devworkspace 0.2.1 → 0.3.0

package/dist/services/tasks.js.map

@@ -1 +1 @@
-{"version":3,"file":"tasks.js","sourceRoot":"","sources":["../../src/services/tasks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAqB,MAAM,sBAAsB,CAAC;AAC3F,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAW,MAAM,sBAAsB,CAAC;AAC9E,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,SAAS,EAA0C,MAAM,qBAAqB,CAAC;AACzG,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,SAAS,EACT,QAAQ,EACR,iBAAiB,EACjB,QAAQ,EACR,cAAc,EAMd,aAAa,EACb,UAAU,EACV,eAAe,GAChB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,EAAuB,MAAM,aAAa,CAAC;AAElE,KAAK,UAAU,YAAY,CAAC,EAAM;IAChC,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IAChD,OAAO,CAAC,MAAM,aAAa,CAAC,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,cAAc,EAAE,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;AACtG,CAAC;AAQD,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,CAAiB,EAAE,KAAsD;IACxG,OAAO,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QAC5B,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,EAAE,CAAC,CAAC;QACtC,MAAM,cAAc,GAAG,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,IAAI,GAAa,cAAc,CAAC,IAAI,CAAC;QACzC,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;YACf,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACpC,IAAI,CAAE,UAAgC,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;gBACpD,MAAM,IAAI,iBAAiB,CAAC,OAAO,EAAE,sBAAsB,KAAK,CAAC,IAAI,IAAI,EAAE,EAAE,IAAI,EAAE,eAAe,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YAChI,CAAC;YACD,IAAI,GAAG,EAAc,CAAC;QACxB,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,EAAE,CAAC,CAAC;QACxC,IAAI,YAAY,GAAG,iBAAiB,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC9E,2GAA2G;QAC3G,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;QACrC,IAAI,cAAc,CAAC,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACzE,IAAI,cAAc,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC;YAAE,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC1G,YAAY,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,SAAkB,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtI,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACpF,MAAM,IAAI,GAAG,gBAAgB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,CAAC,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,cAAc,CAAC,WAAW,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1I,MAAM,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACzB,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,GAAG,cAAc,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;IAC1F,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,CAAiB,EAAE,EAAU;IAC1D,MAAM,EAAE,GAAG,MAAM,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IACpC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;AAC5C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,CAAiB,EAAE,gBAAgB,GAAG,KAAK;IAChF,MAAM,EAAE,GAAG,MAAM,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACzC,OAAO,SAAS,CAAC,EAAE,EAAE,EAAE,gBAAgB,EAAE,CAAC,CAAC;AAC7C,CAAC;AAcD,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,CAAiB,EAAE,EAAU,EAAE,KAAgB;IAC9E,OAAO,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QAC5B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACpC,IAAI,KAAK,CAAC,KAAK;YAAE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC/D,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;YAAE,IAAI,CAAC,iBAAiB,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAC9F,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC;QACxD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;QACtC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/F,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;QAChD,IAAI,KAAK,CAAC,aAAa;YAAE,IAAI,CAAC,QAAQ,GAAG,EAAE,CAAC;QAC5C,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC;QAC9C,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;YACxC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC;gBAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QAC9H,CAAC;QACD,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QAC3B,eAAe,CAAC,IAAI,CAAC,CAAC;QACtB,MAAM,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,CAAiB,EAAE,EAAU,EAAE,MAAc,EAAE,IAAa;IAC9F,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IAChC,IAAI,CAAE,aAAmC,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,iBAAiB,CAAC,OAAO,EAAE,wBAAwB,MAAM,IAAI,EAAE,EAAE,IAAI,EAAE,eAAe,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACjI,CAAC;IACD,OAAO,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QAC5B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,EAAE,EAAgB,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACrE,IAAI,EAAE,KAAK,SAAS,IAAI,IAAI;YAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACrE,MAAM,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACzB,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACxB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,CAAiB,EACjB,EAAU,EACV,KAAa,EACb,MAAc,EACd,QAA8C,EAAE;IAEhD,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IACpC,MAAM,UAAU,GAAG,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;IAC1D,IAAI,CAAE,eAAqC,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACjE,MAAM,IAAI,iBAAiB,CAAC,OAAO,EAAE,mBAAmB,MAAM,IAAI,EAAE,EAAE,IAAI,EAAE,kCAAkC,EAAE,CAAC,CAAC;IACpH,CAAC;IACD,OAAO,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QAC5B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACpC,IAAI,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;QAC5D,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YACrD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,UAA0B,CAAC;QACzC,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,KAAK,CAAC,MAAM;YAAE,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;;YACxC,OAAO,IAAI,CAAC,MAAM,CAAC;QACxB,IAAI,KAAK,CAAC,MAAM;YAAE,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC3D,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAChC,eAAe,CAAC,IAAI,CAAC,CAAC;QACtB,MAAM,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,CAAiB,EAAE,EAAU,EAAE,KAA2B,EAAE,MAAc,EAAE,MAAc;IAC1H,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QACvF,MAAM,IAAI,iBAAiB,CAAC,OAAO,EAAE,sDAAsD,CAAC,CAAC;IAC/F,CAAC;IACD,OAAO,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QAC5B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QACvC,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QAC3B,MAAM,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,CAAiB,EACjB,EAAU,EACV,KAA+F;IAE/F,OAAO,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QAC5B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACpC,IAAI,CAAC,YAAY,GAAG,EAAE,GAAG,IAAI,CAAC,YAAY,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,EAAE,CAAC;QAC9H,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QAC3B,MAAM,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { SCHEMA_VERSION, validateCommands, type CommandEntry } from '../config/schemas.js';\nimport { DevWorkspaceError } from '../errors/index.js';\nimport { loadProject, requireWorkspace, type Ws } from '../core/workspace.js';\nimport { readVersioned } from '../core/versioned.js';\nimport { classifyRequest, WORKFLOWS, type Classification, type WorkflowSpec } from '../tasks/routing.js';\nimport {\n  assertNoSecrets,\n  createTaskObject,\n  evaluateGate,\n  listTasks,\n  loadTask,\n  requiredChecksFor,\n  saveTask,\n  transitionTask,\n  type GateResult,\n  type Task,\n  type TaskStatus,\n  type TaskType,\n  type VerifyStatus,\n  TASK_STATUSES,\n  TASK_TYPES,\n  VERIFY_STATUSES,\n} from '../tasks/task.js';\nimport { pathExists } from '../utils/fs.js';\nimport { isoNow, mutate, type ServiceOptions } from './common.js';\n\nasync function loadContract(ws: Ws): Promise<CommandEntry[]> {\n  if (!(await pathExists(ws.commands))) return [];\n  return (await readVersioned(ws.commands, 'commands', SCHEMA_VERSION, validateCommands)).data.checks;\n}\n\nexport interface CreateTaskResult {\n  task: Task;\n  classification: Classification;\n  workflow: WorkflowSpec;\n}\n\nexport async function createTask(o: ServiceOptions, input: { text: string; type?: string; title?: string }): Promise<CreateTaskResult> {\n  return mutate(o, async (ws) => {\n    const project = await loadProject(ws);\n    const classification = classifyRequest(input.text);\n    let type: TaskType = classification.type;\n    if (input.type) {\n      const up = input.type.toUpperCase();\n      if (!(TASK_TYPES as readonly string[]).includes(up)) {\n        throw new DevWorkspaceError('USAGE', `Unknown task type \"${input.type}\".`, { hint: `Use one of: ${TASK_TYPES.join(', ')}.` });\n      }\n      type = up as TaskType;\n    }\n    const contract = await loadContract(ws);\n    let verification = requiredChecksFor(type, contract, project.settings.review);\n    // Explicit user constraints stay visible: the check is kept but recorded as skipped at the user's request.\n    const skipChecks = new Set<string>();\n    if (classification.constraints.includes('no-e2e')) skipChecks.add('e2e');\n    if (classification.constraints.includes('no-tests')) skipChecks.add('unit').add('integration').add('e2e');\n    verification = verification.map((v) => (skipChecks.has(v.check) ? { ...v, status: 'SKIPPED' as const, reason: 'user-override' } : v));\n    const title = (input.title ?? input.text).replace(/\\s+/g, ' ').trim().slice(0, 100);\n    const task = createTaskObject({ title, type, description: input.text, verification, constraints: classification.constraints }, isoNow(o));\n    await saveTask(ws, task);\n    return { task, classification: { ...classification, type }, workflow: WORKFLOWS[type] };\n  });\n}\n\nexport async function showTask(o: ServiceOptions, id: string): Promise<{ task: Task; gate: GateResult }> {\n  const ws = await requireWorkspace(o.cwd);\n  const task = await loadTask(ws, id);\n  return { task, gate: evaluateGate(task) };\n}\n\nexport async function listTasksService(o: ServiceOptions, includeCompleted = false): ReturnType<typeof listTasks> {\n  const ws = await requireWorkspace(o.cwd);\n  return listTasks(ws, { includeCompleted });\n}\n\nexport interface TaskPatch {\n  title?: string;\n  summary?: string;\n  criteria?: string[];\n  plan?: string[];\n  areas?: string[];\n  decisions?: string[];\n  blockers?: string[];\n  clearBlockers?: boolean;\n  require?: string[];\n}\n\nexport async function updateTask(o: ServiceOptions, id: string, patch: TaskPatch): Promise<Task> {\n  return mutate(o, async (ws) => {\n    const task = await loadTask(ws, id);\n    if (patch.title) task.title = patch.title.trim().slice(0, 200);\n    if (patch.summary !== undefined) task.completionSummary = patch.summary.trim().slice(0, 4000);\n    task.acceptanceCriteria.push(...(patch.criteria ?? []));\n    task.plan.push(...(patch.plan ?? []));\n    task.affectedAreas.push(...(patch.areas ?? []).filter((a) => !task.affectedAreas.includes(a)));\n    task.decisions.push(...(patch.decisions ?? []));\n    if (patch.clearBlockers) task.blockers = [];\n    task.blockers.push(...(patch.blockers ?? []));\n    for (const check of patch.require ?? []) {\n      if (!task.verification.some((v) => v.check === check)) task.verification.push({ check, required: true, status: 'PENDING' });\n    }\n    task.updatedAt = isoNow(o);\n    assertNoSecrets(task);\n    await saveTask(ws, task);\n    return task;\n  });\n}\n\nexport async function setTaskStatus(o: ServiceOptions, id: string, status: string, note?: string): Promise<{ task: Task; gate: GateResult | null }> {\n  const up = status.toUpperCase();\n  if (!(TASK_STATUSES as readonly string[]).includes(up)) {\n    throw new DevWorkspaceError('USAGE', `Unknown task status \"${status}\".`, { hint: `Use one of: ${TASK_STATUSES.join(', ')}.` });\n  }\n  return mutate(o, async (ws) => {\n    const task = await loadTask(ws, id);\n    const gate = transitionTask(task, up as TaskStatus, isoNow(o), note);\n    if (up === 'BLOCKED' && note) task.blockers.push(note.slice(0, 300));\n    await saveTask(ws, task);\n    return { task, gate };\n  });\n}\n\nexport async function recordVerification(\n  o: ServiceOptions,\n  id: string,\n  check: string,\n  result: string,\n  extra: { reason?: string; detail?: string } = {},\n): Promise<Task> {\n  const status = result.toUpperCase();\n  const normalized = status === 'SKIP' ? 'SKIPPED' : status;\n  if (!(VERIFY_STATUSES as readonly string[]).includes(normalized)) {\n    throw new DevWorkspaceError('USAGE', `Unknown result \"${result}\".`, { hint: 'Use pass, fail, skip or pending.' });\n  }\n  return mutate(o, async (ws) => {\n    const task = await loadTask(ws, id);\n    let item = task.verification.find((v) => v.check === check);\n    if (!item) {\n      item = { check, required: false, status: 'PENDING' };\n      task.verification.push(item);\n    }\n    item.status = normalized as VerifyStatus;\n    item.updatedAt = isoNow(o);\n    if (extra.reason) item.reason = extra.reason;\n    else delete item.reason;\n    if (extra.detail) item.detail = extra.detail.slice(0, 500);\n    task.updatedAt = item.updatedAt;\n    assertNoSecrets(task);\n    await saveTask(ws, task);\n    return task;\n  });\n}\n\nexport async function recordTests(o: ServiceOptions, id: string, phase: 'baseline' | 'after', passed: number, failed: number): Promise<Task> {\n  if (!Number.isInteger(passed) || !Number.isInteger(failed) || passed < 0 || failed < 0) {\n    throw new DevWorkspaceError('USAGE', '--passed and --failed must be non-negative integers.');\n  }\n  return mutate(o, async (ws) => {\n    const task = await loadTask(ws, id);\n    task.tests[phase] = { passed, failed };\n    task.updatedAt = isoNow(o);\n    await saveTask(ws, task);\n    return task;\n  });\n}\n\nexport async function attestTask(\n  o: ServiceOptions,\n  id: string,\n  flags: { userWorkIntact?: boolean; knowledgeReviewed?: boolean; finalStateInspected?: boolean },\n): Promise<Task> {\n  return mutate(o, async (ws) => {\n    const task = await loadTask(ws, id);\n    task.attestations = { ...task.attestations, ...Object.fromEntries(Object.entries(flags).filter(([, v]) => v !== undefined)) };\n    task.updatedAt = isoNow(o);\n    await saveTask(ws, task);\n    return task;\n  });\n}\n"]}
