devworkspace 0.2.0 → 0.2.1

package/dist/discovery/commands.js

@@ -1,13 +1,16 @@
 export const TRUST_NOTE = 'Commands marked "repository-script" come from files in the repository (e.g. package.json scripts) and are untrusted input. ' +
     'Inspect what a script does before running it, especially in automation or on unfamiliar repositories.';
+/** First match wins, so more specific scripts (test:unit) are preferred over catch-alls (test). */
 const SCRIPT_CANDIDATES = {
     typecheck: ['typecheck', 'type-check', 'check-types', 'tsc', 'types'],
-    unit: ['test', 'test:unit', 'unit', 'test:run'],
+    unit: ['test:unit', 'unit', 'test', 'test:run'],
     integration: ['test:integration', 'test:int', 'integration'],
     e2e: ['test:e2e', 'e2e', 'test:playwright', 'test:cypress', 'cypress:run'],
     lint: ['lint', 'eslint', 'lint:check'],
     format: ['format:check', 'prettier:check', 'format-check', 'check:format'],
     build: ['build', 'compile'],
+    migrations: ['db:migrate', 'migrate'],
+    security: ['test:security', 'security:test', 'security', 'audit:security'],
 };
 const REQUIRED = {
     typecheck: 'yes',
@@ -20,73 +23,132 @@ const REQUIRED = {
     migrations: 'context',
     security: 'context',
 };
-const ORDER = ['typecheck', 'unit', 'integration', 'e2e', 'lint', 'format', 'build', 'migrations', 'security'];
+export const CHECK_ORDER = ['typecheck', 'unit', 'integration', 'e2e', 'lint', 'format', 'build', 'migrations', 'security'];
 function scriptCommand(pm, script) {
-    const mgr = pm ?? 'npm';
-    if (script === 'test' && (mgr === 'npm' || mgr === 'pnpm' || mgr === 'yarn' || mgr === 'bun'))
-        return `${mgr} test`;
-    if (mgr === 'yarn')
+    if (script === 'test' && (pm === 'npm' || pm === 'pnpm' || pm === 'yarn' || pm === 'bun'))
+        return `${pm} test`;
+    if (pm === 'yarn')
         return `yarn ${script}`;
-    if (mgr === 'bun')
+    if (pm === 'bun')
         return `bun run ${script}`;
-    return `${mgr} run ${script}`;
+    return `${pm} run ${script}`;
 }
 /** Placeholder scripts such as npm's default "no test specified" do not count as tests. */
 function isRealScript(body) {
     return !/no test specified/i.test(body) && body.trim() !== '';
 }
+const byCwd = (a, b) => (a.cwd ?? '').localeCompare(b.cwd ?? '');
+/**
+ * Detected verification commands. Node commands are produced per package and only for scripts that exist in that
+ * package's own manifest. Every check that no package provides gets one unavailable entry so the contract always
+ * lists all nine checks.
+ */
 export function buildContract(input) {
-    const found = new Map();
-    const set = (id, command, source, origin) => {
-        if (!found.has(id))
-            found.set(id, { id, available: true, command, required: REQUIRED[id], source, origin });
+    const found = [];
+    const add = (id, command, source, origin, cwd) => {
+        if (!found.some((f) => f.id === id && (f.cwd ?? '') === (cwd ?? ''))) {
+            found.push({ id, available: true, command, required: REQUIRED[id], source, origin, ...(cwd ? { cwd } : {}) });
+        }
     };
-    if (input.pkg) {
+    for (const np of input.nodePackages) {
+        const manifest = np.dir ? `${np.dir}/package.json` : 'package.json';
         for (const [id, names] of Object.entries(SCRIPT_CANDIDATES)) {
             for (const name of names) {
-                const body = input.pkg.scripts[name];
+                const body = np.pkg.scripts[name];
                 if (body !== undefined && isRealScript(body)) {
-                    set(id, scriptCommand(input.packageManager, name), `${input.pkg.rel}#scripts.${name}`, 'repository-script');
+                    add(id, scriptCommand(np.packageManager, name), `${manifest}#scripts.${name}`, 'repository-script', np.dir);
                     break;
                 }
             }
         }
-        if (!found.has('typecheck') && input.has('tsconfig.json') && input.pkg.hasTypes) {
-            set('typecheck', `${input.packageManager === 'pnpm' ? 'pnpm exec' : 'npx'} tsc --noEmit`, 'tsconfig.json', 'inferred');
+        if (np.pkg.scripts.typecheck === undefined && np.hasTsconfig && np.pkg.hasTypes && !found.some((f) => f.id === 'typecheck' && (f.cwd ?? '') === np.dir)) {
+            add('typecheck', `${np.packageManager === 'pnpm' ? 'pnpm exec' : 'npx'} tsc --noEmit`, `${np.dir ? `${np.dir}/` : ''}tsconfig.json`, 'inferred', np.dir);
         }
     }
     if (input.ecosystems.has('python')) {
         const ev = input.pythonEvidence;
         const hasTestsDir = [...input.files].some((f) => /^tests?\//.test(f) && f.endsWith('.py'));
         if (ev.pytest || hasTestsDir || input.has('pytest.ini'))
-            set('unit', 'pytest', ev.pytest ?? 'tests/', 'inferred');
+            add('unit', 'pytest', ev.pytest ?? 'tests/', 'inferred');
         if (ev.ruff)
-            set('lint', 'ruff check .', ev.ruff, 'inferred');
+            add('lint', 'ruff check .', ev.ruff, 'inferred');
         if (ev.mypy)
-            set('typecheck', 'mypy .', ev.mypy, 'inferred');
+            add('typecheck', 'mypy .', ev.mypy, 'inferred');
         if (ev.black)
-            set('format', 'black --check .', ev.black, 'inferred');
+            add('format', 'black --check .', ev.black, 'inferred');
         if (ev.alembic)
-            set('migrations', 'alembic check', ev.alembic, 'inferred');
+            add('migrations', 'alembic check', ev.alembic, 'inferred');
