iterate-plugin 3.5.7 → 3.6.0

package/dist/index.js

@@ -47,34 +47,60 @@ import { ITERATE_SKILL_PROMPT } from "./skill-prompt.js";
 export const name = 'iterate-plugin';
 export const inject = ['tools', 'systemPrompt'];
 export function apply(ctx) {
-    // 1. Register the 17 tools (14 original + 3 v3.0)
-    registerConfigTool(ctx);
-    registerValidateTool(ctx);
-    registerDecisionLogTool(ctx);
-    registerContextTool(ctx);
-    registerReviewTool(ctx);
-    registerTriageTool(ctx);
-    registerFixTool(ctx);
-    registerDiffTool(ctx);
-    registerRollbackTool(ctx);
-    registerCheckpointTool(ctx);
-    registerStatusTool(ctx);
-    registerHistoryTool(ctx);
-    registerPruneTool(ctx);
-    registerTranscriptTool(ctx);
-    // v3.0: Quality Command Center tools
-    registerExperienceBankTool(ctx);
-    registerQualityGateTool(ctx);
-    registerDefenseEventsTool(ctx);
-    // 2. Wire the observatory approval gate onto dsh's tools/pre-execute waterfall,
-    //    and the live reviewer-activity feed onto tools/result.
+    // 0. Wire the SAFETY hooks BEFORE any tool is registered.
+    //    Registration is a list of 17 independent calls; if one of them threw
+    //    (duplicate name, malformed definition, hostile ctx) while the gate was
+    //    registered last, the tools registered up to that point would keep
+    //    running with NO `tools/pre-execute` approval gate — a fail-open hole
+    //    created by load order. Registering the gate first means a partial load
+    //    can only ever err on the side of MORE gating, never less.
     registerSessionHooks(ctx);
     registerLiveCapture(ctx);
-    // 2. Inject the iterate skill prompt as a system prompt section
-    // This teaches the model how to write iterate workflow scripts using the tools.
-    ctx.systemPrompt.section({
-        name: 'iterate-skill',
-        order: 100,
-        text: ITERATE_SKILL_PROMPT,
-    });
+    // 1. Register the 17 tools (14 original + 3 v3.0). Each registration is
+    //    isolated: one failing tool must not take down the other 16, the gate
+    //    above, or the prompt below (a partial plugin that still gates and
+    //    teaches the workflow beats an aborted `apply`). Failures are logged,
+    //    never swallowed silently.
+    const toolRegistrations = [
+        ['iterate_config', () => registerConfigTool(ctx)],
+        ['iterate_validate', () => registerValidateTool(ctx)],
+        ['iterate_decision_log', () => registerDecisionLogTool(ctx)],
+        ['iterate_context', () => registerContextTool(ctx)],
+        ['iterate_review', () => registerReviewTool(ctx)],
+        ['iterate_triage', () => registerTriageTool(ctx)],
+        ['iterate_fix', () => registerFixTool(ctx)],
+        ['iterate_diff', () => registerDiffTool(ctx)],
+        ['iterate_rollback', () => registerRollbackTool(ctx)],
+        ['iterate_checkpoint', () => registerCheckpointTool(ctx)],
+        ['iterate_status', () => registerStatusTool(ctx)],
+        ['iterate_history', () => registerHistoryTool(ctx)],
+        ['iterate_prune', () => registerPruneTool(ctx)],
+        ['iterate_transcript', () => registerTranscriptTool(ctx)],
+        // v3.0: Quality Command Center tools
+        ['iterate_experience', () => registerExperienceBankTool(ctx)],
+        ['iterate_quality_gate', () => registerQualityGateTool(ctx)],
+        ['iterate_defense_events', () => registerDefenseEventsTool(ctx)],
+    ];
+    for (const [toolName, register] of toolRegistrations) {
+        try {
+            register();
+        }
+        catch (err) {
+            console.warn(`[iterate] failed to register ${toolName}; continuing.`, err);
+        }
+    }
+    // 2. Inject the iterate skill prompt as a system prompt section.
