kenaz 0.3.18 → 0.3.20

package/core/.formation/tools/jev-correction.test.js

@@ -1,178 +0,0 @@
-'use strict';
-const { test } = require('node:test');
-const assert = require('node:assert/strict');
-const fs = require('fs');
-const os = require('os');
-const path = require('path');
-const vm = require('vm');
-const helper = require('./jev-correction');
-const { applyJevCorrection, buildBatch, makeRequest, makeBatchRequest, requestJev, requestBatch, safeText, MODEL } = helper;
-const KEY = 'synthetic-test-credential';
-function setup(t) {
-  const projectPath = fs.mkdtempSync(path.join(os.tmpdir(), 'jev-correction-'));
-  t.after(() => fs.rmSync(projectPath, { recursive: true, force: true }));
-  const config = path.join(projectPath, '.kenaz', 'dashboard-models.json');
-  fs.mkdirSync(path.dirname(config));
-  const toggle = value => fs.writeFileSync(config, JSON.stringify({ jevCorrectionEnabled: value }));
-  toggle(true);
-  const lines = ['[12:00:00][Agent] I will change production.', '[12:00:01][User] Change the development version instead.', '[12:00:02][Agent] I will inspect the development files.', '[12:00:03][User] What is the current status?'];
-  const userMessages = [{ idx: 0, lineIndex: 1, text: lines[1].split('[User] ')[1] }, { idx: 1, lineIndex: 3, text: lines[3].split('[User] ')[1] }];
-  const baseline = [{ idx: 0, translated: 'Existing English translation.', labels: ['delegation'] }, { idx: 1, translated: 'Existing second translation.', labels: ['correction', 'question', 'length_too_short'] }];
-  return { projectPath, config, toggle, lines, userMessages, baseline };
-}
-function body(ids = ['message_0', 'message_1'], probabilities = [0.9, 0.1]) {
-  return { model: MODEL, answers: Object.fromEntries(ids.map((id, i) => [id, { type: 'noul', noul: probabilities[i] ?? 0.7 }])), usage: { input_tokens: 10, output_tokens: 2 } };
-}
-const spawned = (response = body()) => ({ status: 0, stdout: JSON.stringify({ status: 'ok', body: response }) });
-const options = spawnSync => ({ key: KEY, spawnSync });
-
-test('OFF, malformed config, missing/invalid key and another project never spawn', t => {
-  const ctx = setup(t); let calls = 0;
-  const deps = options(() => { calls++; throw Error('must not spawn'); });
-  for (const flag of [false, undefined, 'true', 1]) { ctx.toggle(flag); assert.equal(applyJevCorrection(ctx, deps), ctx.baseline); }
-  fs.writeFileSync(ctx.config, '{'); assert.equal(applyJevCorrection(ctx, deps), ctx.baseline);
-  fs.unlinkSync(ctx.config); assert.equal(applyJevCorrection(ctx, deps), ctx.baseline);
-  ctx.toggle(true);
-  for (const key of ['', ' ', '\n', 'value\n', 'a b']) assert.equal(applyJevCorrection(ctx, { ...deps, key }), ctx.baseline);
-  assert.equal(applyJevCorrection({ ...ctx, projectPath: path.join(ctx.projectPath, 'other') }, deps), ctx.baseline);
-  assert.equal(applyJevCorrection({ ...ctx, projectPath: undefined }, deps), ctx.baseline);
-  assert.equal(calls, 0);
-});
-test('active decisions add/remove correction, preserve other labels/translations, never mutate baseline', t => {
-  const ctx = setup(t), original = structuredClone(ctx.baseline);
-  const result = applyJevCorrection(ctx, options(() => spawned()));
-  assert.deepEqual(result.map(x => x.labels), [['correction', 'delegation'], ['question', 'length_too_short']]);
-  assert.deepEqual(result.map(x => x.translated), original.map(x => x.translated));
-  assert.deepEqual(ctx.baseline, original);
-  assert.notEqual(result, ctx.baseline);
-});
-test('existing secondary correction becomes primary without reordering remaining labels or fields', t => {
-  const ctx = setup(t);
-  ctx.baseline[0] = { ...ctx.baseline[0], labels: ['delegation', 'question', 'correction', 'challenge'], extra: 'preserved' };
