github-router 0.3.250 → 0.3.255

package/dist/gate-discovery-CepmbZnc.js

@@ -0,0 +1,635 @@
+import { t as PATHS } from "./paths-C1cLZ7Ga.js";
+import { a as resolveExecutable } from "./exec-DTO2oin0.js";
+import { p as resolveSealedGate } from "./stop-gate-hook-DQc2KV7B.js";
+import { c as repoRoot, s as repoFingerprint } from "./stop-gate-policy-CHwWbuF_.js";
+import { existsSync, promises } from "node:fs";
+import path from "node:path";
+import { createHash } from "node:crypto";
+//#region src/lib/orchestration/harness-parse.ts
+/**
+* Deterministic, language-agnostic harness PARSER for the structural Stop-gate.
+*
+* The gate runs a repo's own checks (typecheck/lint/test/build) when the agent
+* tries to finish. Historically it only auto-enabled for Bun/TS repos via a
+* hard-coded sealed gate. This module generalizes detection by PARSING the
+* project's own authoritative config — `package.json` scripts, CI `run:` steps,
+* Make/just/task targets, and language manifests — and emitting the canonical
+* check commands it finds.
+*
+* Design properties (a cross-lab panel chose a parser over a model for these):
+*   - EVIDENCE-PINNED BY CONSTRUCTION: every emitted command is either lifted
+*     verbatim from a parsed source file (a package.json script, a CI `run:`
+*     line, a Make target invocation) or is a fixed canonical manifest command
+*     for a detected ecosystem (`cargo check`, `go vet ./...`). The parser never
+*     invents a command, so it has no hallucination / prompt-injection surface.
+*   - PURE + DETERMINISTIC: a function of the repo's files + the live PATH. The
+*     runtime Stop hook re-derives it at each stop (no cache), so it always
+*     reflects the current tree and fails open for free when a tool vanished.
+*   - SHELL-SAFE: `liveExec` runs `command.trim().split(/\s+/)` (naive argv
+*     split, no shell), so every emitted command is validated to be plain
+*     space-separated tokens with no shell operators and no `%` (cmd.exe quoting
+*     throws on `%`). See `isSafeCommand`.
+*
+* This is consumed ONLY by the local Stop hook. The sealed-gate kernel
+* (`run_workflow`) is never fed a parsed command — `GateDescriptor.kind` is
+* `"parsed"`, never a sealed id, and `sealedGateIds()` is unchanged.
+*/
+/** The fast static checks that are always-on; `test` is opt-in (it runs project
+*  code and can be slow on every stop). */
+const STATIC_IDS = /* @__PURE__ */ new Set(["typecheck", "lint"]);
+/** Reject anything that is not a plain, shell-free, `%`-free argv line. This is
+*  the load-bearing guard for `liveExec`'s naive whitespace split. */
+function isSafeCommand(command) {
+	const c = command.trim();
+	if (c.length === 0 || c.length > 200) return false;
+	if (/[\r\n]/.test(c)) return false;
+	const tokens = c.split(/\s+/).filter(Boolean);
+	if (tokens.length === 0) return false;
+	return tokens.every((t) => /^[A-Za-z0-9._/:@=+-]+$/.test(t));
+}
+/** First token of a command (the executable), for a PATH-presence probe. */
+function firstToken(command) {
+	return command.trim().split(/\s+/)[0] ?? "";
+}
+/** True when a command would MUTATE the tree and so must never be a gate: a
+*  `--fix`/`--write` flag or a `:fix`/`:write` script-name suffix (e.g.
