elanous 0.2.32 → 0.2.34

package/scripts/public-export.ts

@@ -283,6 +283,45 @@ export function scanLeaks(root: string, files: readonly string[], markers = LEAK
   return hits;
 }
 
+/** Code literals are reported separately for the crown marker: they are not document/comment leakage. */
+function codeLiteralRanges(file: string, text: string): Array<[number, number]> {
+  if (!/\.(?:ts|tsx|mts|cts|js|jsx|mjs|cjs)$/iu.test(file)) return [];
+  const scanner = ts.createScanner(ts.ScriptTarget.Latest, false, /\.(?:tsx|jsx)$/iu.test(file) ? ts.LanguageVariant.JSX : ts.LanguageVariant.Standard, text);
+  const ranges: Array<[number, number]> = [];
+  for (let token = scanner.scan(); token !== ts.SyntaxKind.EndOfFileToken; token = scanner.scan()) {
+    if (token === ts.SyntaxKind.StringLiteral || token === ts.SyntaxKind.NoSubstitutionTemplateLiteral ||
+        token === ts.SyntaxKind.TemplateHead || token === ts.SyntaxKind.TemplateMiddle || token === ts.SyntaxKind.TemplateTail) {
+      ranges.push([scanner.getTokenPos(), scanner.getTextPos()]);
+    }
+  }
+  return ranges;
+}
+
+export function splitCodeLiteralCeoMarks(files: readonly string[], contents: ReadonlyMap<string, string>, hits: readonly LeakHit[]): { leaks: LeakHit[]; codeLiterals: LeakHit[] } {
+  const leaks: LeakHit[] = [];
+  const codeLiterals: LeakHit[] = [];
+  const fileSet = new Set(files);
+  const classification = new Map<string, Set<number>>();
+  for (const file of new Set(hits.filter((hit) => hit.marker === 'ceo-mark' && !/\.(?:test|spec)\.(?:ts|tsx|mts|cts|js|jsx|mjs|cjs)$/iu.test(hit.file)).map((hit) => hit.file))) {
+    const text = contents.get(file);
+    if (text === undefined || !fileSet.has(file)) continue;
+    const ranges = codeLiteralRanges(file, text);
+    const lines = new Set<number>();
+    let offset = 0;
+    text.split('\n').forEach((line, index) => {
+      const marks = [...line.matchAll(/\u{1F451}/gu)];
+      if (marks.length && marks.every((mark) => ranges.some(([from, to]) => offset + mark.index! >= from && offset + mark.index! + mark[0].length <= to))) lines.add(index + 1);
+      offset += line.length + 1;
+    });
+    classification.set(file, lines);
+  }
+  for (const hit of hits) {
+    if (hit.marker !== 'ceo-mark' || /\.(?:test|spec)\.(?:ts|tsx|mts|cts|js|jsx|mjs|cjs)$/iu.test(hit.file)) { leaks.push(hit); continue; }
+    (classification.get(hit.file)?.has(hit.line) ? codeLiterals : leaks).push(hit);
+  }
+  return { leaks, codeLiterals };
+}
+
 /**
  * 🆕 `runtime-path-outside-export` — 공개되는 «코드»가 공개본에 «없는» 저장소 경로를 문자열로 쥐고 있다.
  * 계기: `docs/graph-templates/**` 가 허용 목록에서 빠져 공개본 영상 라인이 실행 중에 죽을 뻔했다(🅣 · `#20098`).
@@ -448,12 +487,13 @@ export function run(argv: readonly string[], root = resolve(import.meta.dir, '..
       }
       console.error(`exported ${files.length} files (+${Object.keys(config.replace).length} replaced) → ${target}`);
     }
-    const hits = [
+    const rawHits = [
       ...gitIgnoredExportFiles(root, files).filter(inScope).map((file) => ({ marker: 'export-gitignored', file, line: 0, text: '공개본 .gitignore 에 걸린다 — 커밋하면 사라진다' })),
       ...scanLeaks(root, scanned, LEAK_MARKERS, transformed.contents, realDocs),
       ...(redactions ? scanLeaks(root, scanned, privateIdentifierMarkers(redactions), transformed.contents, realDocs) : []),
       ...(!redactions && !noPrivateList ? [{ marker: 'private-identifiers-unchecked', file: privateRedactionsPath(), line: 0, text: 'private redaction list missing' }] : []),
     ];
+    const { leaks: hits, codeLiterals } = splitCodeLiteralCeoMarks(scanned, transformed.contents, rawHits);
     const advisory = scanRuntimePaths(root, files, tracked, transformed.contents).filter((h) => inScope(h.file));
     const summary = summarizeLeaks(hits);
     const advisorySummary = summarizeLeaks(advisory);
@@ -464,6 +504,7 @@ export function run(argv: readonly string[], root = resolve(import.meta.dir, '..
     if (json) {
       console.log(JSON.stringify({
         files: scanned.length, leaks: hits.length, summary, before: { leaks: before.length, summary: beforeSummary }, transforms: transformed.counts, privateRedactions,
+        codeLiterals: { hits: codeLiterals.length, summary: summarizeLeaks(codeLiterals), items: all ? codeLiterals : codeLiterals.slice(0, limit) },
         shownHits: shown.length, truncated, omittedHits: hits.length - shown.length,
         ...(pathPrefix ? { pathPrefix } : {}), hits: shown,
         advisory: { hits: advisory.length, summary: advisorySummary, judge: RUNTIME_PATH_JUDGE, items: all ? advisory : advisory.slice(0, limit) },
@@ -473,6 +514,7 @@ export function run(argv: readonly string[], root = resolve(import.meta.dir, '..
       console.log(`leak check — ${scanned.length} files${pathPrefix ? ` under ${pathPrefix}` : ''} · ${hits.length} hits`);
       for (const [marker, s] of Object.entries(summary)) console.log(`  ${marker.padEnd(20)} ${String(s.files).padStart(5)} files  ${String(s.hits).padStart(6)} lines`);
       for (const hit of shown) console.log(`  ${hit.marker}  ${hit.file}:${hit.line}  ${hit.text}`);
+      if (codeLiterals.length) console.log(`code literals (not document/comment leakage) — ceo-mark ${codeLiterals.length} lines`);
       if (truncated) console.log(`  … ${hits.length - shown.length} more hits not shown — use --all, or narrow with --path <prefix> (⛔ «not in this list» ≠ «no leak»)`);
       if (advisory.length) console.log(`advisory (not counted) — runtime-path-outside-export ${advisory.length} lines · ${advisorySummary['runtime-path-outside-export']?.files ?? 0} files · judge = ${RUNTIME_PATH_JUDGE}`);
     }