+{"version":3,"file":"tasks.js","sourceRoot":"","sources":["../../src/services/tasks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,SAAS,EAA0C,MAAM,qBAAqB,CAAC;AACzG,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,gBAAgB,EAChB,SAAS,EACT,QAAQ,EACR,iBAAiB,EACjB,QAAQ,EACR,cAAc,EAOd,aAAa,EACb,UAAU,EACV,eAAe,GAChB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,MAAM,EAAE,MAAM,EAAuB,MAAM,aAAa,CAAC;AAQlE,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,CAAiB,EAAE,KAAsD;IACxG,OAAO,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QAC5B,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,EAAE,CAAC,CAAC;QACtC,MAAM,cAAc,GAAG,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,IAAI,GAAa,cAAc,CAAC,IAAI,CAAC;QACzC,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;YACf,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACpC,IAAI,CAAE,UAAgC,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;gBACpD,MAAM,IAAI,iBAAiB,CAAC,OAAO,EAAE,sBAAsB,KAAK,CAAC,IAAI,IAAI,EAAE,EAAE,IAAI,EAAE,eAAe,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YAChI,CAAC;YACD,IAAI,GAAG,EAAc,CAAC;QACxB,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,EAAE,CAAC,CAAC;QACxC,IAAI,YAAY,GAAG,iBAAiB,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC9E,2GAA2G;QAC3G,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;QACrC,IAAI,cAAc,CAAC,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACzE,IAAI,cAAc,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC;YAAE,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC1G,YAAY,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,SAAkB,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtI,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACpF,MAAM,IAAI,GAAG,gBAAgB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,CAAC,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,cAAc,CAAC,WAAW,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1I,IAAI,CAAC,KAAK,GAAG,MAAM,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,MAAM,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACzB,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,GAAG,cAAc,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;IAC1F,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,CAAiB,EAAE,EAAU;IAC1D,MAAM,EAAE,GAAG,MAAM,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACxC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,gBAAgB,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;AACpF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,CAAiB,EAAE,gBAAgB,GAAG,KAAK;IAChF,MAAM,EAAE,GAAG,MAAM,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACzC,OAAO,SAAS,CAAC,EAAE,EAAE,EAAE,gBAAgB,EAAE,CAAC,CAAC;AAC7C,CAAC;AAcD,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,CAAiB,EAAE,EAAU,EAAE,KAAgB;IAC9E,OAAO,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QAC5B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACpC,IAAI,KAAK,CAAC,KAAK;YAAE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC/D,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;YAAE,IAAI,CAAC,iBAAiB,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAC9F,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC;QACxD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;QACtC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/F,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;QAChD,IAAI,KAAK,CAAC,aAAa;YAAE,IAAI,CAAC,QAAQ,GAAG,EAAE,CAAC;QAC5C,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC;QAC9C,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;YACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;YAClE,IAAI,QAAQ;gBAAE,QAAQ,CAAC,QAAQ,GAAG,IAAI,CAAC;;gBAClC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QAC3B,eAAe,CAAC,IAAI,CAAC,CAAC;QACtB,MAAM,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,CAAiB,EAAE,EAAU,EAAE,MAAc,EAAE,IAAa;IAC9F,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IAChC,IAAI,CAAE,aAAmC,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,iBAAiB,CAAC,OAAO,EAAE,wBAAwB,MAAM,IAAI,EAAE,EAAE,IAAI,EAAE,eAAe,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACjI,CAAC;IACD,OAAO,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QAC5B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,EAAE,EAAgB,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACnI,IAAI,EAAE,KAAK,SAAS,IAAI,IAAI;YAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACrE,MAAM,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACzB,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACxB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,CAAiB,EACjB,EAAU,EACV,KAAa,EACb,MAAc,EACd,QAAgE,EAAE;IAElE,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IACpC,MAAM,UAAU,GAAG,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;IAC1D,IAAI,CAAE,eAAqC,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACjE,MAAM,IAAI,iBAAiB,CAAC,OAAO,EAAE,mBAAmB,MAAM,IAAI,EAAE,EAAE,IAAI,EAAE,kCAAkC,EAAE,CAAC,CAAC;IACpH,CAAC;IACD,OAAO,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QAC5B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACpC,IAAI,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;QAC5D,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YACrD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,UAA0B,CAAC;QACzC,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QAC3B,iHAAiH;QACjH,mFAAmF;QACnF,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;YAC1B,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAC7F,MAAM,KAAK,GAAa,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,eAAe,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;YAClN,wEAAwE;YACxE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,GAAG,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC;gBAAE,IAAI,CAAC,QAAQ,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;QAClK,CAAC;QACD,IAAI,KAAK,CAAC,MAAM;YAAE,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;;YACxC,OAAO,IAAI,CAAC,MAAM,CAAC;QACxB,IAAI,KAAK,CAAC,MAAM;YAAE,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC3D,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAChC,eAAe,CAAC,IAAI,CAAC,CAAC;QACtB,MAAM,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,CAAiB,EAAE,EAAU,EAAE,KAA2B,EAAE,MAAc,EAAE,MAAc;IAC1H,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QACvF,MAAM,IAAI,iBAAiB,CAAC,OAAO,EAAE,sDAAsD,CAAC,CAAC;IAC/F,CAAC;IACD,OAAO,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QAC5B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QACvC,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QAC3B,MAAM,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,CAAiB,EACjB,EAAU,EACV,KAA+F;IAE/F,OAAO,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QAC5B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACpC,IAAI,CAAC,YAAY,GAAG,EAAE,GAAG,IAAI,CAAC,YAAY,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,EAAE,CAAC;QAC9H,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QAC3B,MAAM,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { DevWorkspaceError } from '../errors/index.js';\nimport { loadProject, requireWorkspace } from '../core/workspace.js';\nimport { captureScope } from '../verification/scope.js';\nimport { gateContext, loadContract } from './verify.js';\nimport { classifyRequest, WORKFLOWS, type Classification, type WorkflowSpec } from '../tasks/routing.js';\nimport {\n  assertNoSecrets,\n  createTaskObject,\n  evaluateGate,\n  nextRequiredStep,\n  listTasks,\n  loadTask,\n  requiredChecksFor,\n  saveTask,\n  transitionTask,\n  type Evidence,\n  type GateResult,\n  type Task,\n  type TaskStatus,\n  type TaskType,\n  type VerifyStatus,\n  TASK_STATUSES,\n  TASK_TYPES,\n  VERIFY_STATUSES,\n} from '../tasks/task.js';\nimport { isoNow, mutate, type ServiceOptions } from './common.js';\n\nexport interface CreateTaskResult {\n  task: Task;\n  classification: Classification;\n  workflow: WorkflowSpec;\n}\n\nexport async function createTask(o: ServiceOptions, input: { text: string; type?: string; title?: string }): Promise<CreateTaskResult> {\n  return mutate(o, async (ws) => {\n    const project = await loadProject(ws);\n    const classification = classifyRequest(input.text);\n    let type: TaskType = classification.type;\n    if (input.type) {\n      const up = input.type.toUpperCase();\n      if (!(TASK_TYPES as readonly string[]).includes(up)) {\n        throw new DevWorkspaceError('USAGE', `Unknown task type \"${input.type}\".`, { hint: `Use one of: ${TASK_TYPES.join(', ')}.` });\n      }\n      type = up as TaskType;\n    }\n    const contract = await loadContract(ws);\n    let verification = requiredChecksFor(type, contract, project.settings.review);\n    // Explicit user constraints stay visible: the check is kept but recorded as skipped at the user's request.\n    const skipChecks = new Set<string>();\n    if (classification.constraints.includes('no-e2e')) skipChecks.add('e2e');\n    if (classification.constraints.includes('no-tests')) skipChecks.add('unit').add('integration').add('e2e');\n    verification = verification.map((v) => (skipChecks.has(v.check) ? { ...v, status: 'SKIPPED' as const, reason: 'user-override' } : v));\n    const title = (input.title ?? input.text).replace(/\\s+/g, ' ').trim().slice(0, 100);\n    const task = createTaskObject({ title, type, description: input.text, verification, constraints: classification.constraints }, isoNow(o));\n    task.scope = await captureScope(ws.root, isoNow(o));\n    await saveTask(ws, task);\n    return { task, classification: { ...classification, type }, workflow: WORKFLOWS[type] };\n  });\n}\n\nexport async function showTask(o: ServiceOptions, id: string): Promise<{ task: Task; gate: GateResult; next: string }> {\n  const ws = await requireWorkspace(o.cwd);\n  const task = await loadTask(ws, id);\n  const ctx = await gateContext(ws, task);\n  return { task, gate: evaluateGate(task, ctx), next: nextRequiredStep(task, ctx) };\n}\n\nexport async function listTasksService(o: ServiceOptions, includeCompleted = false): ReturnType<typeof listTasks> {\n  const ws = await requireWorkspace(o.cwd);\n  return listTasks(ws, { includeCompleted });\n}\n\nexport interface TaskPatch {\n  title?: string;\n  summary?: string;\n  criteria?: string[];\n  plan?: string[];\n  areas?: string[];\n  decisions?: string[];\n  blockers?: string[];\n  clearBlockers?: boolean;\n  require?: string[];\n}\n\nexport async function updateTask(o: ServiceOptions, id: string, patch: TaskPatch): Promise<Task> {\n  return mutate(o, async (ws) => {\n    const task = await loadTask(ws, id);\n    if (patch.title) task.title = patch.title.trim().slice(0, 200);\n    if (patch.summary !== undefined) task.completionSummary = patch.summary.trim().slice(0, 4000);\n    task.acceptanceCriteria.push(...(patch.criteria ?? []));\n    task.plan.push(...(patch.plan ?? []));\n    task.affectedAreas.push(...(patch.areas ?? []).filter((a) => !task.affectedAreas.includes(a)));\n    task.decisions.push(...(patch.decisions ?? []));\n    if (patch.clearBlockers) task.blockers = [];\n    task.blockers.push(...(patch.blockers ?? []));\n    for (const check of patch.require ?? []) {\n      const existing = task.verification.find((v) => v.check === check);\n      if (existing) existing.required = true;\n      else task.verification.push({ check, required: true, status: 'PENDING' });\n    }\n    task.updatedAt = isoNow(o);\n    assertNoSecrets(task);\n    await saveTask(ws, task);\n    return task;\n  });\n}\n\nexport async function setTaskStatus(o: ServiceOptions, id: string, status: string, note?: string): Promise<{ task: Task; gate: GateResult | null }> {\n  const up = status.toUpperCase();\n  if (!(TASK_STATUSES as readonly string[]).includes(up)) {\n    throw new DevWorkspaceError('USAGE', `Unknown task status \"${status}\".`, { hint: `Use one of: ${TASK_STATUSES.join(', ')}.` });\n  }\n  return mutate(o, async (ws) => {\n    const task = await loadTask(ws, id);\n    const gate = transitionTask(task, up as TaskStatus, isoNow(o), note, up === 'COMPLETED' ? await gateContext(ws, task) : undefined);\n    if (up === 'BLOCKED' && note) task.blockers.push(note.slice(0, 300));\n    await saveTask(ws, task);\n    return { task, gate };\n  });\n}\n\nexport async function recordVerification(\n  o: ServiceOptions,\n  id: string,\n  check: string,\n  result: string,\n  extra: { reason?: string; detail?: string; package?: string } = {},\n): Promise<Task> {\n  const status = result.toUpperCase();\n  const normalized = status === 'SKIP' ? 'SKIPPED' : status;\n  if (!(VERIFY_STATUSES as readonly string[]).includes(normalized)) {\n    throw new DevWorkspaceError('USAGE', `Unknown result \"${result}\".`, { hint: 'Use pass, fail, skip or pending.' });\n  }\n  return mutate(o, async (ws) => {\n    const task = await loadTask(ws, id);\n    let item = task.verification.find((v) => v.check === check);\n    if (!item) {\n      item = { check, required: false, status: 'PENDING' };\n      task.verification.push(item);\n    }\n    item.status = normalized as VerifyStatus;\n    item.updatedAt = isoNow(o);\n    // A reported pass is a claim: DevWorkspace did not see the command run. It is kept as such, per package, and the\n    // completion gate of a scoped task only accepts it with an explicit user override.\n    if (normalized === 'PASS') {\n      const pkg = !extra.package || extra.package === '' ? '.' : extra.package.replace(/\\/+$/, '');\n      const claim: Evidence = { kind: 'claimed', at: item.updatedAt, package: pkg, ...(extra.reason === 'user-override' ? { userOverride: true } : {}), ...(extra.detail ? { note: extra.detail.slice(0, 200) } : {}) };\n      // Never replace something DevWorkspace observed with somebody's say-so.\n      if (!item.evidence?.some((e) => e.package === pkg && e.kind === 'executed')) item.evidence = [...(item.evidence ?? []).filter((e) => e.package !== pkg), claim];\n    }\n    if (extra.reason) item.reason = extra.reason;\n    else delete item.reason;\n    if (extra.detail) item.detail = extra.detail.slice(0, 500);\n    task.updatedAt = item.updatedAt;\n    assertNoSecrets(task);\n    await saveTask(ws, task);\n    return task;\n  });\n}\n\nexport async function recordTests(o: ServiceOptions, id: string, phase: 'baseline' | 'after', passed: number, failed: number): Promise<Task> {\n  if (!Number.isInteger(passed) || !Number.isInteger(failed) || passed < 0 || failed < 0) {\n    throw new DevWorkspaceError('USAGE', '--passed and --failed must be non-negative integers.');\n  }\n  return mutate(o, async (ws) => {\n    const task = await loadTask(ws, id);\n    task.tests[phase] = { passed, failed };\n    task.updatedAt = isoNow(o);\n    await saveTask(ws, task);\n    return task;\n  });\n}\n\nexport async function attestTask(\n  o: ServiceOptions,\n  id: string,\n  flags: { userWorkIntact?: boolean; knowledgeReviewed?: boolean; finalStateInspected?: boolean },\n): Promise<Task> {\n  return mutate(o, async (ws) => {\n    const task = await loadTask(ws, id);\n    task.attestations = { ...task.attestations, ...Object.fromEntries(Object.entries(flags).filter(([, v]) => v !== undefined)) };\n    task.updatedAt = isoNow(o);\n    await saveTask(ws, task);\n    return task;\n  });\n}\n"]}

package/dist/services/verify.d.ts

@@ -0,0 +1,47 @@
+import { type CommandEntry } from '../config/schemas.js';
+import { type Ws } from '../core/workspace.js';
+import { type GateContext, type Task } from '../tasks/task.js';
+import { type CommandSafety, type TestEnvDeclaration } from '../verification/safety.js';
+import { type ServiceOptions } from './common.js';
+export declare function loadContract(ws: Ws): Promise<CommandEntry[]>;
+/** Contract plus what the task has changed per package: everything the completion gate needs to judge it. */
+export declare function gateContext(ws: Ws, task: Task, contract?: CommandEntry[]): Promise<GateContext>;
+export type RunOutcome = 'passed' | 'failed' | 'refused' | 'not-affected';
+export interface PackageRun {
+    package: string;
+    command: string | null;
+    outcome: RunOutcome;
+    exitCode?: number | null;
+    durationMs?: number;
+    /** Why DevWorkspace did not run it, or the scrubbed tail of a failure. */
+    reason?: string;
+    safety: CommandSafety['safety'];
+}
+export interface RunCheckResult {
+    task: Task;
+    check: string;
+    runs: PackageRun[];
+}
+export declare function splitCommand(command: string): string[] | null;
+/**
+ * PATH lookup on Windows finds the extensionless Unix shell script (`npm`) before `npm.cmd`, and that cannot be
+ * spawned. Prefer the Windows launcher next to it. Elsewhere the lookup result is used as is.
