+      : 'Resolve the remaining wrapper or dynamic command statically, or confirm the effective NODE_OPTIONS value ' +
+        'in the final test process with DD_TRACE_DEBUG=1.'
     return getIncomplete(
       framework,
-      `${partial}The CI audit remains incomplete because the selected command could not be resolved to the ` +
-        `${framework.framework} runner: ${resolution.reason}.`,
+      'The CI audit remains incomplete because the selected command could not be resolved to the ' +
+        `${framework.framework} runner: ${resolution.reason}. ${visibleFacts.join(' ')}`.trim(),
       {
         ...evidence,
-        recommendation: 'Resolve the remaining wrapper or dynamic command statically, or confirm the effective ' +
-          'NODE_OPTIONS value in the final test process with DD_TRACE_DEBUG=1.',
+        recommendation,
       }
     )
   }
@@ -244,9 +283,10 @@ function getEffectiveNodeOptionsOverride (commandPath = []) {
  * @param {string} command selected CI command
  * @param {object} framework framework manifest entry
  * @param {object} ci selected CI evidence
+ * @param {Map<string, Buffer|undefined>} [projectFileSources] approval-bound project sources
  * @returns {object} static runner resolution
  */
-function getRunnerResolution (command, framework, ci) {
+function getRunnerResolution (command, framework, ci, projectFileSources) {
   if (getDirectRunner(command, framework.framework)) {
     return {
       commandPath: [command],
@@ -266,7 +306,7 @@ function getRunnerResolution (command, framework, ci) {
       status: 'unresolved',
     }
   }
-  const scripts = readProjectScripts(framework.project.packageJson)
+  const scripts = readProjectScripts(framework.project.packageJson, projectFileSources)
   if (!scripts) {
     return {
       reason: 'the approval-bound project package.json is unavailable or invalid',
@@ -283,10 +323,10 @@ function getRunnerResolution (command, framework, ci) {
       status: 'unresolved',
     }
   }
-  const candidate = expansion.terminals.find(terminal => {
+  const candidates = expansion.terminals.filter(terminal => {
     return getDirectRunner(terminal.command, framework.framework)
   })
-  if (!candidate) {
+  if (candidates.length === 0) {
     return {
       lifecycleScripts: expansion.lifecycleScripts,
       reason: 'no bounded local package-script path reaches the selected framework runner',
@@ -294,6 +334,15 @@ function getRunnerResolution (command, framework, ci) {
       status: 'unresolved',
     }
   }
+  if (candidates.length > 1) {
+    return {
+      lifecycleScripts: expansion.lifecycleScripts,
+      reason: 'more than one bounded local package-script path reaches the selected framework runner',
+      source: 'unresolved_wrapper',
+      status: 'unresolved',
+    }
+  }
+  const candidate = candidates[0]
   return {
     commandPath: candidate.path,
     lifecycleScripts: expansion.lifecycleScripts,
@@ -303,11 +352,11 @@ function getRunnerResolution (command, framework, ci) {
   }
 }
 
-function readProjectScripts (filename) {
+function readProjectScripts (filename, projectFileSources) {
   try {
-    const stat = fs.lstatSync(filename)
-    if (!stat.isFile() || stat.isSymbolicLink() || stat.size > MAX_CI_FILE_BYTES) return
-    const packageJson = JSON.parse(fs.readFileSync(filename, 'utf8'))
+    const source = readProjectSource(filename, projectFileSources)
+    if (source === undefined) return
+    const packageJson = JSON.parse(source)
     if (!packageJson.scripts || typeof packageJson.scripts !== 'object' ||
       Array.isArray(packageJson.scripts)) return {}
     return packageJson.scripts
@@ -346,18 +395,19 @@ function classifyUnresolved (ci, resolution, matrixRelevant, jobSource) {
   const ignored = []
   const unresolved = Array.isArray(ci.unresolved) ? ci.unresolved : []
   const githubHosted = /[/\\]\.github[/\\]workflows[/\\]/.test(ci.configFile) &&
-    /^\s*runs-on:\s*(?:ubuntu|windows|macos)-/mi.test(jobSource)
+    /^[ \t]*runs-on:[ \t]*(?:ubuntu|windows|macos)-/mi.test(jobSource)
 
   for (const item of unresolved) {
     const isMatrix = /\bmatrix\b/i.test(item)
-    const isResolvedPackagePath = resolution.source === 'local_package_script' &&
-      /\b(?:lifecycle|npm|package script|pnpm|pretest|posttest|yarn)\b/i.test(item)
+    const isResolvedPackagePath = resolution.status === 'confirmed' &&
+      resolution.source === 'local_package_script' &&
+      /\b(?:bun|lifecycle|npm|package script|pnpm|pretest|posttest|yarn)\b/i.test(item)
     const isAmbientGithubSettings = githubHosted &&
-      /\b(?:repository|organization|environment)[-\s,\w]*\b(?:secrets?|variables?)\b/i.test(item) &&
+      /\b(?:repository|organization|environment)[-\s,\w]+\b(?:secrets?|variables?)\b/i.test(item) &&
       /\b(?:inject|inherit|outside)\b/i.test(item)
     const isOtherJob = /^Other jobs?\b/i.test(item) ||
-      /\bsecond\b.*\bjob\b.*\bonly\b.*\bselected\b/i.test(item) ||
-      /\brelease\b.*\bcontains no test job\b/i.test(item)
+      /\bsecond\b.+\bjob\b.+\bonly\b.+\bselected\b/i.test(item) ||
+      /\brelease\b.+\bcontains no test job\b/i.test(item)
     if ((isMatrix && !matrixRelevant) ||
       isResolvedPackagePath ||
       isAmbientGithubSettings ||
@@ -373,6 +423,29 @@ function classifyUnresolved (ci, resolution, matrixRelevant, jobSource) {
   return { ignored, relevant }
 }
 
