engineering-memory 0.1.0

package/runtime/dist/src/git/git-inspector.js

@@ -0,0 +1,375 @@
+import { lstat, readFile } from 'node:fs/promises';
+import { isAbsolute, relative, resolve, sep } from 'node:path';
+import { assertManagedPath, canonicalPath } from '../utilities/files.js';
+import { sha256, stableStringify } from '../utilities/hash.js';
+import { NativeCommandRunner } from '../utilities/process.js';
+export class GitInspector {
+    runner;
+    constructor(runner = new NativeCommandRunner()) {
+        this.runner = runner;
+    }
+    async findRoot(startPath) {
+        const result = await this.runner.run('git', ['rev-parse', '--show-toplevel'], {
+            cwd: startPath,
+        });
+        if (result.exitCode !== 0) {
+            throw new Error(`Not a Git repository: ${startPath}`);
+        }
+        return await canonicalPath(result.stdout.trim());
+    }
+    async fingerprint(repoRoot) {
+        const [remote, firstCommit] = await Promise.all([
+            this.gitValue(repoRoot, ['config', '--get', 'remote.origin.url']),
+            this.gitValue(repoRoot, ['rev-list', '--max-parents=0', 'HEAD']),
+        ]);
+        const canonicalRoot = await canonicalPath(repoRoot);
+        const identity = remote
+            ? `${canonicalRemoteIdentity(remote)}\n${firstCommit ?? ''}`
+            : `${canonicalRoot.toLowerCase()}\n${firstCommit ?? ''}`;
+        return sha256(identity);
+    }
+    async manifest(repoRoot) {
+        const root = await this.findRoot(repoRoot);
+        const head = await this.gitValue(root, ['rev-parse', 'HEAD']);
+        const changedPaths = head
+            ? await this.changedPathsAgainstHead(root)
+            : await this.unbornChangedPaths(root);
+        const normalizedManifest = changedPaths.map(({ path, originalPath, status, contentHash, size, mode }) => ({
+            path,
+            originalPath: originalPath ?? null,
+            status: semanticStatus(status),
+            contentHash,
+            size,
+            mode: mode ?? null,
+        }));
+        return {
+            repoRoot: root,
+            head,
+            changedPaths,
+            diffHash: sha256(`${head ?? '<unborn>'}\n${stableStringify(normalizedManifest)}\n`),
+        };
+    }
+    async stagedManifest(repoRoot) {
+        const root = await this.findRoot(repoRoot);
+        let result = await this.runner.run('git', ['diff', '--cached', '--name-status', '-z', '--find-renames', '--find-copies', 'HEAD', '--'], { cwd: root });
+        if (result.exitCode !== 0) {
+            result = await this.runner.run('git', ['diff', '--cached', '--name-status', '-z', '--find-renames', '--find-copies', '--'], { cwd: root });
+        }
+        if (result.exitCode !== 0) {
+            throw new Error(`Git staged diff failed: ${result.stderr.trim()}`);
+        }
+        const tokens = result.stdout.split('\0').filter(Boolean);
+        const stagedPaths = [];
+        for (let index = 0; index < tokens.length;) {
+            const status = tokens[index++];
+            if (!status || !/^(?:[ACDMRTUXB]|[RC]\d{1,3})$/.test(status)) {
+                throw new Error('Git returned an invalid staged status');
+            }
+            let originalPath;
+            if (/^[RC]/.test(status)) {
+                const original = tokens[index++];
+                if (!original) {
+                    throw new Error('Git staged rename or copy is missing its original path');
+                }
+                originalPath = normalizeGitPath(original);
+            }
+            const stagedPath = tokens[index++];
+            if (!stagedPath) {
+                throw new Error('Git staged change is missing its destination path');
+            }
+            const path = normalizeGitPath(stagedPath);
+            const indexEntry = status === 'D' ? null : await this.indexEntry(root, path);
+            stagedPaths.push({
+                path,
+                ...(originalPath ? { originalPath } : {}),
+                status,
+                blobOid: indexEntry?.blobOid ?? null,
+                mode: indexEntry?.mode ?? null,
+            });
+        }
+        return stagedPaths.sort((left, right) => left.path.localeCompare(right.path));
+    }
+    async taskManifest(repoRoot, changes) {
+        const root = await this.findRoot(repoRoot);
+        const result = [];
+        for (const change of changes) {
+            const path = normalizeGitPath(change.path);