+    //    This teaches the model how to write iterate workflow scripts using the
+    //    tools. Guarded for the same reason as above: a prompt-injection failure
+    //    must not undo a load that already wired the gate and the tools.
+    try {
+        ctx.systemPrompt.section({
+            name: 'iterate-skill',
+            order: 100,
+            text: ITERATE_SKILL_PROMPT,
+        });
+    }
+    catch (err) {
+        console.warn('[iterate] failed to inject the skill prompt section; continuing.', err);
+    }
 }

package/dist/jobs.js

@@ -11,10 +11,19 @@
  * - `ctx.jobs` only exists when the dsh host loaded a job registry + a
  *   controller serves the calling owner (`@deepseek-ai/dsh-tool-jobs` or an
  *   equivalent). When it is missing, `start()` throws or is absent — we
- *   detect both and fall through to plain execution, so the Job Panel is a
- *   pure enhancement and never breaks a tool call.
+ *   detect both (including a throwing `start` GETTER) and fall through to
+ *   plain execution, so the Job Panel is a pure enhancement and never breaks
+ *   a tool call.
  * - The registry is memory-only and panel rows are read-only (no progress
  *   updates), so these jobs are completion records, not control channels.
+ * - Cancellation is honest, not theatrical. `JobHooks.cancel` is REQUIRED by
+ *   `@deepseek-ai/dsh-jobs` (the registry calls it on kill/teardown), but the
+ *   wrapped tool `fn` exposes no abort channel — a panel kill cannot stop it.
+ *   So `cancel` records the REQUEST (synchronous + idempotent, first reason
+ *   wins), best-effort surfaces it on the record's progress line, and lets the
+ *   job settle with `fn`'s TRUE outcome, with the request annotated in
+ *   `detail`. Settling the record `killed` while `fn()` keeps running would
+ *   show a stopped job that is still running — a lie in the Job Panel.
  */
 /**
  * Read `ctx.jobs` defensively: the dsh plugin context can be a Proxy whose
@@ -30,11 +39,25 @@ function safeJobs(ctx) {
         return undefined;
     }
 }
+/**
+ * Read `jobs.start` defensively: the `start` GETTER itself can throw on a
+ * hostile/proxied registry, and that read must degrade the same way as a
+ * missing registry — never escape `runWithJob`.
+ */
+function safeStart(jobs) {
+    try {
+        return jobs?.start;
+    }
+    catch {
+        return undefined;
+    }
+}
 /**
  * Run `fn` wrapped in a dsh background job, settling it completed/failed
- * with the execution's outcome. When the host exposes no job registry (or
- * refuses the start), `fn` runs untouched and `null` is returned — the Job
- * Panel is an enhancement, never a dependency.
+ * with the execution's ACTUAL outcome (a requested cancel never falsifies it
+ * — see the header). When the host exposes no job registry (or refuses the
+ * start), `fn` runs untouched and `null` is returned — the Job Panel is an
+ * enhancement, never a dependency.
  *
  * @param ctx      the dsh plugin context (may or may not expose `jobs`).
  * @param kind     iterate job kind registered via {@link IterateJobKind}.
@@ -44,21 +67,43 @@ function safeJobs(ctx) {
  */
 export async function runWithJob(ctx, kind, label, fn) {
     const jobs = safeJobs(ctx);
-    if (!jobs || typeof jobs.start !== 'function') {
+    const start = safeStart(jobs);
+    if (!jobs || !start || typeof start !== 'function') {
         return { result: await fn(), jobId: null };
     }
     let settle;
     const done = new Promise((resolve) => {
         settle = resolve;
     });
+    // Honest cancel bookkeeping: the request is recorded (first reason wins),
+    // but `done` is NOT settled here — `fn()` is still running and the panel
+    // must not claim otherwise. The settlement below carries `fn`'s real
+    // outcome, annotated with the request.