     }
     if (input.ecosystems.has('go')) {
-        set('unit', 'go test ./...', 'go.mod', 'inferred');
-        set('build', 'go build ./...', 'go.mod', 'inferred');
-        set('lint', 'go vet ./...', 'go.mod', 'inferred');
+        add('unit', 'go test ./...', 'go.mod', 'inferred');
+        add('build', 'go build ./...', 'go.mod', 'inferred');
+        add('lint', 'go vet ./...', 'go.mod', 'inferred');
     }
     if (input.ecosystems.has('rust')) {
-        set('unit', 'cargo test', 'Cargo.toml', 'inferred');
-        set('build', 'cargo build', 'Cargo.toml', 'inferred');
-        set('lint', 'cargo clippy', 'Cargo.toml', 'inferred');
+        add('unit', 'cargo test', 'Cargo.toml', 'inferred');
+        add('build', 'cargo build', 'Cargo.toml', 'inferred');
+        add('lint', 'cargo clippy', 'Cargo.toml', 'inferred');
     }
     if (input.has('pom.xml')) {
-        set('unit', 'mvn test', 'pom.xml', 'inferred');
-        set('build', 'mvn package', 'pom.xml', 'inferred');
+        add('unit', 'mvn test', 'pom.xml', 'inferred');
+        add('build', 'mvn package', 'pom.xml', 'inferred');
     }
     if (input.has('build.gradle') || input.has('build.gradle.kts')) {
-        set('unit', 'gradle test', 'build.gradle', 'inferred');
-        set('build', 'gradle build', 'build.gradle', 'inferred');
+        add('unit', 'gradle test', 'build.gradle', 'inferred');
+        add('build', 'gradle build', 'build.gradle', 'inferred');
+    }
+    return withPlaceholders(found);
+}
+function withPlaceholders(entries) {
+    const out = [];
+    for (const id of CHECK_ORDER) {
+        const mine = entries.filter((e) => e.id === id && e.available).sort(byCwd);
+        if (mine.length > 0)
+            out.push(...mine);
+        else {
+            const unavailable = entries.find((e) => e.id === id);
+            out.push(unavailable ?? { id, available: false, command: null, required: 'no', source: null, origin: 'inferred' });
+        }
+    }
+    return out;
+}
+/**
+ * Combine the previous contract with fresh detection.
+ *  - Entries confirmed by a person (origin "user") are never dropped or overwritten. A user entry without a cwd
+ *    covers its whole check; one with a cwd covers only that directory, and detection fills in the other packages.
+ *  - If detection is incomplete, previously available entries survive too, with their original provenance.
+ */
+export function mergeContract(previous, detected, opts = {}) {
+    const prev = previous ?? [];
+    const detectedAvailable = detected.filter((d) => d.available);
+    const incomplete = detectedAvailable.length === 0 || !!opts.truncated;
+    let preservedUser = 0;
+    let preservedStale = 0;
+    const out = [];
+    for (const id of CHECK_ORDER) {
+        const user = prev.filter((p) => p.id === id && p.origin === 'user' && p.available);
+        const globalUser = user.some((u) => !u.cwd);
+        const det = detectedAvailable.filter((d) => d.id === id);
+        const chosen = [...user];
+        preservedUser += user.length;
+        if (!globalUser) {
+            for (const d of det)
+                if (!user.some((u) => (u.cwd ?? '') === (d.cwd ?? '')))
+                    chosen.push(d);
+        }
+        if (chosen.length === 0 && incomplete) {
+            const old = prev.filter((p) => p.id === id && p.available);
+            chosen.push(...old);
+            preservedStale += old.length;
+        }
+        if (chosen.length > 0)
+            out.push(...chosen.sort(byCwd));
+        else {
+            // nothing confirmed, nothing detected: list the check as unavailable so the contract always names all nine checks
+            const unavailable = detected.find((d) => d.id === id) ?? { id, available: false, command: null, required: 'no', source: null, origin: 'inferred' };
+            out.push(unavailable);
+        }
     }
-    return ORDER.map((id) => found.get(id) ?? { id, available: false, command: null, required: 'no', source: null, origin: 'inferred' });
+    return { checks: out, preservedUser, preservedStale, incomplete };
 }
 //# sourceMappingURL=commands.js.map

package/dist/discovery/commands.js.map

@@ -1 +1 @@
-{"version":3,"file":"commands.js","sourceRoot":"","sources":["../../src/discovery/commands.ts"],"names":[],"mappings":"AAGA,MAAM,CAAC,MAAM,UAAU,GACrB,6HAA6H;IAC7H,uGAAuG,CAAC;AAW1G,MAAM,iBAAiB,GAA6B;IAClD,SAAS,EAAE,CAAC,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,KAAK,EAAE,OAAO,CAAC;IACrE,IAAI,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,CAAC;IAC/C,WAAW,EAAE,CAAC,kBAAkB,EAAE,UAAU,EAAE,aAAa,CAAC;IAC5D,GAAG,EAAE,CAAC,UAAU,EAAE,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,aAAa,CAAC;IAC1E,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,YAAY,CAAC;IACtC,MAAM,EAAE,CAAC,cAAc,EAAE,gBAAgB,EAAE,cAAc,EAAE,cAAc,CAAC;IAC1E,KAAK,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC;CAC5B,CAAC;AAEF,MAAM,QAAQ,GAA8C;IAC1D,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,KAAK;IACX,WAAW,EAAE,SAAS;IACtB,GAAG,EAAE,SAAS;IACd,IAAI,EAAE,KAAK;IACX,MAAM,EAAE,SAAS;IACjB,KAAK,EAAE,KAAK;IACZ,UAAU,EAAE,SAAS;IACrB,QAAQ,EAAE,SAAS;CACpB,CAAC;AAEF,MAAM,KAAK,GAAc,CAAC,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;AAE1H,SAAS,aAAa,CAAC,EAAiB,EAAE,MAAc;IACtD,MAAM,GAAG,GAAG,EAAE,IAAI,KAAK,CAAC;IACxB,IAAI,MAAM,KAAK,MAAM,IAAI,CAAC,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,KAAK,CAAC;QAAE,OAAO,GAAG,GAAG,OAAO,CAAC;IACpH,IAAI,GAAG,KAAK,MAAM;QAAE,OAAO,QAAQ,MAAM,EAAE,CAAC;IAC5C,IAAI,GAAG,KAAK,KAAK;QAAE,OAAO,WAAW,MAAM,EAAE,CAAC;IAC9C,OAAO,GAAG,GAAG,QAAQ,MAAM,EAAE,CAAC;AAChC,CAAC;AAED,2FAA2F;AAC3F,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAoB;IAChD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC/C,MAAM,GAAG,GAAG,CAAC,EAAW,EAAE,OAAe,EAAE,MAAc,EAAE,MAA8B,EAAQ,EAAE;QACjG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC9G,CAAC,CAAC;IAEF,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;QACd,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC;YAC5D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBACrC,IAAI,IAAI,KAAK,SAAS,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC7C,GAAG,CAAC,EAAa,EAAE,aAAa,CAAC,KAAK,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,YAAY,IAAI,EAAE,EAAE,mBAAmB,CAAC,CAAC;oBACvH,MAAM;gBACR,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;YAChF,GAAG,CAAC,WAAW,EAAE,GAAG,KAAK,CAAC,cAAc,KAAK,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,eAAe,EAAE,eAAe,EAAE,UAAU,CAAC,CAAC;QACzH,CAAC;IACH,CAAC;IAED,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnC,MAAM,EAAE,GAAG,KAAK,CAAC,cAAc,CAAC;QAChC,MAAM,WAAW,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3F,IAAI,EAAE,CAAC,MAAM,IAAI,WAAW,IAAI,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC;YAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAC,MAAM,IAAI,QAAQ,EAAE,UAAU,CAAC,CAAC;QAClH,IAAI,EAAE,CAAC,IAAI;YAAE,GAAG,CAAC,MAAM,EAAE,cAAc,EAAE,EAAE,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAC9D,IAAI,EAAE,CAAC,IAAI;YAAE,GAAG,CAAC,WAAW,EAAE,QAAQ,EAAE,EAAE,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAC7D,IAAI,EAAE,CAAC,KAAK;YAAE,GAAG,CAAC,QAAQ,EAAE,iBAAiB,EAAE,EAAE,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QACrE,IAAI,EAAE,CAAC,OAAO;YAAE,GAAG,CAAC,YAAY,EAAE,eAAe,EAAE,EAAE,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;QACnD,GAAG,CAAC,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;QACrD,GAAG,CAAC,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;QACpD,GAAG,CAAC,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;QACtD,GAAG,CAAC,MAAM,EAAE,cAAc,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QACzB,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;QAC/C,GAAG,CAAC,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAC/D,GAAG,CAAC,MAAM,EAAE,aAAa,EAAE,cAAc,EAAE,UAAU,CAAC,CAAC;QACvD,GAAG,CAAC,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,UAAU,CAAC,CAAC;IAC3D,CAAC;IAED,OAAO,KAAK,CAAC,GAAG,CACd,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAa,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAmB,EAAE,CACrI,CAAC;AACJ,CAAC","sourcesContent":["import type { CheckId, CommandEntry } from '../config/schemas.js';\nimport type { PackageInfo } from './detect.js';\n\nexport const TRUST_NOTE =\n  'Commands marked \"repository-script\" come from files in the repository (e.g. package.json scripts) and are untrusted input. ' +\n  'Inspect what a script does before running it, especially in automation or on unfamiliar repositories.';\n\nexport interface ContractInput {\n  pkg: PackageInfo | null;\n  packageManager: string | null;\n  ecosystems: Set<string>;\n  has: (rel: string) => boolean;\n  pythonEvidence: Record<string, string>;\n  files: Set<string>;\n}\n\nconst SCRIPT_CANDIDATES: Record<string, string[]> = {\n  typecheck: ['typecheck', 'type-check', 'check-types', 'tsc', 'types'],\n  unit: ['test', 'test:unit', 'unit', 'test:run'],\n  integration: ['test:integration', 'test:int', 'integration'],\n  e2e: ['test:e2e', 'e2e', 'test:playwright', 'test:cypress', 'cypress:run'],\n  lint: ['lint', 'eslint', 'lint:check'],\n  format: ['format:check', 'prettier:check', 'format-check', 'check:format'],\n  build: ['build', 'compile'],\n};\n\nconst REQUIRED: Record<CheckId, CommandEntry['required']> = {\n  typecheck: 'yes',\n  unit: 'yes',\n  integration: 'context',\n  e2e: 'context',\n  lint: 'yes',\n  format: 'context',\n  build: 'yes',\n  migrations: 'context',\n  security: 'context',\n};\n\nconst ORDER: CheckId[] = ['typecheck', 'unit', 'integration', 'e2e', 'lint', 'format', 'build', 'migrations', 'security'];\n\nfunction scriptCommand(pm: string | null, script: string): string {\n  const mgr = pm ?? 'npm';\n  if (script === 'test' && (mgr === 'npm' || mgr === 'pnpm' || mgr === 'yarn' || mgr === 'bun')) return `${mgr} test`;\n  if (mgr === 'yarn') return `yarn ${script}`;\n  if (mgr === 'bun') return `bun run ${script}`;\n  return `${mgr} run ${script}`;\n}\n\n/** Placeholder scripts such as npm's default \"no test specified\" do not count as tests. */\nfunction isRealScript(body: string): boolean {\n  return !/no test specified/i.test(body) && body.trim() !== '';\n}\n\nexport function buildContract(input: ContractInput): CommandEntry[] {\n  const found = new Map<CheckId, CommandEntry>();\n  const set = (id: CheckId, command: string, source: string, origin: CommandEntry['origin']): void => {\n    if (!found.has(id)) found.set(id, { id, available: true, command, required: REQUIRED[id], source, origin });\n  };\n\n  if (input.pkg) {\n    for (const [id, names] of Object.entries(SCRIPT_CANDIDATES)) {\n      for (const name of names) {\n        const body = input.pkg.scripts[name];\n        if (body !== undefined && isRealScript(body)) {\n          set(id as CheckId, scriptCommand(input.packageManager, name), `${input.pkg.rel}#scripts.${name}`, 'repository-script');\n          break;\n        }\n      }\n    }\n    if (!found.has('typecheck') && input.has('tsconfig.json') && input.pkg.hasTypes) {\n      set('typecheck', `${input.packageManager === 'pnpm' ? 