devworkspace 0.2.1 → 0.3.0

package/dist/tasks/task.js

@@ -21,7 +21,7 @@ export const TASK_TYPES = [
     'MAINTENANCE',
 ];
 export const TASK_STATUSES = ['IDEA', 'SPECIFIED', 'PLANNED', 'IN_PROGRESS', 'TESTING', 'REVIEW', 'BLOCKED', 'FAILED', 'COMPLETED'];
-export const VERIFY_STATUSES = ['PENDING', 'PASS', 'FAIL', 'SKIPPED'];
+export const VERIFY_STATUSES = ['PENDING', 'PASS', 'FAIL', 'SKIPPED', 'COULD_NOT_RUN'];
 const TRANSITIONS = {
     IDEA: ['SPECIFIED', 'PLANNED', 'IN_PROGRESS', 'BLOCKED', 'FAILED'],
     SPECIFIED: ['PLANNED', 'IN_PROGRESS', 'BLOCKED', 'IDEA'],
@@ -126,7 +126,22 @@ export function validateTask(v, file = 'task') {
         ic.at_('check').str(io.check, { max: 50 });
         ic.at_('required').bool(io.required);
         ic.at_('status').oneOf(io.status, VERIFY_STATUSES);
+        if (io.evidence !== undefined) {
+            ic.at_('evidence')
+                .arr(io.evidence, 100)
+                .forEach((e, j) => {
+                const ec = c.at_(`verification.${i}.evidence.${j}`);
+                const eo = ec.obj(e);
+                ec.at_('kind').oneOf(eo.kind, ['executed', 'claimed']);
+                ec.at_('package').str(eo.package, { max: 240 });
+            });
+        }
     });
+    if (o.scope !== undefined) {
+        const sc = c.at_('scope').obj(o.scope);
+        c.at_('scope.capturedAt').iso(sc.capturedAt);
+        c.at_('scope.baseline').obj(sc.baseline);
+    }
     const a = c.at_('attestations').obj(o.attestations);
     c.at_('attestations.userWorkIntact').bool(a.userWorkIntact);
     c.at_('attestations.knowledgeReviewed').bool(a.knowledgeReviewed);
@@ -135,23 +150,65 @@ export function validateTask(v, file = 'task') {
     c.at_('history').arr(o.history, 500);
     return o;
 }
-/** The completion gate. A task is only COMPLETED when every applicable requirement holds. */
-export function evaluateGate(task) {
+const UNKNOWN_SCOPE = 'unknown';
+/** Per-package requirements of one check. Returns false when the contract has no applicable package entry. */
+function packageGate(v, ctx, failures, warnings) {
+    const entries = ctx.contract.filter((c) => c.id === v.check && c.available && !c.mutates);
+    if (entries.length === 0)
+        return false;
+    const known = ctx.scope !== null;
+    const unknown = !known;
+    let applicable = 0;
+    for (const entry of entries) {
+        const pkg = entry.cwd ?? '.';
+        const fp = known ? ctx.scope[pkg] : UNKNOWN_SCOPE;
+        if (fp === undefined)
+            continue; // this package was not changed, so this check does not apply to it
+        applicable++;
+        const label = `${v.check} [${pkg}]`;
+        const ev = v.evidence?.find((e) => e.package === pkg);
+        if (!ev)
+            failures.push(`${label}: not run for the current changes`);
+        else if (ev.kind === 'claimed' && !ev.userOverride)
+            failures.push(`${label}: only claimed, not executed (run: devworkspace task run <id> ${v.check} --package ${pkg})`);
+        else if (ev.kind === 'claimed')
+            warnings.push(`${label}: accepted on the user's word; DevWorkspace did not observe it run`);
+        else if (ev.exitCode !== 0)
+            failures.push(`${label}: FAIL (exit ${ev.exitCode ?? 'none'})`);
+        else if (!unknown && ev.scope !== fp)
+            failures.push(`${label}: passed, but files changed afterwards; run it again`);
+    }
+    if (known && applicable === 0)
+        warnings.push(`${v.check}: no package with this check was changed`);
+    return true;
+}
+/**
+ * The completion gate. A task is only COMPLETED when every applicable requirement holds.
+ * Tasks that carry a `scope` (created by 0.2.2+) are checked per changed package against executed evidence; older
+ * tasks keep the original rules.
+ */
+export function evaluateGate(task, ctx) {
     const failures = [];
     const warnings = [];
+    const scoped = !!ctx && !!task.scope;
     for (const v of task.verification) {
         if (!v.required)
             continue;
         if (v.status === 'FAIL')
             failures.push(`${v.check}: FAIL`);
-        else if (v.status === 'PENDING')
-            failures.push(`${v.check}: not run yet`);
+        else if (v.status === 'COULD_NOT_RUN')
+            failures.push(`${v.check}: could not run${v.detail ? ` (${v.detail})` : ''}`);
         else if (v.status === 'SKIPPED') {
             if (v.reason === 'user-override')
                 warnings.push(`${v.check}: skipped at the user's request; completion is less certain`);
             else
                 failures.push(`${v.check}: skipped without a user override`);
         }
+        else if (scoped && packageGate(v, ctx, failures, warnings)) {
+            // handled per package
+        }
+        else if (v.status === 'PENDING')
+            failures.push(`${v.check}: not run yet`);
     }
     const { baseline, after } = task.tests;
     if (baseline && !after)
@@ -175,7 +232,7 @@ export function evaluateGate(task) {
     }
     return { ok: failures.length === 0, failures, warnings };
 }
-export function transitionTask(task, to, now, note) {
+export function transitionTask(task, to, now, note, ctx) {
     if (task.status === to)
         return null;
     if (!TRANSITIONS[task.status].includes(to)) {
@@ -185,7 +242,7 @@ export function transitionTask(task, to, now, note) {
     }
     let gate = null;
     if (to === 'COMPLETED') {
-        gate = evaluateGate(task);
+        gate = evaluateGate(task, ctx);
         if (!gate.ok) {
             throw new DevWorkspaceError('GATE', `Task ${task.id} cannot be completed:\n  - ${gate.failures.join('\n  - ')}`, {
                 hint: 'Resolve the items above (or mark the task BLOCKED/FAILED). A task is never complete while verification is failing.',
@@ -197,7 +254,7 @@ export function transitionTask(task, to, now, note) {
     task.updatedAt = now;
     return gate;
 }
-export function nextRequiredStep(task) {
+export function nextRequiredStep(task, ctx) {
     switch (task.status) {
         case 'COMPLETED':
             return 'None. The task is complete.';
@@ -212,10 +269,10 @@ export function nextRequiredStep(task) {
         case 'PLANNED':
             return 'Start implementation (baseline verification first for meaningful changes).';
         default: {
-            const pending = task.verification.filter((v) => v.required && (v.status === 'PENDING' || v.status === 'FAIL'));
+            const pending = task.verification.filter((v) => v.required && (v.status === 'PENDING' || v.status === 'FAIL' || v.status === 'COULD_NOT_RUN'));
             if (pending.length > 0)
-                return `Run/fix verification: ${pending.map((p) => `${p.check} (${p.status.toLowerCase()})`).join(', ')}.`;
-            const g = evaluateGate(task);
+                return `Run/fix verification: ${pending.map((p) => `${p.check} (${p.status.toLowerCase().replace(/_/g, ' ')})`).join(', ')}.`;
+            const g = evaluateGate(task, ctx);
             return g.ok ? 'All gates pass. Mark the task COMPLETED.' : `Satisfy the completion gate: ${g.failures[0]}`;
         }
     }

package/dist/tasks/task.js.map

@@ -1 +1 @@
-{"version":3,"file":"task.js","sourceRoot":"","sources":["../../src/tasks/task.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAqB,MAAM,sBAAsB,CAAC;AACzE,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAClF,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAW,MAAM,sBAAsB,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAEvD,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,UAAU;IACV,KAAK;IACL,SAAS;IACT,UAAU;IACV,eAAe;IACf,SAAS;IACT,aAAa;IACb,UAAU;IACV,cAAc;IACd,SAAS;IACT,aAAa;CACL,CAAC;AAGX,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,CAAU,CAAC;AAG7I,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,CAAU,CAAC;AA6C/E,MAAM,WAAW,GAAqC;IACpD,IAAI,EAAE,CAAC,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE,SAAS,EAAE,QAAQ,CAAC;IAClE,SAAS,EAAE,CAAC,SAAS,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,CAAC;IACxD,OAAO,EAAE,CAAC,aAAa,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC;IACxD,WAAW,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,CAAC;IAC/E,OAAO,EAAE,CAAC,aAAa,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,CAAC;IACpE,MAAM,EAAE,CAAC,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,CAAC;IACpE,OAAO,EAAE,CAAC,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC;IAClE,MAAM,EAAE,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,SAAS,EAAE,CAAC,aAAa,CAAC;CAC3B,CAAC;AAEF,MAAM,UAAU,kBAAkB,CAAC,IAAgB;IACjD,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,aAAa,GAAe,CAAC,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,UAAU,EAAE,cAAc,EAAE,aAAa,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;AAEjJ,MAAM,cAAc,GAA+B;IACjD,QAAQ,EAAE,EAAE;IACZ,aAAa,EAAE,EAAE;IACjB,GAAG,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC;IAC3C,OAAO,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC;IACzD,QAAQ,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC;IAC1D,OAAO,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC;IACtC,WAAW,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC;IACxC,QAAQ,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC;IAC1D,YAAY,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC;IAC9D,OAAO,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,CAAC;IACrE,WAAW,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;CAC/B,CAAC;AAEF,MAAM,UAAU,cAAc,CAAC,IAAc;IAC3C,OAAO,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACtC,CAAC;AAED,6HAA6H;AAC7H,MAAM,UAAU,iBAAiB,CAAC,IAAc,EAAE,QAAwB,EAAE,cAA0C,OAAO;IAC3H,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAY,CAAC,CAAC,CAAC;IAC1F,MAAM,KAAK,GAAuB,EAAE,CAAC;IACrC,KAAK,MAAM,KAAK,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;YACvB,IAAI,WAAW,KAAK,KAAK;gBAAE,SAAS;QACtC,CAAC;aAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,SAAS;QAC3C,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,MAAY,IAAI,IAAI,EAAE;IAC9C,MAAM,CAAC,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC3D,OAAO,KAAK,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;AACjC,CAAC;AAUD,MAAM,UAAU,gBAAgB,CAAC,KAAmB,EAAE,GAAW,EAAE,EAAE,GAAG,SAAS,EAAE;IACjF,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC/C,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,iBAAiB,CAAC,OAAO,EAAE,+BAA+B,CAAC,CAAC;IAClF,MAAM,IAAI,GAAS;QACjB,aAAa,EAAE,cAAc;QAC7B,EAAE;QACF,KAAK;QACL,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,MAAM,EAAE,MAAM;QACd,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,GAAG;QACd,WAAW,EAAE,CAAC,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC;QAC5D,kBAAkB,EAAE,EAAE;QACtB,IAAI,EAAE,EAAE;QACR,aAAa,EAAE,EAAE;QACjB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,KAAK,EAAE,EAAE;QACT,YAAY,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,iBAAiB,EAAE,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE;QAC7F,SAAS,EAAE,EAAE;QACb,QAAQ,EAAE,EAAE;QACZ,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,EAAE;QACpC,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;KAC/C,CAAC;IACF,eAAe,CAAC,IAAI,CAAC,CAAC;IACtB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAU;IACxC,IAAI,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,iBAAiB,CAAC,UAAU,EAAE,qEAAqE,EAAE;YAC7G,IAAI,EAAE,wDAAwD;SAC/D,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,CAAU,EAAE,IAAI,GAAG,MAAM;IACpD,MAAM,CAAC,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;IAC/C,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