devworkspace 0.2.0 → 0.2.2

package/dist/config/schemas.d.ts

@@ -21,7 +21,8 @@ export interface ProjectConfig {
     devworkspaceVersion: string;
     settings: {
         review: ReviewLevel;
-        maxFiles: number;
+        maxFiles: number; /** The project intentionally has no tests/lint/build; doctor stops warning about it. */
+        acknowledgeNoVerification?: boolean;
     };
     managedFiles: ManagedFile[];
 }
@@ -57,6 +58,16 @@ export interface CommandEntry {
     source: string | null;
     /** 'repository-script' = defined by repo config (untrusted input); 'inferred' = guessed from tooling; 'user' = set by a human. */
     origin: 'repository-script' | 'inferred' | 'user';
+    /**
+     * Working directory, relative to the project root (POSIX separators). Absent means the project root.
+     * Package-specific commands (backend vs frontend) must carry it so they are never run in the wrong place.
+     */
+    cwd?: string;
+    /**
+     * True when running the command rewrites project files (a formatter, a fixer). Absent means read-only or unknown.
+     * DevWorkspace never runs a mutating command on its own.
+     */
+    mutates?: boolean;
 }
 export interface CommandsFile {
     schemaVersion: number;

package/dist/config/schemas.js

@@ -1,3 +1,5 @@
+import { DevWorkspaceError } from '../errors/index.js';
+import { validateRelativePath } from '../utils/paths.js';
 import { Check } from './validate.js';
 export const SCHEMA_VERSION = 1;
 export const CONFIDENCE = ['HIGH', 'MEDIUM', 'LOW'];
@@ -16,6 +18,8 @@ export function validateProject(v, file = 'project.json') {
     const s = c.at_('settings').obj(o.settings);
     c.at_('settings.review').oneOf(s.review, REVIEW_LEVELS);
     c.at_('settings.maxFiles').int(s.maxFiles, 100);
+    if (s.acknowledgeNoVerification !== undefined)
+        c.at_('settings.acknowledgeNoVerification').bool(s.acknowledgeNoVerification);
     const mf = c.at_('managedFiles').arr(o.managedFiles, 200);
     mf.forEach((m, i) => {
         const mc = c.at_(`managedFiles.${i}`);
@@ -67,6 +71,14 @@ export function validateCommands(v, file = 'commands.json') {
             ec.at_('command').str(eo.command, { max: 500 });
         ec.at_('required').oneOf(eo.required, REQUIRED_LEVELS);
         ec.at_('origin').oneOf(eo.origin, ['repository-script', 'inferred', 'user']);
+        if (eo.mutates !== undefined)
+            ec.at_('mutates').bool(eo.mutates);
+        if (eo.cwd !== undefined) {
+            const cwd = ec.at_('cwd').str(eo.cwd, { max: 240 });
+            const err = validateRelativePath(cwd);
+            if (err)
+                throw new DevWorkspaceError('SCHEMA', `Invalid ${file}: checks.${i}.cwd ${err}.`);
+        }
     });
     return o;
 }

package/dist/config/schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../../src/config/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAEtC,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC;AAEhC,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAU,CAAC;AAC7D,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,SAAS,EAAE,OAAO,CAAU,CAAC;AAC9G,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAU,CAAC;AAC/E,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAU,CAAC;AAwBjE,MAAM,UAAU,eAAe,CAAC,CAAU,EAAE,IAAI,GAAG,cAAc;IAC/D,MAAM,CAAC,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;IAC/C,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;IACzD,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;IAChD,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACpC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACpC,CAAC,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,mBAAmB,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;IACrE,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACxD,CAAC,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAChD,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;IAC1D,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QAClB,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;QACtC,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACrB,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;QAC1C,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,SAAS,CAAU,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IACH,OAAO,CAA6B,CAAC;AACvC,CAAC;AAuBD,MAAM,UAAU,aAAa,CAAC,CAAU,EAAE,IAAI,GAAG,YAAY;IAC3D,MAAM,CAAC,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAChD,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACrB,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC/B,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACrB,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;QACrC,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;QAChD,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7C,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;QAC9C,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QACxD,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC1C,EAAE,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC;QAC5C,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QACtD,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAC/C,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;QACtC,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;QACtC,IAAI,EAAE,CAAC,cAAc,KAAK,IAAI;YAAE,EAAE,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;IACH,OAAO,CAAyB,CAAC;AACnC,CAAC;AAED,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE,UAAU,CAAU,CAAC;AAEnI,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,CAAU,CAAC;AAkBjE,MAAM,UAAU,gBAAgB,CAAC,CAAU,EAAE,IAAI,GAAG,eAAe;IACjE,MAAM,CAAC,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;IAC/C,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACpC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;SACZ,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC;SAClB,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QAChB,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAChC,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACrB,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;QACrC,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;QACvC,IAAI,EAAE,CAAC,OAAO,KAAK,IAAI;YAAE,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;QACzE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;QACvD,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,mBAAmB,EAAE,UAAU,EAAE,MAAM,CAAU,CAAC,CAAC;IACxF,CAAC,CAAC,CAAC;IACL,OAAO,CAA4B,CAAC;AACtC,CAAC;AAYD,MAAM,UAAU,qBAAqB,CAAC,CAAU,EAAE,IAAI,GAAG,eAAe;IACtE,MAAM,CAAC,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;IAC/C,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IACtC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACpC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACrC,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1D,OAAO,CAA6B,CAAC;AACvC,CAAC","sourcesContent":["import { Check } from './validate.js';\n\nexport const SCHEMA_VERSION = 1;\n\nexport const CONFIDENCE = ['HIGH', 'MEDIUM', 'LOW'] as const;\nexport const FACT_STATUS = ['VERIFIED', 'DETECTED', 'INFERRED', 'USER_DECISION', 'UNKNOWN', 'STALE'] as const;\nexport const SOURCE_TYPES = ['detector', 'file', 'git', 'user', 'ai'] as const;\nexport const REVIEW_LEVELS = ['off', 'light', 'strict'] as const;\n\nexport type Confidence = (typeof CONFIDENCE)[number];\nexport type FactStatus = (typeof FACT_STATUS)[number];\nexport type SourceType = (typeof SOURCE_TYPES)[number];\nexport type ReviewLevel = (typeof REVIEW_LEVELS)[number];\n\nexport interface ManagedFile {\n  path: string;\n  mode: 'owned' | 'section';\n  agent?: string;\n}\n\nexport interface ProjectConfig {\n  schemaVersion: number;\n  projectId: string;\n  name: string;\n  createdAt: string;\n  updatedAt: string;\n  devworkspaceVersion: string;\n  settings: { review: ReviewLevel; maxFiles: number };\n  managedFiles: ManagedFile[];\n}\n\nexport function validateProject(v: unknown, file = 'project.json'): ProjectConfig {\n  const c = new Check(file);\n  const o = c.obj(v);\n  c.at_('schemaVersion').int(o.schemaVersion, 1);\n  c.at_('projectId').str(o.projectId, { min: 8, max: 64 });\n  c.at_('name').str(o.name, { min: 1, max: 200 });\n  c.at_('createdAt').iso(o.createdAt);\n  c.at_('updatedAt').iso(o.updatedAt);\n  c.at_('devworkspaceVersion').str(o.devworkspaceVersion, { max: 40 });\n  const s = c.at_('settings').obj(o.settings);\n  c.at_('settings.review').oneOf(s.review, REVIEW_LEVELS);\n  c.at_('settings.maxFiles').int(s.maxFiles, 100);\n  const mf = c.at_('managedFiles').arr(o.managedFiles, 200);\n  mf.forEach((m, i) => {\n    const mc = c.at_(`managedFiles.