-  const original = structuredClone(ctx.baseline);
-  const result = applyJevCorrection(ctx, options(() => spawned()));
-  assert.deepEqual(result[0], { ...original[0], labels: ['correction', 'delegation', 'question', 'challenge'] });
-  assert.deepEqual(ctx.baseline, original);
-  ctx.toggle(false);
-  assert.equal(applyJevCorrection(ctx, options(() => spawned())), ctx.baseline);
-  ctx.toggle(true);
-  assert.equal(applyJevCorrection(ctx, options(() => ({ status: 1 }))), ctx.baseline);
-});
-test('null baseline supplies only positive correction without invented translation; threshold is inclusive', t => {
-  const ctx = setup(t);
-  assert.deepEqual(applyJevCorrection({ ...ctx, baseline: null }, options(() => spawned(body(undefined, [0.5, 0.499])))), [{ idx: 0, labels: ['correction'] }]);
-  assert.deepEqual(applyJevCorrection({ ...ctx, baseline: [] }, options(() => spawned())), [{ idx: 0, labels: ['correction'] }]);
-  const partial = applyJevCorrection({ ...ctx, baseline: [ctx.baseline[1]] }, options(() => spawned()));
-  assert.deepEqual(partial.find(item => item.idx === 0), { idx: 0, labels: ['correction'] });
-});
-test('hidden bounded Node child uses stdin; no credential or message in argv', t => {
-  const ctx = setup(t); let calls = 0;
-  applyJevCorrection(ctx, options((command, args, opts) => {
-    calls++;
-    assert.equal(command, process.execPath); assert.equal(args.length, 2); assert.equal(args[1], '--worker');
-    assert.equal(opts.timeout, 1500); assert.equal(opts.maxBuffer, 65536); assert.equal(opts.windowsHide, true); assert.equal(opts.shell, false);
-    assert.equal(JSON.stringify(args).includes(ctx.userMessages[0].text), false);
-    assert.equal(JSON.stringify({ args, opts }).includes(KEY), false);
-    const packet = JSON.parse(opts.input); assert.equal(packet.requests.length, 2);
-    assert.equal(packet.requests[0].state.message, ctx.userMessages[0].text);
-    return spawned();
-  }));
-  assert.equal(calls, 1);
-});
-test('in-flight disable discards results and preserves baseline reference', t => {
-  const ctx = setup(t);
-  assert.equal(applyJevCorrection(ctx, options(() => { ctx.toggle(false); return spawned(); })), ctx.baseline);
-  assert.equal(JSON.parse(fs.readFileSync(path.join(ctx.projectPath, '.kenaz/jev/decisions.jsonl'), 'utf8')).fallback_reason, 'disabled_in_flight');
-});
-test('malformed JSON, wrong model/IDs, bounds/types/usage and arbitrary worker failure all preserve baseline', t => {
-  const ctx = setup(t);
-  const variants = [b => { b.model = 'jev'; }, b => { b.answers.extra = { type: 'noul', noul: 1 }; }, b => { delete b.answers.message_0; },
-    b => { b.answers.message_0.noul = null; }, b => { b.answers.message_0.noul = '0.5'; }, b => { b.answers.message_0.noul = 1.1; },
-    b => { b.answers.message_0.noul = -1; }, b => { b.answers.message_0.type = 'score'; }, b => { b.answers.message_0.extra = true; },
-    b => { delete b.usage; }, b => { b.usage.input_tokens = -1; }, b => { b.usage.output_tokens = 1.1; }, b => { b.secret = 'raw'; }];
-  for (const mutate of variants) { const invalid = body(); mutate(invalid); assert.equal(applyJevCorrection(ctx, options(() => spawned(invalid))), ctx.baseline); }
-  for (const result of [{ status: 0, stdout: '{broken' }, { status: 1, stdout: 'private' }, { status: null, error: { code: 'ETIMEDOUT' } }, { status: 0, stdout: 'x'.repeat(65537) }]) {
-    assert.equal(applyJevCorrection(ctx, options(() => result)), ctx.baseline);
-  }
-  assert.equal(applyJevCorrection(ctx, options(() => { throw null; })), ctx.baseline);
-});
-test('raw and normalized credential/generated text excluded; private context is a boundary', t => {