+*  `npm run lint:fix`, `eslint --fix`). Whitespace is normalized first so a
+*  tab/double-space can't slip a flag past the scan. Exported + shared with the
+*  discovered-command sanitizer. */
+function isMutatingCommand(command) {
+	const c = command.trim().replace(/\s+/g, " ");
+	if (/(^| )(--fix|--write|-w|--watch|--serve|--interactive|-i)( |=|$)/i.test(c)) return true;
+	if (/(^| |:|-)(fix|write)\b/i.test(c)) return true;
+	return false;
+}
+/** True when the command is safe AND its executable resolves on PATH (a missing
+*  tool → drop the check rather than guarantee a false-red). */
+function commandRunnable(command) {
+	if (!isSafeCommand(command)) return false;
+	return resolveExecutable(firstToken(command), { env: process.env }) !== null;
+}
+async function readJsonFile(file) {
+	try {
+		return JSON.parse(await promises.readFile(file, "utf8"));
+	} catch {
+		return;
+	}
+}
+async function readTextFile(file) {
+	try {
+		return await promises.readFile(file, "utf8");
+	} catch {
+		return;
+	}
+}
+/** package.json `scripts` as a plain string→string map (best-effort). */
+async function readScripts(root) {
+	const pkg = await readJsonFile(path.join(root, "package.json"));
+	const scripts = pkg && typeof pkg === "object" ? pkg.scripts : void 0;
+	const out = {};
+	if (scripts && typeof scripts === "object") {
+		for (const [k, v] of Object.entries(scripts)) if (typeof v === "string") out[k] = v;
+	}
+	return out;
+}
+/** Pick the JS package runner from the lockfile present at the root. */
+function nodeRunner(root) {
+	if (existsSync(path.join(root, "bun.lockb")) || existsSync(path.join(root, "bun.lock"))) return "bun";
+	if (existsSync(path.join(root, "pnpm-lock.yaml"))) return "pnpm";
+	if (existsSync(path.join(root, "yarn.lock"))) return "yarn";
+	return "npm";
+}
+/** Map a package.json script NAME to a canonical id (read-only checks only — a
+*  `:fix`/`:write` variant mutates the tree and is never a gate). */
+function scriptNameToId(name) {
+	if (/:(fix|write)$/i.test(name)) return null;
+	if (/^(typecheck|type-check|check-types|tsc|types)$/i.test(name)) return "typecheck";
+	if (/^(lint|lint:check|eslint)$/i.test(name)) return "lint";
+	if (/^test$/i.test(name)) return "test";
+	return null;
+}
+async function collectNodeChecks(root, includeTests) {
+	if (!existsSync(path.join(root, "package.json"))) return [];
+	const runner = nodeRunner(root);
+	if (resolveExecutable(runner, { env: process.env }) === null) return [];
+	const scripts = await readScripts(root);
+	const out = [];
+	for (const [name] of Object.entries(scripts)) {
+		const id = scriptNameToId(name);
+		if (!id) continue;
+		if (id === "test" && !includeTests) continue;
+		const command = `${runner} run ${name}`;
+		if (isSafeCommand(command)) out.push({
+			id,
+			command,
+			source: "package.json"
+		});
+	}
+	return out;
+}
+/**
+* Best-effort CI gap-filler: scan GitHub Actions / GitLab CI YAML for single-line
+* `run:` static checks (typecheck/lint/build) the project actually runs. We do
+* NOT lift `test` from CI — CI test jobs frequently need services/secrets and
+* would false-red on every stop. Multi-line / scripted `run:` blocks are skipped
+* (they can't be a single argv). Any parse failure yields nothing.
+*/
+async function collectCiChecks(root) {
+	const files = [];
+	const wfDir = path.join(root, ".github", "workflows");
+	try {
+		for (const name of await promises.readdir(wfDir)) if (/\.ya?ml$/i.test(name)) files.push(path.join(wfDir, name));
+	} catch {}
+	const gitlab = path.join(root, ".gitlab-ci.yml");
+	if (existsSync(gitlab)) files.push(gitlab);
+	if (files.length === 0) return [];
+	let parseYaml;
+	try {
+		({parse: parseYaml} = await import("yaml"));
+	} catch {
+		return [];
+	}
+	const out = [];
+	const seen = /* @__PURE__ */ new Set();
+	const classify = (cmd) => {
+		if (/\b(typecheck|type-check|tsc|mypy|pyright)\b/i.test(cmd)) return "typecheck";