+    let cancelRequested = null;
+    const annotate = (detail) => cancelRequested === null
+        ? detail
+        : `${detail} (cancel requested: ${cancelRequested} — the wrapped tool call has no abort channel and ran to completion)`;
     let jobId = null;
     try {
-        jobId = jobs.start({
+        jobId = start.call(jobs, {
             kind,
             label,
-            run: () => ({
+            run: (job) => ({
                 done,
-                cancel: () => settle({ status: 'killed', detail: 'cancelled' }),
+                cancel: (reason) => {
+                    if (cancelRequested !== null)
+                        return; // idempotent — first reason wins
+                    cancelRequested = reason ?? 'cancel requested';
+                    // Best-effort panel hint while the record is stopping; the registry
+                    // drops writes it cannot apply, and a throwing update must not
+                    // propagate out of the registry's kill path.
+                    try {
+                        job?.updateProgress?.('cancel requested — waiting for the tool call to finish (no abort channel)');
+                    }
+                    catch {
+                        /* progress hint is cosmetic */
+                    }
+                },
             }),
         });
     }
@@ -69,13 +114,13 @@ export async function runWithJob(ctx, kind, label, fn) {
     }
     try {
         const result = await fn();
-        settle({ status: 'completed', detail: 'done' });
+        settle({ status: 'completed', detail: annotate('done') });
         return { result, jobId };
     }
     catch (error) {
         settle({
             status: 'failed',
-            detail: error instanceof Error ? error.message : 'execution failed',
+            detail: annotate(error instanceof Error ? error.message : 'execution failed'),
         });
         throw error;
     }

package/dist/live.js

@@ -18,6 +18,9 @@
  * Safety:
  *   - Read-only observer: never mutates source files; writes only the NDJSON
  *     live file under `.iterate/`.
+ *   - Privacy switch: when the project's effective config sets
+ *     `observatory.capture: false`, nothing is persisted (the file stays
+ *     absent/unchanged). An unreadable config keeps capture ON (defaults).
  *   - The live file is byte-capped (rewrite to last N lines when it grows too
  *     large) so it can never grow unbounded.
  *   - Any capture failure is swallowed (fire-and-forget) so it can never block
@@ -27,7 +30,7 @@ import { mkdir, readFile, stat, appendFile } from 'node:fs/promises';
 import { existsSync } from 'node:fs';
 import { writeTextAtomicAsync } from "./atomic-fs.js";
 import { join } from 'node:path';
-import { resolveProjectRoot } from "./config-loader.js";
+import { loadEffectiveConfig, resolveProjectRoot } from "./config-loader.js";
 /** Keep at most this many live activity entries. */
 export const LIVE_MAX_ENTRIES = 300;
 /** Rewrite the live file when its byte size exceeds this threshold. */
@@ -51,14 +54,41 @@ function enqueueLiveWrite(task) {
     liveWriteQueue = next.catch(() => { });
     return next;
 }
-/** Append one activity record to the project's live feed (byte-capped). */
+/**
+ * True when the project's effective config still allows live capture.
+ * `observatory.capture: false` opts the project out — nothing is persisted.
+ * Failure modes keep TODAY'S behavior: `loadEffectiveConfig` never throws on
+ * an unreadable config (it falls back to defaults, capture on), and any
+ * unexpected loader error here also degrades to capture ON rather than
+ * silently eating activity the operator expected to see.
+ */
+function captureEnabled(projectRoot) {
+    try {
+        return loadEffectiveConfig(projectRoot).config.observatory?.capture !== false;
+    }
+    catch {
+        return true;
+    }
+}
+/**
+ * Append one activity record to the project's live feed (byte-capped).