+function hasNoSupportedCiConfiguration (manifest, ci) {
+  if (ci.configFile || ci.job || ci.command) return false
+  const unresolved = Array.isArray(ci.unresolved) ? ci.unresolved : []
+  return manifest.ciDiscovery?.found?.length === 0 ||
+    unresolved.some(item => /No supported CI configuration file was found/i.test(item))
+}
+
+function hasUnavailableRemoteCiCommand (ci) {
+  if (ci.command) return false
+  const evidence = [
+    ci.step,
+    ...(Array.isArray(ci.unresolved) ? ci.unresolved : []),
+  ].filter(Boolean)
+  if (evidence.some(item => {
+    return /\b(?:remote|external|third-party)\s+(?:action|workflow)\b/i.test(item)
+  })) return true
+
+  return evidence.some(item => {
+    const reference = /^\s*uses:\s*["']?([^"'\s]+)["']?\s*$/im.exec(item)?.[1]
+    return reference && !reference.startsWith('./')
+  })
+}
+
 function matrixAffectsCiFacts (jobSource, command) {
   const matrixReference = /\bmatrix\s*[.[]/
   if (!matrixReference.test(jobSource)) return false
@@ -407,6 +480,8 @@ function normalizeDirectCommand (command) {
     assignments.push(...crossEnv.assignments)
     source = source.slice(crossEnv.length)
   }
+  source = source.replace(/^(?:(?:bunx|npx)(?:\.cmd)?|(?:pnpm|yarn)(?:\.cmd)?\s+exec)\s+/, '')
+    .replace(/^bun x\s+/, '')
   return { assignments, index: prefix.length, source }
 }
 
@@ -446,7 +521,7 @@ function getSelectedJobSource (source, ci) {
 
 function getYamlKeyEntry (line, index) {
   if (!line || /^\s*(?:#|$)/.test(line) || /^\s/.test(line) && line.includes('\t')) return
-  const match = /^(\s*)(?:"([^"]+)"|'([^']+)'|([^:#][^:]*)):\s*(?:#.*)?$/.exec(line)
+  const match = /^(\s*)(?:"([^"]+)"|'([^']+)'|([^\s:#][^:]*)):\s*(?:#.*)?$/.exec(line)
   if (!match) return
   return {
     indent: match[1].length,
@@ -491,16 +566,23 @@ function getMissingReviewFields (ci) {
 }
 
 /**
- * Reads one bounded regular CI file.
+ * Reads one bounded regular project file or its approval-bound snapshot.
  *
- * @param {string} filename CI file
+ * @param {string} filename project file
+ * @param {Map<string, Buffer|undefined>} [projectFileSources] approval-bound project sources
  * @returns {string|undefined} source
  */
-function readCiSource (filename) {
+function readProjectSource (filename, projectFileSources) {
+  if (typeof filename !== 'string') return
+  const resolved = path.resolve(filename)
+  if (projectFileSources) {
+    if (!projectFileSources.has(resolved)) return
+    return projectFileSources.get(resolved)?.toString('utf8')
+  }
   try {
-    const stat = fs.lstatSync(filename)
+    const stat = fs.lstatSync(resolved)
     if (!stat.isFile() || stat.isSymbolicLink() || stat.size > MAX_CI_FILE_BYTES) return
-    return fs.readFileSync(filename, 'utf8')
+    return fs.readFileSync(resolved, 'utf8')
   } catch {}
 }
 
@@ -519,11 +601,35 @@ function containsLiteral (source, value) {
 
 function containsExecutionCommand (source, value) {
   const command = String(value).replaceAll('\r\n', '\n').trim()
-  if (!command || command.includes('\n')) return false
-  return source.split(/\r?\n/).some(line => {
+  if (!command) return false
+  const lines = source.replaceAll('\r\n', '\n').split('\n')
+  return lines.some((line, index) => {
     if (/^\s*#/.test(line)) return false
-    const match = /^\s*(?:-\s*)?(?:run|script):\s*(.*?)\s*$/.exec(line)
-    return match?.[1] === command
+    const match = /^\s*(?:-\s*)?(?:run|script):(.*)$/.exec(line)
+    if (!match) return false
+    const scalar = match[1].trim()
+    if (!/^\|[+-]?$/.test(scalar)) return scalar === command
+
+    const indicatorIndent = /^\s*/.exec(line)[0].length
+    const block = []
+    let contentIndent
+    for (let next = index + 1; next < lines.length; next++) {
+      if (!lines[next].trim()) {
+        block.push('')
+        continue
+      }
+      const nextIndent = /^\s*/.exec(lines[next])[0].length
+      if (contentIndent === undefined) {
+        if (nextIndent <= indicatorIndent) break
+        contentIndent = nextIndent
+      } else if (nextIndent < contentIndent) {
+        break
+      }
+      block.push(lines[next])
+    }
+    if (contentIndent === undefined) return false
+    const blockCommand = block.map(candidate => candidate.slice(contentIndent)).join('\n').trim()
+    return blockCommand === command
   })
 }