+            const worktreeEntry = semanticStatus(change.status) === 'D' ? null : await this.worktreeEntry(root, path);
+            result.push({
+                ...change,
+                path,
+                ...(change.originalPath ? { originalPath: normalizeGitPath(change.originalPath) } : {}),
+                blobOid: worktreeEntry?.blobOid ?? null,
+                mode: change.mode ?? worktreeEntry?.mode ?? null,
+            });
+        }
+        return result.sort((left, right) => left.path.localeCompare(right.path));
+    }
+    async changedPathsAgainstHead(repoRoot) {
+        const [tracked, raw, untracked] = await Promise.all([
+            this.runner.run('git', ['diff', 'HEAD', '--name-status', '-z', '--find-renames', '--find-copies', '--'], { cwd: repoRoot }),
+            this.runner.run('git', ['diff', 'HEAD', '--raw', '-z', '--no-abbrev', '--'], {
+                cwd: repoRoot,
+            }),
+            this.runner.run('git', ['ls-files', '--others', '--exclude-standard', '-z'], {
+                cwd: repoRoot,
+            }),
+        ]);
+        if (tracked.exitCode !== 0) {
+            throw new Error(`Git diff failed: ${tracked.stderr.trim()}`);
+        }
+        if (raw.exitCode !== 0) {
+            throw new Error(`Git raw diff failed: ${raw.stderr.trim()}`);
+        }
+        if (untracked.exitCode !== 0) {
+            throw new Error(`Git untracked file lookup failed: ${untracked.stderr.trim()}`);
+        }
+        const result = await this.parseNameStatus(repoRoot, tracked.stdout, parseRawModes(raw.stdout));
+        for (const token of untracked.stdout.split('\0').filter(Boolean)) {
+            const path = normalizeGitPath(token);
+            const metadata = await this.fileMetadata(repoRoot, path);
+            result.push({
+                path,
+                status: '??',
+                contentHash: metadata.contentHash,
+                size: metadata.size,
+                mode: metadata.mode,
+            });
+        }
+        return deduplicateChangedPaths(result);
+    }
+    async unbornChangedPaths(repoRoot) {
+        const result = await this.runner.run('git', ['ls-files', '--cached', '--others', '--exclude-standard', '-z'], { cwd: repoRoot });
+        if (result.exitCode !== 0) {
+            throw new Error(`Git unborn repository lookup failed: ${result.stderr.trim()}`);
+        }
+        const changedPaths = [];
+        for (const token of result.stdout.split('\0').filter(Boolean)) {
+            const path = normalizeGitPath(token);
+            const metadata = await this.fileMetadata(repoRoot, path);
+            changedPaths.push({
+                path,
+                status: 'A ',
+                contentHash: metadata.contentHash,
+                size: metadata.size,
+                mode: metadata.mode,
+            });
+        }
+        return deduplicateChangedPaths(changedPaths);
+    }
+    async parseNameStatus(repoRoot, output, modes) {
+        const tokens = output.split('\0').filter(Boolean);
+        const result = [];
+        for (let index = 0; index < tokens.length;) {
+            const statusToken = tokens[index++];
+            if (!statusToken || !/^(?:[ACDMRTUXB]|[RC]\d{1,3})$/.test(statusToken)) {
+                throw new Error('Git returned an invalid changed-path status');
+            }
+            let originalPath;
+            if (/^[RC]/.test(statusToken)) {
+                const original = tokens[index++];
+                if (!original) {
+                    throw new Error('Git rename or copy is missing its original path');
+                }
+                originalPath = normalizeGitPath(original);
+            }
+            const destination = tokens[index++];
+            if (!destination) {
+                throw new Error('Git changed path is missing its destination');
+            }
+            const path = normalizeGitPath(destination);
+            const metadata = await this.fileMetadata(repoRoot, path);
+            result.push({
+                path,
+                ...(originalPath ? { originalPath } : {}),
+                status: `${statusToken[0]} `,
+                contentHash: metadata.contentHash,
+                size: metadata.size,
+                mode: modes.get(path) ?? metadata.mode,
+            });
+        }
+        return result;
+    }
+    async fileMetadata(repoRoot, gitPath) {
+        const absolutePath = resolve(repoRoot, gitPath.split('/').join(sep));
+        const fromRoot = relative(repoRoot, absolutePath);