+ */
+export declare function resolveExecutable(found: string | null, name: string, platform: NodeJS.Platform, exists: (p: string) => Promise<boolean>): Promise<string>;
+/**
+ * Run one contract check for the packages the task changed, and record what really happened. DevWorkspace only runs
+ * read-only, non-destructive commands; anything that may touch a database runs only after the user declared a test
+ * environment for that package and check. Refusals are recorded as "could not run", never as a pass.
+ */
+export declare function runTaskCheck(o: ServiceOptions, id: string, check: string, opts?: {
+    package?: string;
+    timeoutMs?: number;
+}): Promise<RunCheckResult>;
+export declare function declareTestEnv(o: ServiceOptions, input: {
+    package: string;
+    checks: string[];
+    target: string;
+    yes: boolean;
+}): Promise<TestEnvDeclaration>;
+export declare function listTestEnv(o: ServiceOptions): Promise<TestEnvDeclaration[]>;
+export declare function revokeTestEnv(o: ServiceOptions, pkg: string): Promise<boolean>;

package/dist/services/verify.js

@@ -0,0 +1,172 @@
+import path from 'node:path';
+import { SCHEMA_VERSION, validateCommands } from '../config/schemas.js';
+import { requireWorkspace } from '../core/workspace.js';
+import { readVersioned } from '../core/versioned.js';
+import { DevWorkspaceError } from '../errors/index.js';
+import { createRunner } from '../integrations/exec.js';
+import { scrub } from '../integrations/manager.js';
+import { loadTask, saveTask, assertNoSecrets } from '../tasks/task.js';
+import { pathExists } from '../utils/fs.js';
+import { classifyCommand, isDeclared, loadTestEnv, readManifestEvidence, assertSafeTarget, removeDeclaration, saveDeclaration } from '../verification/safety.js';
+import { changedSince, scopeByPackage } from '../verification/scope.js';
+import { isoNow, mutate } from './common.js';
+export async function loadContract(ws) {
+    if (!(await pathExists(ws.commands)))
+        return [];
+    return (await readVersioned(ws.commands, 'commands', SCHEMA_VERSION, validateCommands)).data.checks;
+}
+/** Contract plus what the task has changed per package: everything the completion gate needs to judge it. */
+export async function gateContext(ws, task, contract) {
+    const checks = contract ?? (await loadContract(ws));
+    const scope = task.scope ? scopeByPackage(await changedSince(ws.root, task.scope), checks) : null;
+    return { contract: checks, scope };
+}
+/** Anything a shell would interpret. Contract commands are run as an argument vector, never through a shell. */
+const SHELL_SYNTAX = /[&|;<>$`(){}"'\\*?!%^\r\n]/;
+export function splitCommand(command) {
+    if (SHELL_SYNTAX.test(command))
+        return null;
+    const parts = command.trim().split(/\s+/);
+    return parts[0] ? parts : null;
+}
+const DEFAULT_TIMEOUT_MS = 10 * 60_000;
+/**
+ * PATH lookup on Windows finds the extensionless Unix shell script (`npm`) before `npm.cmd`, and that cannot be
+ * spawned. Prefer the Windows launcher next to it. Elsewhere the lookup result is used as is.
+ */
+export async function resolveExecutable(found, name, platform, exists) {
+    if (!found)
+        return name;
+    if (platform !== 'win32' || /\.(?:exe|cmd|bat|com)$/i.test(found))
+        return found;
+    for (const ext of ['.cmd', '.exe', '.bat'])
+        if (await exists(found + ext))
+            return found + ext;
+    return found;
+}
+/**
+ * Run one contract check for the packages the task changed, and record what really happened. DevWorkspace only runs
+ * read-only, non-destructive commands; anything that may touch a database runs only after the user declared a test
+ * environment for that package and check. Refusals are recorded as "could not run", never as a pass.
+ */
+export async function runTaskCheck(o, id, check, opts = {}) {
+    const ws = await requireWorkspace(o.cwd);
+    const task = await loadTask(ws, id);
+    const contract = await loadContract(ws);
+    const wanted = opts.package ? (opts.package === '.' || opts.package === '' ? '.' : opts.package.replace(/\/+$/, '')) : undefined;
+    const entries = contract.filter((c) => c.id === check && c.available && (wanted === undefined || (c.cwd ?? '.') === wanted));
+    if (entries.length === 0) {
+        throw new DevWorkspaceError('NOT_FOUND', `The testing contract has no "${check}" command${wanted ? ` for package "${wanted}"` : ''}.`, {
+            hint: 'See the contract with "devworkspace context", or add the command to .devworkspace/context/commands.json.',
+        });
+    }
+    const scope = (await gateContext(ws, task, contract)).scope;
+    const decls = await loadTestEnv(ws);
+    const runner = o.runner ?? createRunner(o.env ?? process.env, o.platform);
+    const runs = [];
+    const evidence = [];
+    for (const entry of entries) {
+        const pkg = entry.cwd ?? '.';
+        const base = { package: pkg, command: entry.command };
+        const fingerprint = scope === null ? 'unknown' : scope[pkg];
+        if (wanted === undefined && fingerprint === undefined) {
+            runs.push({ ...base, outcome: 'not-affected', safety: 'safe', reason: 'the task changed nothing in this package' });
+            continue;
+        }
+        const manifest = await readManifestEvidence(ws.root, entry);
+        const cls = classifyCommand(entry, manifest);
+        if (cls.safety === 'blocked') {
+            runs.push({ ...base, outcome: 'refused', safety: cls.safety, reason: `refused: ${cls.reasons.join('; ')}` });
+            continue;
+        }
+        if (cls.safety === 'needs-test-environment' && !isDeclared(decls, pkg, check)) {
+            runs.push({
+                ...base,
+                outcome: 'refused',
+                safety: cls.safety,
+                reason: `refused: ${cls.reasons.join('; ')}. Run it yourself against a test environment you control, then declare it with: devworkspace testenv declare --package ${pkg} --check ${check} --target "<description>" --yes`,
+            });
+            continue;
+        }
+        const argv = splitCommand(entry.command ?? '');
+        if (!argv) {
+            runs.push({ ...base, outcome: 'refused', safety: cls.safety, reason: 'refused: the command uses shell syntax, and DevWorkspace never runs a shell' });
+            continue;
+        }
+        const exe = await resolveExecutable(await runner.which(argv[0]), argv[0], o.platform ?? process.platform, pathExists);
+        const started = Date.now();
+        const r = await runner.run({ command: exe, args: argv.slice(1), cwd: pkg === '.' ? ws.root : path.join(ws.root, ...pkg.split('/')), timeoutMs: opts.timeoutMs ?? DEFAULT_TIMEOUT_MS });
+        const durationMs = Date.now() - started;
+        if (r.code === null && !r.timedOut && r.error) {
+            // The command never started (missing executable, bad cwd): that is "could not run", not a test failure.
+            runs.push({ ...base, outcome: 'refused', safety: cls.safety, reason: `could not start: ${scrub(r.error)}` });
+            continue;
+        }
+        const passed = r.ok && r.code === 0;
+        const tail = passed ? undefined : scrub((r.error ?? '') || (r.timedOut ? 'timed out' : '') || r.stderr.slice(-300) || r.stdout.slice(-300) || `exit ${r.code}`);
+        runs.push({ ...base, outcome: passed ? 'passed' : 'failed', safety: cls.safety, exitCode: r.code, durationMs, ...(tail ? { reason: tail } : {}) });
+        evidence.push({ kind: 'executed', at: isoNow(o), package: pkg, command: entry.command ?? undefined, exitCode: r.code, durationMs, scope: fingerprint ?? 'unknown', ...(tail ? { note: tail } : {}) });
+    }
+    const updated = await mutate(o, async (w) => {
+        const t = await loadTask(w, id);
+        let item = t.verification.find((v) => v.check === check);
+        if (!item) {
+            item = { check, required: false, status: 'PENDING' };
+            t.verification.push(item);
+        }
+        for (const e of evidence)
+            item.evidence = [...(item.evidence ?? []).filter((x) => x.package !== e.package), e];
+        item.status = summarize(item, runs);
+        const refused = runs.filter((r) => r.outcome === 'refused');
+        if (item.status === 'COULD_NOT_RUN')
+            item.detail = refused.map((r) => `${r.package}: ${r.reason}`).join(' | ').slice(0, 500);
+        else
+            delete item.detail;
+        delete item.reason;
+        item.updatedAt = isoNow(o);
+        t.updatedAt = item.updatedAt;
+        assertNoSecrets(t);
+        await saveTask(w, t);
+        return t;
+    });
+    return { task: updated, check, runs };
+}
+function summarize(item, runs) {
+    if (runs.some((r) => r.outcome === 'failed'))
+        return 'FAIL';
+    if (runs.some((r) => r.outcome === 'refused'))
+        return 'COULD_NOT_RUN';
+    if (runs.some((r) => r.outcome === 'passed'))
+        return 'PASS';
+    return item.status;
+}
+// ---------- declared test environments ----------
+export async function declareTestEnv(o, input) {
+    if (!input.yes) {
+        throw new DevWorkspaceError('USAGE', 'Declaring a test environment is a statement that running these checks there is safe; confirm with --yes.', {
+            hint: 'DevWorkspace cannot verify a database target (it never reads connection settings). This records your assertion, locally, and nothing else.',
+        });
+    }
+    assertSafeTarget(input.target);
+    const ws = await requireWorkspace(o.cwd);
+    const pkg = input.package === '' ? '.' : input.package.replace(/\/+$/, '');
+    const contract = await loadContract(ws);
+    if (!contract.some((c) => c.available && (c.cwd ?? '.') === pkg)) {
+        throw new DevWorkspaceError('NOT_FOUND', `The testing contract has no commands for package "${pkg}".`, { hint: 'Use a package directory shown by "devworkspace context".' });
+    }
+    const allowed = new Set(['unit', 'integration', 'e2e', 'security']);
+    const bad = input.checks.filter((c) => !allowed.has(c));
+    if (input.checks.length === 0 || bad.length > 0) {
+        throw new DevWorkspaceError('USAGE', `--check must be one or more of: ${[...allowed].join(', ')}.`, { hint: 'Migrations, seeds and resets are never run by DevWorkspace.' });
+    }
+    const decl = { package: pkg, checks: [...new Set(input.checks)].sort(), target: input.target.trim(), declaredAt: isoNow(o) };
+    await mutate(o, async (w) => saveDeclaration(w, decl));
+    return decl;
+}
+export async function listTestEnv(o) {
+    return loadTestEnv(await requireWorkspace(o.cwd));
+}
+export async function revokeTestEnv(o, pkg) {
+    return mutate(o, async (w) => removeDeclaration(w, pkg === '' ? '.' : pkg.replace(/\/+$/, '')));
+}
+//# sourceMappingURL=verify.js.map