;IAC3C,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;IAClD,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACxC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC/C,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACpC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,MAAM,EAAE,eAAe,EAAE,WAAW,EAAE,UAAU,EAAE,aAAa,CAAU;QAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxI,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC;SAClB,GAAG,CAAC,CAAC,CAAC,YAAY,EAAE,GAAG,CAAC;SACxB,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QACnB,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;QACtC,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACxB,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3C,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC;QACrC,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IACL,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;IACpD,CAAC,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;IAC5D,CAAC,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAClE,CAAC,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC;IACtE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACrC,OAAO,CAAoB,CAAC;AAC9B,CAAC;AAQD,6FAA6F;AAC7F,MAAM,UAAU,YAAY,CAAC,IAAU;IACrC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;QAClC,IAAI,CAAC,CAAC,CAAC,QAAQ;YAAE,SAAS;QAC1B,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM;YAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC;aACtD,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS;YAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,eAAe,CAAC,CAAC;aACrE,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAChC,IAAI,CAAC,CAAC,MAAM,KAAK,eAAe;gBAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,6DAA6D,CAAC,CAAC;;gBACpH,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,mCAAmC,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IACD,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;IACvC,IAAI,QAAQ,IAAI,CAAC,KAAK;QAAE,QAAQ,CAAC,IAAI,CAAC,iEAAiE,CAAC,CAAC;IACzG,IAAI,QAAQ,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,KAAK,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM;YAAE,QAAQ,CAAC,IAAI,CAAC,kCAAkC,QAAQ,CAAC,MAAM,OAAO,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAC1H,IAAI,KAAK,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM;YAAE,QAAQ,CAAC,IAAI,CAAC,uCAAuC,QAAQ,CAAC,MAAM,OAAO,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACjI,CAAC;IACD,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,cAAc;YAAE,QAAQ,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;QACpG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,iBAAiB;YAAE,QAAQ,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC;QACrH,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,mBAAmB;YAAE,QAAQ,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC;IACnH,CAAC;IACD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,eAAe,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC3G,QAAQ,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAU,EAAE,EAAc,EAAE,GAAW,EAAE,IAAa;IACnF,IAAI,IAAI,CAAC,MAAM,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,iBAAiB,CAAC,MAAM,EAAE,2BAA2B,IAAI,CAAC,MAAM,OAAO,EAAE,GAAG,EAAE;YACtF,IAAI,EAAE,gBAAgB,IAAI,CAAC,MAAM,KAAK,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;SAC7E,CAAC,CAAC;IACL,CAAC;IACD,IAAI,IAAI,GAAsB,IAAI,CAAC;IACnC,IAAI,EAAE,KAAK,WAAW,EAAE,CAAC;QACvB,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAC1B,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,iBAAiB,CAAC,MAAM,EAAE,QAAQ,IAAI,CAAC,EAAE,8BAA8B,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE;gBAC/G,IAAI,EAAE,oHAAoH;aAC3H,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACrG,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC;IACjB,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC;IACrB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAU;IACzC,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;QACpB,KAAK,WAAW;YACd,OAAO,6BAA6B,CAAC;QACvC,KAAK,QAAQ;YACX,OAAO,+EAA+E,CAAC;QACzF,KAAK,SAAS;YACZ,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,oBAAoB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,4CAA4C,CAAC;QACjJ,KAAK,MAAM;YACT,OAAO,yCAAyC,CAAC;QACnD,KAAK,WAAW;YACd,OAAO,eAAe,CAAC;QACzB,KAAK,SAAS;YACZ,OAAO,4EAA4E,CAAC;QACtF,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC;YAC/G,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,yBAAyB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;YACnI,MAAM,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;YAC7B,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,0CAA0C,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7G,CAAC;IACH,CAAC;AACH,CAAC;AAED,gCAAgC;AAEhC,SAAS,QAAQ,CAAC,EAAM,EAAE,IAAiC;IACzD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;AACxG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,EAAM,EAAE,IAAU;IAC/C,YAAY,CAAC,IAAI,CAAC,CAAC;IACnB,eAAe,CAAC,IAAI,CAAC,CAAC;IACtB,MAAM,IAAI,GAAG,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IAChC,MAAM,sBAAsB,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;IAC3D,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACpC,MAAM,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,cAAc,EAAE,GAAG,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;IAC7G,MAAM,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,EAAM,EAAE,UAAkB;IACvD,KAAK,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,cAAc,CAAC,EAAE,CAAC;QACtD,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;YAAE,SAAS;QACvC,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QACzE,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,UAAU,OAAO,IAAI,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;QACzF,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,UAAU,OAAO,CAAC,CAAC;YAC3D,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,iBAAiB,CAAC,OAAO,EAAE,YAAY,UAAU,iBAAiB,EAAE,EAAE,IAAI,EAAE,gCAAgC,EAAE,CAAC,CAAC;YACtI,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC;YACtC,OAAO,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC;QAChF,CAAC;IACH,CAAC;IACD,MAAM,IAAI,iBAAiB,CAAC,WAAW,EAAE,qBAAqB,UAAU,IAAI,EAAE,EAAE,IAAI,EAAE,iDAAiD,EAAE,CAAC,CAAC;AAC7I,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,EAAM,EAAE,OAAuC,EAAE;IAC/E,MAAM,KAAK,GAAW,EAAE,CAAC;IACzB,MAAM,OAAO,GAAsC,EAAE,CAAC;IACtD,MAAM,IAAI,GAAG,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC;IAC5F,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;YAAE,SAAS;QACvC,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACrF,IAAI,CAAC;gBACH,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACrG,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,KAAK,EAAG,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;YACvF,CAAC;QACH,CAAC;IACH,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IAC7D,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAC5B,CAAC","sourcesContent":["import { promises as fs } from 'node:fs';\nimport path from 'node:path';\nimport { DevWorkspaceError } from '../errors/index.js';\nimport { Check } from '../config/validate.js';\nimport { SCHEMA_VERSION, type CommandEntry } from '../config/schemas.js';\nimport { atomicWriteJson, ensureDir, pathExists, randomId } from '../utils/fs.js';\nimport { readVersioned } from '../core/versioned.js';\nimport { backupIfVersionChanges, type Ws } from '../core/workspace.js';\nimport { containsSecret } from '../security/redact.js';\n\nexport const TASK_TYPES = [\n  'QUESTION',\n  'BUG',\n  'FEATURE',\n  'REFACTOR',\n  'DOCUMENTATION',\n  'TESTING',\n  'PERFORMANCE',\n  'SECURITY',\n  'ARCHITECTURE',\n  'RELEASE',\n  'MAINTENANCE',\n] as const;\nexport type TaskType = (typeof TASK_TYPES)[number];\n\nexport const TASK_STATUSES = ['IDEA', 'SPECIFIED', 'PLANNED', 'IN_PROGRESS', 'TESTING', 'REVIEW', 'BLOCKED', 'FAILED', 'COMPLETED'] as const;\nexport type TaskStatus = (typeof TASK_STATUSES)[number];\n\nexport const VERIFY_STATUSES = ['PENDING', 'PASS', 'FAIL', 'SKIPPED'] as const;\nexport type VerifyStatus = (typeof VERIFY_STATUSES)[number];\n\nexport interface VerificationItem {\n  check: string;\n  required: boolean;\n  status: VerifyStatus;\n  reason?: string;\n  detail?: string;\n  updatedAt?: string;\n}\n\nexport interface TestCounts {\n  passed: number;\n  failed: number;\n}\n\nexport interface Attestations {\n  userWorkIntact: boolean;\n  knowledgeReviewed: boolean;\n  finalStateInspected: boolean;\n}\n\nexport interface Task {\n  schemaVersion: number;\n  id: string;\n  title: string;\n  type: TaskType;\n  status: TaskStatus;\n  createdAt: string;\n  updatedAt: string;\n  description: string;\n  acceptanceCriteria: string[];\n  plan: string[];\n  affectedAreas: string[];\n  verification: VerificationItem[];\n  tests: { baseline?: TestCounts; after?: TestCounts };\n  attestations: Attestations;\n  decisions: string[];\n  blockers: string[];\n  constraints: string[];\n  completionSummary?: string;\n  history: { at: string; from: TaskStatus | null; to: TaskStatus; note?: string }[];\n}\n\nconst TRANSITIONS: Record<TaskStatus, TaskStatus[]> = {\n  IDEA: ['SPECIFIED', 'PLANNED', 'IN_PROGRESS', 'BLOCKED', 'FAILED'],\n  SPECIFIED: ['PLANNED', 'IN_PROGRESS', 'BLOCKED', 'IDEA'],\n  PLANNED: ['IN_PROGRESS', 'SPECIFIED', 'BLOCKED', 'IDEA'],\n  IN_PROGRESS: ['TESTING', 'REVIEW', 'COMPLETED', 'BLOCKED', 'FAILED', 'PLANNED'],\n  TESTING: ['IN_PROGRESS', 'REVIEW', 'COMPLETED', 'BLOCKED', 'FAILED'],\n  REVIEW: ['IN_PROGRESS', 'TESTING', 'COMPLETED', 'BLOCKED', 'FAILED'],\n  BLOCKED: ['IN_PROGRESS', 'PLANNED', 'SPECIFIED', 'IDEA', 'FAILED'],\n  FAILED: ['IN_PROGRESS', 'IDEA'],\n  COMPLETED: ['IN_PROGRESS'],\n};\n\nexport function allowedTransitions(from: TaskStatus): TaskStatus[] {\n  return TRANSITIONS[from];\n}\n\nconst CODE_CHANGING: TaskType[] = ['BUG', 'FEATURE', 'REFACTOR', 'PERFORMANCE', 'SECURITY', 'ARCHITECTURE', 'MAINTENANCE', 'TESTING', 'RELEASE'];\n\nconst CHECKS_BY_TYPE: Record<TaskType, string[]> = {\n  QUESTION: [],\n  DOCUMENTATION: [],\n  BUG: ['unit', 'typecheck', 'lint', 'build'],\n  FEATURE: ['unit', 'typecheck', 'lint', 'build', 'review'],\n  REFACTOR: ['unit', 'typecheck', 'lint', 'build', 'review'],\n  TESTING: ['unit', 'typecheck', 'lint'],\n  PERFORMANCE: ['unit', 'build', 'review'],\n  SECURITY: ['unit', 'typecheck', 'lint', 'build', 'review'],\n  ARCHITECTURE: ['unit', 'typecheck', 'lint', 'build', 'review'],\n  RELEASE: ['unit', 'typecheck', 'lint', 'build', 'integration', 'e2e'],\n  MAINTENANCE: ['lint', 'build'],\n};\n\nexport function isCodeChanging(type: TaskType): boolean {\n  return CODE_CHANGING.includes(type);\n}\n\n/** Verification a task of this type needs, given what the project actually offers. Unavailable checks are never demanded. */\nexport function requiredChecksFor(type: TaskType, contract: CommandEntry[], reviewLevel: 'off' | 'light' | 'strict' = 'light'): VerificationItem[] {\n  const available = new Set(contract.filter((c) => c.available).map((c) => c.id as string));\n  const items: VerificationItem[] = [];\n  for (const check of CHECKS_BY_TYPE[type]) {\n    if (check === 'review') {\n      if (reviewLevel === 'off') continue;\n    } else if (!available.has(check)) continue;\n    items.push({ check, required: true, status: 'PENDING' });\n  }\n  return items;\n}\n\nexport function newTaskId(now: Date = new Date()): string {\n  const d = now.toISOString().slice(0, 10).replace(/-/g, '');\n  return `T-${d}-${randomId(2)}`;\n}\n\nexport interface NewTaskInput {\n  title: string;\n  type: TaskType;\n  description?: string;\n  verification: VerificationItem[];\n  constraints?: string[];\n}\n\nexport function createTaskObject(input: NewTaskInput, now: string, id = newTaskId()): Task {\n  const title = input.title.trim().slice(0, 200);\n  if (!title) throw new DevWorkspaceError('USAGE', 'Task title must not be empty.');\n  const task: Task = {\n    schemaVersion: SCHEMA_VERSION,\n    id,\n    title,\n    type: input.type,\n    status: 'IDEA',\n    createdAt: now,\n    updatedAt: now,\n    description: (input.description ?? '').trim().slice(0, 4000),\n    acceptanceCriteria: [],\n    plan: [],\n    affectedAreas: [],\n    verification: input.verification,\n    tests: {},\n    attestations: { userWorkIntact: false, knowledgeReviewed: false, finalStateInspected: false },\n    decisions: [],\n    blockers: [],\n    constraints: input.constraints ?? [],\n    history: [{ at: now, from: null, to: 'IDEA' }],\n  };\n  assertNoSecrets(task);\n  return task;\n}\n\nexport function assertNoSecrets(task: Task): void {\n  if (containsSecret(JSON.stringify(task))) {\n    throw new DevWorkspaceError('SECURITY', 'Task content looks like it contains a secret; refusing to store it.', {\n      hint: 'Remove credential values from titles, plans and notes.',\n    });\n  }\n}\n\nexport function validateTask(v: unknown, file = 'task'): Task {\n  const c = new Check(file);\n  const o = c.obj(v);\n  c.at_('schemaVersion').int(o.schemaVersion, 1);\n  c.at_('id').str(o.id, { min: 3, max: 64 });\n  c.at_('title').str(o.title, { min: 1, max: 300 });\n  c.at_('type').oneOf(o.type, TASK_TYPES);\n  c.at_('status').oneOf(o.status, TASK_STATUSES);\n  c.at_('createdAt').iso(o.createdAt);\n  c.at_('updatedAt').iso(o.updatedAt);\n  for (const k of ['acceptanceCriteria', 'plan', 'affectedAreas', 'decisions', 'blockers', 'constraints'] as const) c.at_(k).strArr(o[k]);\n  c.at_('verification')\n    .arr(o.verification, 100)\n    .forEach((item, i) => {\n      const ic = c.at_(`verification.${i}`);\n      const io = ic.obj(item);\n      ic.at_('check').str(io.check, { max: 50 });\n      ic.at_('required').bool(io.required);\n      ic.at_('status').oneOf(io.status, VERIFY_STATUSES);\n    });\n  const a = c.at_('attestations').obj(o.attestations);\n  c.at_('attestations.userWorkIntact').bool(a.userWorkIntact);\n  c.at_('attestations.knowledgeReviewed').bool(a.knowledgeReviewed);\n  c.at_('attestations.finalStateInspected').bool(a.finalStateInspected);\n  c.at_('tests').obj(o.tests);\n  c.at_('history').arr(o.history, 500);\n  return o as unknown as Task;\n}\n\nexport interface GateResult {\n  ok: boolean;\n  failures: string[];\n  warnings: string[];\n}\n\n/** The completion gate. A task is only COMPLETED when every applicable requirement holds. */\nexport function evaluateGate(task: Task): GateResult {\n  const failures: string[] = [];\n  const warnings: string[] = [];\n  for (const v of task.verification) {\n    if (!v.required) continue;\n    if (v.status === 'FAIL') failures.push(`${v.check}: FAIL`);\n    else if (v.status === 'PENDING') failures.push(`${v.check}: not run yet`);\n    else if (v.status === 'SKIPPED') {\n      if (v.reason === 'user-override') warnings.push(`${v.check}: skipped at the user's request; completion is less certain`);\n      else failures.push(`${v.check}: skipped without a user override`);\n    }\n  }\n  const { baseline, after } = task.tests;\n  if (baseline && !after) failures.push('baseline test results recorded, but no results after the change');\n  if (baseline && after) {\n    if (after.failed > baseline.failed) failures.push(`regression: failures rose from ${baseline.failed} to ${after.failed}`);\n    if (after.passed < baseline.passed) failures.push(`regression: passing tests fell from ${baseline.passed} to ${after.passed}`);\n  }\n  if (isCodeChanging(task.type)) {\n    if (!task.attestations.userWorkIntact) failures.push('not confirmed: no user work was overwritten');\n    if (!task.attestations.knowledgeReviewed) failures.push('not confirmed: project knowledge was reviewed for updates');\n    if (!task.attestations.finalStateInspected) failures.push('not confirmed: final repository state was inspected');\n  }\n  if ((isCodeChanging(task.type) || task.type === 'DOCUMENTATION') && !(task.completionSummary ?? '').trim()) {\n    failures.push('completion summary is missing');\n  }\n  return { ok: failures.length === 0, failures, warnings };\n}\n\nexport function transitionTask(task: Task, to: TaskStatus, now: string, note?: string): GateResult | null {\n  if (task.status === to) return null;\n  if (!TRANSITIONS[task.status].includes(to)) {\n    throw new DevWorkspaceError('GATE', `Cannot move a task from ${task.status} to ${to}.`, {\n      hint: `Allowed from ${task.status}: ${TRANSITIONS[task.status].join(', ')}.`,\n    });\n  }\n  let gate: GateResult | null = null;\n  if (to === 'COMPLETED') {\n    gate = evaluateGate(task);\n    if (!gate.ok) {\n      throw new DevWorkspaceError('GATE', `Task ${task.id} cannot be completed:\\n  - ${gate.failures.join('\\n  - ')}`, {\n        hint: 'Resolve the items above (or mark the task BLOCKED/FAILED). A task is never complete while verification is failing.',\n      });\n    }\n  }\n  task.history.push({ at: now, from: task.status, to, ...(note ? { note: note.slice(0, 300) } : {}) });\n  task.status = to;\n  task.updatedAt = now;\n  return gate;\n}\n\nexport function nextRequiredStep(task: Task): string {\n  switch (task.status) {\n    case 'COMPLETED':\n      return 'None. The task is complete.';\n    case 'FAILED':\n      return 'Review the failure, then move the task back to IN_PROGRESS or close the idea.';\n    case 'BLOCKED':\n      return task.blockers.length > 0 ? `Resolve blocker: ${task.blockers[task.blockers.length - 1]}` : 'Identify and record what blocks this task.';\n    case 'IDEA':\n      return 'Clarify acceptance criteria, then plan.';\n    case 'SPECIFIED':\n      return 'Write a plan.';\n    case 'PLANNED':\n      return 'Start implementation (baseline verification first for meaningful changes).';\n    default: {\n      const pending = task.verification.filter((v) => v.required && (v.status === 'PENDING' || v.status === 'FAIL'));\n      if (pending.length > 0) return `Run/fix verification: ${pending.map((p) => `${p.check} (${p.status.toLowerCase()})`).join(', ')}.`;\n      const g = evaluateGate(task);\n      return g.ok ? 'All gates pass. Mark the task COMPLETED.' : `Satisfy the completion gate: ${g.failures[0]}`;\n    }\n  }\n}\n\n// ---------- storage ----------\n\nfunction taskFile(ws: Ws, task: Pick<Task, 'id' | 'status'>): string {\n  return path.join(task.status === 'COMPLETED' ? ws.tasksCompleted : ws.tasksActive, `${task.id}.json`);\n}\n\nexport async function saveTask(ws: Ws, task: Task): Promise<void> {\n  validateTask(task);\n  assertNoSecrets(task);\n  const dest = taskFile(ws, task);\n  await backupIfVersionChanges(ws, dest, task.schemaVersion);\n  await ensureDir(path.dirname(dest));\n  await atomicWriteJson(dest, task);\n  const other = path.join(task.status === 'COMPLETED' ? ws.tasksActive : ws.tasksCompleted, `${task.id}.json`);\n  await fs.rm(other, { force: true });\n}\n\nexport async function loadTask(ws: Ws, idOrPrefix: string): Promise<Task> {\n  for (const dir of [ws.tasksActive, ws.tasksCompleted]) {\n    if (!(await pathExists(dir))) continue;\n    const names = (await fs.readdir(dir)).filter((n) => n.endsWith('.json'));\n    const hits = names.filter((n) => n === `${idOrPrefix}.json` || n.startsWith(idOrPrefix));\n    if (hits.length > 1) {\n      const exact = hits.find((n) => n === `${idOrPrefix}.json`);\n      if (!exact) throw new DevWorkspaceError('USAGE', `Task id \"${idOrPrefix}\" is ambiguous.`, { hint: 'Use more characters of the id.' });\n      hits.splice(0, hits.length, exact);\n    }\n    if (hits.length === 1) {\n      const file = path.join(dir, hits[0]!);\n      return (await readVersioned(file, 'task', SCHEMA_VERSION, validateTask)).data;\n    }\n  }\n  throw new DevWorkspaceError('NOT_FOUND', `No task matching \"${idOrPrefix}\".`, { hint: 'List tasks with \"devworkspace task list --all\".' });\n}\n\nexport interface TaskListing {\n  tasks: Task[];\n  corrupt: { file: string; error: string }[];\n}\n\nexport async function listTasks(ws: Ws, opts: { includeCompleted?: boolean } = {}): Promise<TaskListing> {\n  const tasks: Task[] = [];\n  const corrupt: { file: string; error: string }[] = [];\n  const dirs = opts.includeCompleted ? [ws.tasksActive, ws.tasksCompleted] : [ws.tasksActive];\n  for (const dir of dirs) {\n    if (!(await pathExists(dir))) continue;\n    for (const name of (await fs.readdir(dir)).filter((n) => n.endsWith('.json')).sort()) {\n      try {\n        tasks.push((await readVersioned(path.join(dir, name), 'task', SCHEMA_VERSION, validateTask)).data);\n      } catch (e) {\n        corrupt.push({ file: `${path.basename(dir)}/${name}`, error: (e as Error).message });\n      }\n    }\n  }\n  tasks.sort((a, b) => b.updatedAt.localeCompare(a.updatedAt));\n  return { tasks, corrupt };\n}\n"]}
+{"version":3,"file":"task.js","sourceRoot":"","sources":["../../src/tasks/task.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAqB,MAAM,sBAAsB,CAAC;AACzE,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAClF,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAW,MAAM,sBAAsB,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAEvD,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,UAAU;IACV,KAAK;IACL,SAAS;IACT,UAAU;IACV,eAAe;IACf,SAAS;IACT,aAAa;IACb,UAAU;IACV,cAAc;IACd,SAAS;IACT,aAAa;CACL,CAAC;AAGX,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,CAAU,CAAC;AAG7I,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,eAAe,CAAU,CAAC;AA8EhG,MAAM,WAAW,GAAqC;IACpD,IAAI,EAAE,CAAC,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE,SAAS,EAAE,QAAQ,CAAC;IAClE,SAAS,EAAE,CAAC,SAAS,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,CAAC;IACxD,OAAO,EAAE,CAAC,aAAa,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC;IACxD,WAAW,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,CAAC;IAC/E,OAAO,EAAE,CAAC,aAAa,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,CAAC;IACpE,MAAM,EAAE,CAAC,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,CAAC;IACpE,OAAO,EAAE,CAAC,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC;IAClE,MAAM,EAAE,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,SAAS,EAAE,CAAC,aAAa,CAAC;CAC3B,CAAC;AAEF,MAAM,UAAU,kBAAkB,CAAC,IAAgB;IACjD,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,aAAa,GAAe,CAAC,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,UAAU,EAAE,cAAc,EAAE,aAAa,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;AAEjJ,MAAM,cAAc,GAA+B;IACjD,QAAQ,EAAE,EAAE;IACZ,aAAa,EAAE,EAAE;IACjB,GAAG,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC;IAC3C,OAAO,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC;IACzD,QAAQ,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC;IAC1D,OAAO,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC;IACtC,WAAW,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC;IACxC,QAAQ,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC;IAC1D,YAAY,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC;IAC9D,OAAO,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,CAAC;IACrE,WAAW,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;CAC/B,CAAC;AAEF,MAAM,UAAU,cAAc,CAAC,IAAc;IAC3C,OAAO,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACtC,CAAC;AAED,6HAA6H;AAC7H,MAAM,UAAU,iBAAiB,CAAC,IAAc,EAAE,QAAwB,EAAE,cAA0C,OAAO;IAC3H,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAY,CAAC,CAAC,