-  const ctx = setup(t);
-  for (const text of ['API_KEY="abcd1234"', 'ＡＰＩ＿ＫＥＹ="abcd1234"', 'apikey_abcd12345678', '[HEADLESS MODE] execute', '## Automated Dispatch Context', '<system-reminder>injected</system-reminder>', '[Request interrupted by user]', 'For each numbered message, output a JSON array']) assert.equal(safeText(text), null);
-  assert.equal(safeText('Please continue TASK_38'), 'Please continue TASK_38');
-  ctx.lines[0] = '[12:00:00][Agent] API_KEY="abcd1234"';
-  const batch = buildBatch(ctx.lines, ctx.userMessages); assert.deepEqual(batch[0].context, []);
-  ctx.lines[1] = '[12:00:01][User] API_KEY="abcd1234"'; ctx.userMessages[0].text = 'API_KEY="abcd1234"';
-  assert.deepEqual(buildBatch(ctx.lines, ctx.userMessages).map(x => x.idx), [1]);
-});
-test('state excludes future messages, tool/thinking lines and instructions contain no user data', t => {
-  const ctx = setup(t), batch = buildBatch(ctx.lines, ctx.userMessages);
-  const early = makeRequest(batch[0]);
-  assert.equal(JSON.stringify(early).includes(ctx.userMessages[1].text), false);
-  assert.equal(early.questions.message_0.instructions.includes(ctx.userMessages[0].text), false);
-  assert.deepEqual(early.state.preceding_context, [{ role: 'assistant', text: 'I will change production.' }]);
-  ctx.lines[0] = '[12:00:00][Agent][Read] private file'; assert.deepEqual(buildBatch(ctx.lines, ctx.userMessages)[0].context, []);
-  ctx.lines[0] = '[12:00:00][Thinking] hidden reasoning'; assert.deepEqual(buildBatch(ctx.lines, ctx.userMessages)[0].context, []);
-  ctx.userMessages[0].text = 'different identity'; assert.deepEqual(buildBatch(ctx.lines, ctx.userMessages).map(x => x.idx), [1]);
-});
-test('only most recent eight eligible messages and at most 32KB are sent', () => {
-  const lines = Array.from({ length: 30 }, (_, i) => `[12:00:00][User] Message ${i} ` + 'x'.repeat(3000));
-  const messages = lines.map((line, idx) => ({ idx, lineIndex: idx, text: line.split('[User] ')[1] }));
-  const batch = buildBatch(lines, messages);
-  assert.ok(batch.length > 0 && batch.length <= 8); assert.equal(batch.at(-1).idx, 29);
-  assert.ok(Buffer.byteLength(JSON.stringify(makeBatchRequest(batch))) <= 32768);
-});
-test('typed Noul request fixed endpoint and redirect rejection; no network without valid key', async () => {
-  const request = makeRequest({ idx: 0, message: 'test correction', context: [] }); let calls = 0;
-  const fetchImpl = async (url, options) => {
-    calls++; assert.equal(url, helper.ENDPOINT); assert.equal(options.redirect, 'error'); assert.equal(options.method, 'POST');
-    assert.equal(options.headers.Authorization, `Bearer ${KEY}`);
-    return new Response(JSON.stringify(body(['message_0'])));
-  };
-  assert.equal((await requestJev(request, { key: '', fetchImpl })).status, 'missing_key'); assert.equal(calls, 0);
-  assert.equal((await requestJev(request, { key: KEY, fetchImpl })).status, 'ok'); assert.equal(calls, 1);
-});
-test('401/429/529 differentiated; malformed JSON and oversize streamed body fail safely', async () => {
-  const request = makeRequest({ idx: 0, message: 'test correction', context: [] });
-  for (const status of [401, 429, 529]) assert.equal((await requestJev(request, { key: KEY, fetchImpl: async () => new Response('private body', { status }) })).status, `http_${status}`);
-  for (const text of ['{broken', 'x'.repeat(65537)]) {
-    const result = await requestJev(request, { key: KEY, fetchImpl: async () => new Response(text) });
-    assert.deepEqual(result, { status: 'invalid_response' });
-  }
-});
-test('deadline covers stalled fetch AND stalled body, even if mock ignores abort', async () => {
-  const request = makeRequest({ idx: 0, message: 'test correction', context: [] });