package/scripts/ratchets/train-side-invariants.sh

@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+# Train-side sentinel for the eight real HARD 0.2.32 regressions. Run on the
+# merged side tree before the changed-file gate; never interpret a missing test
+# or an incomplete run as a pass.
+set -u
+
+files=(
+  scripts/ratchets/test-interference-patterns.test.ts
+  src/domains/finance-cli.test.ts
+  src/instance/state-dir-provenance-ratchet.test.ts
+  src/self-implement/graph-yaml.test.ts
+  src/self-implement/self-cli-sink-surface.test.ts
+  test/identity-env.test.ts
+  test/no-absolute-path-imports.test.ts
+  test/scenarios/integration.test.ts
+)
+
+if [[ ${1:-} == --list ]]; then
+  printf '%s\n' "${files[@]}"
+  exit 0
+fi
+if [[ $# -gt 1 ]]; then
+  echo 'TRAIN_INVARIANTS_UNMEASURED invalid-arguments'
+  exit 2
+fi
+cd "${1:-.}" || { echo 'TRAIN_INVARIANTS_UNMEASURED repo-unreadable'; exit 2; }
+command -v bun >/dev/null 2>&1 || { echo 'TRAIN_INVARIANTS_UNMEASURED bun-missing'; exit 2; }
+
+for file in "${files[@]}"; do
+  if [[ ! -f $file ]]; then
+    echo "TRAIN_INVARIANTS_UNMEASURED missing-file=$file"
+    exit 2
+  fi
+done
+
+for file in "${files[@]}"; do
+  echo "TRAIN_INVARIANTS_START $file"
+  bun test "$file"
+  rc=$?
+  if [[ $rc -ne 0 ]]; then
+    echo "TRAIN_INVARIANTS_FAIL file=$file rc=$rc"
+    exit 1
+  fi
+done
+echo "TRAIN_INVARIANTS_PASS files=${#files[@]}"