+ * Never rejects: every failure (capture disabled, `.iterate` existing as a
+ * regular file, locked/unwritable feed) is swallowed — the header promises
+ * this path can never crash or block a tool call (`void appendLive(...)`
+ * would otherwise turn a rejection into an unhandled rejection).
+ */
 export function appendLive(projectRoot, entry) {
     return enqueueLiveWrite(async () => {
-        const file = liveFilePath(projectRoot);
-        const line = JSON.stringify(entry) + '\n';
-        await mkdir(join(projectRoot, '.iterate'), { recursive: true });
-        // Amortized O(1): only read+rewrite when the file has grown past the cap.
         try {
+            // Privacy: capture off → do not touch the feed at all.
+            if (!captureEnabled(projectRoot))
+                return;
+            const file = liveFilePath(projectRoot);
+            const line = JSON.stringify(entry) + '\n';
+            // mkdir is INSIDE the guard: `.iterate` may be a regular file (or the
+            // dir unwritable) — it must reject neither the caller nor the queue.
+            await mkdir(join(projectRoot, '.iterate'), { recursive: true });
+            // Amortized O(1): only read+rewrite when the file has grown past the cap.
             const st = await stat(file).catch(() => null);
             if (st && st.size > LIVE_MAX_BYTES) {
                 const raw = await readFile(file, 'utf-8');
@@ -167,12 +197,21 @@ export async function readLive(projectRoot) {
  */
 export function registerLiveCapture(ctx) {
     ctx.on('tools/result', (exec) => {
-        const root = projectRootOf(exec);
-        if (!root)
-            return;
-        const entry = classifyTool(exec.name, exec.arguments, root);
-        if (!entry)
-            return;
-        void appendLive(root, entry);
+        // Defensive: a hostile/proxied exec whose getters throw (`agent`,
+        // `name`, `arguments`) must not abort the observer — unlike the guarded
+        // siblings below, an unguarded throw here would lose the record and
+        // surface an error from a read-only hook. Degrade to a no-op.
+        try {
+            const root = projectRootOf(exec);
+            if (!root)
+                return;
+            const entry = classifyTool(exec.name, exec.arguments, root);
+            if (!entry)
+                return;
+            void appendLive(root, entry);
+        }
+        catch {
+            // An observer must never throw.
+        }
     });
 }

package/dist/meta-review.js

@@ -13,7 +13,7 @@
  * the actual subagent-driven meta-review critique; all deterministic math
  * lives here.
  */
-import { sortFindings } from "./review.js";
+import { isValidRoundNumber, sortFindings } from "./review.js";
 /**
  * Number of distinct consistency checks performed by `metaReviewReport`.
  * The check set is: COUNT_MATCH, SEVERITY_SUM, DIMENSION_SUM, DIMENSION_UNKNOWN,
@@ -26,6 +26,50 @@ export const META_REVIEW_CHECKS = 10;
  * remainder is folded into a "+N more" suffix.
  */
 export const COVERAGE_LIST_TRUNCATE = 10;
+/**
+ * Hard sanity ceiling on a reported round number.
+ *
+ * `rounds[].round` is model/JSON-authored and only needs to be a number to
+ * reach this audit. Round-gap detection enumerates `min..max` of the PRESENT
+ * round numbers, so an absurd value (rounds `{1, 1e15}` or a round of
+ * `Infinity`) used to turn a linear check into an effectively-infinite loop —
+ * a trivial CPU/memory denial of service (and one ROUND_GAP issue per missing
+ * round). Anything above this ceiling is rejected as an invalid round
+ * (ROUND_NUMBER) and excluded from gap enumeration instead of being walked.
+ * Generously above any real run: `config.max_rounds` is capped at 100.
+ */
+export const MAX_REVIEW_ROUND_NUMBER = 1000;
+/**
+ * Max individual ROUND_GAP issues emitted per audit. The remainder is folded
+ * into a single "+N more" issue so a wide-but-legal gap can never flood the
+ * issue list (each issue carries a detail string).
