geopilot 0.0.0-stage → 0.0.1

package/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -1,3 +1,92 @@
-# Temporary Holding Version
+# geopilot
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+**Find the issue. Trace it to source. Prove the fix.**
+
+[![npm version](https://img.shields.io/npm/v/geopilot?color=1d9bf0&label=npm)](https://www.npmjs.com/package/geopilot)
+[![node](https://img.shields.io/node/v/geopilot?color=1d9bf0)](https://www.npmjs.com/package/geopilot)
+[![license](https://img.shields.io/npm/l/geopilot?color=1d9bf0)](https://github.com/moelzanaty3/geopilot/blob/main/LICENSE)
+[![docs](https://img.shields.io/badge/docs-moelzanaty3.github.io%2Fgeopilot-1d9bf0)](https://moelzanaty3.github.io/geopilot/)
+
+**[Documentation](https://moelzanaty3.github.io/geopilot/)** · [Getting started](https://moelzanaty3.github.io/geopilot/docs/getting-started/) · [Rules](https://moelzanaty3.github.io/geopilot/docs/rules/) · [CLI](https://moelzanaty3.github.io/geopilot/docs/cli/) · [Agent plugins](https://moelzanaty3.github.io/geopilot/docs/agent/) · [GitHub](https://github.com/moelzanaty3/geopilot)
+
+geopilot audits any website for the technical conditions crawlers and AI search systems document: robots, sitemaps, indexability, canonicals, metadata and structured data. It shows the evidence, maps the problem to the line that caused it, proposes the smallest safe change, and reports honestly what was verified.
+
+It runs on your machine, with no accounts, telemetry or model calls.
+
+> Technical readiness only. geopilot does not measure or predict citations, rankings, traffic or inclusion in any AI or search product.
+
+## Quick start
+
+Requires Node 22.18 or newer.
+
+```bash
+npx geopilot scan https://www.example.com        # any stack
+npx geopilot scan .                              # a repository, with source locations
+npx geopilot scan . --url http://127.0.0.1:3000  # both: the strongest evidence
+npx geopilot fix                                 # preview fixes; nothing is written
+```
+
+A repository scan on a Next.js app looks like this:
+
+```text
+Readiness   insufficient evidence
+Coverage    43%    Confidence  82%    Assessment  partial
+· 6 rules need runtime evidence — re-run with --url
+
+HIGH  GEO-014  /pricing  /pricing sets robots noindex in its metadata
+      app/pricing/page.tsx:5  provenance exact
+      fix G1-b75653d6 (guarded)  → geopilot fix --rule GEO-014
+MED   GEO-011  site  public/robots.txt has no Sitemap: line
+      public/robots.txt  provenance exact
+      fix S1-6d0f6bea (safe)  → geopilot fix --rule GEO-011
+```
+
+Apply a guarded fix by its id, then have geopilot verify it on a server it starts after the write:
+
+```bash
+npx geopilot fix --apply --approve <fixId> --serve
+```
+
+## Use it from your coding agent
+
+Plugins add five agents and six commands that drive the same CLI. On Codex, the marketplace plugin carries them as skills; install into the repo for real subagents. They keep engine findings apart from their own recommendations, and they never apply a guarded fix without its id.