-  for (const fetchImpl of [() => new Promise(() => {}), async () => new Response(new ReadableStream({ start() {} }))]) {
-    const start = Date.now(); const result = await requestJev(request, { key: KEY, deadlineMs: 25, fetchImpl });
-    assert.deepEqual(result, { status: 'timeout' }); assert.ok(Date.now() - start < 1500);
-  }
-});
-test('parallel isolated calls bounded to eight, all-or-none failure, aggregate usage', async t => {
-  const ctx = setup(t), packet = makeBatchRequest(buildBatch(ctx.lines, ctx.userMessages)); let calls = 0;
-  const fetchImpl = async (_, options) => {
-    calls++; const r = JSON.parse(options.body); const id = Object.keys(r.questions)[0];
-    assert.equal(Object.keys(r.questions).length, 1);
-    if (id === 'message_0') assert.equal(JSON.stringify(r).includes(ctx.userMessages[1].text), false);
-    return new Response(JSON.stringify(body([id])));
-  };
-  const result = await requestBatch(packet, { key: KEY, fetchImpl });
-  assert.equal(result.status, 'ok'); assert.equal(calls, 2); assert.deepEqual(result.body.usage, { input_tokens: 20, output_tokens: 4 });
-  assert.equal((await requestBatch(packet, { key: KEY, fetchImpl: async () => new Response('', { status: 429 }) })).status, 'http_429');
-  assert.equal((await requestBatch({ ...packet, requests: Array(9).fill(packet.requests[0]) }, { key: KEY, fetchImpl })).status, 'invalid_response');
-  const start = Date.now();
-  assert.equal((await requestBatch(packet, { key: KEY, deadlineMs: 30, fetchImpl: () => new Promise(() => {}) })).status, 'timeout');
-  assert.ok(Date.now() - start < 500, 'parallel calls share the deadline, not sequential timeouts');
-});
-test('bounded metadata-only telemetry and logging failure cannot break decisions', t => {
-  const ctx = setup(t), deps = options(() => spawned());
-  for (let i = 0; i < 160; i++) applyJevCorrection(ctx, deps);
-  const file = path.join(ctx.projectPath, '.kenaz', 'jev', 'decisions.jsonl'), text = fs.readFileSync(file, 'utf8');
-  assert.ok(Buffer.byteLength(text) <= 65536);
-  for (const privateText of [KEY, ctx.projectPath, ...ctx.userMessages.map(x => x.text), 'Existing English']) assert.equal(text.includes(privateText), false);
-  for (const line of text.trim().split('\n')) {
-    const row = JSON.parse(line); assert.equal(row.mode, 'active'); assert.equal(row.status, 'applied');
-    assert.ok(row.decisions.every(x => /^[a-f0-9]{64}$/.test(x.message_id)));
-  }
-  fs.rmSync(path.dirname(file), { recursive: true }); fs.writeFileSync(path.dirname(file), 'obstruction');
-  assert.ok(applyJevCorrection(ctx, deps)[0].labels.includes('correction'));
-});

package/core/.formation/tools/log-reader.js

@@ -1,232 +0,0 @@
-#!/usr/bin/env node
-/**
- * Formation Log Reader
- *
- * 讀取 Formation log 檔案的尾端/頭端/錯誤行
- * 用途：讓 Ansuz 按需讀取 log，避免載入完整 log 爆 context
- *
- * Usage:
- *   node .formation/tools/log-reader.js --log <path> --tail 50
- *   node .formation/tools/log-reader.js --task TASK_XXX --tail 50
- *   node .formation/tools/log-reader.js --latest unit --tail 30
- *   node .formation/tools/log-reader.js --log <path> --errors
- *
- * Options:
- *   --log <path>         直接讀指定 log 檔
- *   --task TASK_XXX      在 .formation/logs/ 下搜尋包含 TASK_XXX 的最新 log
- *   --latest <formation> 讀指定陣型目錄下最新的 log
- *   --tail N             只輸出最後 N 行（預設 50）
- *   --head N             只輸出前 N 行
- *   --errors             只輸出包含 ERROR/FAILED/❌ 的行
- */
-
-const fs = require('fs');
-const path = require('path');
-const { LOG_DIR, getLogDir } = require('./utils');
-
-// ─────────────────────────────────────────
-// 尋找 log 檔案
-// ─────────────────────────────────────────
-
-/**
- * 搜尋包含 taskId 的最新 log 檔案