${i}`);\n    const mo = mc.obj(m);\n    mc.at_('path').str(mo.path, { max: 240 });\n    mc.at_('mode').oneOf(mo.mode, ['owned', 'section'] as const);\n  });\n  return o as unknown as ProjectConfig;\n}\n\nexport interface Fact {\n  id: string;\n  key: string;\n  value: string;\n  source: string;\n  sourceType: SourceType;\n  sources: string[];\n  sourceHashes: Record<string, string>;\n  confidence: Confidence;\n  status: FactStatus;\n  createdAt: string;\n  updatedAt: string;\n  lastVerifiedAt: string | null;\n  staleReason?: string;\n}\n\nexport interface FactsFile {\n  schemaVersion: number;\n  facts: Fact[];\n}\n\nexport function validateFacts(v: unknown, file = 'facts.json'): FactsFile {\n  const c = new Check(file);\n  const o = c.obj(v);\n  c.at_('schemaVersion').int(o.schemaVersion, 1);\n  const facts = c.at_('facts').arr(o.facts, 5000);\n  facts.forEach((f, i) => {\n    const fc = c.at_(`facts.${i}`);\n    const fo = fc.obj(f);\n    fc.at_('id').str(fo.id, { max: 64 });\n    fc.at_('key').str(fo.key, { min: 1, max: 100 });\n    fc.at_('value').str(fo.value, { max: 4000 });\n    fc.at_('source').str(fo.source, { max: 500 });\n    fc.at_('sourceType').oneOf(fo.sourceType, SOURCE_TYPES);\n    fc.at_('sources').strArr(fo.sources, 100);\n    fc.at_('sourceHashes').obj(fo.sourceHashes);\n    fc.at_('confidence').oneOf(fo.confidence, CONFIDENCE);\n    fc.at_('status').oneOf(fo.status, FACT_STATUS);\n    fc.at_('createdAt').iso(fo.createdAt);\n    fc.at_('updatedAt').iso(fo.updatedAt);\n    if (fo.lastVerifiedAt !== null) fc.at_('lastVerifiedAt').iso(fo.lastVerifiedAt);\n  });\n  return o as unknown as FactsFile;\n}\n\nexport const CHECK_IDS = ['typecheck', 'unit', 'integration', 'e2e', 'lint', 'format', 'build', 'migrations', 'security'] as const;\nexport type CheckId = (typeof CHECK_IDS)[number];\nexport const REQUIRED_LEVELS = ['yes', 'context', 'no'] as const;\n\nexport interface CommandEntry {\n  id: CheckId;\n  available: boolean;\n  command: string | null;\n  required: (typeof REQUIRED_LEVELS)[number];\n  source: string | null;\n  /** 'repository-script' = defined by repo config (untrusted input); 'inferred' = guessed from tooling; 'user' = set by a human. */\n  origin: 'repository-script' | 'inferred' | 'user';\n}\n\nexport interface CommandsFile {\n  schemaVersion: number;\n  checks: CommandEntry[];\n  trustNote: string;\n}\n\nexport function validateCommands(v: unknown, file = 'commands.json'): CommandsFile {\n  const c = new Check(file);\n  const o = c.obj(v);\n  c.at_('schemaVersion').int(o.schemaVersion, 1);\n  c.at_('trustNote').str(o.trustNote);\n  c.at_('checks')\n    .arr(o.checks, 100)\n    .forEach((e, i) => {\n      const ec = c.at_(`checks.${i}`);\n      const eo = ec.obj(e);\n      ec.at_('id').oneOf(eo.id, CHECK_IDS);\n      ec.at_('available').bool(eo.available);\n      if (eo.command !== null) ec.at_('command').str(eo.command, { max: 500 });\n      ec.at_('required').oneOf(eo.required, REQUIRED_LEVELS);\n      ec.at_('origin').oneOf(eo.origin, ['repository-script', 'inferred', 'user'] as const);\n    });\n  return o as unknown as CommandsFile;\n}\n\nexport interface AnalysisState {\n  schemaVersion: number;\n  analyzedAt: string;\n  refreshedAt: string | null;\n  gitHead: string | null;\n  fileCount: number;\n  truncated: boolean;\n  discoveryHash: string;\n}\n\nexport function validateAnalysisState(v: unknown, file = 'analysis.json'): AnalysisState {\n  const c = new Check(file);\n  const o = c.obj(v);\n  c.at_('schemaVersion').int(o.schemaVersion, 1);\n  c.at_('analyzedAt').iso(o.analyzedAt);\n  c.at_('fileCount').int(o.fileCount);\n  c.at_('truncated').bool(o.truncated);\n  c.at_('discoveryHash').str(o.discoveryHash, { max: 100 });\n  return o as unknown as AnalysisState;\n}\n"]}
+{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../../src/config/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAEtC,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC;AAEhC,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAU,CAAC;AAC7D,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,SAAS,EAAE,OAAO,CAAU,CAAC;AAC9G,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAU,CAAC;AAC/E,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAU,CAAC;AAwBjE,MAAM,UAAU,eAAe,CAAC,CAAU,EAAE,IAAI,GAAG,cAAc;IAC/D,MAAM,CAAC,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;IAC/C,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;IACzD,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;IAChD,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACpC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACpC,CAAC,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,mBAAmB,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;IACrE,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACxD,CAAC,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAChD,IAAI,CAAC,CAAC,yBAAyB,KAAK,SAAS;QAAE,CAAC,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC;IAC7H,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;IAC1D,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QAClB,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;QACtC,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACrB,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;QAC1C,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,SAAS,CAAU,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IACH,OAAO,CAA6B,CAAC;AACvC,CAAC;AAuBD,MAAM,UAAU,aAAa,CAAC,CAAU,EAAE,IAAI,GAAG,YAAY;IAC3D,MAAM,CAAC,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAChD,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACrB,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC/B,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACrB,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;QACrC,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;QAChD,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7C,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;QAC9C,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QACxD,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC1C,EAAE,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC;QAC5C,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QACtD,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAC/C,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;QACtC,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;QACtC,IAAI,EAAE,CAAC,cAAc,KAAK,IAAI;YAAE,EAAE,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;IACH,OAAO,CAAyB,CAAC;AACnC,CAAC;AAED,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE,UAAU,CAAU,CAAC;AAEnI,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,CAAU,CAAC;AA4BjE,MAAM,UAAU,gBAAgB,CAAC,CAAU,EAAE,IAAI,GAAG,eAAe;IACjE,MAAM,CAAC,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;IAC/C,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACpC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;SACZ,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC;SAClB,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QAChB,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAChC,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACrB,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;QACrC,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;QACvC,IAAI,EAAE,CAAC,OAAO,KAAK,IAAI;YAAE,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;QACzE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;QACvD,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,mBAAmB,EAAE,UAAU,EAAE,MAAM,CAAU,CAAC,CAAC;QACtF,IAAI,EAAE,CAAC,OAAO,KAAK,SAAS;YAAE,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;QACjE,IAAI,EAAE,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;YACpD,MAAM,GAAG,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;YACtC,IAAI,GAAG;gBAAE,MAAM,IAAI,iBAAiB,CAAC,QAAQ,EAAE,WAAW,IAAI,YAAY,CAAC,QAAQ,GAAG,GAAG,CAAC,CAAC;QAC7F,CAAC;IACH,CAAC,CAAC,CAAC;IACL,OAAO,CAA4B,CAAC;AACtC,CAAC;AAYD,MAAM,UAAU,qBAAqB,CAAC,CAAU,EAAE,IAAI,GAAG,eAAe;IACtE,MAAM,CAAC,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;IAC/C,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IACtC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACpC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACrC,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1D,OAAO,CAA6B,CAAC;AACvC,CAAC","sourcesContent":["import { DevWorkspaceError } from '../errors/index.js';\nimport { validateRelativePath } from '../utils/paths.js';\nimport { Check } from './validate.js';\n\nexport const SCHEMA_VERSION = 1;\n\nexport const CONFIDENCE = ['HIGH', 'MEDIUM', 'LOW'] as