+		if (/\b(lint|eslint|ruff|clippy|golangci|vet)\b/i.test(cmd)) return "lint";
+		return null;
+	};
+	const consider = (run, source) => {
+		if (typeof run !== "string") return;
+		const cmd = run.trim();
+		if (cmd.includes("\n")) return;
+		if (!isSafeCommand(cmd) || isMutatingCommand(cmd) || !commandRunnable(cmd)) return;
+		const id = classify(cmd);
+		if (!id || seen.has(id)) return;
+		seen.add(id);
+		out.push({
+			id,
+			command: cmd,
+			source
+		});
+	};
+	const walk = (node, source) => {
+		if (!node || typeof node !== "object") return;
+		if (Array.isArray(node)) {
+			for (const v of node) walk(v, source);
+			return;
+		}
+		for (const [k, v] of Object.entries(node)) if (k === "run" && typeof v === "string") consider(v, source);
+		else if (k === "script") {
+			if (typeof v === "string") consider(v, source);
+			else if (Array.isArray(v)) for (const s of v) consider(s, source);
+		} else walk(v, source);
+	};
+	for (const f of files) {
+		const text = await readTextFile(f);
+		if (text === void 0) continue;
+		try {
+			walk(parseYaml(text), path.relative(root, f) || path.basename(f));
+		} catch {}
+	}
+	return out;
+}
+/** Make / just / Taskfile targets matching canonical ids → `<tool> <target>`. */
+async function collectTaskChecks(root, includeTests) {
+	const out = [];
+	const wantId = (target) => scriptNameToId(target);
+	for (const [file, tool] of [
+		["Makefile", "make"],
+		["makefile", "make"],
+		["justfile", "just"],
+		[".justfile", "just"]
+	]) {
+		const text = await readTextFile(path.join(root, file));
+		if (text === void 0) continue;
+		if (resolveExecutable(tool, { env: process.env }) === null) continue;
+		for (const line of text.split(/\r?\n/)) {
+			const m = /^([A-Za-z0-9._-]+)\s*:/.exec(line);
+			if (!m) continue;
+			const id = wantId(m[1]);
+			if (!id || id === "test" && !includeTests) continue;
+			const command = `${tool} ${m[1]}`;
+			if (isSafeCommand(command)) out.push({
+				id,
+				command,
+				source: file
+			});
+		}
+	}
+	const taskfile = ["Taskfile.yml", "Taskfile.yaml"].map((n) => path.join(root, n)).find((p) => existsSync(p));
+	if (taskfile && resolveExecutable("task", { env: process.env }) !== null) {
+		const text = await readTextFile(taskfile);
+		if (text !== void 0) try {
+			const { parse } = await import("yaml");
+			const doc = parse(text);
+			for (const name of Object.keys(doc?.tasks ?? {})) {
+				const id = wantId(name);
+				if (!id || id === "test" && !includeTests) continue;
+				const command = `task ${name}`;
+				if (isSafeCommand(command)) out.push({
+					id,
+					command,
+					source: path.basename(taskfile)
+				});
+			}
+		} catch {}
+	}
+	return out;
+}
+async function collectRustChecks(root, includeTests) {
+	if (!existsSync(path.join(root, "Cargo.toml"))) return [];
+	if (resolveExecutable("cargo", { env: process.env }) === null) return [];
+	const out = [{
+		id: "typecheck",
+		command: "cargo check",
+		source: "Cargo.toml"
+	}];
+	if (resolveExecutable("cargo-clippy", { env: process.env }) !== null) out.push({
+		id: "lint",
+		command: "cargo clippy",
+		source: "Cargo.toml"
+	});
+	if (includeTests) out.push({
+		id: "test",
+		command: "cargo test",
+		source: "Cargo.toml"
+	});
+	return out;
+}
+async function collectGoChecks(root, includeTests) {
+	if (!existsSync(path.join(root, "go.mod"))) return [];
+	if (resolveExecutable("go", { env: process.env }) === null) return [];
+	const out = [{
+		id: "typecheck",
+		command: "go vet ./...",
+		source: "go.mod"
+	}];
+	if (includeTests) out.push({
+		id: "test",
+		command: "go test ./...",
+		source: "go.mod"
+	});
+	return out;
+}
+async function collectPythonChecks(root, includeTests) {
+	const present = [
+		"pyproject.toml",
+		"setup.cfg",
+		"pytest.ini",
+		"tox.ini",
+		"ruff.toml",
+		"mypy.ini"
+	].filter((f) => existsSync(path.join(root, f)));
+	if (present.length === 0) return [];
+	const evidence = present[0];
+	const out = [];