- * @param {string} taskId - TASK_XXX
- * @param {string} [projectPath] - 專案路徑（多專案支援）
- * @returns {string|null}
- */
-function findTaskLog(taskId, projectPath) {
-  const logDir = projectPath ? getLogDir(projectPath) : LOG_DIR;
-  const formations = ['unit', 'solo', 'squad', 'legion', 'misc'];
-  let candidates = [];
-
-  for (const formation of formations) {
-    const dir = path.join(logDir, formation);
-    if (!fs.existsSync(dir)) continue;
-
-    const files = fs.readdirSync(dir)
-      .filter(f => f.endsWith('.log'))
-      .sort((a, b) => {
-        const aErr = a.endsWith('.err.log') ? 1 : 0;
-        const bErr = b.endsWith('.err.log') ? 1 : 0;
-        return aErr - bErr;
-      });
-    for (const file of files) {
-      const filePath = path.join(dir, file);
-      try {
-        const content = fs.readFileSync(filePath, 'utf-8');
-        if (content.includes(taskId)) {
-          const stats = fs.statSync(filePath);
-          candidates.push({ path: filePath, mtime: stats.mtime });
-        }
-      } catch (e) {
-        // skip unreadable files
-      }
-    }
-  }
-
-  if (candidates.length === 0) return null;
-
-  // 回傳最新的
-  candidates.sort((a, b) => b.mtime - a.mtime);
-  return candidates[0].path;
-}
-
-/**
- * 取得指定 formation 的最新 log
- * @param {string} formation - unit / solo / squad / legion
- * @param {string} [projectPath] - 專案路徑（多專案支援）
- * @returns {string|null}
- */
-function findLatestLog(formation, projectPath) {
-  const logDir = projectPath ? getLogDir(projectPath) : LOG_DIR;
-  const dir = path.join(logDir, formation);
-  if (!fs.existsSync(dir)) return null;
-
-  const files = fs.readdirSync(dir)
-    .filter(f => f.endsWith('.log'))
-    .sort((a, b) => {
-      const aErr = a.endsWith('.err.log') ? 1 : 0;
-      const bErr = b.endsWith('.err.log') ? 1 : 0;
-      return aErr - bErr;
-    })
-    .map(f => {
-      const filePath = path.join(dir, f);
-      const stats = fs.statSync(filePath);
-      return { path: filePath, mtime: stats.mtime };
-    });
-
-  if (files.length === 0) return null;
-
-  files.sort((a, b) => b.mtime - a.mtime);
-  return files[0].path;
-}
-
-// ─────────────────────────────────────────
-// 讀取與過濾
-// ─────────────────────────────────────────
-
-/**
- * 讀取 log 並根據選項過濾
- * @param {string} logPath
- * @param {object} opts
- * @param {number} [opts.tail] - 最後 N 行
- * @param {number} [opts.head] - 前 N 行
- * @param {boolean} [opts.errors] - 只顯示錯誤
- */
-function readLog(logPath, opts = {}) {
-  const { tail, head, errors } = opts;
-
-  if (!fs.existsSync(logPath)) {
-    console.error(`❌ Log file not found: ${logPath}`);
-    process.exit(1);
-  }
-
-  const content = fs.readFileSync(logPath, 'utf-8');
-  let lines = content.split('\n');
-
-  // 過濾錯誤行
-  if (errors) {
-    // TASK_1712: Added REFUSED to surface injection-refusal runs in --errors filter
-    const errorKeywords = ['ERROR', 'FAILED', 'FAIL', 'REFUSED', '❌', 'exit 1', 'Exit Code: 1'];
-    lines = lines.filter(line => {
-      const upper = line.toUpperCase();
-      return errorKeywords.some(kw => upper.includes(kw.toUpperCase()));
-    });
-  }
-
-  // 取前/後 N 行
-  if (head) {
-    lines = lines.slice(0, head);
-  } else if (tail) {
-    lines = lines.slice(-tail);
-  }
-
-  console.log(`─── Log: ${logPath} ───`);
-  if (tail) console.log(`─── Last ${tail} lines ───`);
-  if (head) console.log(`─── First ${head} lines ───`);
-  if (errors) console.log(`─── Error lines only ───`);
-  console.log('');
-
-  console.log(lines.join('\n'));
-}
-
-// ─────────────────────────────────────────
-// CLI
-// ─────────────────────────────────────────
-
-if (require.main === module) {
-  const args = process.argv.slice(2);
-