const;\nexport const FACT_STATUS = ['VERIFIED', 'DETECTED', 'INFERRED', 'USER_DECISION', 'UNKNOWN', 'STALE'] as const;\nexport const SOURCE_TYPES = ['detector', 'file', 'git', 'user', 'ai'] as const;\nexport const REVIEW_LEVELS = ['off', 'light', 'strict'] as const;\n\nexport type Confidence = (typeof CONFIDENCE)[number];\nexport type FactStatus = (typeof FACT_STATUS)[number];\nexport type SourceType = (typeof SOURCE_TYPES)[number];\nexport type ReviewLevel = (typeof REVIEW_LEVELS)[number];\n\nexport interface ManagedFile {\n  path: string;\n  mode: 'owned' | 'section';\n  agent?: string;\n}\n\nexport interface ProjectConfig {\n  schemaVersion: number;\n  projectId: string;\n  name: string;\n  createdAt: string;\n  updatedAt: string;\n  devworkspaceVersion: string;\n  settings: { review: ReviewLevel; maxFiles: number; /** The project intentionally has no tests/lint/build; doctor stops warning about it. */ acknowledgeNoVerification?: boolean };\n  managedFiles: ManagedFile[];\n}\n\nexport function validateProject(v: unknown, file = 'project.json'): ProjectConfig {\n  const c = new Check(file);\n  const o = c.obj(v);\n  c.at_('schemaVersion').int(o.schemaVersion, 1);\n  c.at_('projectId').str(o.projectId, { min: 8, max: 64 });\n  c.at_('name').str(o.name, { min: 1, max: 200 });\n  c.at_('createdAt').iso(o.createdAt);\n  c.at_('updatedAt').iso(o.updatedAt);\n  c.at_('devworkspaceVersion').str(o.devworkspaceVersion, { max: 40 });\n  const s = c.at_('settings').obj(o.settings);\n  c.at_('settings.review').oneOf(s.review, REVIEW_LEVELS);\n  c.at_('settings.maxFiles').int(s.maxFiles, 100);\n  if (s.acknowledgeNoVerification !== undefined) c.at_('settings.acknowledgeNoVerification').bool(s.acknowledgeNoVerification);\n  const mf = c.at_('managedFiles').arr(o.managedFiles, 200);\n  mf.forEach((m, i) => {\n    const mc = c.at_(`managedFiles.${i}`);\n    const mo = mc.obj(m);\n    mc.at_('path').str(mo.path, { max: 240 });\n    mc.at_('mode').oneOf(mo.mode, ['owned', 'section'] as const);\n  });\n  return o as unknown as ProjectConfig;\n}\n\nexport interface Fact {\n  id: string;\n  key: string;\n  value: string;\n  source: string;\n  sourceType: SourceType;\n  sources: string[];\n  sourceHashes: Record<string, string>;\n  confidence: Confidence;\n  status: FactStatus;\n  createdAt: string;\n  updatedAt: string;\n  lastVerifiedAt: string | null;\n  staleReason?: string;\n}\n\nexport interface FactsFile {\n  schemaVersion: number;\n  facts: Fact[];\n}\n\nexport function validateFacts(v: unknown, file = 'facts.json'): FactsFile {\n  const c = new Check(file);\n  const o = c.obj(v);\n  c.at_('schemaVersion').int(o.schemaVersion, 1);\n  const facts = c.at_('facts').arr(o.facts, 5000);\n  facts.forEach((f, i) => {\n    const fc = c.at_(`facts.${i}`);\n    const fo = fc.obj(f);\n    fc.at_('id').str(fo.id, { max: 64 });\n    fc.at_('key').str(fo.key, { min: 1, max: 100 });\n    fc.at_('value').str(fo.value, { max: 4000 });\n    fc.at_('source').str(fo.source, { max: 500 });\n    fc.at_('sourceType').oneOf(fo.sourceType, SOURCE_TYPES);\n    fc.at_('sources').strArr(fo.sources, 100);\n    fc.at_('sourceHashes').obj(fo.sourceHashes);\n    fc.at_('confidence').oneOf(fo.confidence, CONFIDENCE);\n    fc.at_('status').oneOf(fo.status, FACT_STATUS);\n    fc.at_('createdAt').iso(fo.createdAt);\n    fc.at_('updatedAt').iso(fo.updatedAt);\n    if (fo.lastVerifiedAt !== null) fc.at_('lastVerifiedAt').iso(fo.lastVerifiedAt);\n  });\n  return o as unknown as FactsFile;\n}\n\nexport const CHECK_IDS = ['typecheck', 'unit', 'integration', 'e2e', 'lint', 'format', 'build', 'migrations', 'security'] as const;\nexport type CheckId = (typeof CHECK_IDS)[number];\nexport const REQUIRED_LEVELS = ['yes', 'context', 'no'] as const;\n\nexport interface CommandEntry {\n  id: CheckId;\n  available: boolean;\n  command: string | null;\n  required: (typeof REQUIRED_LEVELS)[number];\n  source: string | null;\n  /** 'repository-script' = defined by repo config (untrusted input); 'inferred' = guessed from tooling; 'user' = set by a human. */\n  origin: 'repository-script' | 'inferred' | 'user';\n  /**\n   * Working directory, relative to the project root (POSIX separators). Absent means the project root.\n   * Package-specific commands (backend vs frontend) must carry it so they are never run in the wrong place.\n   */\n  cwd?: string;\n  /**\n   * True when running the command rewrites project files (a formatter, a fixer). Absent means read-only or unknown.\n   * DevWorkspace never runs a mutating command on its own.\n   */\n  mutates?: boolean;\n}\n\nexport interface CommandsFile {\n  schemaVersion: number;\n  checks: CommandEntry[];\n  trustNote: string;\n}\n\nexport function validateCommands(v: unknown, file = 'commands.json'): CommandsFile {\n  const c = new Check(file);\n  const o = c.obj(v);\n  c.at_('schemaVersion').int(o.schemaVersion, 1);\n  c.at_('trustNote').str(o.trustNote);\n  c.at_('checks')\n    .arr(o.checks, 100)\n    .forEach((e, i) => {\n      const ec = c.at_(`checks.${i}`);\n      const eo = ec.obj(e);\n      ec.at_('id').oneOf(eo.id, CHECK_IDS);\n      ec.at_('available').bool(eo.available);\n      if (eo.command !== null) ec.at_('command').str(eo.command, { max: 500 });\n      ec.at_('required').oneOf(eo.required, REQUIRED_LEVELS);\n      ec.at_('origin').oneOf(eo.origin, ['repository-script', 'inferred', 'user'] as const);\n      if (eo.mutates !== undefined) ec.at_('mutates').bool(eo.mutates);\n      if (eo.cwd !== undefined) {\n        const cwd = ec.at_('cwd').str(eo.cwd, { max: 240 });\n        const err = validateRelativePath(cwd);\n        if (err) throw new DevWorkspaceError('SCHEMA', `Invalid ${file}: checks.${i}.cwd ${err}.`);\n      }\n    });\n  return o as unknown as CommandsFile;\n}\n\nexport interface AnalysisState {\n  schemaVersion: number;\n  analyzedAt: string;\n  refreshedAt: string | null;\n  gitHead: string | null;\n  fileCount: number;\n  truncated: boolean;\n  discoveryHash: string;\n}\n\nexport function validateAnalysisState(v: unknown, file = 'analysis.json'): AnalysisState {\n  const c = new Check(file);\n  const o = c.obj(v);\n  c.at_('schemaVersion').int(o.schemaVersion, 1);\n  c.at_('analyzedAt').iso(o.analyzedAt);\n  c.at_('fileCount').int(o.fileCount);\n  c.at_('truncated').bool(o.truncated);\n  c.at_('discoveryHash').str(o.discoveryHash, { max: 100 });\n  return o as unknown as AnalysisState;\n}\n"]}

package/dist/discovery/commands.d.ts

@@ -1,12 +1,43 @@
-import type { CommandEntry } from '../config/schemas.js';
+import type { CheckId, CommandEntry } from '../config/schemas.js';
 import type { PackageInfo } from './detect.js';
 export declare const TRUST_NOTE: string;
+/** One Node.js package: the manifest, where it lives, and which package manager its own lockfile says it uses. */
+export interface NodePackageInput {
+    /** Directory relative to the project root, POSIX separators; '' for the root. */
+    dir: string;
+    pkg: PackageInfo;
+    packageManager: string;
+    hasTsconfig: boolean;
+}
 export interface ContractInput {
-    pkg: PackageInfo | null;
-    packageManager: string | null;
+    nodePackages: NodePackageInput[];
     ecosystems: Set<string>;
     has: (rel: string) => boolean;
     pythonEvidence: Record<string, string>;
     files: Set<string>;
 }
+export declare const CHECK_ORDER: CheckId[];
+/**
+ * Detected verification commands. Node commands are produced per package and only for scripts that exist in that
+ * package's own manifest. Every check that no package provides gets one unavailable entry so the contract always
+ * lists all nine checks.
+ */
 export declare function buildContract(input: ContractInput): CommandEntry[];
+export interface MergeResult {
+    checks: CommandEntry[];
+    /** Entries kept from the previous contract because a human confirmed them (origin "user"). */
+    preservedUser: number;
+    /** Previously detected entries kept because this analysis found nothing or was cut short. */
+    preservedStale: number;
+    /** The new detection found no verification commands at all, or the scan was truncated. */
+    incomplete: boolean;
+}
+/**
+ * Combine the previous contract with fresh detection.
+ *  - Entries confirmed by a person (origin "user") are never dropped or overwritten. A user entry without a cwd
+ *    covers its whole check; one with a cwd covers only that directory, and detection fills in the other packages.
+ *  - If detection is incomplete, previously available entries survive too, with their original provenance.