+ */
+export const MAX_ROUND_GAP_REPORTS = 50;
+/**
+ * Hard bound on the round-gap enumeration span. Below
+ * MAX_REVIEW_ROUND_NUMBER on purpose: even a legal range (e.g. round 1 plus
+ * round 1000) is too wide for per-number gap reporting to mean anything, so
+ * it collapses to ONE "range too wide" issue instead of ~1000 iterations and
+ * ~1000 issues. Together with the round-number ceiling this makes the
+ * enumeration O(MAX_ROUND_GAP_SPAN) no matter what reaches it.
+ */
+export const MAX_ROUND_GAP_SPAN = 500;
+/** Bounded, non-throwing list preview for issue detail strings. */
+function previewList(values, max = 20) {
+    const shown = values
+        .slice(0, max)
+        .map((v) => (typeof v === 'number' ? String(v) : typeof v === 'string' ? v : '[object]'))
+        .join(', ');
+    return values.length > max ? `${shown}, … (+${values.length - max} more)` : shown;
+}
+/** Bounded, non-throwing object preview (a hostile round may be circular). */
+function previewRound(r) {
+    if (r === null || typeof r !== 'object')
+        return String(r);
+    const roundNo = r.round;
+    const findings = r.findings;
+    return `{round: ${String(roundNo)}, findings: ${Array.isArray(findings) ? `array(${findings.length})` : typeof findings}}`;
+}
 /**
  * Audit a ReviewReport for internal consistency.
  *
@@ -79,7 +123,9 @@ export function metaReviewReport(report) {
     const sevCounts = { critical: 0, high: 0, medium: 0, low: 0 };
     for (const f of findings) {
         const s = f?.severity;
-        if (s && s in sevCounts)
+        // hasOwn, not `in`: `'__proto__' in sevCounts` is true via inheritance,
+        // and an out-of-spec severity must simply not be bucketed.
+        if (s && Object.hasOwn(sevCounts, s))
             sevCounts[s]++;
     }
     const bucketSum = sevCounts.critical + sevCounts.high + sevCounts.medium + sevCounts.low;
@@ -116,18 +162,23 @@ export function metaReviewReport(report) {
         : [];
     const convSum = findingsByRound.reduce((a, b) => a + Number(b) || 0, 0);
     if (convSum !== total) {
-        add('CONVERGENCE_SUM', 'high', 'convergence.findingsByRound does not sum to totalFindings', `findingsByRound ${JSON.stringify(findingsByRound)} sums to ${convSum}, ` +
+        add('CONVERGENCE_SUM', 'high', 'convergence.findingsByRound does not sum to totalFindings', `findingsByRound [${previewList(findingsByRound)}] sums to ${convSum}, ` +
             `but totalFindings is ${total}.`);
     }
     // `findingsByRound` is indexed by the actual round number (round r → index
-    // r-1), so the "last round" is the LAST RECORDED round's reported number, not
-    // the array's last index (the array is sized to the highest round, which only
-    // equals the record count for contiguous 1..N round numbers). Read the flag
-    // consistency the same way buildReviewReport/computeConvergence set it.
+    // r-1), so the "last round" is the HIGHEST VALID round number, not the
+    // array's last element (buildReviewReport sorts its round list, but this
+    // audit runs on arbitrary JSON, and a malformed trailing round — `1.5`,
+    // `Infinity` — must not be used as an index: Math.min(1.5, len) - 1 is
+    // fractional and reads `undefined` → 0 new → a false CONVERGENCE_FLAG).