+
+| Host | Install | Status |
+| --- | --- | --- |
+| Claude Code | `/plugin install geopilot --marketplace moelzanaty3/geopilot` | Supported |
+| GitHub Copilot CLI | `copilot plugin marketplace add moelzanaty3/geopilot`<br>`copilot plugin install geopilot@geopilot` | Supported |
+| OpenCode | `npx geopilot agent install --host opencode` | Supported |
+| OpenAI Codex | `codex plugin marketplace add moelzanaty3/geopilot`<br>`codex plugin add geopilot@geopilot` | Supported |
+| Claude Code or Codex, committed to one repo | `npx geopilot agent install --host claude-code`<br>`npx geopilot agent install --host codex` | Supported |
+| Other hosts that read `AGENTS.md` | `npx geopilot agent install --host agents-md --write-agents-md` | Provisional |
+
+**Agents:** `scanner`, `fixer`, `reviewer`, `investigator`, `explainer`
+**Commands:** `scan`, `fix`, `review`, `explain`, `insights`, `init`
+
+[Read the plugin guide →](https://moelzanaty3.github.io/geopilot/docs/agent/)
+
+## What you get
+
+| | |
+| --- | --- |
+| **Rules** | A closed catalogue covering robots, crawler access, indexability, canonicals, server HTML, JSON-LD, sitemaps, metadata, links and snippet controls. Each rule cites the documentation it rests on. [Browse the rules](https://moelzanaty3.github.io/geopilot/docs/rules/). |
+| **Four separate outputs** | Readiness, coverage, confidence and assessment scope are never blended. Below 50% coverage, geopilot shows no readiness number rather than guess. [How scoring works](https://moelzanaty3.github.io/geopilot/docs/scoring/). |
+| **Source tracing** | On Next.js App Router and static HTML, findings map to file and line by reading source as an AST. Source is never executed, and every mapping states how much to trust it. [Provenance](https://moelzanaty3.github.io/geopilot/docs/provenance/). |
+| **Fixes** | Five closed-list fixes, each with snapshots and byte-exact rollback. Safe fixes apply with `--apply`; guarded fixes also need their id. [Fixes and verification](https://moelzanaty3.github.io/geopilot/docs/fixes/). |
+| **Honest verification** | Runtime verification counts only on a server geopilot started after the write. Anything less is reported as `applied_unverified`. |
+| **Safety** | An SSRF guard, private targets only when you name them, and robots.txt respected. [Security and privacy](https://moelzanaty3.github.io/geopilot/docs/security/). |
+
+## Status
+
+This is an early alpha. A browser renderer, SARIF output, the GitHub Action, the `review` CLI command, baselines and hooks aren't built yet. [See the current scope](https://github.com/moelzanaty3/geopilot/blob/main/docs/adr/0004-phase-scope.md).
+
+## Links
+
+- [Documentation](https://moelzanaty3.github.io/geopilot/)
+- [Source code](https://github.com/moelzanaty3/geopilot)
+- [Issues](https://github.com/moelzanaty3/geopilot/issues)
+- [Contributing](https://github.com/moelzanaty3/geopilot/blob/main/CONTRIBUTING.md)
+
+## License
+
+[Apache-2.0](https://github.com/moelzanaty3/geopilot/blob/main/LICENSE)