+ */
+export declare function mergeContract(previous: CommandEntry[] | null, detected: CommandEntry[], opts?: {
+    truncated?: boolean;
+}): MergeResult;

package/dist/discovery/commands.js

@@ -1,14 +1,25 @@
 export const TRUST_NOTE = 'Commands marked "repository-script" come from files in the repository (e.g. package.json scripts) and are untrusted input. ' +
     'Inspect what a script does before running it, especially in automation or on unfamiliar repositories.';
+/** First match wins, so more specific scripts (test:unit) are preferred over catch-alls (test). */
 const SCRIPT_CANDIDATES = {
     typecheck: ['typecheck', 'type-check', 'check-types', 'tsc', 'types'],
-    unit: ['test', 'test:unit', 'unit', 'test:run'],
+    unit: ['test:unit', 'unit', 'test', 'test:run'],
     integration: ['test:integration', 'test:int', 'integration'],
     e2e: ['test:e2e', 'e2e', 'test:playwright', 'test:cypress', 'cypress:run'],
     lint: ['lint', 'eslint', 'lint:check'],
     format: ['format:check', 'prettier:check', 'format-check', 'check:format'],
     build: ['build', 'compile'],
+    migrations: ['db:migrate', 'migrate'],
+    security: ['test:security', 'security:test', 'security', 'audit:security'],
 };
+/** Scripts that format in place. They are listed for the user but are never required and never run by DevWorkspace. */
+const FORMATTER_SCRIPTS = ['format', 'fmt', 'format:write', 'prettier:write', 'format:fix'];
+/** True unless the script body clearly only checks. Unknown formatter bodies are treated as modifying files. */
+function writesFiles(body) {
+    if (/(^|\s)--(?:check|list-different)\b|(^|\s)-l(\s|$)/.test(body))
+        return false;
+    return true;
+}
 const REQUIRED = {
     typecheck: 'yes',
     unit: 'yes',
@@ -20,73 +31,138 @@ const REQUIRED = {
     migrations: 'context',
     security: 'context',
 };
-const ORDER = ['typecheck', 'unit', 'integration', 'e2e', 'lint', 'format', 'build', 'migrations', 'security'];
+export const CHECK_ORDER = ['typecheck', 'unit', 'integration', 'e2e', 'lint', 'format', 'build', 'migrations', 'security'];
 function scriptCommand(pm, script) {
-    const mgr = pm ?? 'npm';
-    if (script === 'test' && (mgr === 'npm' || mgr === 'pnpm' || mgr === 'yarn' || mgr === 'bun'))
-        return `${mgr} test`;
-    if (mgr === 'yarn')
+    if (script === 'test' && (pm === 'npm' || pm === 'pnpm' || pm === 'yarn' || pm === 'bun'))
+        return `${pm} test`;
+    if (pm === 'yarn')
         return `yarn ${script}`;
-    if (mgr === 'bun')
+    if (pm === 'bun')
         return `bun run ${script}`;
-    return `${mgr} run ${script}`;
+    return `${pm} run ${script}`;
 }
 /** Placeholder scripts such as npm's default "no test specified" do not count as tests. */
 function isRealScript(body) {
     return !/no test specified/i.test(body) && body.trim() !== '';
 }
+const byCwd = (a, b) => (a.cwd ?? '').localeCompare(b.cwd ?? '');
+/**
+ * Detected verification commands. Node commands are produced per package and only for scripts that exist in that
+ * package's own manifest. Every check that no package provides gets one unavailable entry so the contract always
+ * lists all nine checks.
+ */
 export function buildContract(input) {
-    const found = new Map();
-    const set = (id, command, source, origin) => {
-        if (!found.has(id))
-            found.set(id, { id, available: true, command, required: REQUIRED[id], source, origin });
+    const found = [];
+    const add = (id, command, source, origin, cwd, mutates) => {
+        if (!found.some((f) => f.id === id && (f.cwd ?? '') === (cwd ?? ''))) {
+            found.push({ id, available: true, command, required: mutates ? 'no' : REQUIRED[id], source, origin, ...(cwd ? { cwd } : {}), ...(mutates !== undefined ? { mutates } : {}) });
+        }
     };
-    if (input.pkg) {
+    for (const np of input.nodePackages) {
+        const manifest = np.dir ? `${np.dir}/package.json` : 'package.json';
         for (const [id, names] of Object.entries(SCRIPT_CANDIDATES)) {
             for (const name of names) {
-                const body = input.pkg.scripts[name];
+                const body = np.pkg.scripts[name];
                 if (body !== undefined && isRealScript(body)) {
-                    set(id, scriptCommand(input.packageManager, name), `${input.pkg.rel}#scripts.${name}`, 'repository-script');
+                    add(id, scriptCommand(np.packageManager, name), `${manifest}#scripts.${name}`, 'repository-script', np.dir, id === 'format' ? /(^|\s)(?:--write|--fix|-w)(\s|$)/.test(body) : undefined);
                     break;
                 }
             }
         }
-        if (!found.has('typecheck') && input.has('tsconfig.json') && input.pkg.hasTypes) {
-            set('typecheck', `${input.packageManager === 'pnpm' ? 'pnpm exec' : 'npx'} tsc --noEmit`, 'tsconfig.json', 'inferred');
+        // A package with only an in-place formatter (`format`) still gets a format entry, flagged as modifying files.
+        if (!found.some((f) => f.id === 'format' && (f.cwd ?? '') === np.dir)) {
+            const name = FORMATTER_SCRIPTS.find((n) => np.pkg.scripts[n] !== undefined && isRealScript(np.pkg.scripts[n]));
+            if (name)
+                add('format', scriptCommand(np.packageManager, name), `${manifest}#scripts.${name}`, 'repository-script', np.dir, writesFiles(np.pkg.scripts[name]));
+        }
+        if (np.pkg.scripts.typecheck === undefined && np.hasTsconfig && np.pkg.hasTypes && !found.some((f) => f.id === 'typecheck' && (f.cwd ?? '') === np.dir)) {
+            add('typecheck', `${np.packageManager === 'pnpm' ? 'pnpm exec' : 'npx'} tsc --noEmit`, `${np.dir ? `${np.dir}/` : ''}tsconfig.json`, 'inferred', np.dir);
         }
     }
     if (input.ecosystems.has('python')) {
         const ev = input.pythonEvidence;
         const hasTestsDir = [...input.files].some((f) => /^tests?\//.test(f) && f.endsWith('.py'));
         if (ev.pytest || hasTestsDir || input.has('pytest.ini'))
-            set('unit', 'pytest', ev.pytest ?? 'tests/', 'inferred');
+            add('unit', 'pytest', ev.pytest ?? 'tests/', 'inferred');
         if (ev.ruff)
-            set('lint', 'ruff check .', ev.ruff, 'inferred');
+            add('lint', 'ruff check .', ev.ruff, 'inferred');
         if (ev.mypy)
-            set('typecheck', 'mypy .', ev.mypy, 'inferred');
+            add('typecheck', 'mypy .', ev.mypy, 'inferred');
         if (ev.black)
-            set('format', 'black --check .', ev.black, 'inferred');
+            add('format', 'black --check .', ev.black, 'inferred');
         if (ev.alembic)
-            set('migrations', 'alembic check', ev.alembic, 'inferred');
+            add('migrations', 'alembic check', ev.alembic, 'inferred');
     }
     if (input.ecosystems.has('go')) {
-        set('unit', 'go test ./...', 'go.mod', 'inferred');
-        set('build', 'go build ./...', 'go.mod', 'inferred');
-        set('lint', 'go vet ./...', 'go.mod', 'inferred');
+        add('unit', 'go test ./...', 'go.mod', 'inferred');
+        add('build', 'go build ./...', 'go.mod', 'inferred');
+        add('lint', 'go vet ./...', 'go.mod', 'inferred');
     }
     if (input.ecosystems.has('rust')) {
-        set('unit', 'cargo test', 'Cargo.toml', 'inferred');
-        set('build', 'cargo build', 'Cargo.toml', 'inferred');
-        set('lint', 'cargo clippy', 'Cargo.toml', 'inferred');
+        add('unit', 'cargo test', 'Cargo.toml', 'inferred');
+        add('build', 'cargo build', 'Cargo.toml', 'inferred');
+        add('lint', 'cargo clippy', 'Cargo.toml', 'inferred');
     }
     if (input.has('pom.xml')) {
-        set('unit', 'mvn test', 'pom.xml', 'inferred');
-        set('build', 'mvn package', 'pom.xml', 'inferred');
+        add('unit', 'mvn test', 'pom.xml', 'inferred');
+        add('build', 'mvn package', 'pom.xml', 'inferred');
     }
     if (input.has('build.gradle') || input.has('build.gradle.kts')) {
-        set('unit', 'gradle test', 'build.gradle', 'inferred');
-        set('build', 'gradle build', 'build.gradle', 'inferred');
+        add('unit', 'gradle test', 'build.gradle', 'inferred');
+        add('build', 'gradle build', 'build.gradle', 'inferred');
+    }
+    return withPlaceholders(found);
+}
+function withPlaceholders(entries) {
+    const out = [];
+    for (const id of CHECK_ORDER) {
+        const mine = entries.filter((e) => e.id === id && e.available).sort(byCwd);
+        if (mine.length > 0)
+            out.push(...mine);
+        else {
+            const unavailable = entries.find((e) => e.id === id);
+            out.push(unavailable ?? { id, available: false, command: null, required: 'no', source: null, origin: 'inferred' });
+        }
+    }
+    return out;
+}
+/**
+ * Combine the previous contract with fresh detection.