CAAC;IAC1F,MAAM,KAAK,GAAuB,EAAE,CAAC;IACrC,KAAK,MAAM,KAAK,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;YACvB,IAAI,WAAW,KAAK,KAAK;gBAAE,SAAS;QACtC,CAAC;aAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,SAAS;QAC3C,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,MAAY,IAAI,IAAI,EAAE;IAC9C,MAAM,CAAC,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC3D,OAAO,KAAK,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;AACjC,CAAC;AAUD,MAAM,UAAU,gBAAgB,CAAC,KAAmB,EAAE,GAAW,EAAE,EAAE,GAAG,SAAS,EAAE;IACjF,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC/C,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,iBAAiB,CAAC,OAAO,EAAE,+BAA+B,CAAC,CAAC;IAClF,MAAM,IAAI,GAAS;QACjB,aAAa,EAAE,cAAc;QAC7B,EAAE;QACF,KAAK;QACL,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,MAAM,EAAE,MAAM;QACd,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,GAAG;QACd,WAAW,EAAE,CAAC,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC;QAC5D,kBAAkB,EAAE,EAAE;QACtB,IAAI,EAAE,EAAE;QACR,aAAa,EAAE,EAAE;QACjB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,KAAK,EAAE,EAAE;QACT,YAAY,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,iBAAiB,EAAE,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE;QAC7F,SAAS,EAAE,EAAE;QACb,QAAQ,EAAE,EAAE;QACZ,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,EAAE;QACpC,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;KAC/C,CAAC;IACF,eAAe,CAAC,IAAI,CAAC,CAAC;IACtB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAU;IACxC,IAAI,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,iBAAiB,CAAC,UAAU,EAAE,qEAAqE,EAAE;YAC7G,IAAI,EAAE,wDAAwD;SAC/D,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,CAAU,EAAE,IAAI,GAAG,MAAM;IACpD,MAAM,CAAC,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;IAC/C,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;IAC3C,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;IAClD,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACxC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC/C,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACpC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,MAAM,EAAE,eAAe,EAAE,WAAW,EAAE,UAAU,EAAE,aAAa,CAAU;QAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxI,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC;SAClB,GAAG,CAAC,CAAC,CAAC,YAAY,EAAE,GAAG,CAAC;SACxB,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QACnB,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;QACtC,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACxB,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3C,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC;QACrC,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;QACnD,IAAI,EAAE,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC9B,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC;iBACf,GAAG,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,CAAC;iBACrB,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;gBAChB,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;gBACpD,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBACrB,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,SAAS,CAAU,CAAC,CAAC;gBAChE,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;YAClD,CAAC,CAAC,CAAC;QACP,CAAC;IACH,CAAC,CAAC,CAAC;IACL,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACvC,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC;QAC7C,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC;IACD,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;IACpD,CAAC,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;IAC5D,CAAC,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAClE,CAAC,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC;IACtE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACrC,OAAO,CAAoB,CAAC;AAC9B,CAAC;AAkBD,MAAM,aAAa,GAAG,SAAS,CAAC;AAEhC,8GAA8G;AAC9G,SAAS,WAAW,CAAC,CAAmB,EAAE,GAAgB,EAAE,QAAkB,EAAE,QAAkB;IAChG,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC1F,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACvC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,KAAK,IAAI,CAAC;IACjC,MAAM,OAAO,GAAG,CAAC,KAAK,CAAC;IACvB,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,GAAG,CAAC;QAC7B,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;QACnD,IAAI,EAAE,KAAK,SAAS;YAAE,SAAS,CAAC,mEAAmE;QACnG,UAAU,EAAE,CAAC;QACb,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,KAAK,KAAK,GAAG,GAAG,CAAC;QACpC,MAAM,EAAE,GAAG,CAAC,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,GAAG,CAAC,CAAC;QACtD,IAAI,CAAC,EAAE;YAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,mCAAmC,CAAC,CAAC;aAC/D,IAAI,EAAE,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,EAAE,CAAC,YAAY;YAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,iEAAiE,CAAC,CAAC,KAAK,cAAc,GAAG,GAAG,CAAC,CAAC;aACnK,IAAI,EAAE,CAAC,IAAI,KAAK,SAAS;YAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,oEAAoE,CAAC,CAAC;aACvH,IAAI,EAAE,CAAC,QAAQ,KAAK,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,gBAAgB,EAAE,CAAC,QAAQ,IAAI,MAAM,GAAG,CAAC,CAAC;aACvF,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,KAAK,KAAK,EAAE;YAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,sDAAsD,CAAC,CAAC;IACtH,CAAC;IACD,IAAI,KAAK,IAAI,UAAU,KAAK,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,0CAA0C,CAAC,CAAC;IACnG,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,IAAU,EAAE,GAAiB;IACxD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC;IACrC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;QAClC,IAAI,CAAC,CAAC,CAAC,QAAQ;YAAE,SAAS;QAC1B,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM;YAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC;aACtD,IAAI,CAAC,CAAC,MAAM,KAAK,eAAe;YAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;aAChH,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAChC,IAAI,CAAC,CAAC,MAAM,KAAK,eAAe;gBAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,6DAA6D,CAAC,CAAC;;gBACpH,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,mCAAmC,CAAC,CAAC;QACpE,CAAC;aAAM,IAAI,MAAM,IAAI,WAAW,CAAC,CAAC,EAAE,GAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC9D,sBAAsB;QACxB,CAAC;aAAM,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS;YAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,eAAe,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;IACvC,IAAI,QAAQ,IAAI,CAAC,KAAK;QAAE,QAAQ,CAAC,IAAI,CAAC,iEAAiE,CAAC,CAAC;IACzG,IAAI,QAAQ,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,KAAK,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM;YAAE,QAAQ,CAAC,IAAI,CAAC,kCAAkC,QAAQ,CAAC,MAAM,OAAO,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAC1H,IAAI,KAAK,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM;YAAE,QAAQ,CAAC,IAAI,CAAC,uCAAuC,QAAQ,CAAC,MAAM,OAAO,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACjI,CAAC;IACD,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,cAAc;YAAE,QAAQ,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;QACpG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,iBAAiB;YAAE,QAAQ,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC;QACrH,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,mBAAmB;YAAE,QAAQ,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC;IACnH,CAAC;IACD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,eAAe,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC3G,QAAQ,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAU,EAAE,EAAc,EAAE,GAAW,EAAE,IAAa,EAAE,GAAiB;IACtG,IAAI,IAAI,CAAC,MAAM,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,iBAAiB,CAAC,MAAM,EAAE,2BAA2B,IAAI,CAAC,MAAM,OAAO,EAAE,GAAG,EAAE;YACtF,IAAI,EAAE,gBAAgB,IAAI,CAAC,MAAM,KAAK,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;SAC7E,CAAC,CAAC;IACL,CAAC;IACD,IAAI,IAAI,GAAsB,IAAI,CAAC;IACnC,IAAI,EAAE,KAAK,WAAW,EAAE,CAAC;QACvB,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,iBAAiB,CAAC,MAAM,EAAE,QAAQ,IAAI,CAAC,EAAE,8BAA8B,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE;gBAC/G,IAAI,EAAE,oHAAoH;aAC3H,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACrG,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC;IACjB,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC;IACrB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAU,EAAE,GAAiB;IAC5D,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;QACpB,KAAK,WAAW;YACd,OAAO,6BAA6B,CAAC;QACvC,KAAK,QAAQ;YACX,OAAO,+EAA+E,CAAC;QACzF,KAAK,SAAS;YACZ,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,oBAAoB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,4CAA4C,CAAC;QACjJ,KAAK,MAAM;YACT,OAAO,yCAAyC,CAAC;QACnD,KAAK,WAAW;YACd,OAAO,eAAe,CAAC;QACzB,KAAK,SAAS;YACZ,OAAO,4EAA4E,CAAC;QACtF,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,eAAe,CAAC,CAAC,CAAC;YAC/I,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,yBAAyB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;YACtJ,MAAM,CAAC,GAAG,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAClC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,0CAA0C,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7G,CAAC;IACH,CAAC;AACH,CAAC;AAED,gCAAgC;AAEhC,SAAS,QAAQ,CAAC,EAAM,EAAE,IAAiC;IACzD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;AACxG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,EAAM,EAAE,IAAU;IAC/C,YAAY,CAAC,IAAI,CAAC,CAAC;IACnB,eAAe,CAAC,IAAI,CAAC,CAAC;IACtB,MAAM,IAAI,GAAG,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IAChC,MAAM,sBAAsB,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;IAC3D,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACpC,MAAM,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,cAAc,EAAE,GAAG,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;IAC7G,MAAM,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,EAAM,EAAE,UAAkB;IACvD,KAAK,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,cAAc,CAAC,EAAE,CAAC;QACtD,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;YAAE,SAAS;QACvC,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QACzE,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,UAAU,OAAO,IAAI,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;QACzF,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,UAAU,OAAO,CAAC,CAAC;YAC3D,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,iBAAiB,CAAC,OAAO,EAAE,YAAY,UAAU,iBAAiB,EAAE,EAAE,IAAI,EAAE,gCAAgC,EAAE,CAAC,CAAC;YACtI,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC;YACtC,OAAO,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC;QAChF,CAAC;IACH,CAAC;IACD,MAAM,IAAI,iBAAiB,CAAC,WAAW,EAAE,qBAAqB,UAAU,IAAI,EAAE,EAAE,IAAI,EAAE,iDAAiD,EAAE,CAAC,CAAC;AAC7I,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,EAAM,EAAE,OAAuC,EAAE;IAC/E,MAAM,KAAK,GAAW,EAAE,CAAC;IACzB,MAAM,OAAO,GAAsC,EAAE,CAAC;IACtD,MAAM,IAAI,GAAG,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC;IAC5F,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;YAAE,SAAS;QACvC,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACrF,IAAI,CAAC;gBACH,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACrG,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,KAAK,EAAG,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;YACvF,CAAC;QACH,CAAC;IACH,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IAC7D,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAC5B,CAAC","sourcesContent":["import { promises as fs } from 'node:fs';\nimport path from 'node:path';\nimport { DevWorkspaceError } from '../errors/index.js';\nimport { Check } from '../config/validate.js';\nimport { SCHEMA_VERSION, type CommandEntry } from '../config/schemas.js';\nimport { atomicWriteJson, ensureDir, pathExists, randomId } from '../utils/fs.js';\nimport { readVersioned } from '../core/versioned.js';\nimport { backupIfVersionChanges, type Ws } from '../core/workspace.js';\nimport { containsSecret } from '../security/redact.js';\n\nexport const TASK_TYPES = [\n  'QUESTION',\n  'BUG',\n  'FEATURE',\n  'REFACTOR',\n  'DOCUMENTATION',\n  'TESTING',\n  'PERFORMANCE',\n  'SECURITY',\n  'ARCHITECTURE',\n  'RELEASE',\n  'MAINTENANCE',\n] as const;\nexport type TaskType = (typeof TASK_TYPES)[number];\n\nexport const TASK_STATUSES = ['IDEA', 'SPECIFIED', 'PLANNED', 'IN_PROGRESS', 'TESTING', 'REVIEW', 'BLOCKED', 'FAILED', 'COMPLETED'] as const;\nexport type TaskStatus = (typeof TASK_STATUSES)[number];\n\nexport const VERIFY_STATUSES = ['PENDING', 'PASS', 'FAIL', 'SKIPPED', 'COULD_NOT_RUN'] as const;\nexport type VerifyStatus = (typeof VERIFY_STATUSES)[number];\n\n/**\n * One recorded result for one package. `executed` means DevWorkspace ran the contract command itself and saw the exit\n * code; `claimed` is somebody's report (agent or person) that DevWorkspace could not observe.