package/dist/services/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../src/services/verify.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAqB,MAAM,sBAAsB,CAAC;AAC3F,OAAO,EAAE,gBAAgB,EAAW,MAAM,sBAAsB,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,KAAK,EAAE,MAAM,4BAA4B,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAwF,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAC7J,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,WAAW,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,eAAe,EAA+C,MAAM,2BAA2B,CAAC;AAC9M,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AACxE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAuB,MAAM,aAAa,CAAC;AAElE,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EAAM;IACvC,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IAChD,OAAO,CAAC,MAAM,aAAa,CAAC,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,cAAc,EAAE,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;AACtG,CAAC;AAED,6GAA6G;AAC7G,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,EAAM,EAAE,IAAU,EAAE,QAAyB;IAC7E,MAAM,MAAM,GAAG,QAAQ,IAAI,CAAC,MAAM,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAClG,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AACrC,CAAC;AAqBD,gHAAgH;AAChH,MAAM,YAAY,GAAG,4BAA4B,CAAC;AAElD,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC1C,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACjC,CAAC;AAED,MAAM,kBAAkB,GAAG,EAAE,GAAG,MAAM,CAAC;AAEvC;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAAoB,EAAE,IAAY,EAAE,QAAyB,EAAE,MAAuC;IAC5I,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,QAAQ,KAAK,OAAO,IAAI,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAChF,KAAK,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;QAAE,IAAI,MAAM,MAAM,CAAC,KAAK,GAAG,GAAG,CAAC;YAAE,OAAO,KAAK,GAAG,GAAG,CAAC;IAC9F,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,CAAiB,EAAE,EAAU,EAAE,KAAa,EAAE,OAAiD,EAAE;IAClI,MAAM,EAAE,GAAG,MAAM,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IACpC,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,EAAE,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,KAAK,GAAG,IAAI,IAAI,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACjI,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,IAAI,CAAC,CAAC,SAAS,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC;IAC7H,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,iBAAiB,CAAC,WAAW,EAAE,gCAAgC,KAAK,YAAY,MAAM,CAAC,CAAC,CAAC,iBAAiB,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE;YACrI,IAAI,EAAE,0GAA0G;SACjH,CAAC,CAAC;IACL,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,MAAM,WAAW,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC;IAC5D,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,EAAE,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,IAAI,YAAY,CAAC,CAAC,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC1E,MAAM,IAAI,GAAiB,EAAE,CAAC;IAC9B,MAAM,QAAQ,GAAe,EAAE,CAAC;IAEhC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,GAAG,CAAC;QAC7B,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;QACtD,MAAM,WAAW,GAAG,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5D,IAAI,MAAM,KAAK,SAAS,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YACtD,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,0CAA0C,EAAE,CAAC,CAAC;YACpH,SAAS;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC5D,MAAM,GAAG,GAAG,eAAe,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAC7C,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC7B,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YAC7G,SAAS;QACX,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,wBAAwB,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC;YAC9E,IAAI,CAAC,IAAI,CAAC;gBACR,GAAG,IAAI;gBACP,OAAO,EAAE,SAAS;gBAClB,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,MAAM,EAAE,YAAY,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,0HAA0H,GAAG,YAAY,KAAK,iCAAiC;aAC1N,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QAC/C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,6EAA6E,EAAE,CAAC,CAAC;YACtJ,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,EAAE,IAAI,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACxH,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,kBAAkB,EAAE,CAAC,CAAC;QACvL,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;QACxC,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;YAC9C,wGAAwG;YACxG,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,oBAAoB,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;YAC7G,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAChK,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACnJ,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,WAAW,IAAI,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACxM,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC1C,MAAM,CAAC,GAAG,MAAM,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAChC,IAAI,IAAI,GAAG,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;QACzD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YACrD,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,QAAQ;YAAE,IAAI,CAAC,QAAQ,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;QAC/G,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACpC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC;QAC5D,IAAI,IAAI,CAAC,MAAM,KAAK,eAAe;YAAE,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;;YACxH,OAAO,IAAI,CAAC,MAAM,CAAC;QACxB,OAAO,IAAI,CAAC,MAAM,CAAC;QACnB,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QAC3B,CAAC,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAC7B,eAAe,CAAC,CAAC,CAAC,CAAC;QACnB,MAAM,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,CAAC,CAAC;IACX,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACxC,CAAC;AAED,SAAS,SAAS,CAAC,IAAsB,EAAE,IAAkB;IAC3D,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC;QAAE,OAAO,MAAM,CAAC;IAC5D,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC;QAAE,OAAO,eAAe,CAAC;IACtE,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC;QAAE,OAAO,MAAM,CAAC;IAC5D,OAAO,IAAI,CAAC,MAAM,CAAC;AACrB,CAAC;AAED,mDAAmD;AAEnD,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,CAAiB,EAAE,KAA0E;IAChI,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACf,MAAM,IAAI,iBAAiB,CAAC,OAAO,EAAE,0GAA0G,EAAE;YAC/I,IAAI,EAAE,4IAA4I;SACnJ,CAAC,CAAC;IACL,CAAC;IACD,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/B,MAAM,EAAE,GAAG,MAAM,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC3E,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,EAAE,CAAC,CAAC;IACxC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;QACjE,MAAM,IAAI,iBAAiB,CAAC,WAAW,EAAE,qDAAqD,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,0DAA0D,EAAE,CAAC,CAAC;IAC/K,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC;IACpE,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,iBAAiB,CAAC,OAAO,EAAE,mCAAmC,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,6DAA6D,EAAE,CAAC,CAAC;IAC/K,CAAC;IACD,MAAM,IAAI,GAAuB,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IACjJ,MAAM,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IACvD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,CAAiB;IACjD,OAAO,WAAW,CAAC,MAAM,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,CAAiB,EAAE,GAAW;IAChE,OAAO,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;AAClG,CAAC","sourcesContent":["import path from 'node:path';\nimport { SCHEMA_VERSION, validateCommands, type CommandEntry } from '../config/schemas.js';\nimport { requireWorkspace, type Ws } from '../core/workspace.js';\nimport { readVersioned } from '../core/versioned.js';\nimport { DevWorkspaceError } from '../errors/index.js';\nimport { createRunner } from '../integrations/exec.js';\nimport { scrub } from '../integrations/manager.js';\nimport { loadTask, saveTask, type Evidence, type GateContext, type Task, type VerificationItem, type VerifyStatus, assertNoSecrets } from '../tasks/task.js';\nimport { pathExists } from '../utils/fs.js';\nimport { classifyCommand, isDeclared, loadTestEnv, readManifestEvidence, assertSafeTarget, removeDeclaration, saveDeclaration, type CommandSafety, type TestEnvDeclaration } from '../verification/safety.js';\nimport { changedSince, scopeByPackage } from '../verification/scope.js';\nimport { isoNow, mutate, type ServiceOptions } from './common.js';\n\nexport async function loadContract(ws: Ws): Promise<CommandEntry[]> {\n  if (!(await pathExists(ws.commands))) return [];\n  return (await readVersioned(ws.commands, 'commands', SCHEMA_VERSION, validateCommands)).data.checks;\n}\n\n/** Contract plus what the task has changed per package: everything the completion gate needs to judge it. */\nexport async function gateContext(ws: Ws, task: Task, contract?: CommandEntry[]): Promise<GateContext> {\n  const checks = contract ?? (await loadContract(ws));\n  const scope = task.scope ? scopeByPackage(await changedSince(ws.root, task.scope), checks) : null;\n  return { contract: checks, scope };\n}\n\nexport type RunOutcome = 'passed' | 'failed' | 'refused' | 'not-affected';\n\nexport interface PackageRun {\n  package: string;\n  command: string | null;\n  outcome: RunOutcome;\n  exitCode?: number | null;\n  durationMs?: number;\n  /** Why DevWorkspace did not run it, or the scrubbed tail of a failure. */\n  reason?: string;\n  safety: CommandSafety['safety'];\n}\n\nexport interface RunCheckResult {\n  task: Task;\n  check: string;\n  runs: PackageRun[];\n}\n\n/** Anything a shell would interpret. Contract commands are run as an argument vector, never through a shell. */\nconst SHELL_SYNTAX = /[&|;<>$`(){}\"'\\\\*?!%^\\r\\n]/;\n\nexport function splitCommand(command: string): string[] | null {\n  if (SHELL_SYNTAX.test(command)) return null;\n  const parts = command.trim().split(/\\s+/);\n  return parts[0] ? parts : null;\n}\n\nconst DEFAULT_TIMEOUT_MS = 10 * 60_000;\n\n/**\n * PATH lookup on Windows finds the extensionless Unix shell script (`npm`) before `npm.cmd`, and that cannot be\n * spawned. Prefer the Windows launcher next to it. Elsewhere the lookup result is used as is.\n */\nexport async function resolveExecutable(found: string | null, name: string, platform: NodeJS.Platform, exists: (p: string) => Promise<boolean>): Promise<string> {\n  if (!found) return name;\n  if (platform !== 'win32' || /\\.(?:exe|cmd|bat|com)$/i.test(found)) return found;\n  for (const ext of ['.cmd', '.exe', '.bat']) if (await exists(found + ext)) return found + ext;\n  return found;\n}\n\n/**\n * Run one contract check for the packages the task changed, and record what really happened. DevWorkspace only runs\n * read-only, non-destructive commands; anything that may touch a database runs only after the user declared a test\n * environment for that package and check. Refusals are recorded as \"could not run\", never as a pass.\n */\nexport async function runTaskCheck(o: ServiceOptions, id: string, check: string, opts: { package?: string; timeoutMs?: number } = {}): Promise<RunCheckResult> {\n  const ws = await requireWorkspace(o.cwd);\n  const task = await loadTask(ws, id);\n  const contract = await loadContract(ws);\n  const wanted = opts.package ? (opts.package === '.' || opts.package === '' ? '.' : opts.package.replace(/\\/+$/, '')) : undefined;\n  const entries = contract.filter((c) => c.id === check && c.available && (wanted === undefined || (c.cwd ?? '.') === wanted));\n  if (entries.length === 0) {\n    throw new DevWorkspaceError('NOT_FOUND', `The testing contract has no \"${check}\" command${wanted ? ` for package \"${wanted}\"` : ''}.`, {\n      hint: 'See the contract with \"devworkspace context\", or add the command to .devworkspace/context/commands.json.',\n    });\n  }\n  const scope = (await gateContext(ws, task, contract)).scope;\n  const decls = await loadTestEnv(ws);\n  const runner = o.runner ?? createRunner(o.env ?? process.env, o.platform);\n  const runs: PackageRun[] = [];\n  const evidence: Evidence[] = [];\n\n  for (const entry of entries) {\n    const pkg = entry.cwd ?? '.';\n    const base = { package: pkg, command: entry.command };\n    const fingerprint = scope === null ? 'unknown' : scope[pkg];\n    if (wanted === undefined && fingerprint === undefined) {\n      runs.push({ ...base, outcome: 'not-affected', safety: 'safe', reason: 'the task changed nothing in this package' });\n      continue;\n    }\n    const manifest = await readManifestEvidence(ws.root, entry);\n    const cls = classifyCommand(entry, manifest);\n    if (cls.safety === 'blocked') {\n      runs.push({ ...base, outcome: 'refused', safety: cls.safety, reason: `refused: ${cls.reasons.join('; ')}` });\n      continue;\n    }\n    if (cls.safety === 'needs-test-environment' && !isDeclared(decls, pkg, check)) {\n      runs.push({\n        ...base,\n        outcome: 'refused',\n        safety: cls.safety,\n        reason: `refused: ${cls.reasons.join('; ')}. Run it yourself against a test environment you control, then declare it with: devworkspace testenv declare --package ${pkg} --check ${check} --target \"<description>\" --yes`,\n      });\n      continue;\n    }\n    const argv = splitCommand(entry.command ?? '');\n    if (!argv) {\n      runs.push({ ...base, outcome: 'refused', safety: cls.safety, reason: 'refused: the command uses shell syntax, and DevWorkspace never runs a shell' });\n      continue;\n    }\n    const exe = await resolveExecutable(await runner.which(argv[0]!), argv[0]!, o.platform ?? process.platform, pathExists);\n    const started = Date.now();\n    const r = await runner.run({ command: exe, args: argv.slice(1), cwd: pkg === '.' ? ws.root : path.join(ws.root, ...pkg.split('/')), timeoutMs: opts.timeoutMs ?? DEFAULT_TIMEOUT_MS });\n    const durationMs = Date.now() - started;\n    if (r.code === null && !r.timedOut && r.error) {\n      // The command never started (missing executable, bad cwd): that is \"could not run\", not a test failure.