+ *  - Entries confirmed by a person (origin "user") are never dropped or overwritten. A user entry without a cwd
+ *    covers its whole check; one with a cwd covers only that directory, and detection fills in the other packages.
+ *  - If detection is incomplete, previously available entries survive too, with their original provenance.
+ */
+export function mergeContract(previous, detected, opts = {}) {
+    const prev = previous ?? [];
+    const detectedAvailable = detected.filter((d) => d.available);
+    const incomplete = detectedAvailable.length === 0 || !!opts.truncated;
+    let preservedUser = 0;
+    let preservedStale = 0;
+    const out = [];
+    for (const id of CHECK_ORDER) {
+        const user = prev.filter((p) => p.id === id && p.origin === 'user' && p.available);
+        const globalUser = user.some((u) => !u.cwd);
+        const det = detectedAvailable.filter((d) => d.id === id);
+        const chosen = [...user];
+        preservedUser += user.length;
+        if (!globalUser) {
+            for (const d of det)
+                if (!user.some((u) => (u.cwd ?? '') === (d.cwd ?? '')))
+                    chosen.push(d);
+        }
+        if (chosen.length === 0 && incomplete) {
+            const old = prev.filter((p) => p.id === id && p.available);
+            chosen.push(...old);
+            preservedStale += old.length;
+        }
+        if (chosen.length > 0)
+            out.push(...chosen.sort(byCwd));
+        else {
+            // nothing confirmed, nothing detected: list the check as unavailable so the contract always names all nine checks
+            const unavailable = detected.find((d) => d.id === id) ?? { id, available: false, command: null, required: 'no', source: null, origin: 'inferred' };
+            out.push(unavailable);
+        }
     }
-    return ORDER.map((id) => found.get(id) ?? { id, available: false, command: null, required: 'no', source: null, origin: 'inferred' });
+    return { checks: out, preservedUser, preservedStale, incomplete };
 }
 //# sourceMappingURL=commands.js.map

package/dist/discovery/commands.js.map

@@ -1 +1 @@
-{"version":3,"file":"commands.js","sourceRoot":"","sources":["../../src/discovery/commands.ts"],"names":[],"mappings":"AAGA,MAAM,CAAC,MAAM,UAAU,GACrB,6HAA6H;IAC7H,uGAAuG,CAAC;AAW1G,MAAM,iBAAiB,GAA6B;IAClD,SAAS,EAAE,CAAC,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,KAAK,EAAE,OAAO,CAAC;IACrE,IAAI,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,CAAC;IAC/C,WAAW,EAAE,CAAC,kBAAkB,EAAE,UAAU,EAAE,aAAa,CAAC;IAC5D,GAAG,EAAE,CAAC,UAAU,EAAE,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,aAAa,CAAC;IAC1E,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,YAAY,CAAC;IACtC,MAAM,EAAE,CAAC,cAAc,EAAE,gBAAgB,EAAE,cAAc,EAAE,cAAc,CAAC;IAC1E,KAAK,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC;CAC5B,CAAC;AAEF,MAAM,QAAQ,GAA8C;IAC1D,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,KAAK;IACX,WAAW,EAAE,SAAS;IACtB,GAAG,EAAE,SAAS;IACd,IAAI,EAAE,KAAK;IACX,MAAM,EAAE,SAAS;IACjB,KAAK,EAAE,KAAK;IACZ,UAAU,EAAE,SAAS;IACrB,QAAQ,EAAE,SAAS;CACpB,CAAC;AAEF,MAAM,KAAK,GAAc,CAAC,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;AAE1H,SAAS,aAAa,CAAC,EAAiB,EAAE,MAAc;IACtD,MAAM,GAAG,GAAG,EAAE,IAAI,KAAK,CAAC;IACxB,IAAI,MAAM,KAAK,MAAM,IAAI,CAAC,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,KAAK,CAAC;QAAE,OAAO,GAAG,GAAG,OAAO,CAAC;IACpH,IAAI,GAAG,KAAK,MAAM;QAAE,OAAO,QAAQ,MAAM,EAAE,CAAC;IAC5C,IAAI,GAAG,KAAK,KAAK;QAAE,OAAO,WAAW,MAAM,EAAE,CAAC;IAC9C,OAAO,GAAG,GAAG,QAAQ,MAAM,EAAE,CAAC;AAChC,CAAC;AAED,2FAA2F;AAC3F,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAoB;IAChD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC/C,MAAM,GAAG,GAAG,CAAC,EAAW,EAAE,OAAe,EAAE,MAAc,EAAE,MAA8B,EAAQ,EAAE;QACjG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC9G,CAAC,CAAC;IAEF,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;QACd,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC;YAC5D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBACrC,IAAI,IAAI,KAAK,SAAS,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC7C,GAAG,CAAC,EAAa,EAAE,aAAa,CAAC,KAAK,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,YAAY,IAAI,EAAE,EAAE,mBAAmB,CAAC,CAAC;oBACvH,MAAM;gBACR,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;YAChF,GAAG,CAAC,WAAW,EAAE,GAAG,KAAK,CAAC,cAAc,KAAK,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,eAAe,EAAE,eAAe,EAAE,UAAU,CAAC,CAAC;QACzH,CAAC;IACH,CAAC;IAED,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnC,MAAM,EAAE,GAAG,KAAK,CAAC,cAAc,CAAC;QAChC,MAAM,WAAW,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3F,IAAI,EAAE,CAAC,MAAM,IAAI,WAAW,IAAI,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC;YAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAC,MAAM,IAAI,QAAQ,EAAE,UAAU,CAAC,CAAC;QAClH,IAAI,EAAE,CAAC,IAAI;YAAE,GAAG,CAAC,MAAM,EAAE,cAAc,EAAE,EAAE,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAC9D,IAAI,EAAE,CAAC,IAAI;YAAE,GAAG,CAAC,WAAW,EAAE,QAAQ,EAAE,EAAE,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAC7D,IAAI,EAAE,CAAC,KAAK;YAAE,GAAG,CAAC,QAAQ,EAAE,iBAAiB,EAAE,EAAE,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QACrE,IAAI,EAAE,CAAC,OAAO;YAAE,GAAG,CAAC,YAAY,EAAE,eAAe,EAAE,EAAE,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;QACnD,GAAG,CAAC,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;QACrD,GAAG,CAAC,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;QACpD,GAAG,CAAC,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;QACtD,GAAG,CAAC,MAAM,EAAE,cAAc,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QACzB,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;QAC/C,GAAG,CAAC,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAC/D,GAAG,CAAC,MAAM,EAAE,aAAa,EAAE,cAAc,EAAE,UAAU,CAAC,CAAC;QACvD,GAAG,CAAC,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,UAAU,CAAC,CAAC;IAC3D,CAAC;IAED,OAAO,KAAK,CAAC,GAAG,CACd,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAa,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAmB,EAAE,CACrI,CAAC;AACJ,CAAC","sourcesContent":["import type { CheckId, CommandEntry } from '../config/schemas.js';\nimport type { PackageInfo } from './detect.js';\n\nexport const TRUST_NOTE =\n  'Commands marked \"repository-script\" come from files in the repository (e.g. package.json scripts) and are untrusted input. ' +\n  'Inspect what a script does before running it, especially in automation or on unfamiliar repositories.';\n\nexport interface ContractInput {\n  pkg: PackageInfo | null;\n  packageManager: string | null;\n  ecosystems: Set<string>;\n  has: (rel: string) => boolean;\n  pythonEvidence: Record<string, string>;\n  files: Set<string>;\n}\n\nconst SCRIPT_CANDIDATES: Record<string, string[]> = {\n  typecheck: ['typecheck', 'type-check', 'check-types', 'tsc', 'types'],\n  unit: ['test', 'test:unit', 'unit', 'test:run'],\n  integration: ['test:integration', 'test:int', 'integration'],\n  e2e: ['test:e2e', 'e2e', 'test:playwright', 'test:cypress', 'cypress:run'],\n  lint: ['lint', 'eslint', 'lint:check'],\n  format: ['format:check', 'prettier:check', 'format-check', 'check:format'],\n  build: ['build', 'compile'],\n};\n\nconst REQUIRED: Record<CheckId, CommandEntry['required']> = {\n  typecheck: 'yes',\n  unit: 'yes',\n  integration: 'context',\n  e2e: 'context',\n  lint: 'yes',\n  format: 'context',\n  build: 'yes',\n  migrations: 'context',\n  security: 'context',\n};\n\nconst ORDER: CheckId[] = ['typecheck', 'unit', 'integration', 'e2e', 'lint', 'format', 'build', 'migrations', 'security'];\n\nfunction scriptCommand(pm: string | null, script: string): string {\n  const mgr = pm ?? 