-  if (args.includes('--help') || args.includes('-h')) {
-    console.log(`
-⚔️  Formation Log Reader
-
-讀取 Formation log 檔案的尾端/頭端/錯誤行
-
-Usage:
-  node .formation/tools/log-reader.js --log <path> --tail 50
-  node .formation/tools/log-reader.js --task TASK_XXX --tail 50
-  node .formation/tools/log-reader.js --latest unit --tail 30
-
-Options:
-  --log <path>         直接讀指定 log 檔
-  --task TASK_XXX      在 .formation/logs/ 下搜尋包含 TASK_XXX 的最新 log
-  --latest <formation> 讀指定陣型目錄下最新的 log
-  --tail N             只輸出最後 N 行（預設 50）
-  --head N             只輸出前 N 行
-  --errors             只輸出包含 ERROR/FAILED/❌ 的行
-
-Examples:
-  node .formation/tools/log-reader.js --log .formation/logs/unit/do_abc123.log --tail 30
-  node .formation/tools/log-reader.js --task TASK_248 --errors
-  node .formation/tools/log-reader.js --latest squad --tail 50
-`);
-    process.exit(0);
-  }
-
-  const getArg = (flag) => {
-    for (let i = 0; i < args.length; i++) {
-      if (args[i].startsWith(`${flag}=`)) return args[i].split('=').slice(1).join('=');
-      if (args[i] === flag && args[i + 1]) return args[i + 1];
-    }
-    return null;
-  };
-
-  const logPath = getArg('--log');
-  const taskId = getArg('--task');
-  const latest = getArg('--latest');
-  const projectPath = getArg('--project-path');
-  const tail = parseInt(getArg('--tail') || '50', 10);
-  const head = parseInt(getArg('--head') || '0', 10);
-  const errors = args.includes('--errors');
-
-  let resolvedPath = null;
-
-  if (logPath) {
-    resolvedPath = logPath;
-  } else if (taskId) {
-    resolvedPath = findTaskLog(taskId, projectPath);
-    if (!resolvedPath) {
-      console.error(`❌ No log found for task: ${taskId}`);
-      process.exit(1);
-    }
-  } else if (latest) {
-    resolvedPath = findLatestLog(latest, projectPath);
-    if (!resolvedPath) {
-      console.error(`❌ No log found in formation: ${latest}`);
-      process.exit(1);
-    }
-  } else {
-    console.error('❌ Must specify one of: --log, --task, --latest');
-    process.exit(1);
-  }
-
-  const opts = {};
-  if (head > 0) opts.head = head;
-  else if (tail > 0) opts.tail = tail;
-  if (errors) opts.errors = true;
-
-  readLog(resolvedPath, opts);
-}
-
-module.exports = { findTaskLog, findLatestLog, readLog };

package/core/.formation/tools/revert-daemon-state.js

@@ -1,162 +0,0 @@
-#!/usr/bin/env node
-/**
- * revert-daemon-state.js
- *
- * On-demand cleanup for daemon-drift on the user branch between task merges.
- *
- * The post-complete merge pipeline already auto-reverts daemon-managed paths
- * via .kenaz/specialist/daemon-manifest.yaml + isDaemonManagedPath() inside
- * post-complete.js (worktree merge step). But that only fires DURING a task
- * merge. Between sessions, daemons keep writing to those files and
- * `git status` shows them as modified — pure noise on the user branch.
- *
- * This CLI uses the same manifest as the merge pipeline, but runs ad-hoc:
- *   1. Load .kenaz/specialist/daemon-manifest.yaml
- *   2. For every enrolled state_files entry + every file matching a static_paths
- *      directory entry, check `git status --porcelain` for modification
- *   3. Run `git checkout HEAD -- <path>` to revert each
- *
- * Untracked files are left alone. Files that are not enrolled in the manifest
- * are left alone. The CLI is idempotent and never touches scope_paths or
- * non-daemon files.
- *
- * Usage:
- *   node .formation/tools/revert-daemon-state.js          # do it
- *   node .formation/tools/revert-daemon-state.js --dry    # show plan only
- *   node .formation/tools/revert-daemon-state.js --quiet  # only summary line
- *
- * Exit code: 0 on success (even if nothing reverted), 1 on manifest load
- * failure or git command failure.