     const reportRounds = Array.isArray(report.rounds) ? report.rounds : [];
-    const lastRecordedRound = reportRounds.length > 0 && typeof reportRounds[reportRounds.length - 1]?.round === 'number'
-        ? reportRounds[reportRounds.length - 1].round
-        : null;
+    let lastRecordedRound = null;
+    for (const r of reportRounds) {
+        if (!r || typeof r !== 'object' || !isValidRoundNumber(r.round))
+            continue;
+        if (lastRecordedRound === null || r.round > lastRecordedRound)
+            lastRecordedRound = r.round;
+    }
     const lastRoundNew = lastRecordedRound !== null && lastRecordedRound > 0
         // Over-cap rounds are FOLDED by aggregateRounds into the final slot, so a
         // reported round number may exceed the array length — read the SAME
@@ -144,8 +195,15 @@ export function metaReviewReport(report) {
     const rounds = Array.isArray(report.rounds) ? report.rounds : [];
     const seenRounds = new Set();
     for (const [index, r] of rounds.entries()) {
-        if (!r || typeof r.round !== 'number' || r.round < 1) {
-            add('ROUND_NUMBER', 'medium', 'A round has a missing or non-positive round number', `round: ${JSON.stringify(r)}`);
+        // Reject everything the deterministic core would refuse: a missing,
+        // non-integer, non-finite or absurdly large round number. This is also
+        // the DoS guard for ROUND_GAP below — a round of `Infinity`/1e15 would
+        // otherwise be treated as a legitimate endpoint of the enumeration range.
+        if (!r ||
+            typeof r !== 'object' ||
+            !isValidRoundNumber(r.round) ||
+            r.round > MAX_REVIEW_ROUND_NUMBER) {
+            add('ROUND_NUMBER', 'medium', 'A round has a missing, non-integer or out-of-range round number', `round: ${previewRound(r)} (round numbers must be integers in 1..${MAX_REVIEW_ROUND_NUMBER})`);
             continue;
         }
         seenRounds.add(r.round);
@@ -163,9 +221,30 @@ export function metaReviewReport(report) {
     if (present.length > 0) {
         const min = present[0];
         const max = present[present.length - 1];
-        for (let i = min; i <= max; i++) {
-            if (!seenRounds.has(i)) {
-                add('ROUND_GAP', 'medium', `Round ${i} is missing from the round sequence`, `rounds present: ${present.join(', ')}.`);
+        const span = max - min + 1;
+        const presentPreview = previewList(present, 20);
+        // Hard bound on the enumeration: `min`/`max` come from untrusted round
+        // numbers, so an unguarded `for (i = min; i <= max; i++)` over
+        // {1, 1e15} is an effectively-infinite loop (CPU DoS) that would also
+        // push ~1e15 issues. Rounds above MAX_REVIEW_ROUND_NUMBER are rejected
+        // above, which keeps `span` bounded on its own; this guard stays as the
+        // belt-and-braces backstop so the walk is O(MAX_ROUND_GAP_SPAN) no
+        // matter what reaches it.
+        if (span > MAX_ROUND_GAP_SPAN) {
+            add('ROUND_GAP', 'medium', `Round sequence ${min}..${max} is too wide to audit for gaps`, `${span} round numbers spanned; only rounds present were accepted: ${presentPreview}.`);
+        }
+        else {
+            const missing = [];
+            for (let i = min; i <= max; i++) {
+                if (!seenRounds.has(i))
+                    missing.push(i);
+            }
+            for (const m of missing.slice(0, MAX_ROUND_GAP_REPORTS)) {
+                add('ROUND_GAP', 'medium', `Round ${m} is missing from the round sequence`, `rounds present: ${presentPreview}.`);
+            }
+            if (missing.length > MAX_ROUND_GAP_REPORTS) {
+                add('ROUND_GAP', 'medium', `${missing.length - MAX_ROUND_GAP_REPORTS} more rounds are missing (list capped)`, `${missing.length} of the ${span} numbers in ${min}..${max} are absent; only the first ` +
+                    `${MAX_ROUND_GAP_REPORTS} are listed individually. rounds present: ${presentPreview}.`);
             }
         }
     }
@@ -177,6 +256,35 @@ export function metaReviewReport(report) {
         issues,
     };
 }
+/**
+ * Human-readable reason for a failed evidence attestation.
