kibi-cli 2.31.1 → 2.35.1

package/dist/operations/proof/baseline-diff.js

@@ -1,153 +0,0 @@
-/*
- Kibi — repo-local, per-branch, queryable long-term memory for software projects
- Copyright (C) 2026 Piotr Franczyk
-
- This program is free software: you can redistribute it and/or modify
- it under the terms of the GNU Affero General Public License as published by
- the Free Software Foundation, either version 3 of the License, or
- (at your option) any later version.
- */
-// implements REQ-kibi-verification-evidence-contract
-export const PROOF_BASELINE_VERSION = "kibi.proof-baseline.v3";
-function asStringArray(value) {
-    if (!Array.isArray(value))
-        return [];
-    return value
-        .map((item) => (typeof item === "string" ? item : String(item)))
-        .sort();
-}
-// implements REQ-kibi-verification-evidence-contract
-export function fingerprintRequirements(rows) {
-    const requirements = {};
-    for (const row of rows) {
-        const id = typeof row.id === "string" ? row.id : "";
-        const proofStatus = typeof row.proofStatus === "string" ? row.proofStatus : "";
-        if (id === "" || proofStatus === "not_applicable")
-            continue;
-        requirements[id] = {
-            proofStatus,
-            gaps: asStringArray(row.proofGaps),
-            uncoveredSymbols: asStringArray(row.proofStages?.productionSymbols?.uncoveredSymbols),
-        };
-    }
-    return requirements;
-}
-// implements REQ-kibi-verification-evidence-contract
-export function diffFingerprints(baseline, current) {
-    const before = baseline ?? {};
-    const ids = [
-        ...new Set([...Object.keys(before), ...Object.keys(current)]),
-    ].sort();
-    const changes = [];
-    for (const id of ids) {
-        const left = before[id];
-        const right = current[id];
-        if (left === undefined && right !== undefined) {
-            changes.push({ id, kind: "added", after: right });
-            continue;
-        }
-        if (left !== undefined && right === undefined) {
-            changes.push({ id, kind: "removed", before: left });
-            continue;
-        }
-        if (left === undefined || right === undefined)
-            continue;
-        if (left.proofStatus !== right.proofStatus ||
-            JSON.stringify(left.gaps) !== JSON.stringify(right.gaps) ||
-            JSON.stringify(left.uncoveredSymbols) !==
-                JSON.stringify(right.uncoveredSymbols)) {
-            changes.push({ id, kind: "changed", before: left, after: right });
-        }
-    }
-    return changes;
-}
-export function explanationsForRequirement(rows, requirementId) {
-    const row = rows.find((item) => item.id === requirementId);
-    const explanations = row?.proofStages?.productionSymbols?.explanations;
-    return Array.isArray(explanations)
-        ? explanations
-        : [];
-}
-function renderCandidate(candidate) {
-    const testId = typeof candidate.testId === "string" ? candidate.testId : "?";
-    const reason = typeof candidate.reason === "string" ? candidate.reason : "";
-    const secondaries = Array.isArray(candidate.secondaryReasons)
-        ? candidate.secondaryReasons.filter((item) => typeof item === "string")
-        : [];
-    const secondaryText = secondaries.length > 0 ? ` secondary=${secondaries.join(",")}` : "";
-    return `      covered_by ${testId}: ${reason}${secondaryText}`;
-}
-// implements REQ-kibi-verification-evidence-contract
-export function renderRequirementDiffs(changes, rows = []) {
-    if (changes.length === 0)
-        return "";
-    const lines = [
-        "Requirement fingerprint diffs vs committed proof/baseline.json:",
-    ];
-    for (const change of changes) {
-        if (change.kind === "added" && change.after) {
-            lines.push(`  ${change.id}: added (${change.after.proofStatus}; gaps=${change.after.gaps.join(",") || "none"})`);
-        }
-        else if (change.kind === "removed" && change.before) {
-            lines.push(`  ${change.id}: removed (was ${change.before.proofStatus})`);
-        }
-        else if (change.kind === "changed" && change.before && change.after) {
-            if (change.before.proofStatus !== change.after.proofStatus) {
-                lines.push(`  ${change.id}: ${change.before.proofStatus} -> ${change.after.proofStatus}`);
-            }
-            else {
-                lines.push(`  ${change.id}: fingerprint changed`);
-            }
-            const beforeGaps = new Set(change.before.gaps);
-            const afterGaps = new Set(change.after.gaps);
-            for (const gap of change.after.gaps) {
-                if (!beforeGaps.has(gap))
-                    lines.push(`    gap added: ${gap}`);
-            }
-            for (const gap of change.before.gaps) {
-                if (!afterGaps.has(gap))
-                    lines.push(`    gap removed: ${gap}`);
-            }
-            const beforeSymbols = new Set(change.before.uncoveredSymbols);
-            const afterSymbols = new Set(change.after.uncoveredSymbols);
-            for (const symbol of change.after.uncoveredSymbols) {
-                if (!beforeSymbols.has(symbol))
-                    lines.push(`    uncovered symbol added: ${symbol}`);
-            }
-            for (const symbol of change.before.uncoveredSymbols) {
-                if (!afterSymbols.has(symbol))
-                    lines.push(`    uncovered symbol removed: ${symbol}`);
-            }
-        }
-        const explanations = explanationsForRequirement(rows, change.id);
-        for (const explanation of explanations) {
-            const symbolId = typeof explanation.symbolId === "string" ? explanation.symbolId : "";
-            const reason = typeof explanation.reason === "string" ? explanation.reason : "";
-            if (symbolId !== "")
-                lines.push(`    ${symbolId}: ${reason}`);
-            const candidates = Array.isArray(explanation.coverageCandidates)
-                ? explanation.coverageCandidates
-                : [];
-            for (const candidate of candidates) {
-                if (candidate && typeof candidate === "object")
-                    lines.push(renderCandidate(candidate));
-            }
-        }
-    }
-    return `${lines.join("\n")}\n`;
-}
-export function parseSpawnJson(result) {
-    if (result.error)
-        throw result.error;
-    const text = `${result.stdout ?? ""}`.trim();
-    try {
-        return JSON.parse(text);
-    }
-    catch (error) {
-        const detail = `${result.stderr || result.stdout || ""}`.trim();
-        if (result.status !== 0 && result.status !== null) {
-            throw new Error(detail || String(error));
-        }
-        throw error;
-    }
-}