'pnpm exec' : 'npx'} tsc --noEmit`, 'tsconfig.json', 'inferred');\n    }\n  }\n\n  if (input.ecosystems.has('python')) {\n    const ev = input.pythonEvidence;\n    const hasTestsDir = [...input.files].some((f) => /^tests?\\//.test(f) && f.endsWith('.py'));\n    if (ev.pytest || hasTestsDir || input.has('pytest.ini')) set('unit', 'pytest', ev.pytest ?? 'tests/', 'inferred');\n    if (ev.ruff) set('lint', 'ruff check .', ev.ruff, 'inferred');\n    if (ev.mypy) set('typecheck', 'mypy .', ev.mypy, 'inferred');\n    if (ev.black) set('format', 'black --check .', ev.black, 'inferred');\n    if (ev.alembic) set('migrations', 'alembic check', ev.alembic, 'inferred');\n  }\n  if (input.ecosystems.has('go')) {\n    set('unit', 'go test ./...', 'go.mod', 'inferred');\n    set('build', 'go build ./...', 'go.mod', 'inferred');\n    set('lint', 'go vet ./...', 'go.mod', 'inferred');\n  }\n  if (input.ecosystems.has('rust')) {\n    set('unit', 'cargo test', 'Cargo.toml', 'inferred');\n    set('build', 'cargo build', 'Cargo.toml', 'inferred');\n    set('lint', 'cargo clippy', 'Cargo.toml', 'inferred');\n  }\n  if (input.has('pom.xml')) {\n    set('unit', 'mvn test', 'pom.xml', 'inferred');\n    set('build', 'mvn package', 'pom.xml', 'inferred');\n  }\n  if (input.has('build.gradle') || input.has('build.gradle.kts')) {\n    set('unit', 'gradle test', 'build.gradle', 'inferred');\n    set('build', 'gradle build', 'build.gradle', 'inferred');\n  }\n\n  return ORDER.map(\n    (id) => found.get(id) ?? { id, available: false, command: null, required: 'no' as const, source: null, origin: 'inferred' as const },\n  );\n}\n"]}
+{"version":3,"file":"commands.js","sourceRoot":"","sources":["../../src/discovery/commands.ts"],"names":[],"mappings":"AAGA,MAAM,CAAC,MAAM,UAAU,GACrB,6HAA6H;IAC7H,uGAAuG,CAAC;AAmB1G,mGAAmG;AACnG,MAAM,iBAAiB,GAA6B;IAClD,SAAS,EAAE,CAAC,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,KAAK,EAAE,OAAO,CAAC;IACrE,IAAI,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC;IAC/C,WAAW,EAAE,CAAC,kBAAkB,EAAE,UAAU,EAAE,aAAa,CAAC;IAC5D,GAAG,EAAE,CAAC,UAAU,EAAE,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,aAAa,CAAC;IAC1E,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,YAAY,CAAC;IACtC,MAAM,EAAE,CAAC,cAAc,EAAE,gBAAgB,EAAE,cAAc,EAAE,cAAc,CAAC;IAC1E,KAAK,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC;IAC3B,UAAU,EAAE,CAAC,YAAY,EAAE,SAAS,CAAC;IACrC,QAAQ,EAAE,CAAC,eAAe,EAAE,eAAe,EAAE,UAAU,EAAE,gBAAgB,CAAC;CAC3E,CAAC;AAEF,MAAM,QAAQ,GAA8C;IAC1D,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,KAAK;IACX,WAAW,EAAE,SAAS;IACtB,GAAG,EAAE,SAAS;IACd,IAAI,EAAE,KAAK;IACX,MAAM,EAAE,SAAS;IACjB,KAAK,EAAE,KAAK;IACZ,UAAU,EAAE,SAAS;IACrB,QAAQ,EAAE,SAAS;CACpB,CAAC;AAEF,MAAM,CAAC,MAAM,WAAW,GAAc,CAAC,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;AAEvI,SAAS,aAAa,CAAC,EAAU,EAAE,MAAc;IAC/C,IAAI,MAAM,KAAK,MAAM,IAAI,CAAC,EAAE,KAAK,KAAK,IAAI,EAAE,KAAK,MAAM,IAAI,EAAE,KAAK,MAAM,IAAI,EAAE,KAAK,KAAK,CAAC;QAAE,OAAO,GAAG,EAAE,OAAO,CAAC;IAC/G,IAAI,EAAE,KAAK,MAAM;QAAE,OAAO,QAAQ,MAAM,EAAE,CAAC;IAC3C,IAAI,EAAE,KAAK,KAAK;QAAE,OAAO,WAAW,MAAM,EAAE,CAAC;IAC7C,OAAO,GAAG,EAAE,QAAQ,MAAM,EAAE,CAAC;AAC/B,CAAC;AAED,2FAA2F;AAC3F,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;AAChE,CAAC;AAED,MAAM,KAAK,GAAG,CAAC,CAAe,EAAE,CAAe,EAAU,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;AAErG;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,KAAoB;IAChD,MAAM,KAAK,GAAmB,EAAE,CAAC;IACjC,MAAM,GAAG,GAAG,CAAC,EAAW,EAAE,OAAe,EAAE,MAAc,EAAE,MAA8B,EAAE,GAAY,EAAQ,EAAE;QAC/G,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;YACrE,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAChH,CAAC;IACH,CAAC,CAAC;IAEF,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC,cAAc,CAAC;QACpE,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC;YAC5D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,MAAM,IAAI,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBAClC,IAAI,IAAI,KAAK,SAAS,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC7C,GAAG,CAAC,EAAa,EAAE,aAAa,CAAC,EAAE,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,GAAG,QAAQ,YAAY,IAAI,EAAE,EAAE,mBAAmB,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;oBACvH,MAAM;gBACR,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,CAAC,WAAW,IAAI,EAAE,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,WAAW,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;YACxJ,GAAG,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,cAAc,KAAK,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,eAAe,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;QAC3J,CAAC;IACH,CAAC;IAED,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnC,MAAM,EAAE,GAAG,KAAK,CAAC,cAAc,CAAC;QAChC,MAAM,WAAW,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3F,IAAI,EAAE,CAAC,MAAM,IAAI,WAAW,IAAI,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC;YAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAC,MAAM,IAAI,QAAQ,EAAE,UAAU,CAAC,CAAC;QAClH,IAAI,EAAE,CAAC,IAAI;YAAE,GAAG,CAAC,MAAM,EAAE,cAAc,EAAE,EAAE,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAC9D,IAAI,EAAE,CAAC,IAAI;YAAE,GAAG,CAAC,WAAW,EAAE,QAAQ,EAAE,EAAE,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAC7D,IAAI,EAAE,CAAC,KAAK;YAAE,GAAG,CAAC,QAAQ,EAAE,iBAAiB,EAAE,EAAE,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QACrE,IAAI,EAAE,CAAC,OAAO;YAAE,GAAG,CAAC,YAAY,EAAE,eAAe,EAAE,EAAE,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;QACnD,GAAG,CAAC,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;QACrD,GAAG,CAAC,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;QACpD,GAAG,CAAC,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;QACtD,GAAG,CAAC,MAAM,EAAE,cAAc,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QACzB,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;QAC/C,GAAG,CAAC,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAC/D,GAAG,CAAC,MAAM,EAAE,aAAa,EAAE,cAAc,EAAE,UAAU,CAAC,CAAC;QACvD,GAAG,CAAC,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,UAAU,CAAC,CAAC;IAC3D,CAAC;IAED,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAuB;IAC/C,MAAM,GAAG,GAAmB,EAAE,CAAC;IAC/B,KAAK,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3E,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;aAClC,CAAC;YACJ,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YACrD,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;QACrH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAYD;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,QAA+B,EAAE,QAAwB,EAAE,OAAgC,EAAE;IACzH,MAAM,IAAI,GAAG,QAAQ,IAAI,EAAE,CAAC;IAC5B,MAAM,iBAAiB,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC9D,MAAM,UAAU,GAAG,iBAAiB,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC;IACtE,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,cAAc,GAAG,CAAC,CAAC;IACvB,MAAM,GAAG,GAAmB,EAAE,CAAC;IAE/B,KAAK,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC;QACnF,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC5C,MAAM,GAAG,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACzD,MAAM,MAAM,GAAmB,CAAC,GAAG,IAAI,CAAC,CAAC;QACzC,aAAa,IAAI,IAAI,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,KAAK,MAAM,CAAC,IAAI,GAAG;gBAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;oBAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9F,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,EAAE,CAAC;YACtC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC;YAC3D,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC;YACpB,cAAc,IAAI,GAAG,CAAC,MAAM,CAAC;QAC/B,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;aAClD,CAAC;YACJ,kHAAkH;YAClH,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAa,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAmB,EAAE,CAAC;YACrK,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,aAAa,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC;AACpE,CAAC","sourcesContent":["import type { CheckId, CommandEntry } from '../config/schemas.js';\nimport type { PackageInfo } from './detect.js';\n\nexport const TRUST_NOTE =\n  'Commands marked \"repository-script\" come from files in the repository (e.g. package.json scripts) and are untrusted input. ' +\n  'Inspect what a script does before running it, especially in automation or on unfamiliar repositories.';\n\n/** One Node.js package: the manifest, where it lives, and which package manager its own lockfile says it uses. */\nexport interface NodePackageInput {\n  /** Directory relative to the project root, POSIX separators; '' for the root. */\n  dir: string;\n  pkg: PackageInfo;\n  packageManager: string;\n  hasTsconfig: boolean;\n}\n\nexport interface ContractInput {\n  nodePackages: NodePackageInput[];\n  ecosystems: Set<string>;\n  has: (rel: string) => boolean;\n  pythonEvidence: Record<string, string>;\n  files: Set<string>;\n}\n\n/** First match wins, so more specific scripts (test:unit) are preferred over catch-alls (test). */\nconst SCRIPT_CANDIDATES: Record<string, string[]> = {\n  typecheck: ['typecheck', 'type-check', 'check-types', 'tsc', 'types'],\n  unit: ['test:unit', 'unit', 'test', 'test:run'],\n  integration: ['test:integration', 'test:int', 'integration'],\n  e2e: ['test:e2e', 'e2e', 'test:playwright', 'test:cypress', 'cypress:run'],\n  lint: ['lint', 'eslint', 'lint:check'],\n  format: ['format:check', 'prettier:check', 'format-check', 'check:format'],\n  build: ['build', 'compile'],\n  migrations: ['db:migrate', 'migrate'],\n  security: ['test:security', 'security:test', 'security', 'audit:security'],\n};\n\nconst REQUIRED: Record<CheckId, CommandEntry['required']> = {\n  typecheck: 'yes',\n  unit: 'yes',\n  integration: 'context',\n  e2e: 'context',\n  lint: 'yes',\n  format: 'context',\n  build: 'yes',\n  migrations: 'context',\n  security: 'context',\n};\n\nexport const CHECK_ORDER: CheckId[] = ['typecheck', 'unit', 'integration', 'e2e', 'lint', 'format', 'build', 'migrations', 'security'];\n\nfunction scriptCommand(pm: string, script: string): string {\n  if (script === 'test' && (pm === 'npm' || pm === 'pnpm' || pm === 'yarn' || pm === 'bun')) return `${pm} test`;\n  if (pm === 'yarn') return `yarn ${script}`;\n  if (pm === 'bun') return `bun run ${script}`;\n  return `${pm} run ${script}`;\n}\n\n/** Placeholder scripts such as npm's default \"no test specified\" do not count as tests. */\nfunction isRealScript(body: string): boolean {\n  return !/no test specified/i.test(body) && body.trim() !== '';\n}\n\nconst byCwd = (a: CommandEntry, b: CommandEntry): number => (a.cwd ?? '').localeCompare(b.cwd ?? '');\n\n/**\n * Detected verification commands. Node commands are produced per package and only for scripts that exist in that\n * package's own manifest. Every check that no package provides gets one unavailable entry so the contract always\n * lists all nine checks.