+ *
+ * `file_too_large` / `binary_file` are DISTINCT from `line_out_of_range` (see
+ * evidence.ts): the file EXISTS but cannot be line-addressed, so saying
+ * "does not exist" would send the reader looking for a missing file.
+ */
+function describeEvidenceViolation(v) {
+    switch (v.error) {
+        case 'file_too_large':
+            return `${v.file} is too large to line-address (over the evidence size cap)`;
+        case 'binary_file':
+            return `${v.file} is a binary (NUL-containing) file that cannot be line-addressed`;
+        case 'line_out_of_range':
+            return v.lineTotal !== undefined && v.lineTotal !== null
+                ? `${v.line} is beyond this file's ${v.lineTotal} lines`
+                : `${v.file} is not a regular line-addressable file (directory/device/FIFO)`;
+        default:
+            return `${v.file} does not exist at all (verifiable read required)`;
+    }
+}
+/** Headline for a failed evidence attestation (matches the detail above). */
+function evidenceViolationSummary(v) {
+    const unaddressable = v.error === 'file_too_large' || v.error === 'binary_file';
+    const head = unaddressable
+        ? 'Finding cannot be anchored to line-addressable code'
+        : 'Finding references non-existent code';
+    return `${head}: ${v.file}${v.line ? `:${v.line}` : ''}`;
+}
 /**
  * Build the final review report: pair the source report with its meta-review
  * verdict and a rolled-up summary. Pure and deterministic.
@@ -221,30 +329,26 @@ export function buildFinalReviewReport(report, opts = {}) {
             for (const violation of evidence.results) {
                 if (violation.error === undefined)
                     continue;
-                const detail = violation.error === 'line_out_of_range'
-                    ? violation.lineTotal !== undefined && violation.lineTotal !== null
-                        ? `${violation.line} is beyond this file's ${violation.lineTotal} lines`
-                        : `${violation.file} is a binary/unreadable file not line-addressable`
-                    : `${violation.file} does not exist at all (verifiable read required)`;
+                const detail = describeEvidenceViolation(violation);
+                const summary = evidenceViolationSummary(violation);
                 let roundHint = '';
                 if (report && violation.file) {
                     // Try to attribute the poisoned finding to the round that first
-                    // surfaced it (best-effort; report rounds carry it).
-                    for (const r of report.rounds ?? []) {
-                        const matched = (r.findings ?? []).some((fnd) => !!fnd && fnd?.file === violation.file && fnd?.line === violation.line);
+                    // surfaced it (best-effort; report rounds carry it). `rounds` is
+                    // untrusted JSON, so a null entry must not throw here.
+                    for (const r of (Array.isArray(report.rounds) ? report.rounds : []) ?? []) {
+                        const findings = Array.isArray(r?.findings) ? r.findings : [];
+                        const matched = findings.some((fnd) => !!fnd && fnd?.file === violation.file && fnd?.line === violation.line);
                         if (matched) {
-                            roundHint = ` (round ${r.round})`;
+                            roundHint = ` (round ${String(r.round)})`;
                             break;
                         }
                     }
                 }
-                const summary = `Finding references non-existent code: ${violation.file}` +
-                    (violation.line ? `:${violation.line}` : '') +
-                    roundHint;
                 meta.issues.push({
                     code: 'EVIDENCE_VIOLATION',
                     severity: 'critical',
-                    summary,
+                    summary: summary + roundHint,
                     detail: detail + '. Review results must anchor to real, read code.',
                 });
             }

package/dist/method-scope.js

@@ -68,7 +68,11 @@ const SIGNATURE_PATTERNS = [
  * Returns a sorted array of `{ name, line }` (1-based line numbers).
  */
 export function collectMethodSignatures(text) {
-    const lines = text.split('\n');
+    // Defensive: callers hand in file content read from disk / tool args, which
+    // may be missing or wrong-typed when a fix record is malformed. A non-string
+    // would throw on `.split` inside the atomic-fix gate.