package/dist/agent/install.d.ts

@@ -0,0 +1,23 @@
+export type Host = 'claude-code' | 'opencode' | 'codex' | 'agents-md';
+export type HostStatus = 'supported' | 'provisional' | 'marketplace' | 'not_available';
+export declare const HOSTS: readonly {
+    readonly id: string;
+    readonly status: HostStatus;
+    readonly note: string;
+}[];
+export declare const VERSION_PLACEHOLDER = "{{ENGINE_VERSION}}";
+/** A generated host bundle: published under hosts/, in the repository under plugins/. */
+export declare function bundleSource(bundle: 'claude-project' | 'opencode' | 'codex-project' | 'codex' | 'geopilot'): string;
+export declare function skillSource(): string;
+export declare function listSkillFiles(root: string): string[];
+export declare function installedVersion(repoRoot: string): string | null;
+export interface InstallPlan {
+    readonly host: Host;
+    readonly writes: readonly {
+        readonly path: string;
+        readonly content: string;
+        readonly exists: boolean;
+    }[];
+}
+export declare function planInstall(repoRoot: string, host: Host): InstallPlan;
+export declare function executeInstall(plan: InstallPlan): void;

package/dist/agent/install.js

@@ -0,0 +1,77 @@
+import { existsSync, mkdirSync, readdirSync, readFileSync, statSync, writeFileSync } from 'node:fs';
+import { dirname, join, relative } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { TOOL_VERSION } from "../core/version.js";
+export const HOSTS = [
+    { id: 'claude-code', status: 'supported', note: 'project install: .claude/agents and .claude/skills; or the plugin: /plugin install geopilot --marketplace moelzanaty3/geopilot' },
+    { id: 'opencode', status: 'supported', note: 'project install: .opencode/agents, .opencode/commands, .opencode/skills' },
+    { id: 'copilot', status: 'marketplace', note: 'copilot plugin marketplace add moelzanaty3/geopilot && copilot plugin install geopilot@geopilot' },
+    { id: 'codex', status: 'supported', note: 'project install: .codex/agents and .agents/skills; or the plugin: codex plugin marketplace add moelzanaty3/geopilot && codex plugin add geopilot@geopilot' },
+    { id: 'agents-md', status: 'provisional', note: 'a section in AGENTS.md, with --write-agents-md' },
+    { id: 'cursor', status: 'not_available', note: 'not tested yet; use agents-md' },
+];
+export const VERSION_PLACEHOLDER = '{{ENGINE_VERSION}}';
+/** A generated host bundle: published under hosts/, in the repository under plugins/. */
+export function bundleSource(bundle) {
+    const published = fileURLToPath(new URL(`../../hosts/${bundle}/`, import.meta.url));
+    if (existsSync(published))
+        return published;
+    return fileURLToPath(new URL(`../../../../plugins/${bundle}/`, import.meta.url));
+}
+export function skillSource() {
+    return join(bundleSource('claude-project'), '.claude', 'skills', 'geo');
+}
+export function listSkillFiles(root) {
+    const out = [];
+    const walk = (dir) => {
+        for (const name of readdirSync(dir).sort()) {
+            const abs = join(dir, name);
+            if (statSync(abs).isDirectory())
+                walk(abs);
+            else
+                out.push(relative(root, abs).split('\\').join('/'));
+        }
+    };
+    walk(root);
+    return out;
+}
+export function installedVersion(repoRoot) {
+    const file = join(repoRoot, '.claude', 'skills', 'geo', 'SKILL.md');
+    if (!existsSync(file))
+        return null;
+    const m = /engine-version:\s*"?([^"\n]+)"?/.exec(readFileSync(file, 'utf8'));
+    return m ? m[1].trim() : null;
+}
+const AGENTS_START = '<!-- geopilot:begin -->';
+const AGENTS_END = '<!-- geopilot:end -->';
+export function planInstall(repoRoot, host) {
+    if (host !== 'agents-md') {
+        const src = bundleSource(host === 'claude-code' ? 'claude-project' : host === 'codex' ? 'codex-project' : 'opencode');
+        const writes = listSkillFiles(src).map((rel) => {
+            const content = readFileSync(join(src, rel), 'utf8').replaceAll(VERSION_PLACEHOLDER, TOOL_VERSION);
+            const path = join(repoRoot, rel);
+            return { path, content, exists: existsSync(path) };
+        });
+        return { host, writes };
+    }
+    const path = join(repoRoot, 'AGENTS.md');
+    // --prefix keeps npx from running or configuring itself from the repository being scanned.
+    const cli = `npx --yes --prefix "$(mktemp -d)" geopilot@${TOOL_VERSION}`;
+    const section = `${AGENTS_START}\n## geopilot (GEO technical readiness)\n\nUse the geopilot CLI for technical readiness checks; never claim rule outcomes it did not report.\n\n- Scan: \`${cli} scan --format json\`\n- Explain a rule: \`${cli} explain <ruleId>\`\n- Fixes are dry-run by default; apply only after the user approves each guarded fix (\`--approve <fixId>\`).\n- Label your own file attributions as agent-suggested; they are not engine provenance.\n- Report verification honestly: \`applied_unverified\` is not success.\n\nTechnical readiness only. GEO does not measure or predict citations, rankings, traffic or inclusion in any AI or search product.\n${AGENTS_END}\n`;
+    const exists = existsSync(path);
+    let content = section;
+    if (exists) {
+        const current = readFileSync(path, 'utf8');
+        const s = current.indexOf(AGENTS_START);
+        const e = current.indexOf(AGENTS_END);
+        content = s !== -1 && e > s ? `${current.slice(0, s)}${section}${current.slice(e + AGENTS_END.length + 1)}` : `${current.replace(/\n*$/, '\n\n')}${section}`;
+    }
+    return { host, writes: [{ path, content, exists }] };
+}
+export function executeInstall(plan) {
+    for (const w of plan.writes) {
+        mkdirSync(dirname(w.path), { recursive: true });
+        writeFileSync(w.path, w.content, { mode: w.path.endsWith('.sh') ? 0o755 : 0o644 });
+    }
+}
+//# sourceMappingURL=install.js.map