\n */\nexport function buildContract(input: ContractInput): CommandEntry[] {\n  const found: CommandEntry[] = [];\n  const add = (id: CheckId, command: string, source: string, origin: CommandEntry['origin'], cwd?: string): void => {\n    if (!found.some((f) => f.id === id && (f.cwd ?? '') === (cwd ?? ''))) {\n      found.push({ id, available: true, command, required: REQUIRED[id], source, origin, ...(cwd ? { cwd } : {}) });\n    }\n  };\n\n  for (const np of input.nodePackages) {\n    const manifest = np.dir ? `${np.dir}/package.json` : 'package.json';\n    for (const [id, names] of Object.entries(SCRIPT_CANDIDATES)) {\n      for (const name of names) {\n        const body = np.pkg.scripts[name];\n        if (body !== undefined && isRealScript(body)) {\n          add(id as CheckId, scriptCommand(np.packageManager, name), `${manifest}#scripts.${name}`, 'repository-script', np.dir);\n          break;\n        }\n      }\n    }\n    if (np.pkg.scripts.typecheck === undefined && np.hasTsconfig && np.pkg.hasTypes && !found.some((f) => f.id === 'typecheck' && (f.cwd ?? '') === np.dir)) {\n      add('typecheck', `${np.packageManager === 'pnpm' ? 'pnpm exec' : 'npx'} tsc --noEmit`, `${np.dir ? `${np.dir}/` : ''}tsconfig.json`, 'inferred', np.dir);\n    }\n  }\n\n  if (input.ecosystems.has('python')) {\n    const ev = input.pythonEvidence;\n    const hasTestsDir = [...input.files].some((f) => /^tests?\\//.test(f) && f.endsWith('.py'));\n    if (ev.pytest || hasTestsDir || input.has('pytest.ini')) add('unit', 'pytest', ev.pytest ?? 'tests/', 'inferred');\n    if (ev.ruff) add('lint', 'ruff check .', ev.ruff, 'inferred');\n    if (ev.mypy) add('typecheck', 'mypy .', ev.mypy, 'inferred');\n    if (ev.black) add('format', 'black --check .', ev.black, 'inferred');\n    if (ev.alembic) add('migrations', 'alembic check', ev.alembic, 'inferred');\n  }\n  if (input.ecosystems.has('go')) {\n    add('unit', 'go test ./...', 'go.mod', 'inferred');\n    add('build', 'go build ./...', 'go.mod', 'inferred');\n    add('lint', 'go vet ./...', 'go.mod', 'inferred');\n  }\n  if (input.ecosystems.has('rust')) {\n    add('unit', 'cargo test', 'Cargo.toml', 'inferred');\n    add('build', 'cargo build', 'Cargo.toml', 'inferred');\n    add('lint', 'cargo clippy', 'Cargo.toml', 'inferred');\n  }\n  if (input.has('pom.xml')) {\n    add('unit', 'mvn test', 'pom.xml', 'inferred');\n    add('build', 'mvn package', 'pom.xml', 'inferred');\n  }\n  if (input.has('build.gradle') || input.has('build.gradle.kts')) {\n    add('unit', 'gradle test', 'build.gradle', 'inferred');\n    add('build', 'gradle build', 'build.gradle', 'inferred');\n  }\n\n  return withPlaceholders(found);\n}\n\nfunction withPlaceholders(entries: CommandEntry[]): CommandEntry[] {\n  const out: CommandEntry[] = [];\n  for (const id of CHECK_ORDER) {\n    const mine = entries.filter((e) => e.id === id && e.available).sort(byCwd);\n    if (mine.length > 0) out.push(...mine);\n    else {\n      const unavailable = entries.find((e) => e.id === id);\n      out.push(unavailable ?? { id, available: false, command: null, required: 'no', source: null, origin: 'inferred' });\n    }\n  }\n  return out;\n}\n\nexport interface MergeResult {\n  checks: CommandEntry[];\n  /** Entries kept from the previous contract because a human confirmed them (origin \"user\"). */\n  preservedUser: number;\n  /** Previously detected entries kept because this analysis found nothing or was cut short. */\n  preservedStale: number;\n  /** The new detection found no verification commands at all, or the scan was truncated. */\n  incomplete: boolean;\n}\n\n/**\n * Combine the previous contract with fresh detection.\n *  - Entries confirmed by a person (origin \"user\") are never dropped or overwritten. A user entry without a cwd\n *    covers its whole check; one with a cwd covers only that directory, and detection fills in the other packages.\n *  - If detection is incomplete, previously available entries survive too, with their original provenance.\n */\nexport function mergeContract(previous: CommandEntry[] | null, detected: CommandEntry[], opts: { truncated?: boolean } = {}): MergeResult {\n  const prev = previous ?? [];\n  const detectedAvailable = detected.filter((d) => d.available);\n  const incomplete = detectedAvailable.length === 0 || !!opts.truncated;\n  let preservedUser = 0;\n  let preservedStale = 0;\n  const out: CommandEntry[] = [];\n\n  for (const id of CHECK_ORDER) {\n    const user = prev.filter((p) => p.id === id && p.origin === 'user' && p.available);\n    const globalUser = user.some((u) => !u.cwd);\n    const det = detectedAvailable.filter((d) => d.id === id);\n    const chosen: CommandEntry[] = [...user];\n    preservedUser += user.length;\n    if (!globalUser) {\n      for (const d of det) if (!user.some((u) => (u.cwd ?? '') === (d.cwd ?? ''))) chosen.push(d);\n    }\n    if (chosen.length === 0 && incomplete) {\n      const old = prev.filter((p) => p.id === id && p.available);\n      chosen.push(...old);\n      preservedStale += old.length;\n    }\n    if (chosen.length > 0) out.push(...chosen.sort(byCwd));\n    else {\n      // nothing confirmed, nothing detected: list the check as unavailable so the contract always names all nine checks\n      const unavailable = detected.find((d) => d.id === id) ?? { id, available: false, command: null, required: 'no' as const, source: null, origin: 'inferred' as const };\n      out.push(unavailable);\n    }\n  }\n  return { checks: out, preservedUser, preservedStale, incomplete };\n}\n"]}

package/dist/discovery/detect.d.ts

@@ -1,4 +1,5 @@
 import type { ScanResult } from './scan.js';