package/dist/operations/proof/impact.d.ts

@@ -1,51 +0,0 @@
-import type { OperationContext } from "../../public/operations/runtime-types.js";
-import { type CoverageRowLike, type RequirementFingerprints, diffFingerprints } from "./baseline-diff.js";
-export declare const COMMITTED_BASELINE_PATH = "proof/baseline.json";
-export type ProofBaselineFile = {
-    readonly version?: string;
-    readonly mode?: string;
-    readonly currentRequirements?: number;
-    readonly proofTested?: number;
-    readonly currentUntested?: number;
-    readonly trackedGaps?: Record<string, number>;
-    readonly requirements?: RequirementFingerprints;
-};
-export type ProofImpactResult = {
-    readonly comparisonTarget: typeof COMMITTED_BASELINE_PATH;
-    readonly baselineVersion: string;
-    readonly currentRequirements: number;
-    readonly proofTested: number;
-    readonly currentUntested: number;
-    readonly changes: ReturnType<typeof diffFingerprints>;
-};
-export type ReadCommittedFile = (workspaceRoot: string, relativePath: string) => string | Promise<string>;
-export type ProofImpactExecuteOptions = {
-    readonly readCommittedFile?: ReadCommittedFile;
-    readonly loadCoverage?: (context: OperationContext) => Promise<{
-        structuredContent: unknown;
-    }>;
-};
-export declare function readCommittedHeadFile(workspaceRoot: string, relativePath: string): string;
-export declare function loadCommittedBaseline(workspaceRoot: string, readCommittedFile?: ReadCommittedFile): Promise<ProofBaselineFile>;
-/**
- * A baseline committed before kibi.proof-baseline.v3 records a fully tested
- * requirement as `proven`. Read it as `tested`, so the comparison shows real
- * changes instead of a rename on every row.
- */
-export declare function upgradeBaselineStatuses(baseline: ProofBaselineFile): ProofBaselineFile;
-/** Diagnostic only: successful evaluation always exits 0. Ratchet lives in check-proof-baseline.mjs. */
-export declare function proofImpactExitCode(_result: ProofImpactResult): 0;
-export declare function buildProofImpact(baseline: ProofBaselineFile, coverage: {
-    summary?: Record<string, unknown>;
-    rows?: unknown;
-}): {
-    result: ProofImpactResult;
-    rows: CoverageRowLike[];
-};
-export declare function renderProofImpact(result: ProofImpactResult, rows: readonly CoverageRowLike[]): string;
-export declare function executeProofImpact(context: OperationContext, options?: ProofImpactExecuteOptions): Promise<{
-    result: ProofImpactResult;
-    rows: CoverageRowLike[];
-    text: string;
-}>;
-//# sourceMappingURL=impact.d.ts.map