+	const configText = await readTextFile(path.join(root, present[0])) ?? "";
+	const mentions = (tool) => present.some((f) => f.startsWith(tool)) || configText.includes(tool);
+	if (mentions("mypy") && resolveExecutable("mypy", { env: process.env }) !== null) out.push({
+		id: "typecheck",
+		command: "mypy .",
+		source: evidence
+	});
+	if (mentions("ruff") && resolveExecutable("ruff", { env: process.env }) !== null) out.push({
+		id: "lint",
+		command: "ruff check .",
+		source: evidence
+	});
+	if (includeTests && (mentions("pytest") || existsSync(path.join(root, "pytest.ini")))) {
+		if (resolveExecutable("pytest", { env: process.env }) !== null) out.push({
+			id: "test",
+			command: "pytest -q",
+			source: evidence
+		});
+	}
+	return out;
+}
+/** Pick the first runnable candidate per id, in source-priority order. */
+function pickByPriority(candidates) {
+	const byId = /* @__PURE__ */ new Map();
+	for (const c of candidates) if (!byId.has(c.id) && commandRunnable(c.command)) byId.set(c.id, c);
+	const order = [
+		"typecheck",
+		"lint",
+		"test"
+	];
+	const checks = [];
+	const evidence = /* @__PURE__ */ new Set();
+	for (const id of order) {
+		const c = byId.get(id);
+		if (c) {
+			checks.push({
+				id: c.id,
+				command: c.command
+			});
+			evidence.add(c.source);
+		}
+	}
+	return {
+		checks,
+		evidence: [...evidence]
+	};
+}
+/**
+* Resolve the gate descriptor for an already-resolved repo `root`.
+*   1. bun/TS sealed fast-path — byte-identical to the legacy `detectHarnessGateId`
+*      (bun on PATH + a `typecheck` script → sealed `default-ci`/`typecheck-test`).
+*   2. else the deterministic parser: collect candidates from package.json
+*      scripts (primary, self-contained), Make/just/task, language manifests, and
+*      a CI gap-filler for static checks; pick one per id by priority. A `parsed`
+*      descriptor is returned only when at least one STATIC check survives (a
+*      test-only set would either be off-by-default or risk false-reds).
+*   3. else null (the launcher prints why and the gate stays off).
+*/
+async function parseGateDescriptor(root, opts) {
+	if (resolveExecutable("bun", { env: process.env }) !== null) {
+		const scripts = await readScripts(root);
+		if (typeof scripts.typecheck === "string") return {
+			kind: "sealed",
+			gateId: typeof scripts.lint === "string" ? "default-ci" : "typecheck-test",
+			workdir: root
+		};
+	}
+	const candidates = (await Promise.all([
+		collectNodeChecks(root, opts.includeTests),
+		collectTaskChecks(root, opts.includeTests),
+		collectRustChecks(root, opts.includeTests),
+		collectGoChecks(root, opts.includeTests),
+		collectPythonChecks(root, opts.includeTests),
+		collectCiChecks(root)
+	])).flat();
+	if (candidates.length === 0) return null;
+	const ecosystem = candidates.find((c) => c.source === "package.json") ? "node" : candidates.find((c) => c.source === "Cargo.toml") ? "rust" : candidates.find((c) => c.source === "go.mod") ? "go" : candidates.find((c) => /^(pyproject|setup|pytest|tox|ruff|mypy)/.test(c.source)) ? "python" : candidates.find((c) => /^(Makefile|makefile|justfile|\.justfile|Taskfile)/.test(c.source)) ? "make" : "ci";
+	const { checks, evidence } = pickByPriority(candidates);
+	if (checks.length === 0) return null;
+	if (!checks.some((c) => STATIC_IDS.has(c.id)) && !opts.includeTests) return null;
+	return {
+		kind: "parsed",
+		checks,
+		ecosystem,
+		workdir: root,
+		evidence
+	};
+}
+/** The checks a descriptor runs: a sealed descriptor resolves its sealed command
+*  set from the registry; parsed/discovered carry their own. Fresh array. */
+function checksForDescriptor(d) {
+	if (d.kind === "sealed") {
+		const sealed = resolveSealedGate(d.gateId);
+		return sealed ? sealed.checks.map((c) => ({
+			id: c.id,
+			command: c.command
+		})) : [];
+	}
+	return d.checks.map((c) => ({
+		id: c.id,
+		command: c.command
+	}));
+}
+/** A stable key over a descriptor's effective check set, for baseline isolation.