\n      runs.push({ ...base, outcome: 'refused', safety: cls.safety, reason: `could not start: ${scrub(r.error)}` });\n      continue;\n    }\n    const passed = r.ok && r.code === 0;\n    const tail = passed ? undefined : scrub((r.error ?? '') || (r.timedOut ? 'timed out' : '') || r.stderr.slice(-300) || r.stdout.slice(-300) || `exit ${r.code}`);\n    runs.push({ ...base, outcome: passed ? 'passed' : 'failed', safety: cls.safety, exitCode: r.code, durationMs, ...(tail ? { reason: tail } : {}) });\n    evidence.push({ kind: 'executed', at: isoNow(o), package: pkg, command: entry.command ?? undefined, exitCode: r.code, durationMs, scope: fingerprint ?? 'unknown', ...(tail ? { note: tail } : {}) });\n  }\n\n  const updated = await mutate(o, async (w) => {\n    const t = await loadTask(w, id);\n    let item = t.verification.find((v) => v.check === check);\n    if (!item) {\n      item = { check, required: false, status: 'PENDING' };\n      t.verification.push(item);\n    }\n    for (const e of evidence) item.evidence = [...(item.evidence ?? []).filter((x) => x.package !== e.package), e];\n    item.status = summarize(item, runs);\n    const refused = runs.filter((r) => r.outcome === 'refused');\n    if (item.status === 'COULD_NOT_RUN') item.detail = refused.map((r) => `${r.package}: ${r.reason}`).join(' | ').slice(0, 500);\n    else delete item.detail;\n    delete item.reason;\n    item.updatedAt = isoNow(o);\n    t.updatedAt = item.updatedAt;\n    assertNoSecrets(t);\n    await saveTask(w, t);\n    return t;\n  });\n  return { task: updated, check, runs };\n}\n\nfunction summarize(item: VerificationItem, runs: PackageRun[]): VerifyStatus {\n  if (runs.some((r) => r.outcome === 'failed')) return 'FAIL';\n  if (runs.some((r) => r.outcome === 'refused')) return 'COULD_NOT_RUN';\n  if (runs.some((r) => r.outcome === 'passed')) return 'PASS';\n  return item.status;\n}\n\n// ---------- declared test environments ----------\n\nexport async function declareTestEnv(o: ServiceOptions, input: { package: string; checks: string[]; target: string; yes: boolean }): Promise<TestEnvDeclaration> {\n  if (!input.yes) {\n    throw new DevWorkspaceError('USAGE', 'Declaring a test environment is a statement that running these checks there is safe; confirm with --yes.', {\n      hint: 'DevWorkspace cannot verify a database target (it never reads connection settings). This records your assertion, locally, and nothing else.',\n    });\n  }\n  assertSafeTarget(input.target);\n  const ws = await requireWorkspace(o.cwd);\n  const pkg = input.package === '' ? '.' : input.package.replace(/\\/+$/, '');\n  const contract = await loadContract(ws);\n  if (!contract.some((c) => c.available && (c.cwd ?? '.') === pkg)) {\n    throw new DevWorkspaceError('NOT_FOUND', `The testing contract has no commands for package \"${pkg}\".`, { hint: 'Use a package directory shown by \"devworkspace context\".' });\n  }\n  const allowed = new Set(['unit', 'integration', 'e2e', 'security']);\n  const bad = input.checks.filter((c) => !allowed.has(c));\n  if (input.checks.length === 0 || bad.length > 0) {\n    throw new DevWorkspaceError('USAGE', `--check must be one or more of: ${[...allowed].join(', ')}.`, { hint: 'Migrations, seeds and resets are never run by DevWorkspace.' });\n  }\n  const decl: TestEnvDeclaration = { package: pkg, checks: [...new Set(input.checks)].sort(), target: input.target.trim(), declaredAt: isoNow(o) };\n  await mutate(o, async (w) => saveDeclaration(w, decl));\n  return decl;\n}\n\nexport async function listTestEnv(o: ServiceOptions): Promise<TestEnvDeclaration[]> {\n  return loadTestEnv(await requireWorkspace(o.cwd));\n}\n\nexport async function revokeTestEnv(o: ServiceOptions, pkg: string): Promise<boolean> {\n  return mutate(o, async (w) => removeDeclaration(w, pkg === '' ? '.' : pkg.replace(/\\/+$/, '')));\n}\n"]}

package/dist/tasks/routing.js

@@ -158,7 +158,9 @@ export function detectConstraints(text) {
     return OVERRIDE_PATTERNS.filter(([, re]) => re.test(text)).map(([c]) => c);
 }
 const QUESTION_START = /^\s*(?:where|what|which|who|when|how\s+(?:does|do|is|are|can|should)|why|explain|describe|show\s+me|walk\s+me|is\s+there|are\s+there|can\s+you\s+(?:explain|tell|show)|tell\s+me|list|find)\b/i;
-const IMPERATIVE_START = /^\s*(?:fix|add|implement|create|build|refactor|remove|delete|update|change|rename|write|make|migrate|upgrade|optimi[sz]e|release|publish)\b/i;
+const IMPERATIVE_START = /^\s*(?:fix|add|implement|create|build|refactor|remove|delete|update|change|rename|write|make|migrate|upgrade|optimi[sz]e|release|publish|validate|ensure|prevent|enforce|guard|reject|restrict|handle|resolve|patch|repair|address|correct|replace|move|extract|rewrite|convert|improve|enable|disable|support|introduce|apply|configure|install|harden|secure|scope|isolate)\b/i;
+/** A direct yes/no or open question: it ends in a question mark and does not start like an instruction. */
+const DIRECT_QUESTION = /\?\s*$/;
 /** Heuristic classifier used to propose a task type. The agent may override it; ambiguous input defaults to the safest (read-only) type. */
 export function classifyRequest(text) {
     const constraints = detectConstraints(text);
@@ -170,17 +172,19 @@ export function classifyRequest(text) {
         constraints,
         readOnly: WORKFLOWS[type].readOnly || constraints.includes('no-modify') || constraints.includes('plan-only'),
     });
-    if (QUESTION_START.test(t) && !IMPERATIVE_START.test(t))
+    if ((QUESTION_START.test(t) || DIRECT_QUESTION.test(t)) && !IMPERATIVE_START.test(t))
         return make('QUESTION', 'high');
     if (/\b(?:add|write|improve|increase)\s+(?:\w+\s+)?(?:unit\s+|e2e\s+|integration\s+)?tests?\b|\btest coverage\b|^\s*run\s+(?:the\s+|all\s+)?(?:\w+\s+)?tests?\b/i.test(t))
         return make('TESTING', 'high');
     if (/\b(?:upgrade|bump|update\s+dependenc\w*)\b/i.test(t))
         return make('MAINTENANCE', 'high');
+    if (/\b(?:vulnerab\w*|csrf|xss|sql injection|cve-\d+|cross-?tenant|tenant isolation|privilege escalation|idor)\b/i.test(t))
+        return make('SECURITY', 'high');
     if (/\b(?:fix|bug|broken|crash(?:es|ing)?|regression|not working|fails?|failing|exception|error)\b/i.test(t))
         return make('BUG', 'high');
     if (/\b(?:refactor|restructure|reorgani[sz]e|clean\s?up|simplify|de-?duplicate)\b/i.test(t))
         return make('REFACTOR', 'high');
-    if (/\b(?:vulnerab\w*|security|csrf|xss|sql injection|sanitiz\w*|harden\w*|cve-\d+)\b/i.test(t))
+    if (/\b(?:vulnerab\w*|security|csrf|xss|sql injection|sanitiz\w*|harden\w*|cve-\d+|cross-?tenant|tenant isolation|ownership|authori[sz]ation|privilege escalation|idor)\b/i.test(t))
         return make('SECURITY', 'high');
     if (/\b(?:performance|slow|latency|speed up|optimi[sz]e|throughput)\b/i.test(t))
         return make('PERFORMANCE', 'high');
@@ -194,6 +198,9 @@ export function classifyRequest(text) {
         return make('ARCHITECTURE', 'high');
     if (/\b(?:add|implement|create|build|support|introduce|enable|new)\b/i.test(t))
         return make('FEATURE', 'high');
+    // An instruction we cannot place is still a request to change something. Never default it to a read-only question.
+    if (IMPERATIVE_START.test(t))
+        return make('FEATURE', 'low');
     return make('QUESTION', 'low');
 }
 export function renderRoutingTable() {

package/dist/tasks/routing.js.map

@@ -1 +1 @@
-{"version":3,"file":"routing.js","sourceRoot":"","sources":["../../src/tasks/routing.ts"],"names":[],"mappings":"AAiBA,uHAAuH;AACvH,MAAM,CAAC,MAAM,SAAS,GAAmC;IACvD,QAAQ,EAAE;QACR,IAAI,EAAE,UAAU;QAChB,YAAY,EAAE,CAAC;QACf,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,KAAK;QAChB,KAAK,EAAE;YACL,+FAA+F;YAC/F,4FAA4F;YAC5F,4DAA4D;SAC7D;QACD,YAAY,EAAE,yCAAyC;QACvD,WAAW,EAAE,EAAE;QACf,QAAQ,EAAE,WAAW;QACrB,eAAe,EAAE,gGAAgG;KAClH;IACD,GAAG,EAAE;QACH,IAAI,EAAE,KAAK;QACX,YAAY,EAAE,CAAC;QACf,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,IAAI;QACf,KAAK,EAAE;YACL,qDAAqD;YACrD,4CAA4C;YAC5C,+CAA+C;YAC/C,yCAAyC;YACzC,qGAAqG;YACrG,kEAAkE;SACnE;QACD,YAAY,EAAE,2GAA2G;QACzH,WAAW,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC;QACjC,QAAQ,EAAE,0DAA0D;QACpE,eAAe,EAAE,iEAAiE;KACnF;IACD,OAAO,EAAE;QACP,IAAI,EAAE,SAAS;QACf,YAAY,EAAE,CAAC;QACf,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,IAAI;QACf,KAAK,EAAE;YACL,sDAAsD;YACtD,2DAA2D;YAC3D,+CAA+C;YAC/C,iEAAiE;YACjE,kBAAkB;YAClB,mFAAmF;SACpF;QACD,YAAY,EAAE,6DAA6D;QAC3E,WAAW,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC;QAC7D,QAAQ,EAAE,sDAAsD;QAChE,eAAe,EAAE,6EAA6E;KAC/F;IACD,QAAQ,EAAE;QACR,IAAI,EAAE,UAAU;QAChB,YAAY,EAAE,CAAC;QACf,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,IAAI;QACf,KAAK,EAAE;YACL,8EAA8E;YAC9E,2EAA2E;YAC3E,8CAA8C;YAC9C,wFAAwF;YACxF,kBAAkB;SACnB;QACD,YAAY,EAAE,qEAAqE;QACnF,WAAW,EAAE,CAAC,OAAO,EAAE,gBAAgB,EAAE,SAAS,CAAC;QACnD,QAAQ,EAAE,gCAAgC;QAC1C,eAAe,EAAE,0CAA0C;KAC5D;IACD,aAAa,EAAE;QACb,IAAI,EAAE,eAAe;QACrB,YAAY,EAAE,CAAC;QACf,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,KAAK;QAChB,KAAK,EAAE,CAAC,0CAA0C,EAAE,0BAA0B,EAAE,yEAAyE,CAAC;QAC1J,YAAY,EAAE,0CAA0C;QACxD,WAAW,EAAE,EAAE;QACf,QAAQ,EAAE,WAAW;QACrB,eAAe,EAAE,SAAS;KAC3B;IACD,OAAO,EAAE;QACP,IAAI,EAAE,SAAS;QACf,YAAY,EAAE,CAAC;QACf,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,IAAI;QACf,KAAK,EAAE,CAAC,mBAAmB,EAAE,iCAAiC,EAAE,qEAAqE,EAAE,iDAAiD,CAAC;QACzL,YAAY,EAAE,kCAAkC;QAChD,WAAW,EAAE,CAAC,OAAO,CAAC;QACtB,QAAQ,EAAE,WAAW;QACrB,eAAe,EAAE,8CAA8C;KAChE;IACD,WAAW,EAAE;QACX,IAAI,EAAE,aAAa;QACnB,YAAY,EAAE,CAAC;QACf,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,IAAI;QACf,KAAK,EAAE,CAAC,qCAAqC,EAAE,6BAA6B,EAAE,oDAAoD,EAAE,SAAS,CAAC;QAC9I,YAAY,EAAE,oDAAoD;QAClE,WAAW,EAAE,CAAC,UAAU,EAAE,SAAS,CAAC;QACpC,QAAQ,EAAE,8BAA8B;QACxC,eAAe,EAAE,iDAAiD;KACnE;IACD,QAAQ,EAAE;QACR,IAAI,EAAE,UAAU;QAChB,YAAY,EAAE,CAAC;QACf,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,IAAI;QACf,KAAK,EAAE,CAAC,mBAAmB,EAAE,+CAA+C,EAAE,6CAA6C,EAAE,2CAA2C,EAAE,qDAAqD,CAAC;QAChO,YAAY,EAAE,8DAA8D;QAC5E,WAAW,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC;QACjC,QAAQ,EAAE,8CAA8C;QACxD,eAAe,EAAE,gDAAgD;KAClE;IACD,YAAY,EAAE;QACZ,IAAI,EAAE,cAAc;QACpB,YAAY,EAAE,CAAC;QACf,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,IAAI;QACf,KAAK,EAAE,CAAC,4EAA4E,EAAE,6EAA6E,EAAE,uCAAuC,EAAE,+BAA+B,CAAC;QAC9O,YAAY,EAAE,oDAAoD;QAClE,WAAW,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC;QACpD,QAAQ,EAAE,qCAAqC;QAC/C,eAAe,EAAE,qDAAqD;KACvE;IACD,OAAO,EAAE;QACP,IAAI,EAAE,SAAS;QACf,YAAY,EAAE,CAAC;QACf,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,IAAI;QACf,KAAK,EAAE,CAAC,8BAA8B,EAAE,0EAA0E,EAAE,sDAAsD,EAAE,6DAA6D,CAAC;QAC1O,YAAY,EAAE,qCAAqC;QACnD,WAAW,EAAE,CAAC,OAAO,CAAC;QACtB,QAAQ,EAAE,wBAAwB;QAClC,eAAe,EAAE,mCAAmC;KACrD;IACD,WAAW,EAAE;QACX,IAAI,EAAE,aAAa;QACnB,YAAY,EAAE,CAAC;QACf,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,IAAI;QACf,KAAK,EAAE,CAAC,mBAAmB,EAAE,kBAAkB,EAAE,4DAA4D,CAAC;QAC9G,YAAY,EAAE,+CAA+C;QAC7D,WAAW,EAAE,EAAE;QACf,QAAQ,EAAE,WAAW;QACrB,eAAe,EAAE,uCAAuC;KACzD;CACF,CAAC;AAEF,MAAM,iBAAiB,GAA2B;IAChD,CAAC,WAAW,EAAE,0KAA0K,CAAC;IACzL,CAAC,WAAW,EAAE,iFAAiF,CAAC;IAChG,CAAC,WAAW,EAAE,8DAA8D,CAAC;IAC7E,CAAC,QAAQ,EAAE,sFAAsF,CAAC;IAClG,CAAC,UAAU,EAAE,iFAAiF,CAAC;IAC/F,CAAC,QAAQ,EAAE,wDAAwD,CAAC;CACrE,CAAC;AAEF,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;AAC7E,CAAC;AAUD,MAAM,cAAc,GAAG,gMAAgM,CAAC;AACxN,MAAM,gBAAgB,GAAG,8IAA8I,CAAC;AAExK,4IAA4I;AAC5I,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,MAAM,WAAW,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC5C,+EAA+E;IAC/E,MAAM,CAAC,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,GAAG,GAAG,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1H,MAAM,IAAI,GAAG,CAAC,IAAc,EAAE,UAA0B,EAAkB,EAAE,CAAC,CAAC;QAC5E,IAAI;QACJ,UAAU;QACV,WAAW;QACX,QAAQ,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,IAAI,WAAW,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,WAAW,CAAC;KAC7G,CAAC,CAAC;IACH,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACzF,IAAI,6JAA6J,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC1M,IAAI,6CAA6C,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IAC9F,IAAI,gGAAgG,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACzI,IAAI,+EAA+E,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC7H,IAAI,mFAAmF,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACjI,IAAI,mEAAmE,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IACpH,IAAI,yDAAyD,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC5G,IAAI,mDAAmD,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAChG,IAAI,gFAAgF,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IACjI,IAAI,8DAA8D,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;IAChH,IAAI,kEAAkE,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC/G,OAAO,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,MAAM,IAAI,GAAI,MAAM,CAAC,MAAM,CAAC,SAAS,CAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAClE,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrH,OAAO,KAAK,CAAC,CAAC,IAAI,MAAM,KAAK,OAAO,CAAC,CAAC,YAAY,MAAM,CAAC,CAAC,YAAY,IAAI,CAAC;IAC7E,CAAC,CAAC,CAAC;IACH,OAAO,CAAC,gDAAgD,EAAE,2BAA2B,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC7G,CAAC","sourcesContent":["import