+        if (fromRoot.startsWith('..') || isAbsolute(fromRoot)) {
+            throw new Error(`Git changed path escapes the repository: ${gitPath}`);
+        }
+        try {
+            const safePath = await assertManagedPath(repoRoot, absolutePath, false);
+            const fileStat = await lstat(safePath);
+            if (fileStat.isSymbolicLink()) {
+                throw new Error(`Git changed path is a symbolic link: ${gitPath}`);
+            }
+            if (fileStat.isFile()) {
+                return {
+                    contentHash: sha256(await readFile(safePath)),
+                    size: fileStat.size,
+                    mode: fileStat.mode & 0o111 ? '100755' : '100644',
+                };
+            }
+        }
+        catch (error) {
+            if (!(error instanceof Error && 'code' in error && error.code === 'ENOENT')) {
+                throw error;
+            }
+        }
+        return { contentHash: null, size: null, mode: null };
+    }
+    async indexEntry(repoRoot, path) {
+        const result = await this.runner.run('git', ['ls-files', '--stage', '-z', '--', path], {
+            cwd: repoRoot,
+        });
+        if (result.exitCode !== 0) {
+            throw new Error(`Git index lookup failed: ${result.stderr.trim()}`);
+        }
+        const entries = result.stdout.split('\0').filter(Boolean);
+        const matches = entries.flatMap((entry) => {
+            const match = /^(\d{6}) ([0-9a-f]{40,64}) ([0-3])\t(.+)$/.exec(entry);
+            if (!match || normalizeGitPath(match[4]) !== path) {
+                return [];
+            }
+            return [{ mode: match[1], oid: match[2], stage: match[3] }];
+        });
+        if (matches.length !== 1 ||
+            matches[0].stage !== '0' ||
+            !['100644', '100755'].includes(matches[0].mode)) {
+            throw new Error(`Git staged path is not a regular stage-zero file: ${path}`);
+        }
+        return {
+            blobOid: matches[0].oid,
+            mode: matches[0].mode,
+        };
+    }
+    async worktreeEntry(repoRoot, path) {
+        const absolutePath = resolve(repoRoot, path.split('/').join(sep));
+        const safePath = await assertManagedPath(repoRoot, absolutePath, false);
+        const fileStat = await lstat(safePath);
+        if (fileStat.isSymbolicLink() || !fileStat.isFile()) {
+            throw new Error(`Git task path is not a regular file: ${path}`);
+        }
+        const result = await this.runner.run('git', ['hash-object', `--path=${path}`, '--', path], {
+            cwd: repoRoot,
+        });
+        const oid = result.stdout.trim().split(/\r?\n/)[0];
+        if (result.exitCode !== 0 || !oid || !/^[0-9a-f]{40,64}$/.test(oid)) {
+            throw new Error(`Git worktree blob lookup failed: ${path}`);
+        }
+        return {
+            blobOid: oid,
+            mode: fileStat.mode & 0o111 ? '100755' : '100644',
+        };
+    }
+    async pathHistorySubjects(repoRoot, paths) {
+        if (paths.length === 0)
+            return [];
+        const root = await this.findRoot(repoRoot);
+        const result = await this.runner.run('git', ['log', '--max-count=100', '--pretty=%s', '--', ...paths], { cwd: root });
+        if (result.exitCode !== 0)
+            return [];
+        return result.stdout
+            .split(/\r?\n/)
+            .map((line) => line.trim())
+            .filter(Boolean);
+    }
+    async gitValue(repoRoot, args) {
+        const result = await this.runner.run('git', args, { cwd: repoRoot });
+        const value = result.stdout.trim().split(/\r?\n/)[0];
+        return result.exitCode === 0 && value ? value : null;
+    }
+}
+function normalizeGitPath(path) {
+    const normalized = path.replace(/\\/g, '/');
+    if (!normalized ||
+        normalized.startsWith('/') ||
+        /^[A-Za-z]:\//.test(normalized) ||
+        normalized.split('/').includes('..') ||
+        normalized.includes('\0')) {
+        throw new Error(`Git returned an unsafe changed path: ${normalized}`);
+    }
+    return normalized;
+}
+function semanticStatus(status) {
+    if (status === '??') {
+        return 'A';
+    }
+    for (const candidate of ['R', 'C', 'A', 'D', 'T', 'U', 'M']) {
+        if (status.includes(candidate)) {
+            return candidate;
+        }
+    }
+    return status.trim() || status;
+}
+function deduplicateChangedPaths(entries) {
+    const byPath = new Map();
+    for (const entry of entries) {
+        if (byPath.has(entry.path)) {