+import { type NodePackageInput } from './commands.js';
 import type { CommandEntry } from '../config/schemas.js';
 export interface Detected {
     name: string;
@@ -10,6 +11,7 @@ export interface SubProject {
     name: string;
     ecosystem: string;
     frameworks: string[];
+    packageManager?: string;
 }
 export interface PackageInfo {
     rel: string;
@@ -49,6 +51,8 @@ export interface DiscoveryReport {
         packages: SubProject[];
     };
     commands: CommandEntry[];
+    /** Recognised package manifests (project-relative). Used as evidence for derived facts. */
+    manifests: string[];
     testConfigs: string[];
     ci: string[];
     docker: string[];
@@ -69,4 +73,17 @@ export interface DetectInput {
     projectName: string;
     scan: ScanResult;
 }
+export interface FoundNodePackage extends NodePackageInput {
+    manifest: string;
+    /** Where the package manager came from, for transparency in discovery.json consumers. */
+    pmSource: 'lockfile' | 'packageManager field' | 'inherited from root' | 'default';
+}
+/**
+ * Find every Node.js package, not just the root one. Each package gets its own package manager from its own lockfile
+ * (falling back to the packageManager field, then the root lockfile, then npm). No script is ever executed.
+ */
+export declare function discoverNodePackages(root: string, files: Set<string>): Promise<{
+    packages: FoundNodePackage[];
+    unparsable: string[];
+}>;
 export declare function detectProject(input: DetectInput): Promise<DiscoveryReport>;

package/dist/discovery/detect.js

@@ -221,6 +221,71 @@ function languagesFrom(byExt) {
     }
     return [...acc.entries()].map(([name, files]) => ({ name, files })).sort((a, b) => b.files - a.files || a.name.localeCompare(b.name));
 }
+const LOCKFILES = [
+    ['pnpm-lock.yaml', 'pnpm'],
+    ['yarn.lock', 'yarn'],
+    ['bun.lockb', 'bun'],
+    ['bun.lock', 'bun'],
+    ['package-lock.json', 'npm'],
+    ['npm-shrinkwrap.json', 'npm'],
+];
+const MAX_NODE_PACKAGES = 200;
+const MAX_MANIFEST_DEPTH = 5;
+/** A package.json that only sets {"type":"module"} (a marker file) is not a package. */
+function isRealManifest(p) {
+    return !!p.name || Object.keys(p.scripts).length > 0 || Object.keys(p.deps).length > 0 || p.workspaces.length > 0;
+}
+function lockfilePm(files, dir) {
+    for (const [lock, pm] of LOCKFILES)
+        if (files.has(dir ? `${dir}/${lock}` : lock))
+            return pm;
+    return null;
+}
+/**
+ * Find every Node.js package, not just the root one. Each package gets its own package manager from its own lockfile
+ * (falling back to the packageManager field, then the root lockfile, then npm). No script is ever executed.
+ */
+export async function discoverNodePackages(root, files) {
+    const manifests = [...files]
+        .filter((f) => path.posix.basename(f) === 'package.json' && !isAuxPath(f) && f.split('/').length <= MAX_MANIFEST_DEPTH)
+        .sort((a, b) => a.split('/').length - b.split('/').length || a.localeCompare(b))
+        .slice(0, MAX_NODE_PACKAGES);
+    const rootLockPm = lockfilePm(files, '');
+    const packages = [];
+    const unparsable = [];
+    for (const manifest of manifests) {
+        const pkg = await readPackageJson(root, manifest);
+        if (!pkg) {
+            unparsable.push(manifest);
+            continue;
+        }
+        if (!isRealManifest(pkg))
+            continue;
+        const dir = path.posix.dirname(manifest) === '.' ? '' : path.posix.dirname(manifest);
+        const own = lockfilePm(files, dir);
+        const field = pkg.packageManagerField?.split('@')[0] ?? null;
+        let packageManager;
+        let pmSource;
+        if (own) {
+            packageManager = own;
+            pmSource = 'lockfile';
+        }
+        else if (field) {
+            packageManager = field;
+            pmSource = 'packageManager field';
+        }
+        else if (rootLockPm && dir !== '') {
+            packageManager = rootLockPm;
+            pmSource = 'inherited from root';
+        }
+        else {
+            packageManager = 'npm';
+            pmSource = 'default';
+        }
+        packages.push({ dir, pkg, packageManager, hasTsconfig: files.has(dir ? `${dir}/tsconfig.json` : 'tsconfig.json'), manifest, pmSource });
+    }
+    return { packages, unparsable };
+}
 export async function detectProject(input) {
     const { root, scan } = input;
     const files = scan.files;
@@ -232,27 +297,23 @@ export async function detectProject(input) {
         if (!frameworks.has(d.name))
             frameworks.set(d.name, d);
     };
-    // Node / JS
-    const rootPkg = has('package.json') ? await readPackageJson(root, 'package.json') : null;
-    if (has('package.json') && !rootPkg)
-        warnings.push('package.json exists but could not be parsed.');
-    if (rootPkg) {
+    // Node / JS: every package.json, not only the one at the root
+    const { packages: nodePkgs, unparsable } = await discoverNodePackages(root, files);
+    for (const m of unparsable.slice(0, 5))
+        warnings.push(`${m} exists but could not be parsed.`);
+    const rootNode = nodePkgs.find((p) => p.dir === '');
+    const rootPkg = rootNode?.pkg ?? null;
+    if (nodePkgs.length > 0) {
         ecosystems.add('node');
-        nodeFrameworks(rootPkg).forEach(addFw);
+        for (const p of nodePkgs)
+            nodeFrameworks(p.pkg).forEach(addFw);
     }
     let packageManager = null;
-    if (has('pnpm-lock.yaml'))