package/scripts/release-loop/auto-approve-node.ts

@@ -15,8 +15,12 @@ const outcomeMetric = (name: string, node: Record<string, unknown> | undefined):
   verdict: node?.outcome === undefined ? 'unmeasured' : node.outcome === 'ok' ? 'pass' : 'fail',
 });
 
-/** Rows shown in auto-approval.md but never counted toward the 8 blocking metrics. */
+/** Rows outside the original eight fixed metrics. TUI regressions have their own HITL gate below. */
 export const WARNING_ONLY = new Set(['tui-regress', 'mac-smoke']);
+export const BLOCKING_METRIC_NAMES = [
+  'gate regressions and measurement', 'bun version', 'upgrade', 'tui', 'notes-check',
+  'public leak and prepare completeness', 'docs notes page', 'installation files',
+] as const;
 
 /** `ok` · `warn` (a failure) · `unmeasured` (error or no output) — the macOS smoke never blocks publishing. */
 function macSmokeLevel(node: Record<string, unknown> | undefined): 'ok' | 'warn' | 'unmeasured' {
@@ -42,40 +46,50 @@ export function runAutoApprove(context: GraphContext = readGraphContext(), deps:
     catch { distCount = undefined; }
   }
   const gateErrorAbsent = gate && !Object.hasOwn(gate, 'error');
-  const regressStatus = regressWarning(validatedTuiRegress(context.outputs.tui?.regress));
+  const regress = validatedTuiRegress(context.outputs.tui?.regress);
+  const regressStatus = regressWarning(regress);
+  const failedCheckIds = 'unmeasured' in regress ? null : regress.results.filter((result) => !result.ok).map((result) => result.id);
+  const failedLabel = failedCheckIds === null ? 'unmeasured' : `${failedCheckIds.length} [${failedCheckIds.join(', ') || '-'}]`;
+  const regressNeedsApproval = regressStatus.level !== 'ok';
   const macSmoke = context.outputs['mac-smoke'];
   const metrics: ApprovalMetric[] = [
-    { name: 'gate regressions and measurement', value: JSON.stringify({ outcome: gate?.outcome ?? null, introduced: gate?.introduced ?? null, error: gate?.error ?? null }),
+    { name: BLOCKING_METRIC_NAMES[0], value: JSON.stringify({ outcome: gate?.outcome ?? null, introduced: gate?.introduced ?? null, error: gate?.error ?? null }),
       verdict: !gate || gate.outcome === undefined || !Array.isArray(gate.introduced) ? 'unmeasured'
         : gate.outcome === 'ok' && gate.introduced.length === 0 && gateErrorAbsent ? 'pass' : 'fail' },
-    { name: 'bun version', value: `running=${bunVersion}; pinned=${pinned ?? 'missing'}`,
+    { name: BLOCKING_METRIC_NAMES[1], value: `running=${bunVersion}; pinned=${pinned ?? 'missing'}`,
       verdict: !pinned ? 'unmeasured' : bunVersion === pinned ? 'pass' : 'fail' },
-    outcomeMetric('upgrade', context.outputs.upgrade),
-    outcomeMetric('tui', context.outputs.tui),
-    outcomeMetric('notes-check', context.outputs['notes-check']),
-    { name: 'public leak and prepare completeness', value: `prepare=${prepare?.outcome ?? 'missing'}`,
+    outcomeMetric(BLOCKING_METRIC_NAMES[2], context.outputs.upgrade),
+    outcomeMetric(BLOCKING_METRIC_NAMES[3], context.outputs.tui),
+    outcomeMetric(BLOCKING_METRIC_NAMES[4], context.outputs['notes-check']),
+    { name: BLOCKING_METRIC_NAMES[5], value: `prepare=${prepare?.outcome ?? 'missing'}`,
       verdict: prepare?.outcome === undefined ? 'unmeasured' : prepare.outcome === 'ok' ? 'pass' : 'fail' },
-    { name: 'docs notes page', value: `docs=${context.outputs.docs?.outcome ?? 'missing'}; notes=${String(context.outputs.docs?.notes ?? 'missing')}`,
+    { name: BLOCKING_METRIC_NAMES[6], value: `docs=${context.outputs.docs?.outcome ?? 'missing'}; notes=${String(context.outputs.docs?.notes ?? 'missing')}`,
       verdict: context.outputs.docs?.outcome === undefined || context.outputs.docs.notes === undefined ? 'unmeasured'