package/dist/operations/proof/impact.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"impact.d.ts","sourceRoot":"","sources":["../../../src/operations/proof/impact.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAC;AAEjF,OAAO,EACL,KAAK,eAAe,EAEpB,KAAK,uBAAuB,EAC5B,gBAAgB,EAGjB,MAAM,oBAAoB,CAAC;AAG5B,eAAO,MAAM,uBAAuB,wBAAwB,CAAC;AAE7D,MAAM,MAAM,iBAAiB,GAAG;IAC9B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,QAAQ,CAAC,YAAY,CAAC,EAAE,uBAAuB,CAAC;CACjD,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,QAAQ,CAAC,gBAAgB,EAAE,OAAO,uBAAuB,CAAC;IAC1D,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC,OAAO,gBAAgB,CAAC,CAAC;CACvD,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG,CAC9B,aAAa,EAAE,MAAM,EACrB,YAAY,EAAE,MAAM,KACjB,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;AAE9B,MAAM,MAAM,yBAAyB,GAAG;IACtC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C,QAAQ,CAAC,YAAY,CAAC,EAAE,CACtB,OAAO,EAAE,gBAAgB,KACtB,OAAO,CAAC;QAAE,iBAAiB,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CAC9C,CAAC;AAgDF,wBAAgB,qBAAqB,CACnC,aAAa,EAAE,MAAM,EACrB,YAAY,EAAE,MAAM,GACnB,MAAM,CAcR;AAGD,wBAAsB,qBAAqB,CACzC,aAAa,EAAE,MAAM,EACrB,iBAAiB,GAAE,iBAAyC,GAC3D,OAAO,CAAC,iBAAiB,CAAC,CAW5B;AAED;;;;GAIG;AAEH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,iBAAiB,GAC1B,iBAAiB,CAUnB;AAED,wGAAwG;AACxG,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,iBAAiB,GAAG,CAAC,CAEjE;AAGD,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,iBAAiB,EAC3B,QAAQ,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,GAC9D;IAAE,MAAM,EAAE,iBAAiB,CAAC;IAAC,IAAI,EAAE,eAAe,EAAE,CAAA;CAAE,CAuBxD;AAGD,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,iBAAiB,EACzB,IAAI,EAAE,SAAS,eAAe,EAAE,GAC/B,MAAM,CAYR;AAGD,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,gBAAgB,EACzB,OAAO,GAAE,yBAA8B,GACtC,OAAO,CAAC;IACT,MAAM,EAAE,iBAAiB,CAAC;IAC1B,IAAI,EAAE,eAAe,EAAE,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC,CAmBD"}