- */
-
-'use strict';
-
-const fs = require('fs');
-const path = require('path');
-const { execSync, spawnSync } = require('child_process');
-
-const ROOT = path.resolve(__dirname, '..', '..');
-const MANIFEST = path.join(ROOT, '.kenaz', 'specialist', 'daemon-manifest.yaml');
-
-const argv = process.argv.slice(2);
-const DRY = argv.includes('--dry') || argv.includes('--dry-run');
-const QUIET = argv.includes('--quiet');
-
-function log(...args) {
-  if (!QUIET) console.log(...args);
-}
-
-function loadYaml(filePath) {
-  let yaml;
-  try {
-    yaml = require('js-yaml');
-  } catch {
-    const candidates = [
-      path.resolve(__dirname, '../../.vendor/js-yaml.cjs'),
-      path.resolve(__dirname, '.vendor/js-yaml.cjs'),
-      path.resolve(__dirname, '..', '.vendor', 'js-yaml.cjs'),
-    ];
-    for (const c of candidates) {
-      try { yaml = require(c); break; } catch {}
-    }
-  }
-  if (!yaml) throw new Error('js-yaml not available — check .formation/.vendor/');
-  return yaml.load(fs.readFileSync(filePath, 'utf8'));
-}
-
-function loadManifest() {
-  if (!fs.existsSync(MANIFEST)) {
-    throw new Error(`daemon-manifest.yaml not found at ${MANIFEST}`);
-  }
-  const raw = loadYaml(MANIFEST);
-  return {
-    stateFiles: Array.isArray(raw?.state_files) ? raw.state_files : [],
-    staticPaths: Array.isArray(raw?.static_paths) ? raw.static_paths : [],
-  };
-}
-
-function normalizeRepoPath(p) {
-  return String(p || '')
-    .replace(/\\/g, '/')
-    .replace(/^\.\//, '')
-    .replace(/\/+/g, '/');
-}
-
-function listModifiedTracked() {
-  const out = execSync('git status --porcelain --untracked-files=no', {
-    cwd: ROOT, encoding: 'utf8', windowsHide: true,
-  });
-  const modified = [];
-  for (const line of out.split(/\r?\n/)) {
-    if (!line) continue;
-    const xy = line.slice(0, 2);
-    const rel = normalizeRepoPath(line.slice(3).trim());
-    if (xy.includes('M') || xy.includes('A') || xy.includes('D') || xy.includes('R')) {
-      modified.push(rel);
-    }
-  }
-  return modified;
-}
-
-function isManagedByManifest(relPath, manifest) {
-  const norm = normalizeRepoPath(relPath);
-  if (!norm) return false;
-  if (manifest.stateFiles.includes(norm)) return true;
-  for (const sp of manifest.staticPaths) {
-    const spn = normalizeRepoPath(sp);
-    if (spn === norm) return true;
-    if (spn.endsWith('/') && norm.startsWith(spn)) return true;
-  }
-  return false;
-}
-
-function gitCheckoutHead(paths) {
-  if (paths.length === 0) return { ok: true, stderr: '' };
-  // Use spawnSync with --pathspec-file via stdin to avoid command-line length limits
-  const args = ['checkout', 'HEAD', '--', ...paths];
-  const r = spawnSync('git', args, { cwd: ROOT, encoding: 'utf8', windowsHide: true });
-  return { ok: r.status === 0, stderr: r.stderr || '' };
-}
-
-function main() {
-  let manifest;
-  try { manifest = loadManifest(); }
-  catch (e) {
-    console.error(`✗ ${e.message}`);
-    process.exit(1);
-  }
-
-  const modified = listModifiedTracked();
-  const managed = modified.filter(p => isManagedByManifest(p, manifest));
-  const unmanaged = modified.filter(p => !isManagedByManifest(p, manifest));
-
-  if (managed.length === 0) {
-    log(`✓ No daemon-managed drift in working tree (${modified.length} other modified file(s) untouched).`);
-    return;
-  }
-
-  log(`Daemon-managed drift detected (${managed.length} file(s)):`);
-  for (const p of managed) log(`  ~ ${p}`);
-
-  if (unmanaged.length > 0 && !QUIET) {
-    log('');
-    log(`Non-daemon modifications (left alone):`);
-    for (const p of unmanaged) log(`    ${p}`);
-  }
-
-  if (DRY) {
-    log('');
-    log('[--dry] No changes made. Re-run without --dry to revert.');
-    return;
-  }
-
-  log('');
-  const result = gitCheckoutHead(managed);
-  if (!result.ok) {
-    console.error(`✗ git checkout failed:\n${result.stderr.trim()}`);
-    process.exit(1);
-  }
-  console.log(`✓ Reverted ${managed.length} daemon-managed file(s) to HEAD.`);
-}
-
-main();