\n */\nexport interface Evidence {\n  kind: 'executed' | 'claimed';\n  at: string;\n  /** Package directory relative to the project root; \".\" for the root. */\n  package: string;\n  command?: string;\n  exitCode?: number | null;\n  durationMs?: number;\n  /** Fingerprint of the task's changes inside this package when the result was recorded. */\n  scope?: string;\n  /** A claim the user explicitly vouched for (--reason user-override). */\n  userOverride?: boolean;\n  /** One-line, scrubbed explanation (failure tail or refusal reason). Never a connection string or credential. */\n  note?: string;\n}\n\nexport interface VerificationItem {\n  check: string;\n  required: boolean;\n  status: VerifyStatus;\n  reason?: string;\n  detail?: string;\n  updatedAt?: string;\n  /** Latest result per package. Absent on tasks recorded by older versions. */\n  evidence?: Evidence[];\n}\n\n/** Files that were already modified when the task was created, so they are not blamed on the task. */\nexport interface TaskScope {\n  capturedAt: string;\n  /** Git HEAD when the task was created; null outside a repository. */\n  head: string | null;\n  /** Project-relative path -> content hash of files already modified at creation (\"deleted\" for removed files). */\n  baseline: Record<string, string>;\n}\n\nexport interface TestCounts {\n  passed: number;\n  failed: number;\n}\n\nexport interface Attestations {\n  userWorkIntact: boolean;\n  knowledgeReviewed: boolean;\n  finalStateInspected: boolean;\n}\n\nexport interface Task {\n  schemaVersion: number;\n  id: string;\n  title: string;\n  type: TaskType;\n  status: TaskStatus;\n  createdAt: string;\n  updatedAt: string;\n  description: string;\n  acceptanceCriteria: string[];\n  plan: string[];\n  affectedAreas: string[];\n  verification: VerificationItem[];\n  tests: { baseline?: TestCounts; after?: TestCounts };\n  attestations: Attestations;\n  /** Present on tasks created by 0.2.2+: enables package-aware, evidence-based completion. */\n  scope?: TaskScope;\n  decisions: string[];\n  blockers: string[];\n  constraints: string[];\n  completionSummary?: string;\n  history: { at: string; from: TaskStatus | null; to: TaskStatus; note?: string }[];\n}\n\nconst TRANSITIONS: Record<TaskStatus, TaskStatus[]> = {\n  IDEA: ['SPECIFIED', 'PLANNED', 'IN_PROGRESS', 'BLOCKED', 'FAILED'],\n  SPECIFIED: ['PLANNED', 'IN_PROGRESS', 'BLOCKED', 'IDEA'],\n  PLANNED: ['IN_PROGRESS', 'SPECIFIED', 'BLOCKED', 'IDEA'],\n  IN_PROGRESS: ['TESTING', 'REVIEW', 'COMPLETED', 'BLOCKED', 'FAILED', 'PLANNED'],\n  TESTING: ['IN_PROGRESS', 'REVIEW', 'COMPLETED', 'BLOCKED', 'FAILED'],\n  REVIEW: ['IN_PROGRESS', 'TESTING', 'COMPLETED', 'BLOCKED', 'FAILED'],\n  BLOCKED: ['IN_PROGRESS', 'PLANNED', 'SPECIFIED', 'IDEA', 'FAILED'],\n  FAILED: ['IN_PROGRESS', 'IDEA'],\n  COMPLETED: ['IN_PROGRESS'],\n};\n\nexport function allowedTransitions(from: TaskStatus): TaskStatus[] {\n  return TRANSITIONS[from];\n}\n\nconst CODE_CHANGING: TaskType[] = ['BUG', 'FEATURE', 'REFACTOR', 'PERFORMANCE', 'SECURITY', 'ARCHITECTURE', 'MAINTENANCE', 'TESTING', 'RELEASE'];\n\nconst CHECKS_BY_TYPE: Record<TaskType, string[]> = {\n  QUESTION: [],\n  DOCUMENTATION: [],\n  BUG: ['unit', 'typecheck', 'lint', 'build'],\n  FEATURE: ['unit', 'typecheck', 'lint', 'build', 'review'],\n  REFACTOR: ['unit', 'typecheck', 'lint', 'build', 'review'],\n  TESTING: ['unit', 'typecheck', 'lint'],\n  PERFORMANCE: ['unit', 'build', 'review'],\n  SECURITY: ['unit', 'typecheck', 'lint', 'build', 'review'],\n  ARCHITECTURE: ['unit', 'typecheck', 'lint', 'build', 'review'],\n  RELEASE: ['unit', 'typecheck', 'lint', 'build', 'integration', 'e2e'],\n  MAINTENANCE: ['lint', 'build'],\n};\n\nexport function isCodeChanging(type: TaskType): boolean {\n  return CODE_CHANGING.includes(type);\n}\n\n/** Verification a task of this type needs, given what the project actually offers. Unavailable checks are never demanded. */\nexport function requiredChecksFor(type: TaskType, contract: CommandEntry[], reviewLevel: 'off' | 'light' | 'strict' = 'light'): VerificationItem[] {\n  const available = new Set(contract.filter((c) => c.available).map((c) => c.id as string));\n  const items: VerificationItem[] = [];\n  for (const check of CHECKS_BY_TYPE[type]) {\n    if (check === 'review') {\n      if (reviewLevel === 'off') continue;\n    } else if (!available.has(check)) continue;\n    items.push({ check, required: true, status: 'PENDING' });\n  }\n  return items;\n}\n\nexport function newTaskId(now: Date = new Date()): string {\n  const d = now.toISOString().slice(0, 10).replace(/-/g, '');\n  return `T-${d}-${randomId(2)}`;\n}\n\nexport interface NewTaskInput {\n  title: string;\n  type: TaskType;\n  description?: string;\n  verification: VerificationItem[];\n  constraints?: string[];\n}\n\nexport function createTaskObject(input: NewTaskInput, now: string, id = newTaskId()): Task {\n  const title = input.title.trim().slice(0, 200);\n  if (!title) throw new DevWorkspaceError('USAGE', 'Task title must not be empty.');\n  const task: Task = {\n    schemaVersion: SCHEMA_VERSION,\n    id,\n    title,\n    type: input.type,\n    status: 'IDEA',\n    createdAt: now,\n    updatedAt: now,\n    description: (input.description ?? '').trim().slice(0, 4000),\n    acceptanceCriteria: [],\n    plan: [],\n    affectedAreas: [],\n    verification: input.verification,\n    tests: {},\n    attestations: { userWorkIntact: false, knowledgeReviewed: false, finalStateInspected: false },\n    decisions: [],\n    blockers: [],\n    constraints: input.constraints ?? [],\n    history: [{ at: now, from: null, to: 'IDEA' }],\n  };\n  assertNoSecrets(task);\n  return task;\n}\n\nexport function assertNoSecrets(task: Task): void {\n  if (containsSecret(JSON.stringify(task))) {\n    throw new DevWorkspaceError('SECURITY', 'Task content looks like it contains a secret; refusing to store it.', {\n      hint: 'Remove credential values from titles, plans and notes.',\n    });\n  }\n}\n\nexport function validateTask(v: unknown, file = 'task'): Task {\n  const c = new Check(file);\n  const o = c.obj(v);\n  c.at_('schemaVersion').int(o.schemaVersion, 1);\n  c.at_('id').str(o.id, { min: 3, max: 64 });\n  c.at_('title').str(o.title, { min: 1, max: 300 });\n  c.at_('type').oneOf(o.type, TASK_TYPES);\n  c.at_('status').oneOf(o.status, TASK_STATUSES);\n  c.at_('createdAt').iso(o.createdAt);\n  c.at_('updatedAt').iso(o.updatedAt);\n  for (const k of ['acceptanceCriteria', 'plan', 'affectedAreas', 'decisions', 'blockers', 'constraints'] as const) c.at_(k).strArr(o[k]);\n  c.at_('verification')\n    .arr(o.verification, 100)\n    .forEach((item, i) => {\n      const ic = c.at_(`verification.${i}`);\n      const io = ic.obj(item);\n      ic.at_('check').str(io.check, { max: 50 });\n      ic.at_('required').bool(io.required);\n      ic.at_('status').oneOf(io.status, VERIFY_STATUSES);\n      if (io.evidence !== undefined) {\n        ic.at_('evidence')\n          .arr(io.evidence, 100)\n          .forEach((e, j) => {\n            const ec = c.at_(`verification.${i}.evidence.${j}`);\n            const eo = ec.obj(e);\n            ec.at_('kind').oneOf(eo.kind, ['executed', 'claimed'] as const);\n            ec.at_('package').str(eo.package, { max: 240 });\n          });\n      }\n    });\n  if (o.scope !== undefined) {\n    const sc = c.at_('scope').obj(o.scope);\n    c.at_('scope.capturedAt').iso(sc.capturedAt);\n    c.at_('scope.baseline').obj(sc.baseline);\n  }\n  const a = c.at_('attestations').obj(o.attestations);\n  c.at_('attestations.userWorkIntact').bool(a.userWorkIntact);\n  c.at_('attestations.knowledgeReviewed').bool(a.knowledgeReviewed);\n  c.at_('attestations.finalStateInspected').bool(a.finalStateInspected);\n  c.at_('tests').obj(o.tests);\n  c.at_('history').arr(o.history, 500);\n  return o as unknown as Task;\n}\n\nexport interface GateResult {\n  ok: boolean;\n  failures: string[];\n  warnings: string[];\n}\n\n/** What the gate needs to know beyond the task itself: the contract and what the task changed, per package. */\nexport interface GateContext {\n  contract: CommandEntry[];\n  /**\n   * Fingerprint of the task's changes inside each package (\".\" = everything). `null` means the changes could not be\n   * determined (not a Git repository, or nothing changed since the task started), so every package counts as affected.\n   */\n  scope: Record<string, string> | null;\n}\n\nconst UNKNOWN_SCOPE = 'unknown';\n\n/** Per-package requirements of one check. Returns false when the contract has no applicable package entry. */\nfunction packageGate(v: VerificationItem, ctx: GateContext, failures: string[], warnings: string[]): boolean {\n  const entries = ctx.contract.filter((c) => c.id === v.check && c.available && !c.mutates);\n  if (entries.length === 0) return false;\n  const known = ctx.scope !== null;\n  const unknown = !known;\n  let applicable = 0;\n  for (const entry of entries) {\n    const pkg = entry.cwd ?? '.';\n    const fp = known ? ctx.scope![pkg] : UNKNOWN_SCOPE;\n    if (fp === undefined) continue; // this package was not changed, so this check does not apply to it\n    applicable++;\n    const label = `${v.check} [${pkg}]`;\n    const ev = v.evidence?.find((e) => e.package === pkg);\n    if (!ev) failures.push(`${label}: not run for the current changes`);\n    else if (ev.kind === 'claimed' && !ev.userOverride) failures.push(`${label}: only claimed, not executed (run: devworkspace task run <id> ${v.check} --package ${pkg})`);\n    else if (ev.kind === 'claimed') warnings.push(`${label}: accepted on the user's word; DevWorkspace did not observe it run`);\n    else if (ev.exitCode !== 0) failures.push(`${label}: FAIL (exit ${ev.exitCode ?? 'none'})`);\n    else if (!unknown && ev.scope !== fp) failures.push(`${label}: passed, but files changed afterwards; run it again`);\n  }\n  if (known && applicable === 0) warnings.push(`${v.check}: no package with this check was changed`);\n  return true;\n}\n\n/**\n * The completion gate. A task is only COMPLETED when every applicable requirement holds.\n * Tasks that carry a `scope` (created by 0.2.2+) are checked per changed package against executed evidence; older\n * tasks keep the original rules.