package/dist/operations/proof/impact.js

@@ -1,138 +0,0 @@
-/*
- Kibi — repo-local, per-branch, queryable long-term memory for software projects
- Copyright (C) 2026 Piotr Franczyk
-
- This program is free software: you can redistribute it and/or modify
- it under the terms of the GNU Affero General Public License as published by
- the Free Software Foundation, either version 3 of the License, or
- (at your option) any later version.
- */
-import { execFileSync } from "node:child_process";
-import { executeCoverage } from "../../public/operations/specs/reporting.js";
-import { diffFingerprints, fingerprintRequirements, renderRequirementDiffs, } from "./baseline-diff.js";
-// implements REQ-kibi-verification-evidence-contract
-export const COMMITTED_BASELINE_PATH = "proof/baseline.json";
-function asNumber(value) {
-    return typeof value === "number" && Number.isFinite(value) ? value : 0;
-}
-function gitErrorText(error) {
-    if (error && typeof error === "object" && "stderr" in error) {
-        const stderr = error.stderr;
-        if (typeof stderr === "string" && stderr.trim() !== "")
-            return stderr;
-        if (Buffer.isBuffer(stderr) && stderr.length > 0) {
-            return stderr.toString("utf8");
-        }
-    }
-    return error instanceof Error ? error.message : String(error);
-}
-function committedBaselineReadError(relativePath, error) {
-    const text = gitErrorText(error);
-    if (/not a git repository/i.test(text) ||
-        /ambiguous argument 'HEAD'/i.test(text) ||
-        /unknown revision/i.test(text) ||
-        /needed a single revision/i.test(text) ||
-        /bad revision 'HEAD'/i.test(text)) {
-        return new Error(`proof impact: repository is not in a suitable Git state to read HEAD:${relativePath}`);
-    }
-    if (/does not exist in 'HEAD'/i.test(text) ||
-        /exists on disk, but not in 'HEAD'/i.test(text) ||
-        /path '.*' does not exist/i.test(text)) {
-        return new Error(`proof impact: HEAD:${relativePath} is missing or unreadable`);
-    }
-    return new Error(`proof impact: could not read HEAD:${relativePath}: ${text.trim()}`);
-}
-// implements REQ-kibi-verification-evidence-contract
-export function readCommittedHeadFile(workspaceRoot, relativePath) {
-    try {
-        return execFileSync("git", ["-C", workspaceRoot, "show", `HEAD:${relativePath}`], {
-            encoding: "utf8",
-            maxBuffer: 64 * 1024 * 1024,
-            stdio: ["ignore", "pipe", "pipe"],
-        });
-    }
-    catch (error) {
-        throw committedBaselineReadError(relativePath, error);
-    }
-}
-// implements REQ-kibi-verification-evidence-contract
-export async function loadCommittedBaseline(workspaceRoot, readCommittedFile = readCommittedHeadFile) {
-    const raw = await readCommittedFile(workspaceRoot, COMMITTED_BASELINE_PATH);
-    let parsed;
-    try {
-        parsed = JSON.parse(raw);
-    }
-    catch {
-        throw new Error(`proof impact: HEAD:${COMMITTED_BASELINE_PATH} is not valid JSON`);
-    }
-    return upgradeBaselineStatuses(parsed);
-}
-/**
- * A baseline committed before kibi.proof-baseline.v3 records a fully tested
- * requirement as `proven`. Read it as `tested`, so the comparison shows real
- * changes instead of a rename on every row.
- */
-// implements REQ-kibi-evidence-levels
-export function upgradeBaselineStatuses(baseline) {
-    if (baseline.requirements === undefined)
-        return baseline;
-    const requirements = {};
-    for (const [id, entry] of Object.entries(baseline.requirements)) {
-        requirements[id] =
-            entry?.proofStatus === "proven"
-                ? { ...entry, proofStatus: "tested" }
-                : entry;
-    }
-    return { ...baseline, requirements };
-}
-/** Diagnostic only: successful evaluation always exits 0. Ratchet lives in check-proof-baseline.mjs. */
-export function proofImpactExitCode(_result) {
-    return 0;
-}
-// implements REQ-kibi-verification-evidence-contract
-export function buildProofImpact(baseline, coverage) {
-    const rows = Array.isArray(coverage.rows)
-        ? coverage.rows
-        : [];
-    const summary = coverage.summary ?? {};
-    const proofNotApplicable = asNumber(summary.proofNotApplicable);
-    const total = asNumber(summary.total);
-    const proofTested = asNumber(summary.proofTested);
-    const currentUntested = asNumber(summary.proofMissing) + asNumber(summary.proofUnresolved);
-    const current = fingerprintRequirements(rows);
-    const changes = diffFingerprints(baseline.requirements, current);
-    return {
-        rows,
-        result: {
-            comparisonTarget: COMMITTED_BASELINE_PATH,
-            baselineVersion: baseline.version ?? "unknown",
-            currentRequirements: total - proofNotApplicable,
-            proofTested,
-            currentUntested,
-            changes,
-        },
-    };
-}
-// implements REQ-kibi-verification-evidence-contract
-export function renderProofImpact(result, rows) {
-    const header = [
-        `Proof impact compared to committed ${result.comparisonTarget}`,
-        `baseline version: ${result.baselineVersion}`,
-        `current requirements: ${result.currentRequirements}`,
-        `proofTested: ${result.proofTested}`,
-        `currentUntested: ${result.currentUntested}`,
-        `changed requirements: ${result.changes.length}`,
-        "",
-    ];
-    const diff = renderRequirementDiffs(result.changes, rows);
-    return `${header.join("\n")}${diff || "No requirement fingerprint changes versus the committed baseline.\n"}`;
-}
-// implements REQ-kibi-verification-evidence-contract
-export async function executeProofImpact(context, options = {}) {
-    const baseline = await loadCommittedBaseline(context.workspaceRoot, options.readCommittedFile ?? readCommittedHeadFile);
-    const coverage = options.loadCoverage
-        ? await options.loadCoverage(context)
-        : await executeCoverage({ by: "req", includePassing: true, limit: 100_000, offset: 0 }, context);
-    const { result, rows } = buildProofImpact(baseline, coverage.structuredContent);
-    return { result, rows, text: renderProofImpact(result, rows) };
-}