+            throw new Error(`Git returned duplicate changed path metadata: ${entry.path}`);
+        }
+        byPath.set(entry.path, entry);
+    }
+    return [...byPath.values()].sort((left, right) => left.path.localeCompare(right.path));
+}
+function parseRawModes(output) {
+    const tokens = output.split('\0').filter(Boolean);
+    const modes = new Map();
+    for (let index = 0; index < tokens.length;) {
+        const header = tokens[index++];
+        const match = header ? /^:(\d{6}) (\d{6}) [0-9a-f]+ [0-9a-f]+ ([A-Z])\d*$/.exec(header) : null;
+        if (!match) {
+            throw new Error('Git returned invalid raw mode metadata');
+        }
+        if (match[3] === 'R' || match[3] === 'C') {
+            if (!tokens[index++]) {
+                throw new Error('Git raw rename or copy is missing its original path');
+            }
+        }
+        const destination = tokens[index++];
+        if (!destination) {
+            throw new Error('Git raw mode metadata is missing its destination path');
+        }
+        const path = normalizeGitPath(destination);
+        const mode = match[2] === '000000' ? null : match[2];
+        if (mode !== null && mode !== '100644' && mode !== '100755') {
+            throw new Error(`Git changed path does not have a regular file mode: ${path}`);
+        }
+        modes.set(path, mode);
+    }
+    return modes;
+}
+function canonicalRemoteIdentity(remote) {
+    const trimmed = remote.trim();
+    const scpLike = /^(?:[^@/:]+@)?([^/:]+):(.+)$/.exec(trimmed);
+    if (scpLike &&
+        !/^[A-Za-z][A-Za-z0-9+.-]*:\/\//.test(trimmed) &&
+        !/^[A-Za-z]:[\\/]/.test(trimmed)) {
+        return `${scpLike[1].toLowerCase()}/${normalizeRemotePath(scpLike[2])}`;
+    }
+    try {
+        const url = new URL(trimmed);
+        const protocol = url.protocol.toLowerCase();
+        const defaultPort = (protocol === 'https:' && url.port === '443') ||
+            (protocol === 'http:' && url.port === '80') ||
+            (protocol === 'ssh:' && url.port === '22');
+        const authority = `${url.hostname.toLowerCase()}${url.port && !defaultPort ? `:${url.port}` : ''}`;
+        if (authority) {
+            return `${authority}/${normalizeRemotePath(url.pathname)}`;
+        }
+        return `local/${normalizeRemotePath(url.pathname)}`;
+    }
+    catch {
+        return `local/${normalizeRemotePath(trimmed.replace(/[?#].*$/, ''))}`;
+    }
+}
+function normalizeRemotePath(path) {
+    const normalized = path
+        .replace(/\\/g, '/')
+        .replace(/^\/+|\/+$/g, '')
+        .replace(/\.git$/i, '');
+    if (!normalized || normalized.split('/').includes('..')) {
+        throw new Error('Git remote path is invalid');
+    }
+    return normalized;
+}
+//# sourceMappingURL=git-inspector.js.map

package/runtime/dist/src/git/pre-commit.js

@@ -0,0 +1,44 @@
+#!/usr/bin/env node
+import { createCredentialStore } from '../auth/credential-store.js';
+import { EtagCache } from '../cache/etag-cache.js';
+import { apiNamespaceKey, apiStateRoot, endpoints, loadBridgeConfig } from '../config.js';
+import { ApiClient } from '../runtime/api-client.js';
+import { OfflineOutbox } from '../runtime/offline-outbox.js';
+import { GitInspector } from './git-inspector.js';
+import { VerificationGate } from './verification-gate.js';
+async function run() {
+    const config = loadBridgeConfig();
+    const stateRoot = apiStateRoot(config);
+    const credentials = createCredentialStore({
+        service: config.credentialService,
+        account: `${config.credentialAccount}:${apiNamespaceKey(config.apiBaseUrl)}`,
+        stateRoot,
+    });
+    const client = new ApiClient({
+        baseUrl: config.apiBaseUrl,
+        timeoutMs: config.requestTimeoutMs,
+        credentials,
+        cache: new EtagCache({
+            stateRoot,
+            maxEntries: config.cacheMaxEntries,
+            maxBytes: config.cacheMaxBytes,
+            maxAgeMs: config.cacheMaxAgeMs,
+        }),
+        refreshPath: endpoints.authRefresh,
+    });
+    const git = new GitInspector();
+    const repoRoot = await git.findRoot(process.argv[2] ?? process.cwd());
+    const gate = new VerificationGate(stateRoot, git, new OfflineOutbox(stateRoot), async (body) => (await client.request(endpoints.taskCommitGate, {
+        method: 'POST',
+        body,
+        retryRefresh: true,
+    })).data);
+    const result = await gate.verify(repoRoot);
+    process.stderr.write(`${JSON.stringify(result)}\n`);
+    process.exitCode = result.allowed ? 0 : 1;
+}