\n */\nexport function evaluateGate(task: Task, ctx?: GateContext): GateResult {\n  const failures: string[] = [];\n  const warnings: string[] = [];\n  const scoped = !!ctx && !!task.scope;\n  for (const v of task.verification) {\n    if (!v.required) continue;\n    if (v.status === 'FAIL') failures.push(`${v.check}: FAIL`);\n    else if (v.status === 'COULD_NOT_RUN') failures.push(`${v.check}: could not run${v.detail ? ` (${v.detail})` : ''}`);\n    else if (v.status === 'SKIPPED') {\n      if (v.reason === 'user-override') warnings.push(`${v.check}: skipped at the user's request; completion is less certain`);\n      else failures.push(`${v.check}: skipped without a user override`);\n    } else if (scoped && packageGate(v, ctx!, failures, warnings)) {\n      // handled per package\n    } else if (v.status === 'PENDING') failures.push(`${v.check}: not run yet`);\n  }\n  const { baseline, after } = task.tests;\n  if (baseline && !after) failures.push('baseline test results recorded, but no results after the change');\n  if (baseline && after) {\n    if (after.failed > baseline.failed) failures.push(`regression: failures rose from ${baseline.failed} to ${after.failed}`);\n    if (after.passed < baseline.passed) failures.push(`regression: passing tests fell from ${baseline.passed} to ${after.passed}`);\n  }\n  if (isCodeChanging(task.type)) {\n    if (!task.attestations.userWorkIntact) failures.push('not confirmed: no user work was overwritten');\n    if (!task.attestations.knowledgeReviewed) failures.push('not confirmed: project knowledge was reviewed for updates');\n    if (!task.attestations.finalStateInspected) failures.push('not confirmed: final repository state was inspected');\n  }\n  if ((isCodeChanging(task.type) || task.type === 'DOCUMENTATION') && !(task.completionSummary ?? '').trim()) {\n    failures.push('completion summary is missing');\n  }\n  return { ok: failures.length === 0, failures, warnings };\n}\n\nexport function transitionTask(task: Task, to: TaskStatus, now: string, note?: string, ctx?: GateContext): GateResult | null {\n  if (task.status === to) return null;\n  if (!TRANSITIONS[task.status].includes(to)) {\n    throw new DevWorkspaceError('GATE', `Cannot move a task from ${task.status} to ${to}.`, {\n      hint: `Allowed from ${task.status}: ${TRANSITIONS[task.status].join(', ')}.`,\n    });\n  }\n  let gate: GateResult | null = null;\n  if (to === 'COMPLETED') {\n    gate = evaluateGate(task, ctx);\n    if (!gate.ok) {\n      throw new DevWorkspaceError('GATE', `Task ${task.id} cannot be completed:\\n  - ${gate.failures.join('\\n  - ')}`, {\n        hint: 'Resolve the items above (or mark the task BLOCKED/FAILED). A task is never complete while verification is failing.',\n      });\n    }\n  }\n  task.history.push({ at: now, from: task.status, to, ...(note ? { note: note.slice(0, 300) } : {}) });\n  task.status = to;\n  task.updatedAt = now;\n  return gate;\n}\n\nexport function nextRequiredStep(task: Task, ctx?: GateContext): string {\n  switch (task.status) {\n    case 'COMPLETED':\n      return 'None. The task is complete.';\n    case 'FAILED':\n      return 'Review the failure, then move the task back to IN_PROGRESS or close the idea.';\n    case 'BLOCKED':\n      return task.blockers.length > 0 ? `Resolve blocker: ${task.blockers[task.blockers.length - 1]}` : 'Identify and record what blocks this task.';\n    case 'IDEA':\n      return 'Clarify acceptance criteria, then plan.';\n    case 'SPECIFIED':\n      return 'Write a plan.';\n    case 'PLANNED':\n      return 'Start implementation (baseline verification first for meaningful changes).';\n    default: {\n      const pending = task.verification.filter((v) => v.required && (v.status === 'PENDING' || v.status === 'FAIL' || v.status === 'COULD_NOT_RUN'));\n      if (pending.length > 0) return `Run/fix verification: ${pending.map((p) => `${p.check} (${p.status.toLowerCase().replace(/_/g, ' ')})`).join(', ')}.`;\n      const g = evaluateGate(task, ctx);\n      return g.ok ? 'All gates pass. Mark the task COMPLETED.' : `Satisfy the completion gate: ${g.failures[0]}`;\n    }\n  }\n}\n\n// ---------- storage ----------\n\nfunction taskFile(ws: Ws, task: Pick<Task, 'id' | 'status'>): string {\n  return path.join(task.status === 'COMPLETED' ? ws.tasksCompleted : ws.tasksActive, `${task.id}.json`);\n}\n\nexport async function saveTask(ws: Ws, task: Task): Promise<void> {\n  validateTask(task);\n  assertNoSecrets(task);\n  const dest = taskFile(ws, task);\n  await backupIfVersionChanges(ws, dest, task.schemaVersion);\n  await ensureDir(path.dirname(dest));\n  await atomicWriteJson(dest, task);\n  const other = path.join(task.status === 'COMPLETED' ? ws.tasksActive : ws.tasksCompleted, `${task.id}.json`);\n  await fs.rm(other, { force: true });\n}\n\nexport async function loadTask(ws: Ws, idOrPrefix: string): Promise<Task> {\n  for (const dir of [ws.tasksActive, ws.tasksCompleted]) {\n    if (!(await pathExists(dir))) continue;\n    const names = (await fs.readdir(dir)).filter((n) => n.endsWith('.json'));\n    const hits = names.filter((n) => n === `${idOrPrefix}.json` || n.startsWith(idOrPrefix));\n    if (hits.length > 1) {\n      const exact = hits.find((n) => n === `${idOrPrefix}.json`);\n      if (!exact) throw new DevWorkspaceError('USAGE', `Task id \"${idOrPrefix}\" is ambiguous.`, { hint: 'Use more characters of the id.' });\n      hits.splice(0, hits.length, exact);\n    }\n    if (hits.length === 1) {\n      const file = path.join(dir, hits[0]!);\n      return (await readVersioned(file, 'task', SCHEMA_VERSION, validateTask)).data;\n    }\n  }\n  throw new DevWorkspaceError('NOT_FOUND', `No task matching \"${idOrPrefix}\".`, { hint: 'List tasks with \"devworkspace task list --all\".' });\n}\n\nexport interface TaskListing {\n  tasks: Task[];\n  corrupt: { file: string; error: string }[];\n}\n\nexport async function listTasks(ws: Ws, opts: { includeCompleted?: boolean } = {}): Promise<TaskListing> {\n  const tasks: Task[] = [];\n  const corrupt: { file: string; error: string }[] = [];\n  const dirs = opts.includeCompleted ? [ws.tasksActive, ws.tasksCompleted] : [ws.tasksActive];\n  for (const dir of dirs) {\n    if (!(await pathExists(dir))) continue;\n    for (const name of (await fs.readdir(dir)).filter((n) => n.endsWith('.json')).sort()) {\n      try {\n        tasks.push((await readVersioned(path.join(dir, name), 'task', SCHEMA_VERSION, validateTask)).data);\n      } catch (e) {\n        corrupt.push({ file: `${path.basename(dir)}/${name}`, error: (e as Error).message });\n      }\n    }\n  }\n  tasks.sort((a, b) => b.updatedAt.localeCompare(a.updatedAt));\n  return { tasks, corrupt };\n}\n"]}

package/dist/verification/safety.d.ts

@@ -0,0 +1,38 @@
+import type { CommandEntry } from '../config/schemas.js';
+import type { Ws } from '../core/workspace.js';
+export type Safety = 'safe' | 'needs-test-environment' | 'blocked';
+export interface CommandSafety {
+    safety: Safety;
+    reasons: string[];
+    /** Services the package is known to use (from its manifest), for the explanation only. */
+    services: string[];
+}
+export interface ManifestEvidence {
+    scriptBody: string | null;
+    services: string[];
+    hasCredentialFile: boolean;
+}
+/** Read the package manifest next to a command: the script it runs and the services the package depends on. Never reads .env files. */
+export declare function readManifestEvidence(root: string, entry: CommandEntry): Promise<ManifestEvidence>;
+/**
+ * Decide whether DevWorkspace may run a contract command by itself. Pure; no file is read here.
+ *  - blocked: modifies project files, changes a schema/data set, or is destructive. Never run automatically.
+ *  - needs-test-environment: exercises real services or may (a catch-all `test` in a package that uses a database).
+ *    Runs only after the user declared a test environment for that package and check.
+ *  - safe: typecheck, lint, build, unit tests and read-only format checks.
+ * A database is never judged safe from its name; DevWorkspace does not read connection settings at all.
+ */
+export declare function classifyCommand(entry: CommandEntry, evidence: ManifestEvidence): CommandSafety;
+export interface TestEnvDeclaration {
+    /** Package directory relative to the project root; "." for the root. */
+    package: string;
+    checks: string[];
+    /** Human description of the target, e.g. "docker compose test stack on this laptop". Never a connection string. */
+    target: string;
+    declaredAt: string;
+}
+export declare function loadTestEnv(ws: Ws): Promise<TestEnvDeclaration[]>;
+export declare function assertSafeTarget(target: string): void;
+export declare function saveDeclaration(ws: Ws, d: TestEnvDeclaration): Promise<void>;
+export declare function removeDeclaration(ws: Ws, pkg: string): Promise<boolean>;
+export declare function isDeclared(decls: TestEnvDeclaration[], pkg: string, check: string): TestEnvDeclaration | undefined;

package/dist/verification/safety.js

@@ -0,0 +1,120 @@
+import path from 'node:path';
+import { DevWorkspaceError } from '../errors/index.js';
+import { containsSecret } from '../security/redact.js';
+import { safeReadText } from '../security/files.js';
+import { atomicWriteJson, pathExists, readJsonFile } from '../utils/fs.js';
+/** Dependencies that mean a package talks to a database or queue. */
+const SERVICE_DEPS = {
+    pg: 'PostgreSQL',
+    postgres: 'PostgreSQL',
+    'drizzle-orm': 'a SQL database',
+    prisma: 'a SQL database',
+    '@prisma/client': 'a SQL database',
+    typeorm: 'a SQL database',
+    sequelize: 'a SQL database',
+    knex: 'a SQL database',
+    mongoose: 'MongoDB',
+    mongodb: 'MongoDB',
+    redis: 'Redis',
+    ioredis: 'Redis',
+    bullmq: 'Redis',
+    bull: 'Redis',
+};
+/** Words that make a command destructive or schema-changing no matter which check it is filed under. */
+const DESTRUCTIVE = /(?:^|[\s:/_-])(?:drop|truncate|flushall|flushdb|reset|seed|migrate)(?:$|[\s:/_.-])|db:push|--force|rm\s+-rf/i;
+/** Checks whose job is to exercise real services. They need a declared test environment. */
+const SERVICE_CHECKS = new Set(['integration', 'security', 'e2e']);
+/** Read the package manifest next to a command: the script it runs and the services the package depends on. Never reads .env files. */
+export async function readManifestEvidence(root, entry) {
+    const dir = entry.cwd && entry.cwd !== '.' ? entry.cwd : '';
+    const manifest = dir ? `${dir}/package.json` : 'package.json';
+    let scriptBody = null;
+    const services = new Set();
+    try {
+        const text = await safeReadText(root, manifest, 1024 * 1024);
+        const json = text ? JSON.parse(text) : null;
+        const script = /#scripts\.(.+)$/.exec(entry.source ?? '')?.[1];
+        if (json && script && typeof json.scripts?.[script] === 'string')
+            scriptBody = json.scripts[script];
+        for (const dep of Object.keys({ ...json?.dependencies, ...json?.devDependencies }))
+            if (SERVICE_DEPS[dep])
+                services.add(SERVICE_DEPS[dep]);
+    }
+    catch {
+        /* unreadable manifest: no evidence */
+    }
+    let hasCredentialFile = false;
+    for (const name of ['.env', '.env.local', '.env.test', '.env.development']) {
+        if (await pathExists(path.join(root, ...(dir ? [dir] : []), name)))
+            hasCredentialFile = true;
+    }
+    // "a SQL database" is only the fallback label for an ORM; drop it once a specific database is known.
+    if (services.size > 1)
+        services.delete('a SQL database');
+    return { scriptBody, services: [...services].sort(), hasCredentialFile };
+}
+/**
+ * Decide whether DevWorkspace may run a contract command by itself. Pure; no file is read here.