+*  Sealed descriptors key on their gate id (preserving legacy baseline keys);
+*  parsed/discovered key on the canonicalized (id,command) set, so a changed
+*  command set yields a fresh baseline instead of masking/inventing regressions. */
+function descriptorHash(d) {
+	if (d.kind === "sealed") return `sealed:${d.gateId}`;
+	const canon = [...d.checks].map((c) => `${c.id}${c.command.trim().replace(/\s+/g, " ")}`).sort().join("
");
+	return `${d.kind}:${createHash("sha256").update(canon).digest("hex").slice(0, 32)}`;
+}
+//#endregion
+//#region src/lib/orchestration/gate-discovery.ts
+/**
+* Evidence-pinned model FALLBACK for the structural Stop-gate — the last resort
+* when the deterministic parser (`harness-parse`) finds no runnable checks.
+*
+* A read-only worker reads the repo's own config/docs and proposes the canonical
+* check commands. Two guards keep this safe despite being model-authored:
+*   1. SANITIZE — `sanitizeDiscoveredCheck` rejects shell metacharacters (so a
+*      command can never chain/redirect/expand), destructive/stateful verbs,
+*      interactive/watch shapes, and an executable that isn't on PATH. What
+*      survives is a single plain argv line, safe for `liveExec`'s naive split.
+*   2. EVIDENCE-PIN — a surviving command must appear (whitespace-normalized)
+*      VERBATIM in one of the collected source files. The model cannot invent a
+*      command or be prompt-injected into emitting one that isn't already a real
+*      command in the repo (and a real command in a user-trusted repo is the
+*      same authority the existing gate already runs).
+*
+* Discovery runs ONCE at launch and the result is cached per (repoFingerprint,
+* sourcesHash) in a human-readable record. The runtime Stop hook only READS the
+* cached record (no model call at stop). This is consumed ONLY by the local Stop
+* hook; the sealed-gate kernel never sees a discovered command.
+*/
+/** The allowlist of files the discovery worker is steered to read — config +
+*  docs that legitimately describe how to check a project. Secret files are
+*  additionally blocked at the worker IO layer (`.env*`/`*.pem`/`id_*`/…). */
+const SIGNAL_FILES = [
+	"package.json",
+	"Makefile",
+	"makefile",
+	"justfile",
+	".justfile",
+	"Taskfile.yml",
+	"Taskfile.yaml",
+	"Cargo.toml",
+	"go.mod",
+	"pyproject.toml",
+	"setup.cfg",
+	"tox.ini",
+	"pytest.ini",
+	"CONTRIBUTING.md",
+	"CONTRIBUTING",
+	"README.md",
+	"README",
+	"DEVELOPING.md",
+	"mix.exs",
+	"build.gradle",
+	"pom.xml",
+	"composer.json"
+];
+const SIGNAL_DIRS = [".github/workflows"];
+const MAX_SIGNAL_BYTES = 65536;
+/** Global caps so a repo with many workflow files can't inflate discovery /
+*  hashing cost: at most this many files and this much total text. */
+const MAX_SIGNAL_FILES = 40;
+const MAX_TOTAL_SIGNAL_BYTES = 524288;
+/** Words that mark a command as destructive, stateful, or non-terminating — a
+*  "check" must never do any of these. (Shell operators are already rejected by
+*  `isSafeCommand`, so chaining can't smuggle them past this word scan.) */
+const DENY_WORD = /\b(rm|rmdir|mv|dd|mkfs|sudo|chmod|chown|publish|push|deploy|migrate|kubectl|terraform|docker|curl|wget|ssh|scp|rsync|nc|eval|npm i|npm install|yarn add|pip install|apt|brew|watch|serve|repl|dev|start)\b/i;
+/**
+* True when `command` is safe to auto-run as a check: a plain argv line (no
+* shell metacharacters), no destructive/stateful verb, no mutating/interactive
+* shape, and its executable resolves on PATH. The deny-word scan runs on a
+* whitespace-NORMALIZED copy so a tab / double-space can't split `npm  install`
+* past the literal-space patterns.