-        packageManager = 'pnpm';
-    else if (has('yarn.lock'))
-        packageManager = 'yarn';
-    else if (has('bun.lockb') || has('bun.lock'))
-        packageManager = 'bun';
-    else if (has('package-lock.json') || has('npm-shrinkwrap.json'))
-        packageManager = 'npm';
-    else if (rootPkg?.packageManagerField)
-        packageManager = rootPkg.packageManagerField.split('@')[0] ?? null;
-    else if (rootPkg)
-        packageManager = 'npm';
+    const pms = [...new Set(nodePkgs.map((p) => p.packageManager))].sort();
+    if (pms.length === 1)
+        packageManager = pms[0];
+    else if (pms.length > 1)
+        packageManager = `mixed (${pms.join(', ')})`;
     // Python
     const py = await pythonText(root, scan);
     const hasPy = has('pyproject.toml') || has('requirements.txt') || has('Pipfile') || has('setup.py') || [...files].some((f) => f.endsWith('.py') && !isAuxPath(f));
@@ -301,7 +362,7 @@ export async function detectProject(input) {
         workspacePatterns = parseWorkspaceYaml((await safeReadText(root, 'pnpm-workspace.yaml', 64 * 1024).catch(() => null)) ?? '');
     }
     else if (rootPkg && rootPkg.workspaces.length > 0) {
-        monoTool = packageManager === 'yarn' ? 'yarn-workspaces' : 'npm-workspaces';
+        monoTool = rootNode?.packageManager === 'yarn' ? 'yarn-workspaces' : 'npm-workspaces';
         workspacePatterns = rootPkg.workspaces;
     }
     else if (has('lerna.json'))
@@ -321,28 +382,19 @@ export async function detectProject(input) {
     else if (has('go.work'))
         monoTool = 'go-work';
     const packages = [];
-    if (monoTool) {
-        if (workspacePatterns.length === 0 && (monoTool === 'lerna' || monoTool === 'nx' || monoTool === 'turborepo')) {
-            workspacePatterns = ['packages/*', 'apps/*', 'libs/*'];
-        }
-        const dirs = expandWorkspaceGlobs(workspacePatterns, files, manifest).slice(0, 100);
-        for (const d of dirs) {
-            if (manifest === 'package.json') {
-                const p = await readPackageJson(root, `${d}/package.json`);
-                packages.push({
-                    path: d,
-                    name: p?.name ?? path.posix.basename(d),
-                    ecosystem: 'node',
-                    frameworks: p ? nodeFrameworks(p).map((f) => f.name) : [],
-                });
-                if (p)
-                    nodeFrameworks(p).forEach(addFw);
-            }
-            else {
-                packages.push({ path: d, name: path.posix.basename(d), ecosystem: 'rust', frameworks: [] });
-            }
+    for (const p of nodePkgs) {
+        if (p.dir === '')
+            continue;
+        packages.push({ path: p.dir, name: p.pkg.name ?? path.posix.basename(p.dir), ecosystem: 'node', frameworks: nodeFrameworks(p.pkg).map((f) => f.name), packageManager: p.packageManager });
+    }
+    if (monoTool === 'cargo-workspace') {
+        for (const d of expandWorkspaceGlobs(workspacePatterns, files, manifest).slice(0, 100)) {
+            packages.push({ path: d, name: path.posix.basename(d), ecosystem: 'rust', frameworks: [] });
         }
     }
+    // Several packages without any workspace tooling (e.g. backend/ + frontend/ and no root package.json) is still one repository of many packages.
+    if (!monoTool && nodePkgs.length >= 2)
+        monoTool = 'multi-package';
     const testConfigs = [...files].filter((f) => TEST_CONFIG_RE.test(f) && f.split('/').length <= 4 && !isAuxPath(f)).sort().slice(0, 30);
     const ci = [
         ...[...files].filter((f) => f.startsWith('.github/workflows/')),
@@ -377,13 +429,19 @@ export async function detectProject(input) {
             entryHints.push(cand);
     }
     const commands = buildContract({
-        pkg: rootPkg,
-        packageManager,
+        nodePackages: nodePkgs,
         ecosystems,
         has,
         pythonEvidence: py.evidence,
         files,
     });
+    const languages = languagesFrom(scan.byExtension).slice(0, 12);
+    if (ecosystems.size === 0 && languages.length > 0) {
+        warnings.push(`No ecosystem was recognised although source files were found (${languages.slice(0, 3).map((l) => l.name).join(', ')}). Package manifests may be missing or unsupported; record verification commands by hand in .devworkspace/context/commands.json.`);
+    }
+    if (ecosystems.size > 0 && !commands.some((c) => c.available)) {
+        warnings.push('No verification commands (tests, lint, typecheck, build) were found in the package manifests.');
+    }
     if (scan.truncated)
         warnings.push('Scan hit its file or depth limit; discovery is partial.');
     if (scan.sensitiveFiles.length > 0)
@@ -400,13 +458,14 @@ export async function detectProject(input) {
             skippedSymlinks: scan.skippedSymlinks,
             ignoredEntries: scan.ignoredEntries,
         },
-        languages: languagesFrom(scan.byExtension).slice(0, 12),
+        languages,
         topDirs: scan.topDirs,
         ecosystems: [...ecosystems].sort(),
         packageManager,
         frameworks: [...frameworks.values()].sort((a, b) => a.name.localeCompare(b.name)),
         monorepo: { tool: monoTool, packages },
         commands,
+        manifests: [...nodePkgs.map((p) => p.manifest), ...['pyproject.toml', 'requirements.txt', 'Pipfile', 'go.mod', 'Cargo.toml', 'pom.xml', 'build.gradle', 'build.gradle.kts', 'composer.json', 'Gemfile'].filter(has)].sort(),
         testConfigs,
         ci,
         docker,