'npm';\n  if (script === 'test' && (mgr === 'npm' || mgr === 'pnpm' || mgr === 'yarn' || mgr === 'bun')) return `${mgr} test`;\n  if (mgr === 'yarn') return `yarn ${script}`;\n  if (mgr === 'bun') return `bun run ${script}`;\n  return `${mgr} run ${script}`;\n}\n\n/** Placeholder scripts such as npm's default \"no test specified\" do not count as tests. */\nfunction isRealScript(body: string): boolean {\n  return !/no test specified/i.test(body) && body.trim() !== '';\n}\n\nexport function buildContract(input: ContractInput): CommandEntry[] {\n  const found = new Map<CheckId, CommandEntry>();\n  const set = (id: CheckId, command: string, source: string, origin: CommandEntry['origin']): void => {\n    if (!found.has(id)) found.set(id, { id, available: true, command, required: REQUIRED[id], source, origin });\n  };\n\n  if (input.pkg) {\n    for (const [id, names] of Object.entries(SCRIPT_CANDIDATES)) {\n      for (const name of names) {\n        const body = input.pkg.scripts[name];\n        if (body !== undefined && isRealScript(body)) {\n          set(id as CheckId, scriptCommand(input.packageManager, name), `${input.pkg.rel}#scripts.${name}`, 'repository-script');\n          break;\n        }\n      }\n    }\n    if (!found.has('typecheck') && input.has('tsconfig.json') && input.pkg.hasTypes) {\n      set('typecheck', `${input.packageManager === 'pnpm' ? 'pnpm exec' : 'npx'} tsc --noEmit`, 'tsconfig.json', 'inferred');\n    }\n  }\n\n  if (input.ecosystems.has('python')) {\n    const ev = input.pythonEvidence;\n    const hasTestsDir = [...input.files].some((f) => /^tests?\\//.test(f) && f.endsWith('.py'));\n    if (ev.pytest || hasTestsDir || input.has('pytest.ini')) set('unit', 'pytest', ev.pytest ?? 'tests/', 'inferred');\n    if (ev.ruff) set('lint', 'ruff check .', ev.ruff, 'inferred');\n    if (ev.mypy) set('typecheck', 'mypy .', ev.mypy, 'inferred');\n    if (ev.black) set('format', 'black --check .', ev.black, 'inferred');\n    if (ev.alembic) set('migrations', 'alembic check', ev.alembic, 'inferred');\n  }\n  if (input.ecosystems.has('go')) {\n    set('unit', 'go test ./...', 'go.mod', 'inferred');\n    set('build', 'go build ./...', 'go.mod', 'inferred');\n    set('lint', 'go vet ./...', 'go.mod', 'inferred');\n  }\n  if (input.ecosystems.has('rust')) {\n    set('unit', 'cargo test', 'Cargo.toml', 'inferred');\n    set('build', 'cargo build', 'Cargo.toml', 'inferred');\n    set('lint', 'cargo clippy', 'Cargo.toml', 'inferred');\n  }\n  if (input.has('pom.xml')) {\n    set('unit', 'mvn test', 'pom.xml', 'inferred');\n    set('build', 'mvn package', 'pom.xml', 'inferred');\n  }\n  if (input.has('build.gradle') || input.has('build.gradle.kts')) {\n    set('unit', 'gradle test', 'build.gradle', 'inferred');\n    set('build', 'gradle build', 'build.gradle', 'inferred');\n  }\n\n  return ORDER.map(\n    (id) => found.get(id) ?? { id, available: false, command: null, required: 'no' as const, source: null, origin: 'inferred' as const },\n  );\n}\n"]}
+{"version":3,"file":"commands.js","sourceRoot":"","sources":["../../src/discovery/commands.ts"],"names":[],"mappings":"AAGA,MAAM,CAAC,MAAM,UAAU,GACrB,6HAA6H;IAC7H,uGAAuG,CAAC;AAmB1G,mGAAmG;AACnG,MAAM,iBAAiB,GAA6B;IAClD,SAAS,EAAE,CAAC,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,KAAK,EAAE,OAAO,CAAC;IACrE,IAAI,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC;IAC/C,WAAW,EAAE,CAAC,kBAAkB,EAAE,UAAU,EAAE,aAAa,CAAC;IAC5D,GAAG,EAAE,CAAC,UAAU,EAAE,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,aAAa,CAAC;IAC1E,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,YAAY,CAAC;IACtC,MAAM,EAAE,CAAC,cAAc,EAAE,gBAAgB,EAAE,cAAc,EAAE,cAAc,CAAC;IAC1E,KAAK,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC;IAC3B,UAAU,EAAE,CAAC,YAAY,EAAE,SAAS,CAAC;IACrC,QAAQ,EAAE,CAAC,eAAe,EAAE,eAAe,EAAE,UAAU,EAAE,gBAAgB,CAAC;CAC3E,CAAC;AAEF,uHAAuH;AACvH,MAAM,iBAAiB,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,YAAY,CAAC,CAAC;AAE5F,gHAAgH;AAChH,SAAS,WAAW,CAAC,IAAY;IAC/B,IAAI,mDAAmD,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACjF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,QAAQ,GAA8C;IAC1D,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,KAAK;IACX,WAAW,EAAE,SAAS;IACtB,GAAG,EAAE,SAAS;IACd,IAAI,EAAE,KAAK;IACX,MAAM,EAAE,SAAS;IACjB,KAAK,EAAE,KAAK;IACZ,UAAU,EAAE,SAAS;IACrB,QAAQ,EAAE,SAAS;CACpB,CAAC;AAEF,MAAM,CAAC,MAAM,WAAW,GAAc,CAAC,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;AAEvI,SAAS,aAAa,CAAC,EAAU,EAAE,MAAc;IAC/C,IAAI,MAAM,KAAK,MAAM,IAAI,CAAC,EAAE,KAAK,KAAK,IAAI,EAAE,KAAK,MAAM,IAAI,EAAE,KAAK,MAAM,IAAI,EAAE,KAAK,KAAK,CAAC;QAAE,OAAO,GAAG,EAAE,OAAO,CAAC;IAC/G,IAAI,EAAE,KAAK,MAAM;QAAE,OAAO,QAAQ,MAAM,EAAE,CAAC;IAC3C,IAAI,EAAE,KAAK,KAAK;QAAE,OAAO,WAAW,MAAM,EAAE,CAAC;IAC7C,OAAO,GAAG,EAAE,QAAQ,MAAM,EAAE,CAAC;AAC/B,CAAC;AAED,2FAA2F;AAC3F,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;AAChE,CAAC;AAED,MAAM,KAAK,GAAG,CAAC,CAAe,EAAE,CAAe,EAAU,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;AAErG;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,KAAoB;IAChD,MAAM,KAAK,GAAmB,EAAE,CAAC;IACjC,MAAM,GAAG,GAAG,CAAC,EAAW,EAAE,OAAe,EAAE,MAAc,EAAE,MAA8B,EAAE,GAAY,EAAE,OAAiB,EAAQ,EAAE;QAClI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;YACrE,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAChL,CAAC;IACH,CAAC,CAAC;IAEF,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC,cAAc,CAAC;QACpE,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC;YAC5D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,MAAM,IAAI,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBAClC,IAAI,IAAI,KAAK,SAAS,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC7C,GAAG,CAAC,EAAa,EAAE,aAAa,CAAC,EAAE,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,GAAG,QAAQ,YAAY,IAAI,EAAE,EAAE,mBAAmB,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,kCAAkC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;oBACpM,MAAM;gBACR,CAAC;YACH,CAAC;QACH,CAAC;QACD,8GAA8G;QAC9G,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;YACtE,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,YAAY,CAAC,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC;YAChH,IAAI,IAAI;gBAAE,GAAG,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,GAAG,QAAQ,YAAY,IAAI,EAAE,EAAE,mBAAmB,EAAE,EAAE,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAE,CAAC,CAAC,CAAC;QAClK,CAAC;QACD,IAAI,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,CAAC,WAAW,IAAI,EAAE,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,WAAW,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;YACxJ,GAAG,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,cAAc,KAAK,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,eAAe,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;QAC3J,CAAC;IACH,CAAC;IAED,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnC,MAAM,EAAE,GAAG,KAAK,CAAC,cAAc,CAAC;QAChC,MAAM,WAAW,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3F,IAAI,EAAE,CAAC,MAAM,IAAI,WAAW,IAAI,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC;YAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAC,MAAM,IAAI,QAAQ,EAAE,UAAU,CAAC,CAAC;QAClH,IAAI,EAAE,CAAC,IAAI;YAAE,GAAG,CAAC,MAAM,EAAE,cAAc,EAAE,EAAE,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAC9D,IAAI,EAAE,CAAC,IAAI;YAAE,GAAG,CAAC,WAAW,EAAE,QAAQ,EAAE,EAAE,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAC7D,IAAI,EAAE,CAAC,KAAK;YAAE,GAAG,CAAC,QAAQ,EAAE,iBAAiB,EAAE,EAAE,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QACrE,IAAI,EAAE,CAAC,OAAO;YAAE,GAAG,CAAC,YAAY,EAAE,eAAe,EAAE,EAAE,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;QACnD,GAAG,CAAC,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;QACrD,GAAG,CAAC,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;QACpD,GAAG,CAAC,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;QACtD,GAAG,CAAC,MAAM,EAAE,cAAc,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QACzB,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;QAC/C,GAAG,CAAC,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAC/D,GAAG,CAAC,MAAM,EAAE,aAAa,EAAE,cAAc,EAAE,UAAU,CAAC,CAAC;QACvD,GAAG,CAAC,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,UAAU,CAAC,CAAC;IAC3D,CAAC;IAED,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAuB;IAC/C,MAAM,GAAG,GAAmB,EAAE,CAAC;IAC/B,KAAK,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3E,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;aAClC,CAAC;YACJ,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YACrD,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;QACrH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAYD;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,QAA+B,EAAE,QAAwB,EAAE,OAAgC,EAAE;IACzH,MAAM,IAAI,GAAG,QAAQ,IAAI,EAAE,CAAC;IAC5B,MAAM,iBAAiB,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC9D,MAAM,UAAU,GAAG,iBAAiB,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC;IACtE,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,cAAc,GAAG,CAAC,CAAC;IACvB,MAAM,GAAG,GAAmB,EAAE,CAAC;IAE/B,KAAK,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC;QACnF,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC5C,MAAM,GAAG,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACzD,MAAM,MAAM,GAAmB,CAAC,GAAG,IAAI,CAAC,CAAC;QACzC,aAAa,IAAI,IAAI,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,KAAK,MAAM,CAAC,IAAI,GAAG;gBAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;oBAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9F,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,EAAE,CAAC;YACtC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC;YAC3D,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC;YACpB,cAAc,IAAI,GAAG,CAAC,MAAM,CAAC;QAC/B,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;aAClD,CAAC;YACJ,kHAAkH;YAClH,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAa,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAmB,EAAE,CAAC;YACrK,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,aAAa,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC;AACpE,CAAC","sourcesContent":["import type { CheckId, CommandEntry } from '../config/schemas.js';\nimport type { PackageInfo } from './detect.js';\n\nexport const TRUST_NOTE =\n  'Commands marked \"repository-script\" come from files in the repository (e.g. package.json scripts) and are untrusted input. ' +\n  'Inspect what a script does before running it, especially in automation or on unfamiliar repositories.';\n\n/** One Node.js package: the manifest, where it lives, and which package manager its own lockfile says it uses. */\nexport interface NodePackageInput {\n  /** Directory relative to the project root, POSIX separators; '' for the root. */\n  dir: string;\n  pkg: PackageInfo;\n  packageManager: string;\n  hasTsconfig: boolean;\n}\n\nexport interface ContractInput {\n  nodePackages: NodePackageInput[];\n  ecosystems: Set<string>;\n  has: (rel: string) => boolean;\n  pythonEvidence: Record<string, string>;\n  files: Set<string>;\n}\n\n/** First match wins, so more specific scripts (test:unit) are preferred over catch-alls (test). */\nconst SCRIPT_CANDIDATES: Record<string, string[]> = {\n  typecheck: ['typecheck', 'type-check', 'check-types', 'tsc', 'types'],\n  unit: ['test:unit', 'unit', 'test', 'test:run'],\n  integration: ['test:integration', 'test:int', 'integration'],\n  e2e: ['test:e2e', 'e2e', 'test:playwright', 'test:cypress', 'cypress:run'],\n  lint: ['lint', 'eslint', 'lint:check'],\n  format: ['format:check', 'prettier:check', 'format-check', 'check:format'],\n  build: ['build', 'compile'],\n  migrations: ['db:migrate', 'migrate'],\n  security: ['test:security', 'security:test', 'security', 'audit:security'],\n};\n\n/** Scripts that format in place. They are listed for the user but are never required and never run by DevWorkspace. */\nconst FORMATTER_SCRIPTS = ['format', 'fmt', 'format:write', 'prettier:write', 'format:fix'];\n\n/** True unless the script body clearly only checks. Unknown formatter bodies are treated as modifying files. */\nfunction writesFiles(body: string): boolean {\n  if (/(^|\\s)--(?:check|list-different)\\b|(^|\\s)-l(\\s|$)/.test(body)) return false;\n  return true;\n}\n\nconst REQUIRED: Record<CheckId, CommandEntry['required']> = {\n  typecheck: 'yes',\n  unit: 'yes',\n  integration: 'context',\n  e2e: 'context',\n  lint: 'yes',\n  format: 'context',\n  build: 'yes',\n  migrations: 'context',\n  security: 'context',\n};\n\nexport const CHECK_ORDER: CheckId[] = ['typecheck', 'unit', 'integration', 'e2e', 'lint', 'format', 'build', 'migrations', 'security'];\n\nfunction scriptCommand(pm: string, script: string): string {\n  if (script === 'test' && (pm === 'npm' || pm === 'pnpm' || pm === 'yarn' || pm === 'bun')) return `${pm} test`;\n  if (pm === 'yarn') return `yarn ${script}`;\n  if (pm === 'bun') return `bun run ${script}`;\n  return `${pm} run ${script}`;\n}\n\n/** Placeholder scripts such as npm's default \"no test specified\" do not count as tests. */\nfunction isRealScript(body: string): boolean {\n  return !/no test specified/i.test(body) && body.trim() !== '';\n}\n\nconst byCwd = (a: CommandEntry, b: CommandEntry): number => (a.cwd ?? '').localeCompare(b.cwd ?? '');\n\n/**\n * Detected verification commands. Node commands are produced per package and only for scripts that exist in that\n * package's own manifest. Every check that no package provides gets one unavailable entry so the contract always\n * lists all nine checks.\n */\nexport function buildContract(input: ContractInput): CommandEntry[] {\n  const found: CommandEntry[] = [];\n  const add = (id: CheckId, command: string, source: string, origin: CommandEntry['origin'], cwd?: string, mutates?: boolean): void => {\n    if (!found.some((f) => f.id === id && (f.cwd ?? '') === (cwd ?? ''))) {\n      found.push({ id, available: true, command, required: mutates ? 'no' : REQUIRED[id], source, origin, ...(cwd ? { cwd } : {}), ...(mutates !== undefined ? { mutates } : {}) });\n    }\n  };\n\n  for (const np of input.nodePackages) {\n    const manifest = np.dir ? `${np.dir}/package.json` : 'package.json';\n    for (const [id, names] of Object.entries(SCRIPT_CANDIDATES)) {\n      for (const name of names) {\n        const body = np.pkg.scripts[name];\n        if (body !== undefined && isRealScript(body)) {\n          add(id as CheckId, scriptCommand(np.packageManager, name), `${manifest}#scripts.${name}`, 'repository-script', np.dir, id === 'format' ? /(^|\\s)(?:--write|--fix|-w)(\\s|$)/.test(body) : undefined);\n          break;\n        }\n      }\n    }\n    // A package with only an in-place formatter (`format`) still gets a format entry, flagged as modifying files.