type { TaskType } from './task.js';\n\nexport type Constraint = 'no-modify' | 'plan-only' | 'no-commit' | 'no-e2e' | 'no-tests' | 'no-fix';\n\nexport interface WorkflowSpec {\n  type: TaskType;\n  /** Highest context level normally needed (1 instructions … 6 tests/implementation). */\n  contextDepth: 1 | 2 | 3 | 4 | 5 | 6;\n  readOnly: boolean;\n  trackTask: boolean;\n  steps: string[];\n  verification: string;\n  agentSkills: string[];\n  ponytail: string;\n  knowledgeUpdate: string;\n}\n\n/** Single source of truth for routing. The generated Claude skill and docs/routing.md are rendered from this table. */\nexport const WORKFLOWS: Record<TaskType, WorkflowSpec> = {\n  QUESTION: {\n    type: 'QUESTION',\n    contextDepth: 5,\n    readOnly: true,\n    trackTask: false,\n    steps: [\n      'Read .devworkspace/context facts relevant to the topic (devworkspace context --topic <area>).',\n      'Use Graphify (if ready) or targeted search to locate the code; read only the files needed.',\n      'Answer with file references. State uncertainty explicitly.',\n    ],\n    verification: 'None. Do not modify files or run tests.',\n    agentSkills: [],\n    ponytail: 'Not used.',\n    knowledgeUpdate: 'Only if you discovered a durable fact that is missing; record it with \"devworkspace fact add\".',\n  },\n  BUG: {\n    type: 'BUG',\n    contextDepth: 6,\n    readOnly: false,\n    trackTask: true,\n    steps: [\n      'Check git status; protect uncommitted user changes.',\n      'Investigate and reproduce where practical.',\n      'Write a regression test and confirm it fails.',\n      'Fix the cause, confirm the test passes.',\n      'Run the applicable regression suite, then typecheck/lint/build as required by the testing contract.',\n      'Review the diff; record results with \"devworkspace task verify\".',\n    ],\n    verification: 'Regression test, applicable suite, typecheck, lint, build (whatever the testing contract marks required).',\n    agentSkills: ['/test', '/review'],\n    ponytail: 'Light review of the diff when review level is not \"off\".',\n    knowledgeUpdate: 'Only if the bug revealed a persistent constraint or convention.',\n  },\n  FEATURE: {\n    type: 'FEATURE',\n    contextDepth: 6,\n    readOnly: false,\n    trackTask: true,\n    steps: [\n      'Check git status. Read relevant facts and decisions.',\n      'Write acceptance criteria and a short plan (task update).',\n      'Write tests for the criteria, then implement.',\n      'Run targeted tests, then regression, then typecheck/lint/build.',\n      'Review the diff.',\n      'Update project knowledge for architecture, conventions or decisions that changed.',\n    ],\n    verification: 'Targeted tests, regression, typecheck, lint, build, review.',\n    agentSkills: ['/spec', '/plan', '/build', '/test', '/review'],\n    ponytail: 'Review for unnecessary complexity before completion.',\n    knowledgeUpdate: 'Yes when the feature adds a module, integration, business rule or decision.',\n  },\n  REFACTOR: {\n    type: 'REFACTOR',\n    contextDepth: 6,\n    readOnly: false,\n    trackTask: true,\n    steps: [\n      'Check git status. Analyse architecture, decisions and dependents (Graphify).',\n      'Record a baseline test result (devworkspace task tests --phase baseline).',\n      'Plan, then refactor in small verified steps.',\n      'Run targeted verification and the full regression suite; compare against the baseline.',\n      'Review the diff.',\n    ],\n    verification: 'Baseline vs after (no regressions), typecheck, lint, build, review.',\n    agentSkills: ['/plan', '/code-simplify', '/review'],\n    ponytail: 'Use for simplification review.',\n    knowledgeUpdate: 'Yes if structure or conventions changed.',\n  },\n  DOCUMENTATION: {\n    type: 'DOCUMENTATION',\n    contextDepth: 4,\n    readOnly: false,\n    trackTask: false,\n    steps: ['Read the code or facts being documented.', 'Edit documentation only.', 'Run documentation checks if the project has them (link or lint checks).'],\n    verification: 'Only checks that apply to documentation.',\n    agentSkills: [],\n    ponytail: 'Not used.',\n    knowledgeUpdate: 'Rarely.',\n  },\n  TESTING: {\n    type: 'TESTING',\n    contextDepth: 6,\n    readOnly: false,\n    trackTask: true,\n    steps: ['Check git status.', 'Find existing test conventions.', 'Add tests; confirm they fail for the right reason where applicable.', 'Run the affected suite plus typecheck and lint.'],\n    verification: 'Affected tests, typecheck, lint.',\n    agentSkills: ['/test'],\n    ponytail: 'Optional.',\n    knowledgeUpdate: 'If the testing strategy or commands changed.',\n  },\n  PERFORMANCE: {\n    type: 'PERFORMANCE',\n    contextDepth: 6,\n    readOnly: false,\n    trackTask: true,\n    steps: ['Measure first; record the baseline.', 'Change one thing at a time.', 'Re-measure and run the regression suite and build.', 'Review.'],\n    verification: 'Before/after measurement, regression suite, build.',\n    agentSkills: ['/webperf', '/review'],\n    ponytail: 'Review for added complexity.',\n    knowledgeUpdate: 'If a persistent constraint or decision emerged.',\n  },\n  SECURITY: {\n    type: 'SECURITY',\n    contextDepth: 6,\n    readOnly: false,\n    trackTask: true,\n    steps: ['Check git status.', 'Understand the threat and the affected paths.', 'Test that demonstrates the issue, then fix.', 'Regression suite, typecheck, lint, build.', 'Security-focused review. Never print secret values.'],\n    verification: 'Regression and exploit test, typecheck, lint, build, review.',\n    agentSkills: ['/test', '/review'],\n    ponytail: 'Use for bug and security review of the diff.',\n    knowledgeUpdate: 'Yes for new security conventions or decisions.',\n  },\n  ARCHITECTURE: {\n    type: 'ARCHITECTURE',\n    contextDepth: 6,\n    readOnly: false,\n    trackTask: true,\n    steps: ['Read facts, decisions and architecture notes; map structure with Graphify.', 'Present options and record the chosen one with \"devworkspace decision add\".', 'Plan and implement in verified steps.', 'Full verification and review.'],\n    verification: 'Baseline vs after, typecheck, lint, build, review.',\n    agentSkills: ['/spec', '/plan', '/build', '/review'],\n    ponytail: 'Review for unnecessary abstraction.',\n    knowledgeUpdate: 'Always: architecture notes and the decision record.',\n  },\n  RELEASE: {\n    type: 'RELEASE',\n    contextDepth: 6,\n    readOnly: false,\n    trackTask: true,\n    steps: ['Check git status and branch.', 'Run the full testing contract including integration/e2e where available.', 'Update changelog and version per project convention.', 'Do not publish or push without explicit user authorisation.'],\n    verification: 'Everything in the testing contract.',\n    agentSkills: ['/ship'],\n    ponytail: 'Optional final review.',\n    knowledgeUpdate: 'If release process facts changed.',\n  },\n  MAINTENANCE: {\n    type: 'MAINTENANCE',\n    contextDepth: 4,\n    readOnly: false,\n    trackTask: true,\n    steps: ['Check git status.', 'Make the change.', 'Run lint and build; run tests when behaviour could change.'],\n    verification: 'Lint, build, tests if behaviour could change.',\n    agentSkills: [],\n    ponytail: 'Optional.',\n    knowledgeUpdate: 'Only for changed commands or tooling.',\n  },\n};\n\nconst OVERRIDE_PATTERNS: [Constraint, RegExp][] = [\n  ['no-modify', /\\b(?:only|just)\\s+(?:explain|describe|investigate|look|read|review)\\b|\\b(?:do\\s*n[o']t|don'?t|never)\\s+(?:modify|change|edit|touch)\\b|\\bread[- ]only\\b|\\bno\\s+changes\\b/i],\n  ['plan-only', /\\b(?:only|just)\\s+(?:make\\s+|write\\s+|give\\s+me\\s+)?a\\s+plan\\b|\\bplan\\s+only\\b/i],\n  ['no-commit', /\\b(?:do\\s*n[o']t|don'?t|never)\\s+commit\\b|\\bno\\s+commits?\\b/i],\n  ['no-e2e', /\\b(?:do\\s*n[o']t|don'?t|skip|no)\\s+(?:run\\s+)?(?:the\\s+)?(?:e2e|end[- ]to[- ]end)\\b/i],\n  ['no-tests', /\\b(?:do\\s*n[o']t|don'?t|skip)\\s+(?:run\\s+)?(?:any\\s+|the\\s+)?tests\\b(?!\\s+but)/i],\n  ['no-fix', /\\b(?:do\\s*n[o']t|don'?t)\\s+fix\\b|\\bwithout\\s+fixing\\b/i],\n];\n\nexport function detectConstraints(text: string): Constraint[] {\n  return OVERRIDE_PATTERNS.filter(([, re]) => re.test(text)).map(([c]) => c);\n}\n\nexport interface Classification {\n  type: TaskType;\n  confidence: 'high' | 'low';\n  constraints: Constraint[];\n  /** True when the request must not change files (question type, or an explicit user override). */\n  readOnly: boolean;\n}\n\nconst QUESTION_START = /^\\s*(?:where|what|which|who|when|how\\s+(?:does|do|is|are|can|should)|why|explain|describe|show\\s+me|walk\\s+me|is\\s+there|are\\s+there|can\\s+you\\s+(?:explain|tell|show)|tell\\s+me|list|find)\\b/i;\nconst IMPERATIVE_START = /^\\s*(?:fix|add|implement|create|build|refactor|remove|delete|update|change|rename|write|make|migrate|upgrade|optimi[sz]e|release|publish)\\b/i;\n\n/** Heuristic classifier used to propose a task type. The agent may override it; ambiguous input defaults to the safest (read-only) type. */\nexport function classifyRequest(text: string): Classification {\n  const constraints = detectConstraints(text);\n  // Negated phrases (\"don't fix anything\") describe limits, not the task itself.\n  const t = OVERRIDE_PATTERNS.reduce((acc, [, re]) => acc.replace(new RegExp(re.source, re.flags + 'g'), ' '), text).trim();\n  const make = (type: TaskType, confidence: 'high' | 'low'): Classification => ({\n    type,\n    confidence,\n    constraints,\n    readOnly: WORKFLOWS[type].readOnly || constraints.includes('no-modify') || constraints.includes('plan-only'),\n  });\n  if (QUESTION_START.test(t) && !IMPERATIVE_START.test(t)) return make('QUESTION', 'high');\n  if (/\\b(?:add|write|improve|increase)\\s+(?:\\w+\\s+)?(?:unit\\s+|e2e\\s+|integration\\s+)?tests?\\b|\\btest coverage\\b|^\\s*run\\s+(?:the\\s+|all\\s+)?(?:\\w+\\s+)?tests?\\b/i.test(t)) return make('TESTING', 'high');\n  if (/\\b(?:upgrade|bump|update\\s+dependenc\\w*)\\b/i.test(t)) return make('MAINTENANCE', 'high');\n  if (/\\b(?:fix|bug|broken|crash(?:es|ing)?|regression|not working|fails?|failing|exception|error)\\b/i.test(t)) return make('BUG', 'high');\n  if (/\\b(?:refactor|restructure|reorgani[sz]e|clean\\s?up|simplify|de-?duplicate)\\b/i.test(t)) return make('REFACTOR', 'high');\n  if (/\\b(?:vulnerab\\w*|security|csrf|xss|sql injection|sanitiz\\w*|harden\\w*|cve-\\d+)\\b/i.test(t)) return make('SECURITY', 'high');\n  if (/\\b(?:performance|slow|latency|speed up|optimi[sz]e|throughput)\\b/i.test(t)) return make('PERFORMANCE', 'high');\n  if (/\\b(?:document|readme|docs|changelog|jsdoc|docstring)\\b/i.test(t)) return make('DOCUMENTATION', 'high');\n  if (/\\b(?:release|publish|deploy|ship|version bump)\\b/i.test(t)) return make('RELEASE', 'high');\n  if (/\\b(?:upgrade|bump|update\\s+dependenc\\w*|chore|lint(?:ing)?|format(?:ting)?)\\b/i.test(t)) return make('MAINTENANCE', 'high');\n  if (/\\b(?:redesign|re-?architect\\w*|migrate\\s+to|architecture)\\b/i.test(t)) return make('ARCHITECTURE', 'high');\n  if (/\\b(?:add|implement|create|build|support|introduce|enable|new)\\b/i.test(t)) return make('FEATURE', 'high');\n  return make('QUESTION', 'low');\n}\n\nexport function renderRoutingTable(): string {\n  const rows = (Object.values(WORKFLOWS) as WorkflowSpec[]).map((w) => {\n    const flags = [w.readOnly ? 'read-only' : 'modifies code', w.trackTask ? 'tracked task' : 'no task file'].join(', ');\n    return `| ${w.type} | ${flags} | L${w.contextDepth} | ${w.verification} |`;\n  });\n  return ['| Type | Nature | Max context | Verification |', '| --- | --- | --- | --- |', ...rows].join('\\n');\n}\n"]}