+    const source = typeof text === 'string' ? text : '';
+    const lines = source.split('\n');
     const out = [];
     // Set lookup instead of scanning the growing array (O(S²) → O(S)).
     const seen = new Set();
@@ -95,7 +99,7 @@ export function collectMethodSignatures(text) {
 }
 /** Number of physical lines in `text` (a trailing newline does not add a line). */
 export function countTextLines(text) {
-    if (text === '')
+    if (typeof text !== 'string' || text === '')
         return 0;
     const parts = text.split('\n');
     return parts[parts.length - 1] === '' ? parts.length - 1 : parts.length;
@@ -107,11 +111,14 @@ export function countTextLines(text) {
  * span runs to the final non-blank line of the file.
  */
 export function collectMethodSpans(text) {
-    const signatures = collectMethodSignatures(text);
+    // Same non-string guard as collectMethodSignatures: this runs inside the
+    // atomic-fix gate on content that may be missing.
+    const source = typeof text === 'string' ? text : '';
+    const signatures = collectMethodSignatures(source);
     if (signatures.length === 0)
         return [];
-    const lines = text.split('\n');
-    const lineCount = countTextLines(text);
+    const lines = source.split('\n');
+    const lineCount = countTextLines(source);
     /** Last non-blank line at or before `candidate`. */
     function trimBlank(endCandidate, floor) {
         let end = endCandidate;
@@ -137,6 +144,18 @@ export function collectMethodSpans(text) {
 function intersects(spanStart, spanEnd, regionStart, regionEnd) {
     return spanStart <= regionEnd && spanEnd >= regionStart;
 }
+/**
+ * True when a hunk's coordinates are usable for span intersection.
+ *
+ * `hunks` is a `ChangedRegion[]` that reaches this gate from a diff computed
+ * on tool-arg content; a malformed entry (`NaN`, `Infinity`, a negative or
+ * fractional line number) would build a `NaN`/negative region that either
+ * matches every method or none, silently wrong-sizing the adjacent-method
+ * verdict. Non-finite and negative starts/counts are simply skipped.
+ */
+function isValidRegion(start, count) {
+    return Number.isInteger(start) && start >= 0 && Number.isInteger(count) && count >= 1;
+}
 /**
  * Count the distinct methods a set of diff hunks touches.
  *
@@ -150,13 +169,17 @@ function intersects(spanStart, spanEnd, regionStart, regionEnd) {
  *  - Methods touched by both sides are counted once (keyed name@startLine).
  */
 export function countTouchedMethods(before, after, hunks) {
-    if (hunks.length === 0)
+    // A non-array `hunks` (malformed fix record / tool arg) is "nothing
+    // changed", matching the empty-hunk case — never a throw in the fix gate.
+    if (!Array.isArray(hunks) || hunks.length === 0)
         return 0;
     const beforeSpans = collectMethodSpans(before);
     const afterSpans = collectMethodSpans(after);
     const touched = new Set();
     for (const h of hunks) {
-        if (h.oldLines > 0) {
+        if (!h || typeof h !== 'object')
+            continue;
+        if (h.oldLines > 0 && isValidRegion(h.oldStart, h.oldLines)) {
             const oldEnd = h.oldStart + h.oldLines - 1;
             for (const s of beforeSpans) {
                 if (intersects(s.startLine, s.endLine, h.oldStart, oldEnd)) {
@@ -164,7 +187,7 @@ export function countTouchedMethods(before, after, hunks) {
                 }
             }
         }
-        if (h.newLines > 0) {
+        if (h.newLines > 0 && isValidRegion(h.newStart, h.newLines)) {
             const newEnd = h.newStart + h.newLines - 1;
             for (const s of afterSpans) {
                 if (intersects(s.startLine, s.endLine, h.newStart, newEnd)) {