package/dist/agent/install.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"install.js","sourceRoot":"","sources":["../../src/agent/install.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACpG,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAQlD,MAAM,CAAC,MAAM,KAAK,GAA2F;IAC3G,EAAE,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,gIAAgI,EAAE;IAClL,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,yEAAyE,EAAE;IACxH,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,iGAAiG,EAAE;IACjJ,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,2JAA2J,EAAE;IACvM,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,gDAAgD,EAAE;IAClG,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,+BAA+B,EAAE;CACjF,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG,oBAAoB,CAAC;AAExD,yFAAyF;AACzF,MAAM,UAAU,YAAY,CAAC,MAA8E;IACzG,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,eAAe,MAAM,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACpF,IAAI,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5C,OAAO,aAAa,CAAC,IAAI,GAAG,CAAC,uBAAuB,MAAM,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AACnF,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,OAAO,IAAI,CAAC,YAAY,CAAC,gBAAgB,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,CAAC,GAAW,EAAQ,EAAE;QACjC,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAC5B,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;gBAAE,IAAI,CAAC,GAAG,CAAC,CAAC;;gBACtC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,CAAC;IACX,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;IACpE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,CAAC,GAAG,iCAAiC,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAC7E,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACjC,CAAC;AAOD,MAAM,YAAY,GAAG,yBAAyB,CAAC;AAC/C,MAAM,UAAU,GAAG,uBAAuB,CAAC;AAE3C,MAAM,UAAU,WAAW,CAAC,QAAgB,EAAE,IAAU;IACtD,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QACtH,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;YAC7C,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC,UAAU,CAAC,mBAAmB,EAAE,YAAY,CAAC,CAAC;YACnG,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YACjC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrD,CAAC,CAAC,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC1B,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACzC,2FAA2F;IAC3F,MAAM,GAAG,GAAG,8CAA8C,YAAY,EAAE,CAAC;IACzE,MAAM,OAAO,GAAG,GAAG,YAAY,6JAA6J,GAAG,8CAA8C,GAAG,0aAA0a,UAAU,IAAI,CAAC;IACzqB,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,OAAO,GAAG,OAAO,CAAC;IACtB,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC3C,MAAM,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACxC,MAAM,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACtC,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;IAC/J,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAiB;IAC9C,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAC5B,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,aAAa,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IACrF,CAAC;AACH,CAAC"}

package/dist/cache/runs.d.ts

@@ -0,0 +1,18 @@
+import type { Report } from '../types.ts';
+export declare const RETAIN_RUNS = 10;
+export declare const SNAPSHOT_MAX_BYTES: number;
+export declare function userCacheDir(env?: NodeJS.ProcessEnv): string;
+export declare function cacheRoot(repoRoot: string | null, env?: NodeJS.ProcessEnv): string;
+export declare function ensureGeoDir(root: string): void;
+export declare function runDir(root: string, runId: string): string;
+export declare function snapshotName(url: string): string;
+export declare function saveRun(root: string, report: Report, snapshots: ReadonlyMap<string, string>): string;
+export declare function listRuns(root: string): string[];
+export interface LoadedRun {
+    readonly report: Report;
+    readonly reportSha256: string;
+    readonly dir: string;
+    readonly dom: ReadonlyMap<string, string>;
+}
+export declare function loadRun(root: string, runId: string): LoadedRun | null;
+export declare function latestRun(root: string): string | null;