+*/
+function sanitizeDiscoveredCheck(command) {
+	if (!isSafeCommand(command)) return false;
+	const norm = normalizeWs(command);
+	if (DENY_WORD.test(norm)) return false;
+	if (isMutatingCommand(norm)) return false;
+	const first = norm.split(" ")[0] ?? "";
+	return resolveExecutable(first, { env: process.env }) !== null;
+}
+function normalizeWs(s) {
+	return s.replace(/\s+/g, " ").trim();
+}
+/** Collect the text of the allowlisted signal files (capped), for evidence-pin +
+*  the sources hash. Returns the concatenated text and the relative file list. */
+async function collectSignals(root) {
+	const parts = [];
+	const files = [];
+	let total = 0;
+	const readCapped = async (abs, rel) => {
+		if (files.length >= MAX_SIGNAL_FILES || total >= MAX_TOTAL_SIGNAL_BYTES) return;
+		try {
+			const raw = await promises.readFile(abs, "utf8");
+			const slice = raw.length > MAX_SIGNAL_BYTES ? raw.slice(0, MAX_SIGNAL_BYTES) : raw;
+			parts.push(slice);
+			files.push(rel);
+			total += slice.length;
+		} catch {}
+	};
+	for (const f of SIGNAL_FILES) {
+		const abs = path.join(root, f);
+		if (existsSync(abs)) await readCapped(abs, f);
+	}
+	for (const d of SIGNAL_DIRS) {
+		const dir = path.join(root, d);
+		try {
+			for (const name of await promises.readdir(dir)) if (/\.(ya?ml)$/i.test(name)) await readCapped(path.join(dir, name), path.join(d, name));
+		} catch {}
+	}
+	return {
+		text: parts.join("\n"),
+		files
+	};
+}
+/** A freshness hash over the signal files' contents + relative paths. A change
+*  to how the project checks itself flips this → re-discovery on next launch. */
+async function sourcesHash(root) {
+	const { text, files } = await collectSignals(root);
+	return createHash("sha256").update(files.sort().join("\n")).update("\0").update(text).digest("hex");
+}
+function discoveredDir() {
+	return path.join(PATHS.APP_DIR, "stop-gate", "discovered");
+}
+function recordPathFor(root) {
+	return path.join(discoveredDir(), createHash("sha256").update(path.resolve(root)).digest("hex").slice(0, 32));
+}
+/** Read the cached discovered record for `root`, verifying it still matches the
+*  live repo identity AND the live sources hash. Any mismatch / unreadable /
+*  empty-checks record → null (re-discover or stay off; never run a stale set). */
+async function readDiscoveredGate(root) {
+	let rec;
+	try {
+		rec = JSON.parse(await promises.readFile(recordPathFor(root), "utf8"));
+	} catch {
+		return null;
+	}
+	if (!rec || !Array.isArray(rec.checks) || rec.checks.length === 0) return null;
+	const fp = await repoFingerprint(root).catch(() => "");
+	if (fp.length === 0 || fp !== rec.fingerprint) return null;
+	const sh = await sourcesHash(root).catch(() => "");
+	if (sh.length === 0 || sh !== rec.sourcesHash) return null;
+	const checks = rec.checks.filter((c) => c && typeof c.id === "string" && VALID_IDS.has(c.id) && typeof c.command === "string" && sanitizeDiscoveredCheck(c.command));
+	if (checks.length === 0) return null;
+	return {
+		...rec,
+		checks
+	};
+}
+async function writeDiscoveredGate(rec) {
+	await promises.mkdir(discoveredDir(), { recursive: true });
+	const tmp = `${recordPathFor(rec.root)}.${process.pid}.tmp`;
+	await promises.writeFile(tmp, `${JSON.stringify(rec, null, 2)}\n`, { mode: 384 });
+	await promises.rename(tmp, recordPathFor(rec.root));
+}