         : context.outputs.docs.outcome === 'ok' && typeof context.outputs.docs.notes === 'string' && context.outputs.docs.notes.trim() ? 'pass' : 'fail' },
-    { name: 'installation files', value: `dist files=${distCount ?? 'missing'}; prepare.out=${String(out ?? 'missing')}`,
+    { name: BLOCKING_METRIC_NAMES[7], value: `dist files=${distCount ?? 'missing'}; prepare.out=${String(out ?? 'missing')}`,
       verdict: prepare?.outcome !== 'ok' ? prepare?.outcome === undefined ? 'unmeasured' : 'fail'
         : distCount === undefined ? 'unmeasured' : distCount === 5 ? 'pass' : 'fail' },
-    // Warning-only and last, so the numbered rows 1–8 keep their places in auto-approval.md (V1g follow-up).
-    { name: 'tui-regress', value: regressStatus.level, reason: regressStatus.line, verdict: 'pass' },
+    // Kept after the eight fixed metrics; a failed or unmeasured subcheck requires the existing approve-publish HITL node.
+    { name: 'tui-regress', value: regressStatus.level, reason: regressStatus.line,
+      verdict: regressStatus.level === 'ok' ? 'pass' : regressStatus.level === 'warn' ? 'fail' : 'unmeasured' },
     // MAC1: the macOS smoke is warning-only too (ship with known issues) — shown, never counted.
     { name: 'mac-smoke', value: macSmokeLevel(macSmoke), reason: typeof macSmoke?.summary === 'string' ? macSmoke.summary : undefined, verdict: 'pass' },
   ];
-  const outcome = metrics.filter((metric) => !WARNING_ONLY.has(metric.name)).every((metric) => metric.verdict === 'pass') ? 'ok' as const : 'fail' as const;
+  const outcome = metrics.filter((metric) => !WARNING_ONLY.has(metric.name)).every((metric) => metric.verdict === 'pass')
+    && !regressNeedsApproval ? 'ok' as const : 'fail' as const;
   const report = join(root, 'release', version, 'auto-approval.md');
   const lines = [`# v${version} auto-approval`, '', `Outcome: ${outcome}`, '', '| # | Metric | Value | Verdict |', '|---|---|---|---|',
     ...metrics.map((metric, i) => `| ${i + 1} | ${metric.name} | ${[metric.value, metric.reason].filter(Boolean).join(' — ').replaceAll('|', '\\|').replace(/[\r\n]/g, ' ')} | ${metric.verdict} |`),
+    '', `TUI subcheck: ${regressStatus.level} · failed ${failedLabel} · ${regressNeedsApproval ? 'HITL 수용/정지 필요' : '자동 판정 가능'}`,
     '', '## 되돌리는 법', `gh release edit v${version} --draft`, `git tag -d v${version} && git push origin :refs/tags/v${version}`, '해당 docs PR revert', ''];
   mkdirSync(dirname(report), { recursive: true });
   writeFileSync(report, lines.join('\n'));
-  debug.log('release-loop.approve', 'auto-decision', { version, outcome, metrics });
-  return { outcome, verdict: outcome === 'ok' ? 'pass' as const : 'fail' as const, summary: `auto approval ${outcome}: ${metrics.filter((metric) => !WARNING_ONLY.has(metric.name) && metric.verdict === 'pass').length}/8`,
-    ...(outcome === 'ok' ? { decidedBy: 'release-loop metrics' as const } : {}), metrics, report };
+  const tuiSubcheck = { runId: context.runId ?? null, level: regressStatus.level,
+    fail: failedCheckIds?.length ?? null, failedCheckIds, approvalRequired: regressNeedsApproval };
+  debug.log('release-loop.approve', 'auto-decision', { version, outcome, metrics, tuiSubcheck });
+  return { outcome, verdict: outcome === 'ok' ? 'pass' as const : 'fail' as const,
+    summary: `auto approval ${outcome}: ${metrics.filter((metric) => !WARNING_ONLY.has(metric.name) && metric.verdict === 'pass').length}/8${regressNeedsApproval ? ` · tui-regress ${regressStatus.level} failed ${failedLabel} → HITL` : ''}`,
+    runId: context.runId ?? null, tuiSubcheck, ...(outcome === 'ok' ? { decidedBy: 'release-loop metrics' as const } : {}), metrics, report };
 }
 