package/dist/cache/runs.js

@@ -0,0 +1,91 @@
+import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { homedir, platform } from 'node:os';
+import { join } from 'node:path';
+import { canonicalJson, sha256 } from "../core/hash.js";
+import { redact } from "../core/redact.js";
+// `.geo/runs/<runId>` inside a repository, otherwise the OS user cache
+// (spec 5.1). Ten runs are kept. DOM snapshots are bounded and redacted; no
+// cookies, auth headers or full response bodies beyond the cap are stored.
+export const RETAIN_RUNS = 10;
+export const SNAPSHOT_MAX_BYTES = 512 * 1024;
+export function userCacheDir(env = process.env) {
+    if (env.GEO_CACHE_DIR)
+        return env.GEO_CACHE_DIR;
+    if (platform() === 'win32')
+        return join(env.LOCALAPPDATA ?? join(homedir(), 'AppData', 'Local'), 'geopilot');
+    if (platform() === 'darwin')
+        return join(homedir(), 'Library', 'Caches', 'geopilot');
+    return join(env.XDG_CACHE_HOME ?? join(homedir(), '.cache'), 'geopilot');
+}
+export function cacheRoot(repoRoot, env = process.env) {
+    return repoRoot ? join(repoRoot, '.geo') : userCacheDir(env);
+}
+export function ensureGeoDir(root) {
+    mkdirSync(join(root, 'runs'), { recursive: true });
+    const gi = join(root, '.gitignore');
+    if (root.endsWith('.geo') && !existsSync(gi))
+        writeFileSync(gi, '*\n');
+}
+export function runDir(root, runId) {
+    if (!/^r-[0-9TZ]+-[0-9a-f]{6}$/.test(runId))
+        throw new Error(`not a run id: ${runId}`);
+    return join(root, 'runs', runId);
+}
+export function snapshotName(url) {
+    return `${sha256(url).slice(0, 16)}.html`;
+}
+export function saveRun(root, report, snapshots) {
+    ensureGeoDir(root);
+    const dir = runDir(root, report.run.id);
+    mkdirSync(join(dir, 'dom'), { recursive: true });
+    const json = canonicalJson(report);
+    writeFileSync(join(dir, 'report.json'), json);
+    const index = {};
+    for (const [url, html] of snapshots) {
+        const name = snapshotName(url);
+        const bounded = Buffer.byteLength(html) > SNAPSHOT_MAX_BYTES ? Buffer.from(html).subarray(0, SNAPSHOT_MAX_BYTES).toString('utf8') : html;
+        writeFileSync(join(dir, 'dom', name), redact(bounded));
+        index[url] = name;
+    }
+    writeFileSync(join(dir, 'dom', 'index.json'), canonicalJson(index));
+    prune(root);
+    return dir;
+}
+export function listRuns(root) {
+    const dir = join(root, 'runs');
+    if (!existsSync(dir))
+        return [];
+    return readdirSync(dir).filter((d) => /^r-/.test(d)).sort();
+}
+function prune(root) {
+    const runs = listRuns(root);
+    for (const old of runs.slice(0, Math.max(0, runs.length - RETAIN_RUNS))) {
+        // Runs holding fix snapshots are kept: rollback depends on them.
+        if (existsSync(join(root, 'runs', old, 'fix')))
+            continue;
+        rmSync(join(root, 'runs', old), { recursive: true, force: true });
+    }
+}
+export function loadRun(root, runId) {
+    const dir = runDir(root, runId);
+    const file = join(dir, 'report.json');
+    if (!existsSync(file))
+        return null;
+    const text = readFileSync(file, 'utf8');
+    const dom = new Map();
+    const idx = join(dir, 'dom', 'index.json');
+    if (existsSync(idx)) {
+        const index = JSON.parse(readFileSync(idx, 'utf8'));
+        for (const [url, name] of Object.entries(index)) {
+            const p = join(dir, 'dom', name);
+            if (existsSync(p))
+                dom.set(url, readFileSync(p, 'utf8'));
+        }
+    }
+    return { report: JSON.parse(text), reportSha256: sha256(text), dir, dom };
+}
+export function latestRun(root) {
+    const runs = listRuns(root).filter((r) => existsSync(join(root, 'runs', r, 'report.json')));
+    return runs[runs.length - 1] ?? null;
+}
+//# sourceMappingURL=runs.js.map