+const DISCOVERY_PROMPT = (files) => `You are configuring an automated pre-finish CHECK gate for this repository. Read ONLY these already-present config/doc files to learn how the project checks itself: ${files.join(", ")}. Identify the canonical FAST static check command (typecheck and/or lint) and, if obvious, the test command. Rules: (1) return a command ONLY if it appears VERBATIM in one of those files — never invent one; (2) commands must be non-interactive, self-terminating, read-only verification (NO install / publish / push / deploy / migrate / format-in-place / watch / serve / dev-server / delete); (3) at most 3 commands; (4) if unsure, return an empty list. Respond with ONLY a fenced \`\`\`json block of the shape {"ecosystem":"<label>","checks":[{"id":"typecheck|lint|test","command":"<single-line command>"}],"confidence":"high|low"} and NOTHING else.`;
+/** Extract the first fenced/bare JSON object from the worker's text. */
+function extractJson(text) {
+	const fenced = /```(?:json)?\s*([\s\S]*?)```/i.exec(text);
+	const body = fenced ? fenced[1] : text;
+	const start = body.indexOf("{");
+	const end = body.lastIndexOf("}");
+	if (start < 0 || end <= start) return void 0;
+	try {
+		return JSON.parse(body.slice(start, end + 1));
+	} catch {
+		return;
+	}
+}
+const VALID_IDS = /* @__PURE__ */ new Set([
+	"typecheck",
+	"lint",
+	"test"
+]);
+/**
+* Sanitize + EVIDENCE-PIN the model's raw checks against the collected source
+* text. Pure (no IO) so it is unit-testable without the worker. A check survives
+* only if: its id is canonical, it isn't a `test` while tests are off, its id
+* hasn't already been taken, it passes `sanitizeDiscoveredCheck`, AND its command
+* appears (whitespace-normalized) VERBATIM in `evidenceText`. The evidence-pin is
+* the load-bearing guard: the model cannot invent a command or be prompt-injected
+* into one that isn't already a real command in the (user-trusted) repo.
+*/
+function filterDiscoveredChecks(rawChecks, evidenceText, includeTests) {
+	const evidenceNorm = normalizeWs(evidenceText);
+	const seen = /* @__PURE__ */ new Set();
+	const checks = [];
+	for (const c of Array.isArray(rawChecks) ? rawChecks : []) {
+		if (!c || typeof c !== "object") continue;
+		const id = c.id;
+		const command = c.command;
+		if (typeof id !== "string" || !VALID_IDS.has(id)) continue;
+		if (typeof command !== "string") continue;
+		if (id === "test" && !includeTests) continue;
+		if (seen.has(id)) continue;
+		if (!sanitizeDiscoveredCheck(command)) continue;
+		if (!evidenceNorm.includes(normalizeWs(command))) continue;
+		seen.add(id);
+		checks.push({
+			id,
+			command: command.trim()
+		});
+	}
+	return checks;
+}
+/**
+* Run the read-only worker to discover check commands for `cwd`. Returns the
+* sanitized + evidence-pinned result, or null (worker unavailable / errored /
+* nothing survived). NEVER throws.
+*/
+async function discoverGateCommands(cwd, opts) {
+	const root = await repoRoot(cwd).catch(() => cwd);
+	const { text: evidenceText, files } = await collectSignals(root);
+	if (files.length === 0) return null;
+	let result;
+	try {
+		const { runWorkerAgent } = await import("./engine-DNCX0Hfd.js");
+		result = await runWorkerAgent({
+			mode: "explore",
+			workspace: root,
+			prompt: DISCOVERY_PROMPT(files),
+			signal: opts.signal
+		});
+	} catch {
+		return null;
+	}
+	if (result.isError) return null;
+	const parsed = extractJson(result.text);
+	if (!parsed || typeof parsed !== "object") return null;
+	const obj = parsed;
+	const checks = filterDiscoveredChecks(obj.checks, evidenceText, opts.includeTests);
+	if (checks.length === 0) return null;
+	return {
+		ecosystem: typeof obj.ecosystem === "string" && obj.ecosystem.length > 0 ? obj.ecosystem : "discovered",
+		checks,
+		confidence: typeof obj.confidence === "string" ? obj.confidence : "low",
+		evidence: files
+	};
+}
+//#endregion
+export { checksForDescriptor as a, writeDiscoveredGate as i, readDiscoveredGate as n, descriptorHash as o, sourcesHash as r, parseGateDescriptor as s, discoverGateCommands as t };
+
+//# sourceMappingURL=gate-discovery-CepmbZnc.js.map