 if (import.meta.main) {

package/scripts/release-loop/gate-closure.ts

@@ -11,6 +11,9 @@ import { sourceCandidates } from '../../src/self-implement/importer-test-index.j
 
 /** Files the closure follows (code). Changing anything else that is not a test or inert Markdown is a full gate. */
 export const CODE_FILE = /\.(?:[cm]?[jt]sx?)$/;
+/** One release input whose readers use a literal basename in readFileSync(join(import.meta.dir, ...)).
+ *  Other JSON stays a full gate until its dependency edge is proved. */
+export const TRACEABLE_RELEASE_JSON = 'scripts/release-loop/known-issues-0.2.33-approved.json';
 const TEST_FILE = /^(?:[\w.-]+\/)*[\w.-]+\.test\.(?:tsx?|jsx?|mts|cts)$/;
 /** Test-side helpers: their filesystem scans and unresolved code paths make a test opaque (production code is trusted to
  *  reach code only through imports and the literal paths below). */
@@ -159,7 +162,8 @@ export function buildClosureGraph(tree: ClosureTree, options: ClosureOptions = {
     for (const match of code.matchAll(LITERAL)) {
       const value = match[2]!;
       if (!value || value.length > 300 || value.includes('${') || /\s/.test(value) || /^[a-z]+:/i.test(value)) continue;
-      const pathLike = value.startsWith('./') || value.startsWith('../') || (value.includes('/') && /^[\w@.-]+(?:\/[\w@.-]+)+\/?$/.test(value)) || CODE_FILE.test(value);
+      const pathLike = value.startsWith('./') || value.startsWith('../') || (value.includes('/') && /^[\w@.-]+(?:\/[\w@.-]+)+\/?$/.test(value)) || CODE_FILE.test(value)
+        || value === TRACEABLE_RELEASE_JSON.split('/').at(-1);
       if (!pathLike) continue;
       const plain = value.replace(/\/$/, '');
       const hit = resolveLiteral(file, plain);

package/scripts/release-loop/gate-diff.ts

@@ -12,7 +12,7 @@ export function parseFailures(output: string): string[] {
     const line = raw.trim();
     const header = /^(?:\.\/)?((?:[\w.-]+\/)+[\w.-]+\.test\.tsx?):(?:\s|$)/.exec(line);
     if (header) { file = header[1]; continue; }
-    const failed = /^\(fail\)[ \t]+(.+?)(?:[ \t]+\[[\d.]+(?:ms|s)\])?$/.exec(line);
+    const failed = /^\(fail\)[ \t]+(.+?)(?:[ \t]+\[[\d.]+(?:ms|s)\])?[ \t]*$/.exec(raw);
     if (failed && file) failures.add(`${file} > ${failed[1]!.trim()}`);
   }
   return [...failures].sort();