package/dist/cache/runs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runs.js","sourceRoot":"","sources":["../../src/cache/runs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAClG,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAG3C,uEAAuE;AACvE,4EAA4E;AAC5E,2EAA2E;AAE3E,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,CAAC;AAC9B,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAG,GAAG,IAAI,CAAC;AAE7C,MAAM,UAAU,YAAY,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC/D,IAAI,GAAG,CAAC,aAAa;QAAE,OAAO,GAAG,CAAC,aAAa,CAAC;IAChD,IAAI,QAAQ,EAAE,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC,GAAG,CAAC,YAAY,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,UAAU,CAAC,CAAC;IAC7G,IAAI,QAAQ,EAAE,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;IACrF,OAAO,IAAI,CAAC,GAAG,CAAC,cAAc,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,EAAE,UAAU,CAAC,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,QAAuB,EAAE,MAAyB,OAAO,CAAC,GAAG;IACrF,OAAO,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IACpC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAAE,aAAa,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,IAAY,EAAE,KAAa;IAChD,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,KAAK,EAAE,CAAC,CAAC;IACvF,OAAO,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,IAAY,EAAE,MAAc,EAAE,SAAsC;IAC1F,YAAY,CAAC,IAAI,CAAC,CAAC;IACnB,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACxC,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACnC,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,EAAE,IAAI,CAAC,CAAC;IAC9C,MAAM,KAAK,GAA2B,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,SAAS,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACzI,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QACvD,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;IACpB,CAAC;IACD,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,YAAY,CAAC,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;IACpE,KAAK,CAAC,IAAI,CAAC,CAAC;IACZ,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,IAAY;IACnC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC/B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAChC,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AAC9D,CAAC;AAED,SAAS,KAAK,CAAC,IAAY;IACzB,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC5B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,GAAG,WAAW,CAAC,CAAC,EAAE,CAAC;QACxE,iEAAiE;QACjE,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;YAAE,SAAS;QACzD,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACpE,CAAC;AACH,CAAC;AASD,MAAM,UAAU,OAAO,CAAC,IAAY,EAAE,KAAa;IACjD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAChC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IACtC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;IAC3C,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAA2B,CAAC;QAC9E,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAChD,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YACjC,IAAI,UAAU,CAAC,CAAC,CAAC;gBAAE,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAW,EAAE,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AACtF,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC;IAC5F,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC;AACvC,CAAC"}

package/dist/cli/args.d.ts

@@ -0,0 +1,20 @@
+export interface FlagSpec {
+    readonly name: string;
+    readonly type: 'boolean' | 'string' | 'multi';
+    readonly short?: string;
+}
+export declare const GLOBAL_FLAGS: readonly FlagSpec[];
+export declare const SCAN_FLAGS: readonly FlagSpec[];
+export declare const FIX_FLAGS: readonly FlagSpec[];
+export declare const INIT_FLAGS: readonly FlagSpec[];
+export declare const AGENT_FLAGS: readonly FlagSpec[];
+export declare const RULES_FLAGS: readonly FlagSpec[];
+export declare const INSIGHTS_FLAGS: readonly FlagSpec[];
+export interface Parsed {
+    readonly positionals: string[];
+    readonly bool: ReadonlySet<string>;
+    readonly str: ReadonlyMap<string, string>;
+    readonly multi: ReadonlyMap<string, string[]>;
+}
+export declare function parseArgs(argv: readonly string[], specs: readonly FlagSpec[]): Parsed;
+export declare function intFlag(p: Parsed, name: string, min: number, max: number): number | undefined;