+ *  - blocked: modifies project files, changes a schema/data set, or is destructive. Never run automatically.
+ *  - needs-test-environment: exercises real services or may (a catch-all `test` in a package that uses a database).
+ *    Runs only after the user declared a test environment for that package and check.
+ *  - safe: typecheck, lint, build, unit tests and read-only format checks.
+ * A database is never judged safe from its name; DevWorkspace does not read connection settings at all.
+ */
+export function classifyCommand(entry, evidence) {
+    const reasons = [];
+    const services = evidence.services;
+    const text = `${entry.command ?? ''} ${evidence.scriptBody ?? ''}`;
+    if (entry.mutates)
+        return { safety: 'blocked', reasons: ['it modifies project files; DevWorkspace never runs formatters or fixers'], services };
+    if (entry.id === 'migrations')
+        return { safety: 'blocked', reasons: ['it changes a database schema; DevWorkspace never runs migrations'], services };
+    if (DESTRUCTIVE.test(text))
+        return { safety: 'blocked', reasons: ['its definition mentions a destructive or schema-changing operation (drop/reset/seed/migrate/flush)'], services };
+    if (SERVICE_CHECKS.has(entry.id)) {
+        reasons.push(`${entry.id} tests exercise real services${services.length ? ` (the package uses ${services.join(', ')})` : ''}`);
+    }
+    else if (entry.id === 'unit' && services.length > 0 && /(?:^|\s)(?:run\s+)?test(?:\s|$)/.test(entry.command ?? '') && !/unit/.test(entry.command ?? '')) {
+        reasons.push(`the catch-all test script of a package that uses ${services.join(', ')} may include integration tests`);
+    }
+    if (reasons.length === 0)
+        return { safety: 'safe', reasons: [], services };
+    if (evidence.hasCredentialFile)
+        reasons.push('a credential file exists in the package (never read), so the database target cannot be verified');
+    else
+        reasons.push('the database target cannot be verified');
+    return { safety: 'needs-test-environment', reasons, services };
+}
+const file = (ws) => path.join(ws.localDir, 'test-environment.json');
+export async function loadTestEnv(ws) {
+    if (!(await pathExists(file(ws))))
+        return [];
+    const raw = (await readJsonFile(file(ws)));
+    return Array.isArray(raw.declarations) ? raw.declarations : [];
+}
+export function assertSafeTarget(target) {
+    const t = target.trim();
+    if (t.length < 5 || t.length > 200)
+        throw new DevWorkspaceError('USAGE', '--target must be a short description (5-200 characters) of the test environment.');
+    if (containsSecret(t) || /[a-z][a-z0-9+.-]*:\/\/\S+/i.test(t) || /(?:password|passwd|pwd|token|secret)\s*[=:]/i.test(t)) {
+        throw new DevWorkspaceError('SECURITY', 'The target description looks like a connection string or credential; refusing to store it.', {
+            hint: 'Describe the environment in words (for example "disposable docker compose stack"), not how to connect to it.',
+        });
+    }
+}
+export async function saveDeclaration(ws, d) {
+    const all = (await loadTestEnv(ws)).filter((x) => x.package !== d.package);
+    await atomicWriteJson(file(ws), { schemaVersion: 1, declarations: [...all, d] });
+}
+export async function removeDeclaration(ws, pkg) {
+    const all = await loadTestEnv(ws);
+    const rest = all.filter((x) => x.package !== pkg);
+    if (rest.length === all.length)
+        return false;
+    await atomicWriteJson(file(ws), { schemaVersion: 1, declarations: rest });
+    return true;
+}
+export function isDeclared(decls, pkg, check) {
+    return decls.find((d) => d.package === pkg && d.checks.includes(check));
+}
+//# sourceMappingURL=safety.js.map

package/dist/verification/safety.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"safety.js","sourceRoot":"","sources":["../../src/verification/safety.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAG3E,qEAAqE;AACrE,MAAM,YAAY,GAA2B;IAC3C,EAAE,EAAE,YAAY;IAChB,QAAQ,EAAE,YAAY;IACtB,aAAa,EAAE,gBAAgB;IAC/B,MAAM,EAAE,gBAAgB;IACxB,gBAAgB,EAAE,gBAAgB;IAClC,OAAO,EAAE,gBAAgB;IACzB,SAAS,EAAE,gBAAgB;IAC3B,IAAI,EAAE,gBAAgB;IACtB,QAAQ,EAAE,SAAS;IACnB,OAAO,EAAE,SAAS;IAClB,KAAK,EAAE,OAAO;IACd,OAAO,EAAE,OAAO;IAChB,MAAM,EAAE,OAAO;IACf,IAAI,EAAE,OAAO;CACd,CAAC;AAEF,wGAAwG;AACxG,MAAM,WAAW,GAAG,8GAA8G,CAAC;AACnI,4FAA4F;AAC5F,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC;AAiBnE,uIAAuI;AACvI,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAAY,EAAE,KAAmB;IAC1E,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,KAAK,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5D,MAAM,QAAQ,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,eAAe,CAAC,CAAC,CAAC,cAAc,CAAC;IAC9D,IAAI,UAAU,GAAkB,IAAI,CAAC;IACrC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,GAAG,IAAI,CAAC,CAAC;QAC7D,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAA2H,CAAC,CAAC,CAAC,IAAI,CAAC;QACvK,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC/D,IAAI,IAAI,IAAI,MAAM,IAAI,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,KAAK,QAAQ;YAAE,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAE,CAAC;QACrG,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,YAAY,EAAE,GAAG,IAAI,EAAE,eAAe,EAAE,CAAC;YAAE,IAAI,YAAY,CAAC,GAAG,CAAC;gBAAE,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAE,CAAC,CAAC;IAC9I,CAAC;IAAC,MAAM,CAAC;QACP,sCAAsC;IACxC,CAAC;IACD,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,kBAAkB,CAAC,EAAE,CAAC;QAC3E,IAAI,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;YAAE,iBAAiB,GAAG,IAAI,CAAC;IAC/F,CAAC;IACD,qGAAqG;IACrG,IAAI,QAAQ,CAAC,IAAI,GAAG,CAAC;QAAE,QAAQ,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACzD,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE,iBAAiB,EAAE,CAAC;AAC3E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,KAAmB,EAAE,QAA0B;IAC7E,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC;IACnC,MAAM,IAAI,GAAG,GAAG,KAAK,CAAC,OAAO,IAAI,EAAE,IAAI,QAAQ,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;IACnE,IAAI,KAAK,CAAC,OAAO;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,yEAAyE,CAAC,EAAE,QAAQ,EAAE,CAAC;IAChJ,IAAI,KAAK,CAAC,EAAE,KAAK,YAAY;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,kEAAkE,CAAC,EAAE,QAAQ,EAAE,CAAC;IACrJ,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,oGAAoG,CAAC,EAAE,QAAQ,EAAE,CAAC;IACpL,IAAI,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;QACjC,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,EAAE,gCAAgC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,sBAAsB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACjI,CAAC;SAAM,IAAI,KAAK,CAAC,EAAE,KAAK,MAAM,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,iCAAiC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;QAC1J,OAAO,CAAC,IAAI,CAAC,oDAAoD,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;IACxH,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC;IAC3E,IAAI,QAAQ,CAAC,iBAAiB;QAAE,OAAO,CAAC,IAAI,CAAC,iGAAiG,CAAC,CAAC;;QAC3I,OAAO,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;IAC5D,OAAO,EAAE,MAAM,EAAE,wBAAwB,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AACjE,CAAC;AAkBD,MAAM,IAAI,GAAG,CAAC,EAAM,EAAU,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,EAAE,uBAAuB,CAAC,CAAC;AAEjF,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,EAAM;IACtC,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IAC7C,MAAM,GAAG,GAAG,CAAC,MAAM,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAyB,CAAC;IACnE,OAAO,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,MAAc;IAC7C,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IACxB,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,GAAG;QAAE,MAAM,IAAI,iBAAiB,CAAC,OAAO,EAAE,kFAAkF,CAAC,CAAC;IAC7J,IAAI,cAAc,CAAC,CAAC,CAAC,IAAI,4BAA4B,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,8CAA8C,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACxH,MAAM,IAAI,iBAAiB,CAAC,UAAU,EAAE,4FAA4F,EAAE;YACpI,IAAI,EAAE,8GAA8G;SACrH,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EAAM,EAAE,CAAqB;IACjE,MAAM,GAAG,GAAG,CAAC,MAAM,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC;IAC3E,MAAM,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,aAAa,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC,EAAwB,CAAC,CAAC;AACzG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EAAM,EAAE,GAAW;IACzD,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,EAAE,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,GAAG,CAAC,CAAC;IAClD,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC7C,MAAM,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,aAAa,EAAE,CAAC,EAAE,YAAY,EAAE,IAAI,EAAwB,CAAC,CAAC;IAChG,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAA2B,EAAE,GAAW,EAAE,KAAa;IAChF,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,GAAG,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;AAC1E,CAAC","sourcesContent":["import path from 'node:path';\nimport type { CommandEntry } from '../config/schemas.js';\nimport { DevWorkspaceError } from '../errors/index.js';\nimport { containsSecret } from '../security/redact.js';\nimport { safeReadText } from '../security/files.js';\nimport { atomicWriteJson, pathExists, readJsonFile } from '../utils/fs.js';\nimport type { Ws } from '../core/workspace.js';\n\n/** Dependencies that mean a package talks to a database or queue. */\nconst SERVICE_DEPS: Record<string, string> = {\n  pg: 'PostgreSQL',\n  postgres: 'PostgreSQL',\n  'drizzle-orm': 'a SQL database',\n  prisma: 'a SQL database',\n  '@prisma/client': 'a SQL database',\n  typeorm: 'a SQL database',\n  sequelize: 'a SQL database',\n  knex: 'a SQL database',\n  mongoose: 'MongoDB',\n  mongodb: 'MongoDB',\n  redis: 'Redis',\n  ioredis: 'Redis',\n  bullmq: 'Redis',\n  bull: 'Redis',\n};\n\n/** Words that make a command destructive or schema-changing no matter which check it is filed under. */\nconst DESTRUCTIVE = /(?:^|[\\s:/_-])(?:drop|truncate|flushall|flushdb|reset|seed|migrate)(?:$|[\\s:/_.-])|db:push|--force|rm\\s+-rf/i;\n/** Checks whose job is to exercise real services. They need a declared test environment. */\nconst SERVICE_CHECKS = new Set(['integration', 'security', 'e2e']);\n\nexport type Safety = 'safe' | 'needs-test-environment' | 'blocked';\n\nexport interface CommandSafety {\n  safety: Safety;\n  reasons: string[];\n  /** Services the package is known to use (from its manifest), for the explanation only. */\n  services: string[];\n}\n\nexport interface ManifestEvidence {\n  scriptBody: string | null;\n  services: string[];\n  hasCredentialFile: boolean;\n}\n\n/** Read the package manifest next to a command: the script it runs and the services the package depends on. Never reads .env files. */\nexport async function readManifestEvidence(root: string, entry: CommandEntry): Promise<ManifestEvidence> {\n  const dir = entry.cwd && entry.cwd !== '.' ? entry.cwd : '';\n  const manifest = dir ? `${dir}/package.json` : 'package.json';\n  let scriptBody: string | null = null;\n  const services = new Set<string>();\n  try {\n    const text = await safeReadText(root, manifest, 1024 * 1024);\n    const json = text ? (JSON.parse(text) as { scripts?: Record<string, string>; dependencies?: Record<string, string>; devDependencies?: Record<string, string> }) : null;\n    const script = /#scripts\\.(.+)$/.exec(entry.source ?? '')?.[1];\n    if (json && script && typeof json.scripts?.[script] === 'string') scriptBody = json.scripts[script]!;\n    for (const dep of Object.keys({ ...json?.dependencies, ...json?.devDependencies })) if (SERVICE_DEPS[dep]) services.add(SERVICE_DEPS[dep]!);\n  } catch {\n    /* unreadable manifest: no evidence */\n  }\n  let hasCredentialFile = false;\n  for (const name of ['.env', '.env.local', '.env.test', '.env.development']) {\n    if (await pathExists(path.join(root, ...