+{"version":3,"file":"routing.js","sourceRoot":"","sources":["../../src/tasks/routing.ts"],"names":[],"mappings":"AAiBA,uHAAuH;AACvH,MAAM,CAAC,MAAM,SAAS,GAAmC;IACvD,QAAQ,EAAE;QACR,IAAI,EAAE,UAAU;QAChB,YAAY,EAAE,CAAC;QACf,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,KAAK;QAChB,KAAK,EAAE;YACL,+FAA+F;YAC/F,4FAA4F;YAC5F,4DAA4D;SAC7D;QACD,YAAY,EAAE,yCAAyC;QACvD,WAAW,EAAE,EAAE;QACf,QAAQ,EAAE,WAAW;QACrB,eAAe,EAAE,gGAAgG;KAClH;IACD,GAAG,EAAE;QACH,IAAI,EAAE,KAAK;QACX,YAAY,EAAE,CAAC;QACf,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,IAAI;QACf,KAAK,EAAE;YACL,qDAAqD;YACrD,4CAA4C;YAC5C,+CAA+C;YAC/C,yCAAyC;YACzC,qGAAqG;YACrG,kEAAkE;SACnE;QACD,YAAY,EAAE,2GAA2G;QACzH,WAAW,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC;QACjC,QAAQ,EAAE,0DAA0D;QACpE,eAAe,EAAE,iEAAiE;KACnF;IACD,OAAO,EAAE;QACP,IAAI,EAAE,SAAS;QACf,YAAY,EAAE,CAAC;QACf,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,IAAI;QACf,KAAK,EAAE;YACL,sDAAsD;YACtD,2DAA2D;YAC3D,+CAA+C;YAC/C,iEAAiE;YACjE,kBAAkB;YAClB,mFAAmF;SACpF;QACD,YAAY,EAAE,6DAA6D;QAC3E,WAAW,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC;QAC7D,QAAQ,EAAE,sDAAsD;QAChE,eAAe,EAAE,6EAA6E;KAC/F;IACD,QAAQ,EAAE;QACR,IAAI,EAAE,UAAU;QAChB,YAAY,EAAE,CAAC;QACf,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,IAAI;QACf,KAAK,EAAE;YACL,8EAA8E;YAC9E,2EAA2E;YAC3E,8CAA8C;YAC9C,wFAAwF;YACxF,kBAAkB;SACnB;QACD,YAAY,EAAE,qEAAqE;QACnF,WAAW,EAAE,CAAC,OAAO,EAAE,gBAAgB,EAAE,SAAS,CAAC;QACnD,QAAQ,EAAE,gCAAgC;QAC1C,eAAe,EAAE,0CAA0C;KAC5D;IACD,aAAa,EAAE;QACb,IAAI,EAAE,eAAe;QACrB,YAAY,EAAE,CAAC;QACf,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,KAAK;QAChB,KAAK,EAAE,CAAC,0CAA0C,EAAE,0BAA0B,EAAE,yEAAyE,CAAC;QAC1J,YAAY,EAAE,0CAA0C;QACxD,WAAW,EAAE,EAAE;QACf,QAAQ,EAAE,WAAW;QACrB,eAAe,EAAE,SAAS;KAC3B;IACD,OAAO,EAAE;QACP,IAAI,EAAE,SAAS;QACf,YAAY,EAAE,CAAC;QACf,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,IAAI;QACf,KAAK,EAAE,CAAC,mBAAmB,EAAE,iCAAiC,EAAE,qEAAqE,EAAE,iDAAiD,CAAC;QACzL,YAAY,EAAE,kCAAkC;QAChD,WAAW,EAAE,CAAC,OAAO,CAAC;QACtB,QAAQ,EAAE,WAAW;QACrB,eAAe,EAAE,8CAA8C;KAChE;IACD,WAAW,EAAE;QACX,IAAI,EAAE,aAAa;QACnB,YAAY,EAAE,CAAC;QACf,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,IAAI;QACf,KAAK,EAAE,CAAC,qCAAqC,EAAE,6BAA6B,EAAE,oDAAoD,EAAE,SAAS,CAAC;QAC9I,YAAY,EAAE,oDAAoD;QAClE,WAAW,EAAE,CAAC,UAAU,EAAE,SAAS,CAAC;QACpC,QAAQ,EAAE,8BAA8B;QACxC,eAAe,EAAE,iDAAiD;KACnE;IACD,QAAQ,EAAE;QACR,IAAI,EAAE,UAAU;QAChB,YAAY,EAAE,CAAC;QACf,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,IAAI;QACf,KAAK,EAAE,CAAC,mBAAmB,EAAE,+CAA+C,EAAE,6CAA6C,EAAE,2CAA2C,EAAE,qDAAqD,CAAC;QAChO,YAAY,EAAE,8DAA8D;QAC5E,WAAW,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC;QACjC,QAAQ,EAAE,8CAA8C;QACxD,eAAe,EAAE,gDAAgD;KAClE;IACD,YAAY,EAAE;QACZ,IAAI,EAAE,cAAc;QACpB,YAAY,EAAE,CAAC;QACf,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,IAAI;QACf,KAAK,EAAE,CAAC,4EAA4E,EAAE,6EAA6E,EAAE,uCAAuC,EAAE,+BAA+B,CAAC;QAC9O,YAAY,EAAE,oDAAoD;QAClE,WAAW,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC;QACpD,QAAQ,EAAE,qCAAqC;QAC/C,eAAe,EAAE,qDAAqD;KACvE;IACD,OAAO,EAAE;QACP,IAAI,EAAE,SAAS;QACf,YAAY,EAAE,CAAC;QACf,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,IAAI;QACf,KAAK,EAAE,CAAC,8BAA8B,EAAE,0EAA0E,EAAE,sDAAsD,EAAE,6DAA6D,CAAC;QAC1O,YAAY,EAAE,qCAAqC;QACnD,WAAW,EAAE,CAAC,OAAO,CAAC;QACtB,QAAQ,EAAE,wBAAwB;QAClC,eAAe,EAAE,mCAAmC;KACrD;IACD,WAAW,EAAE;QACX,IAAI,EAAE,aAAa;QACnB,YAAY,EAAE,CAAC;QACf,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,IAAI;QACf,KAAK,EAAE,CAAC,mBAAmB,EAAE,kBAAkB,EAAE,4DAA4D,CAAC;QAC9G,YAAY,EAAE,+CAA+C;QAC7D,WAAW,EAAE,EAAE;QACf,QAAQ,EAAE,WAAW;QACrB,eAAe,EAAE,uCAAuC;KACzD;CACF,CAAC;AAEF,MAAM,iBAAiB,GAA2B;IAChD,CAAC,WAAW,EAAE,0KAA0K,CAAC;IACzL,CAAC,WAAW,EAAE,iFAAiF,CAAC;IAChG,CAAC,WAAW,EAAE,8DAA8D,CAAC;IAC7E,CAAC,QAAQ,EAAE,sFAAsF,CAAC;IAClG,CAAC,UAAU,EAAE,iFAAiF,CAAC;IAC/F,CAAC,QAAQ,EAAE,wDAAwD,CAAC;CACrE,CAAC;AAEF,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;AAC7E,CAAC;AAUD,MAAM,cAAc,GAAG,gMAAgM,CAAC;AACxN,MAAM,gBAAgB,GACpB,kXAAkX,CAAC;AACrX,2GAA2G;AAC3G,MAAM,eAAe,GAAG,QAAQ,CAAC;AAEjC,4IAA4I;AAC5I,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,MAAM,WAAW,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC5C,+EAA+E;IAC/E,MAAM,CAAC,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,GAAG,GAAG,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1H,MAAM,IAAI,GAAG,CAAC,IAAc,EAAE,UAA0B,EAAkB,EAAE,CAAC,CAAC;QAC5E,IAAI;QACJ,UAAU;QACV,WAAW;QACX,QAAQ,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,IAAI,WAAW,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,WAAW,CAAC;KAC7G,CAAC,CAAC;IACH,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACtH,IAAI,6JAA6J,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC1M,IAAI,6CAA6C,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IAC9F,IAAI,8GAA8G,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC5J,IAAI,gGAAgG,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACzI,IAAI,+EAA+E,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC7H,IAAI,uKAAuK,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACrN,IAAI,mEAAmE,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IACpH,IAAI,yDAAyD,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC5G,IAAI,mDAAmD,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAChG,IAAI,gFAAgF,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IACjI,IAAI,8DAA8D,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;IAChH,IAAI,kEAAkE,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC/G,mHAAmH;IACnH,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC5D,OAAO,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,MAAM,IAAI,GAAI,MAAM,CAAC,MAAM,CAAC,SAAS,CAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAClE,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrH,OAAO,KAAK,CAAC,CAAC,IAAI,MAAM,KAAK,OAAO,CAAC,CAAC,YAAY,MAAM,CAAC,CAAC,YAAY,IAAI,CAAC;IAC7E,CAAC,CAAC,CAAC;IACH,OAAO,CAAC,gDAAgD,EAAE,2BAA2B,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC7G,CAAC","sourcesContent":["import type { TaskType } from './task.js';\n\nexport type Constraint = 'no-modify' | 'plan-only' | 'no-commit' | 'no-e2e' | 'no-tests' | 'no-fix';\n\nexport interface WorkflowSpec {\n  type: TaskType;\n  /** Highest context level normally needed (1 instructions … 6 tests/implementation). */\n  contextDepth: 1 | 2 | 3 | 4 | 5 | 6;\n  readOnly: boolean;\n  trackTask: boolean;\n  steps: string[];\n  verification: string;\n  agentSkills: string[];\n  ponytail: string;\n  knowledgeUpdate: string;\n}\n\n/** Single source of truth for routing. The generated Claude skill and docs/routing.md are rendered from this table. */\nexport const WORKFLOWS: Record<TaskType, WorkflowSpec> = {\n  QUESTION: {\n    type: 'QUESTION',\n    contextDepth: 5,\n    readOnly: true,\n    trackTask: false,\n    steps: [\n      'Read .devworkspace/context facts relevant to the topic (devworkspace context --topic <area>).',\n      'Use Graphify (if ready) or targeted search to locate the code; read only the files needed.',\n      'Answer with file references. State uncertainty explicitly.',\n    ],\n    verification: 'None. Do not modify files or run tests.',\n    agentSkills: [],\n    ponytail: 'Not used.',\n    knowledgeUpdate: 'Only if you discovered a durable fact that is missing; record it with \"devworkspace fact add\".',\n  },\n  BUG: {\n    type: 'BUG',\n    contextDepth: 6,\n    readOnly: false,\n    trackTask: true,\n    steps: [\n      'Check git status; protect uncommitted user changes.',\n      'Investigate and reproduce where practical.',\n      'Write a regression test and confirm it fails.',\n      'Fix the cause, confirm the test passes.',\n      'Run the applicable regression suite, then typecheck/lint/build as required by the testing contract.',\n      'Review the diff; record results with \"devworkspace task verify\".',\n    ],\n    verification: 'Regression test, applicable suite, typecheck, lint, build (whatever the testing contract marks required).',\n    agentSkills: ['/test', '/review'],\n    ponytail: 'Light review of the diff when review level is not \"off\".',\n    knowledgeUpdate: 'Only if the bug revealed a persistent constraint or convention.',\n  },\n  FEATURE: {\n    type: 'FEATURE',\n    contextDepth: 6,\n    readOnly: false,\n    trackTask: true,\n    steps: [\n      'Check git status. Read relevant facts and decisions.',\n      'Write acceptance criteria and a short plan (task update).',\n      'Write tests for the criteria, then implement.',\n      'Run targeted tests, then regression, then typecheck/lint/build.',\n      'Review the diff.',\n      'Update project knowledge for architecture, conventions or decisions that changed.',\n    ],\n    verification: 'Targeted tests, regression, typecheck, lint, build, review.',\n    agentSkills: ['/spec', '/plan', '/build', '/test', '/review'],\n    ponytail: 'Review for unnecessary complexity before completion.',\n    knowledgeUpdate: 'Yes when the feature adds a module, integration, business rule or decision.',\n  },\n  REFACTOR: {\n    type: 'REFACTOR',\n    contextDepth: 6,\n    readOnly: false,\n    trackTask: true,\n    steps: [\n      'Check git status. Analyse architecture, decisions and dependents (Graphify).',\n      'Record a baseline test result (devworkspace task tests --phase baseline).',\n      'Plan, then refactor in small verified steps.',\n      'Run targeted verification and the full regression suite; compare against the baseline.',\n      'Review the diff.',\n    ],\n    verification: 'Baseline vs after (no regressions), typecheck, lint, build, review.',\n    agentSkills: ['/plan', '/code-simplify', '/review'],\n    ponytail: 'Use for simplification review.',\n    knowledgeUpdate: 'Yes if structure or conventions changed.',\n  },\n  DOCUMENTATION: {\n    type: 'DOCUMENTATION',\n    contextDepth: 4,\n    readOnly: false,\n    trackTask: false,\n    steps: ['Read the code or facts being documented.', 'Edit documentation only.', 'Run documentation checks if the project has them (link or lint checks).'],\n    verification: 'Only checks that apply to documentation.',\n    agentSkills: [],\n    ponytail: 'Not used.',\n    knowledgeUpdate: 'Rarely.',\n  },\n  TESTING: {\n    type: 'TESTING',\n    contextDepth: 6,\n    readOnly: false,\n    trackTask: true,\n    steps: ['Check git status.', 'Find existing test conventions.', 'Add tests; confirm they fail for the right reason where applicable.', 'Run the affected suite plus typecheck and lint.'],\n    verification: 'Affected tests, typecheck, lint.',\n    agentSkills: ['/test'],\n    ponytail: 'Optional.',\n    knowledgeUpdate: 'If the testing strategy or commands changed.',\n  },\n  PERFORMANCE: {\n    type: 'PERFORMANCE',\n    contextDepth: 