\n    if (!found.some((f) => f.id === 'format' && (f.cwd ?? '') === np.dir)) {\n      const name = FORMATTER_SCRIPTS.find((n) => np.pkg.scripts[n] !== undefined && isRealScript(np.pkg.scripts[n]!));\n      if (name) add('format', scriptCommand(np.packageManager, name), `${manifest}#scripts.${name}`, 'repository-script', np.dir, writesFiles(np.pkg.scripts[name]!));\n    }\n    if (np.pkg.scripts.typecheck === undefined && np.hasTsconfig && np.pkg.hasTypes && !found.some((f) => f.id === 'typecheck' && (f.cwd ?? '') === np.dir)) {\n      add('typecheck', `${np.packageManager === 'pnpm' ? 'pnpm exec' : 'npx'} tsc --noEmit`, `${np.dir ? `${np.dir}/` : ''}tsconfig.json`, 'inferred', np.dir);\n    }\n  }\n\n  if (input.ecosystems.has('python')) {\n    const ev = input.pythonEvidence;\n    const hasTestsDir = [...input.files].some((f) => /^tests?\\//.test(f) && f.endsWith('.py'));\n    if (ev.pytest || hasTestsDir || input.has('pytest.ini')) add('unit', 'pytest', ev.pytest ?? 'tests/', 'inferred');\n    if (ev.ruff) add('lint', 'ruff check .', ev.ruff, 'inferred');\n    if (ev.mypy) add('typecheck', 'mypy .', ev.mypy, 'inferred');\n    if (ev.black) add('format', 'black --check .', ev.black, 'inferred');\n    if (ev.alembic) add('migrations', 'alembic check', ev.alembic, 'inferred');\n  }\n  if (input.ecosystems.has('go')) {\n    add('unit', 'go test ./...', 'go.mod', 'inferred');\n    add('build', 'go build ./...', 'go.mod', 'inferred');\n    add('lint', 'go vet ./...', 'go.mod', 'inferred');\n  }\n  if (input.ecosystems.has('rust')) {\n    add('unit', 'cargo test', 'Cargo.toml', 'inferred');\n    add('build', 'cargo build', 'Cargo.toml', 'inferred');\n    add('lint', 'cargo clippy', 'Cargo.toml', 'inferred');\n  }\n  if (input.has('pom.xml')) {\n    add('unit', 'mvn test', 'pom.xml', 'inferred');\n    add('build', 'mvn package', 'pom.xml', 'inferred');\n  }\n  if (input.has('build.gradle') || input.has('build.gradle.kts')) {\n    add('unit', 'gradle test', 'build.gradle', 'inferred');\n    add('build', 'gradle build', 'build.gradle', 'inferred');\n  }\n\n  return withPlaceholders(found);\n}\n\nfunction withPlaceholders(entries: CommandEntry[]): CommandEntry[] {\n  const out: CommandEntry[] = [];\n  for (const id of CHECK_ORDER) {\n    const mine = entries.filter((e) => e.id === id && e.available).sort(byCwd);\n    if (mine.length > 0) out.push(...mine);\n    else {\n      const unavailable = entries.find((e) => e.id === id);\n      out.push(unavailable ?? { id, available: false, command: null, required: 'no', source: null, origin: 'inferred' });\n    }\n  }\n  return out;\n}\n\nexport interface MergeResult {\n  checks: CommandEntry[];\n  /** Entries kept from the previous contract because a human confirmed them (origin \"user\"). */\n  preservedUser: number;\n  /** Previously detected entries kept because this analysis found nothing or was cut short. */\n  preservedStale: number;\n  /** The new detection found no verification commands at all, or the scan was truncated. */\n  incomplete: boolean;\n}\n\n/**\n * Combine the previous contract with fresh detection.\n *  - Entries confirmed by a person (origin \"user\") are never dropped or overwritten. A user entry without a cwd\n *    covers its whole check; one with a cwd covers only that directory, and detection fills in the other packages.\n *  - If detection is incomplete, previously available entries survive too, with their original provenance.\n */\nexport function mergeContract(previous: CommandEntry[] | null, detected: CommandEntry[], opts: { truncated?: boolean } = {}): MergeResult {\n  const prev = previous ?? [];\n  const detectedAvailable = detected.filter((d) => d.available);\n  const incomplete = detectedAvailable.length === 0 || !!opts.truncated;\n  let preservedUser = 0;\n  let preservedStale = 0;\n  const out: CommandEntry[] = [];\n\n  for (const id of CHECK_ORDER) {\n    const user = prev.filter((p) => p.id === id && p.origin === 'user' && p.available);\n    const globalUser = user.some((u) => !u.cwd);\n    const det = detectedAvailable.filter((d) => d.id === id);\n    const chosen: CommandEntry[] = [...user];\n    preservedUser += user.length;\n    if (!globalUser) {\n      for (const d of det) if (!user.some((u) => (u.cwd ?? '') === (d.cwd ?? ''))) chosen.push(d);\n    }\n    if (chosen.length === 0 && incomplete) {\n      const old = prev.filter((p) => p.id === id && p.available);\n      chosen.push(...old);\n      preservedStale += old.length;\n    }\n    if (chosen.length > 0) out.push(...chosen.sort(byCwd));\n    else {\n      // nothing confirmed, nothing detected: list the check as unavailable so the contract always names all nine checks\n      const unavailable = detected.find((d) => d.id === id) ?? { id, available: false, command: null, required: 'no' as const, source: null, origin: 'inferred' as const };\n      out.push(unavailable);\n    }\n  }\n  return { checks: out, preservedUser, preservedStale, incomplete };\n}\n"]}

package/dist/discovery/detect.d.ts

@@ -1,5 +1,7 @@
 import type { ScanResult } from './scan.js';
+import { type NodePackageInput } from './commands.js';
 import type { CommandEntry } from '../config/schemas.js';
+import { type EntryPoint } from './entrypoints.js';
 export interface Detected {
     name: string;
     category: 'framework' | 'test' | 'tool' | 'database' | 'runtime';
@@ -10,6 +12,7 @@ export interface SubProject {
     name: string;
     ecosystem: string;
     frameworks: string[];
+    packageManager?: string;
 }
 export interface PackageInfo {
     rel: string;
@@ -20,6 +23,9 @@ export interface PackageInfo {
     packageManagerField?: string;
     hasTypes: boolean;
     type?: string;
+    /** `main` field and `bin` targets, used as evidence for entry points. */
+    main?: string;
+    bin?: string[];
 }
 export interface DiscoveryReport {
     schemaVersion: 1;
@@ -49,6 +55,8 @@ export interface DiscoveryReport {
         packages: SubProject[];
     };
     commands: CommandEntry[];
+    /** Recognised package manifests (project-relative). Used as evidence for derived facts. */
+    manifests: string[];
     testConfigs: string[];
     ci: string[];
     docker: string[];
@@ -58,6 +66,8 @@ export interface DiscoveryReport {
     /** Names of credential-like files that exist. Their content is never read. */
     sensitiveFilesPresent: string[];
     entryHints: string[];
+    /** Entry points a package itself declares (start-like scripts, `main`, `bin`), with the evidence for each. */
+    entryPoints: EntryPoint[];
     warnings: string[];
 }
 export declare function isAuxPath(rel: string): boolean;
@@ -69,4 +79,17 @@ export interface DetectInput {
     projectName: string;
     scan: ScanResult;
 }
+export interface FoundNodePackage extends NodePackageInput {
+    manifest: string;
+    /** Where the package manager came from, for transparency in discovery.json consumers. */
+    pmSource: 'lockfile' | 'packageManager field' | 'inherited from root' | 'default';
+}
+/**
+ * Find every Node.js package, not just the root one. Each package gets its own package manager from its own lockfile
+ * (falling back to the packageManager field, then the root lockfile, then npm). No script is ever executed.
+ */
+export declare function discoverNodePackages(root: string, files: Set<string>): Promise<{
+    packages: FoundNodePackage[];
+    unparsable: string[];
+}>;
 export declare function detectProject(input: DetectInput): Promise<DiscoveryReport>;