+void run().catch(() => {
+    process.stderr.write('Engineering Memory Git gate failed\n');
+    process.exitCode = 1;
+});
+//# sourceMappingURL=pre-commit.js.map

package/runtime/dist/src/git/verification-gate.js

@@ -0,0 +1,221 @@
+import { readdir } from 'node:fs/promises';
+import { join } from 'node:path';
+import { ensureManagedDirectory, readJson, removeFile, safeSegment, writeJson, } from '../utilities/files.js';
+export class VerificationGate {
+    git;
+    outbox;
+    commitGateAttestor;
+    root;
+    constructor(stateRoot, git, outbox, commitGateAttestor) {
+        this.git = git;
+        this.outbox = outbox;
+        this.commitGateAttestor = commitGateAttestor;
+        this.root = join(stateRoot, 'verification-gates');
+    }
+    async record(input) {
+        if (input.taskClosed &&
+            (!Number.isSafeInteger(input.taskVersion) || (input.taskVersion ?? 0) < 1)) {
+            throw new Error('Closed task verification receipt requires its backend task version');
+        }
+        const verifiedAt = new Date();
+        const taskChanges = await this.git.taskManifest(input.repoRoot, input.taskChanges);
+        await writeJson(this.pathFor(input.repoFingerprint), {
+            schemaVersion: 4,
+            taskId: input.taskId,
+            projectId: input.projectId,
+            repoFingerprint: input.repoFingerprint,
+            diffHash: input.diffHash,
+            verifiedAt: verifiedAt.toISOString(),
+            expiresAt: input.taskClosed
+                ? null
+                : new Date(verifiedAt.getTime() + (input.ttlMs ?? 15 * 60_000)).toISOString(),
+            taskClosed: input.taskClosed ?? false,
+            taskVersion: input.taskVersion ?? null,
+            taskChanges,
+        }, this.root);
+    }
+    async verify(repoRoot) {
+        const [fingerprint, manifest, stagedChanges, pending] = await Promise.all([
+            this.git.fingerprint(repoRoot),
+            this.git.manifest(repoRoot),
+            this.git.stagedManifest(repoRoot),
+            this.outbox.list(),
+        ]);
+        if (pending.length > 0) {
+            return { allowed: false, reason: 'offline_outbox_pending', diffHash: manifest.diffHash };
+        }
+        const receipt = await readJson(this.pathFor(fingerprint), this.root);
+        if (!receipt) {
+            return { allowed: false, reason: 'task_verify_required', diffHash: manifest.diffHash };
+        }
+        if (!receipt.taskClosed) {
+            return {
+                allowed: false,
+                reason: 'task_close_required',
+                diffHash: manifest.diffHash,
+                taskId: receipt.taskId,
+            };
+        }
+        if (receipt.schemaVersion !== 4 ||
+            !receipt.projectId ||
+            typeof receipt.taskVersion !== 'number' ||
+            !Number.isSafeInteger(receipt.taskVersion) ||
+            receipt.taskVersion < 1 ||
+            !isTaskManifest(receipt.taskChanges)) {
+            return {
+                allowed: false,
+                reason: 'closed_receipt_invalid',
+                diffHash: manifest.diffHash,
+                taskId: receipt.taskId,
+            };
+        }
+        if (receipt.diffHash !== manifest.diffHash) {
+            return {
+                allowed: false,
+                reason: 'git_diff_changed_after_verify',
+                diffHash: manifest.diffHash,
+                taskId: receipt.taskId,
+            };
+        }
+        if (stagedChanges.length === 0) {
+            return {
+                allowed: false,
+                reason: 'no_task_changes_staged',
+                diffHash: manifest.diffHash,
+                taskId: receipt.taskId,
+            };
+        }
+        if (stagedChanges.some((entry) => !belongsToTask(entry, receipt.taskChanges))) {
+            return {
+                allowed: false,
+                reason: 'staged_change_outside_task',
+                diffHash: manifest.diffHash,
+                taskId: receipt.taskId,
+            };
+        }
+        if (!this.commitGateAttestor) {
+            return {
+                allowed: false,
+                reason: 'online_commit_gate_unavailable',
+                diffHash: manifest.diffHash,
+                taskId: receipt.taskId,
+            };
+        }
+        try {
+            const attestation = await this.commitGateAttestor({
+                taskId: receipt.taskId,
+                projectId: receipt.projectId,
+                repoFingerprint: receipt.repoFingerprint,