6,\n    readOnly: false,\n    trackTask: true,\n    steps: ['Measure first; record the baseline.', 'Change one thing at a time.', 'Re-measure and run the regression suite and build.', 'Review.'],\n    verification: 'Before/after measurement, regression suite, build.',\n    agentSkills: ['/webperf', '/review'],\n    ponytail: 'Review for added complexity.',\n    knowledgeUpdate: 'If a persistent constraint or decision emerged.',\n  },\n  SECURITY: {\n    type: 'SECURITY',\n    contextDepth: 6,\n    readOnly: false,\n    trackTask: true,\n    steps: ['Check git status.', 'Understand the threat and the affected paths.', 'Test that demonstrates the issue, then fix.', 'Regression suite, typecheck, lint, build.', 'Security-focused review. Never print secret values.'],\n    verification: 'Regression and exploit test, typecheck, lint, build, review.',\n    agentSkills: ['/test', '/review'],\n    ponytail: 'Use for bug and security review of the diff.',\n    knowledgeUpdate: 'Yes for new security conventions or decisions.',\n  },\n  ARCHITECTURE: {\n    type: 'ARCHITECTURE',\n    contextDepth: 6,\n    readOnly: false,\n    trackTask: true,\n    steps: ['Read facts, decisions and architecture notes; map structure with Graphify.', 'Present options and record the chosen one with \"devworkspace decision add\".', 'Plan and implement in verified steps.', 'Full verification and review.'],\n    verification: 'Baseline vs after, typecheck, lint, build, review.',\n    agentSkills: ['/spec', '/plan', '/build', '/review'],\n    ponytail: 'Review for unnecessary abstraction.',\n    knowledgeUpdate: 'Always: architecture notes and the decision record.',\n  },\n  RELEASE: {\n    type: 'RELEASE',\n    contextDepth: 6,\n    readOnly: false,\n    trackTask: true,\n    steps: ['Check git status and branch.', 'Run the full testing contract including integration/e2e where available.', 'Update changelog and version per project convention.', 'Do not publish or push without explicit user authorisation.'],\n    verification: 'Everything in the testing contract.',\n    agentSkills: ['/ship'],\n    ponytail: 'Optional final review.',\n    knowledgeUpdate: 'If release process facts changed.',\n  },\n  MAINTENANCE: {\n    type: 'MAINTENANCE',\n    contextDepth: 4,\n    readOnly: false,\n    trackTask: true,\n    steps: ['Check git status.', 'Make the change.', 'Run lint and build; run tests when behaviour could change.'],\n    verification: 'Lint, build, tests if behaviour could change.',\n    agentSkills: [],\n    ponytail: 'Optional.',\n    knowledgeUpdate: 'Only for changed commands or tooling.',\n  },\n};\n\nconst OVERRIDE_PATTERNS: [Constraint, RegExp][] = [\n  ['no-modify', /\\b(?:only|just)\\s+(?:explain|describe|investigate|look|read|review)\\b|\\b(?:do\\s*n[o']t|don'?t|never)\\s+(?:modify|change|edit|touch)\\b|\\bread[- ]only\\b|\\bno\\s+changes\\b/i],\n  ['plan-only', /\\b(?:only|just)\\s+(?:make\\s+|write\\s+|give\\s+me\\s+)?a\\s+plan\\b|\\bplan\\s+only\\b/i],\n  ['no-commit', /\\b(?:do\\s*n[o']t|don'?t|never)\\s+commit\\b|\\bno\\s+commits?\\b/i],\n  ['no-e2e', /\\b(?:do\\s*n[o']t|don'?t|skip|no)\\s+(?:run\\s+)?(?:the\\s+)?(?:e2e|end[- ]to[- ]end)\\b/i],\n  ['no-tests', /\\b(?:do\\s*n[o']t|don'?t|skip)\\s+(?:run\\s+)?(?:any\\s+|the\\s+)?tests\\b(?!\\s+but)/i],\n  ['no-fix', /\\b(?:do\\s*n[o']t|don'?t)\\s+fix\\b|\\bwithout\\s+fixing\\b/i],\n];\n\nexport function detectConstraints(text: string): Constraint[] {\n  return OVERRIDE_PATTERNS.filter(([, re]) => re.test(text)).map(([c]) => c);\n}\n\nexport interface Classification {\n  type: TaskType;\n  confidence: 'high' | 'low';\n  constraints: Constraint[];\n  /** True when the request must not change files (question type, or an explicit user override). */\n  readOnly: boolean;\n}\n\nconst QUESTION_START = /^\\s*(?:where|what|which|who|when|how\\s+(?:does|do|is|are|can|should)|why|explain|describe|show\\s+me|walk\\s+me|is\\s+there|are\\s+there|can\\s+you\\s+(?:explain|tell|show)|tell\\s+me|list|find)\\b/i;\nconst IMPERATIVE_START =\n  /^\\s*(?:fix|add|implement|create|build|refactor|remove|delete|update|change|rename|write|make|migrate|upgrade|optimi[sz]e|release|publish|validate|ensure|prevent|enforce|guard|reject|restrict|handle|resolve|patch|repair|address|correct|replace|move|extract|rewrite|convert|improve|enable|disable|support|introduce|apply|configure|install|harden|secure|scope|isolate)\\b/i;\n/** A direct yes/no or open question: it ends in a question mark and does not start like an instruction. */\nconst DIRECT_QUESTION = /\\?\\s*$/;\n\n/** Heuristic classifier used to propose a task type. The agent may override it; ambiguous input defaults to the safest (read-only) type. */\nexport function classifyRequest(text: string): Classification {\n  const constraints = detectConstraints(text);\n  // Negated phrases (\"don't fix anything\") describe limits, not the task itself.\n  const t = OVERRIDE_PATTERNS.reduce((acc, [, re]) => acc.replace(new RegExp(re.source, re.flags + 'g'), ' '), text).trim();\n  const make = (type: TaskType, confidence: 'high' | 'low'): Classification => ({\n    type,\n    confidence,\n    constraints,\n    readOnly: WORKFLOWS[type].readOnly || constraints.includes('no-modify') || constraints.includes('plan-only'),\n  });\n  if ((QUESTION_START.test(t) || DIRECT_QUESTION.test(t)) && !IMPERATIVE_START.test(t)) return make('QUESTION', 'high');\n  if (/\\b(?:add|write|improve|increase)\\s+(?:\\w+\\s+)?(?:unit\\s+|e2e\\s+|integration\\s+)?tests?\\b|\\btest coverage\\b|^\\s*run\\s+(?:the\\s+|all\\s+)?(?:\\w+\\s+)?tests?\\b/i.test(t)) return make('TESTING', 'high');\n  if (/\\b(?:upgrade|bump|update\\s+dependenc\\w*)\\b/i.test(t)) return make('MAINTENANCE', 'high');\n  if (/\\b(?:vulnerab\\w*|csrf|xss|sql injection|cve-\\d+|cross-?tenant|tenant isolation|privilege escalation|idor)\\b/i.test(t)) return make('SECURITY', 'high');\n  if (/\\b(?:fix|bug|broken|crash(?:es|ing)?|regression|not working|fails?|failing|exception|error)\\b/i.test(t)) return make('BUG', 'high');\n  if (/\\b(?:refactor|restructure|reorgani[sz]e|clean\\s?up|simplify|de-?duplicate)\\b/i.test(t)) return make('REFACTOR', 'high');\n  if (/\\b(?:vulnerab\\w*|security|csrf|xss|sql injection|sanitiz\\w*|harden\\w*|cve-\\d+|cross-?tenant|tenant isolation|ownership|authori[sz]ation|privilege escalation|idor)\\b/i.test(t)) return make('SECURITY', 'high');\n  if (/\\b(?:performance|slow|latency|speed up|optimi[sz]e|throughput)\\b/i.test(t)) return make('PERFORMANCE', 'high');\n  if (/\\b(?:document|readme|docs|changelog|jsdoc|docstring)\\b/i.test(t)) return make('DOCUMENTATION', 'high');\n  if (/\\b(?:release|publish|deploy|ship|version bump)\\b/i.test(t)) return make('RELEASE', 'high');\n  if (/\\b(?:upgrade|bump|update\\s+dependenc\\w*|chore|lint(?:ing)?|format(?:ting)?)\\b/i.test(t)) return make('MAINTENANCE', 'high');\n  if (/\\b(?:redesign|re-?architect\\w*|migrate\\s+to|architecture)\\b/i.test(t)) return make('ARCHITECTURE', 'high');\n  if (/\\b(?:add|implement|create|build|support|introduce|enable|new)\\b/i.test(t)) return make('FEATURE', 'high');\n  // An instruction we cannot place is still a request to change something. Never default it to a read-only question.\n  if (IMPERATIVE_START.test(t)) return make('FEATURE', 'low');\n  return make('QUESTION', 'low');\n}\n\nexport function renderRoutingTable(): string {\n  const rows = (Object.values(WORKFLOWS) as WorkflowSpec[]).map((w) => {\n    const flags = [w.readOnly ? 'read-only' : 'modifies code', w.trackTask ? 'tracked task' : 'no task file'].join(', ');\n    return `| ${w.type} | ${flags} | L${w.contextDepth} | ${w.verification} |`;\n  });\n  return ['| Type | Nature | Max context | Verification |', '| --- | --- | --- | --- |', ...rows].join('\\n');\n}\n"]}

package/dist/tasks/task.d.ts

@@ -4,8 +4,27 @@ export declare const TASK_TYPES: readonly ["QUESTION", "BUG", "FEATURE", "REFACT
 export type TaskType = (typeof TASK_TYPES)[number];
 export declare const TASK_STATUSES: readonly ["IDEA", "SPECIFIED", "PLANNED", "IN_PROGRESS", "TESTING", "REVIEW", "BLOCKED", "FAILED", "COMPLETED"];
 export type TaskStatus = (typeof TASK_STATUSES)[number];
-export declare const VERIFY_STATUSES: readonly ["PENDING", "PASS", "FAIL", "SKIPPED"];
+export declare const VERIFY_STATUSES: readonly ["PENDING", "PASS", "FAIL", "SKIPPED", "COULD_NOT_RUN"];
 export type VerifyStatus = (typeof VERIFY_STATUSES)[number];
+/**
+ * One recorded result for one package. `executed` means DevWorkspace ran the contract command itself and saw the exit
+ * code; `claimed` is somebody's report (agent or person) that DevWorkspace could not observe.
+ */
+export interface Evidence {
+    kind: 'executed' | 'claimed';
+    at: string;
+    /** Package directory relative to the project root; "." for the root. */
+    package: string;
+    command?: string;
+    exitCode?: number | null;
+    durationMs?: number;
+    /** Fingerprint of the task's changes inside this package when the result was recorded. */
+    scope?: string;
+    /** A claim the user explicitly vouched for (--reason user-override). */
+    userOverride?: boolean;
+    /** One-line, scrubbed explanation (failure tail or refusal reason). Never a connection string or credential. */
+    note?: string;
+}
 export interface VerificationItem {
     check: string;
     required: boolean;
@@ -13,6 +32,16 @@ export interface VerificationItem {
     reason?: string;
     detail?: string;
     updatedAt?: string;
+    /** Latest result per package. Absent on tasks recorded by older versions. */
+    evidence?: Evidence[];
+}
+/** Files that were already modified when the task was created, so they are not blamed on the task. */
+export interface TaskScope {
+    capturedAt: string;
+    /** Git HEAD when the task was created; null outside a repository. */
+    head: string | null;
+    /** Project-relative path -> content hash of files already modified at creation ("deleted" for removed files). */
+    baseline: Record<string, string>;
 }
 export interface TestCounts {
     passed: number;
@@ -41,6 +70,8 @@ export interface Task {
         after?: TestCounts;
     };
     attestations: Attestations;
+    /** Present on tasks created by 0.2.2+: enables package-aware, evidence-based completion. */
+    scope?: TaskScope;
     decisions: string[];
     blockers: string[];
     constraints: string[];
@@ -72,10 +103,23 @@ export interface GateResult {
     failures: string[];
     warnings: string[];
 }
-/** The completion gate. A task is only COMPLETED when every applicable requirement holds. */
-export declare function evaluateGate(task: Task): GateResult;
-export declare function transitionTask(task: Task, to: TaskStatus, now: string, note?: string): GateResult | null;
-export declare function nextRequiredStep(task: Task): string;
+/** What the gate needs to know beyond the task itself: the contract and what the task changed, per package. */
+export interface GateContext {
+    contract: CommandEntry[];
+    /**
+     * Fingerprint of the task's changes inside each package ("." = everything). `null` means the changes could not be
+     * determined (not a Git repository, or nothing changed since the task started), so every package counts as affected.
+     */
+    scope: Record<string, string> | null;
+}
+/**
+ * The completion gate. A task is only COMPLETED when every applicable requirement holds.
+ * Tasks that carry a `scope` (created by 0.2.2+) are checked per changed package against executed evidence; older
+ * tasks keep the original rules.
+ */
+export declare function evaluateGate(task: Task, ctx?: GateContext): GateResult;
+export declare function transitionTask(task: Task, to: TaskStatus, now: string, note?: string, ctx?: GateContext): GateResult | null;
+export declare function nextRequiredStep(task: Task, ctx?: GateContext): string;
 export declare function saveTask(ws: Ws, task: Task): Promise<void>;
 export declare function loadTask(ws: Ws, idOrPrefix: string): Promise<Task>;
 export interface TaskListing {