package/dist/traceability/reviewed-coordinate-refresh.d.ts

@@ -1,10 +0,0 @@
-import type { HostSourceAnalysisResultV2, SourceAnalysisService } from "../plugins/source-analysis-service.js";
-import type { GitChangeSnapshot } from "./git-change-snapshot.js";
-import type { Fingerprint } from "./impact-review.js";
-/** Authorize lexical coordinate migration only from a captured local staged review.
- * Protected PR hosts must use their target-base evaluator, not this HEAD policy. */
-export declare function createReviewedDecoratorCoordinateVerifier(snapshot: GitChangeSnapshot, service: SourceAnalysisService, bindings: {
-    providerSetFingerprint: Fingerprint;
-    evaluatorFingerprint: Fingerprint;
-}): (path: string, analysis: HostSourceAnalysisResultV2) => Promise<void>;
-//# sourceMappingURL=reviewed-coordinate-refresh.d.ts.map

package/dist/traceability/reviewed-coordinate-refresh.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"reviewed-coordinate-refresh.d.ts","sourceRoot":"","sources":["../../src/traceability/reviewed-coordinate-refresh.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,0BAA0B,EAC1B,qBAAqB,EACtB,MAAM,uCAAuC,CAAC;AAE/C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAKlE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD;oFACoF;AACpF,wBAAgB,yCAAyC,CACvD,QAAQ,EAAE,iBAAiB,EAC3B,OAAO,EAAE,qBAAqB,EAC9B,QAAQ,EAAE;IACR,sBAAsB,EAAE,WAAW,CAAC;IACpC,oBAAoB,EAAE,WAAW,CAAC;CACnC,GACA,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,0BAA0B,KAAK,OAAO,CAAC,IAAI,CAAC,CA4DvE"}

package/dist/traceability/reviewed-coordinate-refresh.js

@@ -1,49 +0,0 @@
-import { analyzeSourceChanges } from "../plugins/source-change-analysis.js";
-import { evaluateImpactReview, loadBaseImpactPolicy, } from "./impact-evaluator.js";
-/** Authorize lexical coordinate migration only from a captured local staged review.
- * Protected PR hosts must use their target-base evaluator, not this HEAD policy. */
-export function createReviewedDecoratorCoordinateVerifier(snapshot, service, bindings) {
-    if (process.env.CI)
-        throw new Error("Reviewed partial coordinate migration is unavailable in CI without a protected target-base snapshot");
-    const policy = loadBaseImpactPolicy(snapshot);
-    let reviewValidation;
-    return async (path, analysis) => {
-        snapshot.assertUnchanged();
-        if (analysis.status !== "partial" ||
-            analysis.language !== "python" ||
-            analysis.sourceFile !== path ||
-            analysis.module.analysisMode !== "parser" ||
-            analysis.stamp?.pluginId !== "kibi-plugin-treesitter" ||
-            analysis.uncoveredRanges.length === 0 ||
-            analysis.providerId !== "kibi-plugin-treesitter.tree-sitter.v2" ||
-            analysis.diagnostics.length === 0 ||
-            analysis.providerFingerprint === null ||
-            !analysis.diagnostics.every((diagnostic) => diagnostic.code === "TREESITTER_DECORATOR_EXPANSION_UNAVAILABLE" &&
-                policy.allowedPartial.some((allowed) => allowed.providerId === analysis.providerId &&
-                    allowed.providerFingerprint ===
-                        `sha256:${analysis.providerFingerprint}` &&
-                    allowed.diagnosticCode === diagnostic.code &&
-                    allowed.limitationClass === "python-decorator-expansion")))
-            throw new Error(`Decorator coordinates for ${path} are not allowed by the captured base policy`);
-        reviewValidation ??= (async () => {
-            const analyses = await analyzeSourceChanges(snapshot.inventory, service);
-            // Use the same host normalization as staged check, without changing the
-            // original captured inventory used by the generated-byte comparison.
-            const evaluatedSnapshot = {
-                ...snapshot,
-                inventory: snapshot.inventory.map((file) => analyses.get(file.path)?.after?.status === "ok"
-                    ? { ...file, analysisDepth: "symbol", disposition: "checked" }
-                    : { ...file }),
-            };
-            const result = evaluateImpactReview(evaluatedSnapshot, {
-                ...bindings,
-                analyses,
-            });
-            if (!result.passed)
-                throw new Error(`Reviewed coordinate migration failed: ${result.diagnostics.map((diagnostic) => diagnostic.message).join("; ")}`);
-            snapshot.assertUnchanged();
-        })();
-        await reviewValidation;
-        snapshot.assertUnchanged();
-    };
-}