+                diffHash: manifest.diffHash,
+                expectedTaskVersion: receipt.taskVersion,
+            });
+            const result = asObject(attestation);
+            if (result?.allowed !== true ||
+                result.taskId !== receipt.taskId ||
+                result.taskVersion !== receipt.taskVersion ||
+                result.diffHash !== manifest.diffHash) {
+                return {
+                    allowed: false,
+                    reason: 'online_commit_gate_mismatch',
+                    diffHash: manifest.diffHash,
+                    taskId: receipt.taskId,
+                };
+            }
+        }
+        catch {
+            return {
+                allowed: false,
+                reason: 'online_commit_gate_rejected',
+                diffHash: manifest.diffHash,
+                taskId: receipt.taskId,
+            };
+        }
+        return {
+            allowed: true,
+            reason: 'verified',
+            diffHash: manifest.diffHash,
+            taskId: receipt.taskId,
+        };
+    }
+    async invalidateTask(taskId) {
+        await ensureManagedDirectory(this.root, this.root);
+        const entries = await readdir(this.root, { withFileTypes: true });
+        for (const entry of entries) {
+            if (entry.name.endsWith('.json') && (!entry.isFile() || entry.isSymbolicLink())) {
+                throw new Error(`Unsafe verification gate entry: ${entry.name}`);
+            }
+        }
+        await Promise.all(entries
+            .filter((entry) => entry.isFile() && entry.name.endsWith('.json'))
+            .map(async (entry) => {
+            const path = join(this.root, entry.name);
+            const receipt = await readJson(path, this.root);
+            if (receipt?.taskId === taskId) {
+                await removeFile(path, this.root);
+            }
+        }));
+    }
+    async clear() {
+        await ensureManagedDirectory(this.root, this.root);
+        const entries = await readdir(this.root, { withFileTypes: true });
+        for (const entry of entries) {
+            if (!entry.isFile() || entry.isSymbolicLink() || !entry.name.endsWith('.json')) {
+                throw new Error(`Unsafe verification gate entry: ${entry.name}`);
+            }
+            await removeFile(join(this.root, entry.name), this.root);
+        }
+    }
+    pathFor(repoFingerprint) {
+        return join(this.root, `${safeSegment(repoFingerprint)}.json`);
+    }
+}
+function asObject(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value) ? value : null;
+}
+function isTaskManifest(value) {
+    return (Array.isArray(value) &&
+        value.every((entry) => entry !== null &&
+            typeof entry === 'object' &&
+            typeof entry.path === 'string' &&
+            isRepositoryRelative(entry.path) &&
+            (entry.originalPath === undefined ||
+                isRepositoryRelative(entry.originalPath ?? '')) &&
+            typeof entry.status === 'string' &&
+            (entry.contentHash === null ||
+                /^[0-9a-f]{64}$/.test(entry.contentHash ?? '')) &&
+            (entry.size === null ||
+                (Number.isSafeInteger(entry.size) &&
+                    (entry.size ?? -1) >= 0)) &&
+            (entry.blobOid === null ||
+                /^[0-9a-f]{40,64}$/.test(entry.blobOid ?? '')) &&
+            (entry.mode === null ||
+                entry.mode === '100644' ||
+                entry.mode === '100755')));
+}
+function isRepositoryRelative(value) {
+    const normalized = value.replace(/\\/g, '/');
+    return (normalized.length > 0 &&
+        !normalized.startsWith('/') &&
+        !/^[A-Za-z]:\//.test(normalized) &&
+        !normalized.split('/').includes('..') &&
+        !normalized.includes('\0'));
+}
+function belongsToTask(staged, taskChanges) {
+    return taskChanges.some((taskChange) => taskChange.path === staged.path &&
+        semanticStatus(taskChange.status) === semanticStatus(staged.status) &&
+        (staged.originalPath ?? null) === (taskChange.originalPath ?? null) &&
+        staged.blobOid === taskChange.blobOid &&
+        staged.mode === taskChange.mode);
+}
+function semanticStatus(status) {
+    if (status === '??') {
+        return 'A';
+    }
+    for (const candidate of ['R', 'C', 'A', 'D', 'T', 'U', 'M']) {
+        if (status.includes(candidate)) {
+            return candidate;
+        }
+    }
+    return status.trim() || status;
+}
+//# sourceMappingURL=verification-gate.js.map