(dir ? [dir] : []), name))) hasCredentialFile = true;\n  }\n  // \"a SQL database\" is only the fallback label for an ORM; drop it once a specific database is known.\n  if (services.size > 1) services.delete('a SQL database');\n  return { scriptBody, services: [...services].sort(), hasCredentialFile };\n}\n\n/**\n * Decide whether DevWorkspace may run a contract command by itself. Pure; no file is read here.\n *  - blocked: modifies project files, changes a schema/data set, or is destructive. Never run automatically.\n *  - needs-test-environment: exercises real services or may (a catch-all `test` in a package that uses a database).\n *    Runs only after the user declared a test environment for that package and check.\n *  - safe: typecheck, lint, build, unit tests and read-only format checks.\n * A database is never judged safe from its name; DevWorkspace does not read connection settings at all.\n */\nexport function classifyCommand(entry: CommandEntry, evidence: ManifestEvidence): CommandSafety {\n  const reasons: string[] = [];\n  const services = evidence.services;\n  const text = `${entry.command ?? ''} ${evidence.scriptBody ?? ''}`;\n  if (entry.mutates) return { safety: 'blocked', reasons: ['it modifies project files; DevWorkspace never runs formatters or fixers'], services };\n  if (entry.id === 'migrations') return { safety: 'blocked', reasons: ['it changes a database schema; DevWorkspace never runs migrations'], services };\n  if (DESTRUCTIVE.test(text)) return { safety: 'blocked', reasons: ['its definition mentions a destructive or schema-changing operation (drop/reset/seed/migrate/flush)'], services };\n  if (SERVICE_CHECKS.has(entry.id)) {\n    reasons.push(`${entry.id} tests exercise real services${services.length ? ` (the package uses ${services.join(', ')})` : ''}`);\n  } else if (entry.id === 'unit' && services.length > 0 && /(?:^|\\s)(?:run\\s+)?test(?:\\s|$)/.test(entry.command ?? '') && !/unit/.test(entry.command ?? '')) {\n    reasons.push(`the catch-all test script of a package that uses ${services.join(', ')} may include integration tests`);\n  }\n  if (reasons.length === 0) return { safety: 'safe', reasons: [], services };\n  if (evidence.hasCredentialFile) reasons.push('a credential file exists in the package (never read), so the database target cannot be verified');\n  else reasons.push('the database target cannot be verified');\n  return { safety: 'needs-test-environment', reasons, services };\n}\n\n// ---------- explicit test-environment declarations (machine-local, never committed) ----------\n\nexport interface TestEnvDeclaration {\n  /** Package directory relative to the project root; \".\" for the root. */\n  package: string;\n  checks: string[];\n  /** Human description of the target, e.g. \"docker compose test stack on this laptop\". Never a connection string. */\n  target: string;\n  declaredAt: string;\n}\n\ninterface TestEnvFile {\n  schemaVersion: 1;\n  declarations: TestEnvDeclaration[];\n}\n\nconst file = (ws: Ws): string => path.join(ws.localDir, 'test-environment.json');\n\nexport async function loadTestEnv(ws: Ws): Promise<TestEnvDeclaration[]> {\n  if (!(await pathExists(file(ws)))) return [];\n  const raw = (await readJsonFile(file(ws))) as Partial<TestEnvFile>;\n  return Array.isArray(raw.declarations) ? raw.declarations : [];\n}\n\nexport function assertSafeTarget(target: string): void {\n  const t = target.trim();\n  if (t.length < 5 || t.length > 200) throw new DevWorkspaceError('USAGE', '--target must be a short description (5-200 characters) of the test environment.');\n  if (containsSecret(t) || /[a-z][a-z0-9+.-]*:\\/\\/\\S+/i.test(t) || /(?:password|passwd|pwd|token|secret)\\s*[=:]/i.test(t)) {\n    throw new DevWorkspaceError('SECURITY', 'The target description looks like a connection string or credential; refusing to store it.', {\n      hint: 'Describe the environment in words (for example \"disposable docker compose stack\"), not how to connect to it.',\n    });\n  }\n}\n\nexport async function saveDeclaration(ws: Ws, d: TestEnvDeclaration): Promise<void> {\n  const all = (await loadTestEnv(ws)).filter((x) => x.package !== d.package);\n  await atomicWriteJson(file(ws), { schemaVersion: 1, declarations: [...all, d] } satisfies TestEnvFile);\n}\n\nexport async function removeDeclaration(ws: Ws, pkg: string): Promise<boolean> {\n  const all = await loadTestEnv(ws);\n  const rest = all.filter((x) => x.package !== pkg);\n  if (rest.length === all.length) return false;\n  await atomicWriteJson(file(ws), { schemaVersion: 1, declarations: rest } satisfies TestEnvFile);\n  return true;\n}\n\nexport function isDeclared(decls: TestEnvDeclaration[], pkg: string, check: string): TestEnvDeclaration | undefined {\n  return decls.find((d) => d.package === pkg && d.checks.includes(check));\n}\n"]}

package/dist/verification/scope.d.ts

@@ -0,0 +1,19 @@
+import type { CommandEntry } from '../config/schemas.js';
+import type { TaskScope } from '../tasks/task.js';
+export type ChangeMap = Record<string, string>;
+/** Files that differ from HEAD right now (modified, staged or untracked), project-relative, with a content hash. */
+export declare function dirtyFiles(root: string): Promise<{
+    head: string | null;
+    files: ChangeMap;
+} | null>;
+/** Snapshot taken when a task is created: what is already modified is not the task's doing. */
+export declare function captureScope(root: string, now: string): Promise<TaskScope>;
+/** Files that changed since the task started, with their current hashes. Null when that cannot be determined. */
+export declare function changedSince(root: string, scope: TaskScope): Promise<ChangeMap | null>;
+/** Directories (relative to the project root) that have their own checks in the contract, longest first. */
+export declare function packageDirs(contract: CommandEntry[]): string[];
+/**
+ * Fingerprint of the changes inside each package. A change under a package belongs to it; a change outside every package
+ * (root config, shared tooling) belongs to all of them. "." covers everything. Returns null when nothing is known.
+ */
+export declare function scopeByPackage(changes: ChangeMap | null, contract: CommandEntry[]): Record<string, string> | null;

package/dist/verification/scope.js

@@ -0,0 +1,119 @@
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
+import { gitAvailable, parsePorcelainZ } from '../git/git.js';
+import { isSensitiveFile } from '../security/files.js';
+import { sha256File, sha256Text } from '../utils/fs.js';
+import { run } from '../utils/proc.js';
+const MAX_TRACKED_FILES = 2000;
+const MAX_HASH_BYTES = 8 * 1024 * 1024;
+/** Documentation and tool-managed folders never decide which package's checks apply. */
+const NOT_CODE = /^(?:\.devworkspace|\.claude|graphify-out)\/|\.(?:md|mdx|rst|txt)$/i;
+async function git(root, args) {
+    const r = await run('git', args, { cwd: root, timeoutMs: 30_000 });
+    return r.ok ? r.stdout : null;
+}
+async function fileFingerprint(root, rel) {
+    const full = path.join(root, ...rel.split('/'));
+    try {
+        const st = await fs.lstat(full);
+        if (!st.isFile())
+            return 'not-a-file';
+        if (st.size > MAX_HASH_BYTES)
+            return `large:${st.size}:${Math.floor(st.mtimeMs)}`;
+        return await sha256File(full);
+    }
+    catch {
+        return 'deleted';
+    }
+}
+/** Files that differ from HEAD right now (modified, staged or untracked), project-relative, with a content hash. */
+export async function dirtyFiles(root) {
+    if (!(await gitAvailable()))
+        return null;
+    if ((await git(root, ['rev-parse', '--is-inside-work-tree']))?.trim() !== 'true')
+        return null;
+    const prefix = ((await git(root, ['rev-parse', '--show-prefix'])) ?? '').trim();
+    const head = ((await git(root, ['rev-parse', 'HEAD'])) ?? '').trim() || null;
+    const status = await git(root, ['status', '--porcelain=v1', '-z', '--untracked-files=all']);
+    if (status === null)
+        return null;
+    const files = {};
+    for (const e of parsePorcelainZ(status)) {
+        if (e.xy === '!!' || !e.path.startsWith(prefix))
+            continue;
+        const rel = e.path.slice(prefix.length);
+        if (NOT_CODE.test(rel) || isSensitiveFile(rel))
+            continue;
+        if (Object.keys(files).length >= MAX_TRACKED_FILES)
+            break;
+        files[rel] = await fileFingerprint(root, rel);
+    }
+    return { head, files };
+}
+/** Snapshot taken when a task is created: what is already modified is not the task's doing. */
+export async function captureScope(root, now) {
+    const d = await dirtyFiles(root);
+    return { capturedAt: now, head: d?.head ?? null, baseline: d?.files ?? {} };
+}
+/** Project-relative files committed since `head` (so committing during a task does not hide its changes). */
+async function committedSince(root, head) {
+    const prefix = ((await git(root, ['rev-parse', '--show-prefix'])) ?? '').trim();
+    const out = await git(root, ['diff', '--name-only', '-z', head, 'HEAD']);
+    if (out === null)
+        return null;
+    return out.split('\0').filter((f) => f && f.startsWith(prefix)).map((f) => f.slice(prefix.length));
+}
+/** Files that changed since the task started, with their current hashes. Null when that cannot be determined. */
+export async function changedSince(root, scope) {
+    const now = await dirtyFiles(root);
+    if (!now)
+        return null;
+    const changed = {};
+    for (const [rel, hash] of Object.entries(now.files))
+        if (scope.baseline[rel] !== hash)
+            changed[rel] = hash;
+    // A file that was modified at the start and has since been cleaned up (committed or reverted) also changed.
+    for (const rel of Object.keys(scope.baseline))
+        if (!(rel in now.files))
+            changed[rel] = await fileFingerprint(root, rel);
+    if (scope.head && now.head && scope.head !== now.head) {
+        const committed = await committedSince(root, scope.head);
+        if (committed === null)
+            return null;
+        for (const rel of committed)
+            if (!NOT_CODE.test(rel) && !isSensitiveFile(rel) && !(rel in changed))
+                changed[rel] = await fileFingerprint(root, rel);
+    }
+    return changed;
+}
+/** Directories (relative to the project root) that have their own checks in the contract, longest first. */
+export function packageDirs(contract) {
+    const dirs = new Set();
+    for (const c of contract)
+        if (c.available && c.cwd && c.cwd !== '.')
+            dirs.add(c.cwd);
+    return [...dirs].sort((a, b) => b.length - a.length || a.localeCompare(b));
+}
+/**
+ * Fingerprint of the changes inside each package. A change under a package belongs to it; a change outside every package
+ * (root config, shared tooling) belongs to all of them. "." covers everything. Returns null when nothing is known.
+ */
+export function scopeByPackage(changes, contract) {
+    if (!changes)
+        return null;
+    const files = Object.keys(changes).filter((f) => !NOT_CODE.test(f)).sort();
+    if (files.length === 0)
+        return null;
+    const dirs = packageDirs(contract);
+    const owner = (f) => dirs.find((d) => f === d || f.startsWith(`${d}/`)) ?? null;
+    const shared = files.filter((f) => owner(f) === null);
+    const line = (f) => `${f}:${changes[f]}`;
+    const out = { '.': sha256Text(files.map(line).join('\n')) };
+    for (const d of dirs) {
+        const mine = files.filter((f) => owner(f) === d);
+        if (mine.length > 0 || shared.length > 0)
+            out[d] = sha256Text([...mine, ...shared].sort().map(line).join('\n'));
+    }
+    return out;
+}
+//# sourceMappingURL=scope.js.map