llm-relay 0.54.0 → 0.55.2

package/dist/delegate-gate/minimality.js

@@ -0,0 +1,120 @@
+import { reportedPath } from "./diff-parser.js";
+/** Two lines carry the same code but differ only in leading whitespace. */
+function isWhitespaceOnlyChange(removed, added) {
+    return removed !== added && removed.trimStart() === added.trimStart();
+}
+/** Two lines are byte-identical once surrounding whitespace is trimmed — a change that reads as
+ * "different bytes, same code" (re-indentation, a trailing-space touch, a blank line shuffled). */
+function hasNoSemanticDelta(removed, added) {
+    return removed !== added && removed.trim() === added.trim();
+}
+/**
+ * Pair a hunk's removed lines against its added lines by position.
+ *
+ * This is deliberately naive — position pairing, not a diff-of-diffs — because a delegate-diff
+ * gate is reading output a lane already produced, not re-deriving the edit. It is precise for the
+ * common single-block replacement shape (a contiguous run of `-` lines immediately followed by a
+ * contiguous run of `+` lines, equal in count) and says nothing when counts differ rather than
+ * guessing a pairing.
+ */
+function pairedRemoveAddRuns(hunk) {
+    const pairs = [];
+    const lines = hunk.lines;
+    let i = 0;
+    while (i < lines.length) {
+        if (lines[i].kind !== "remove") {
+            i += 1;
+            continue;
+        }
+        const removeStart = i;
+        while (i < lines.length && lines[i].kind === "remove")
+            i += 1;
+        const removeRun = lines.slice(removeStart, i);
+        const addStart = i;
+        while (i < lines.length && lines[i].kind === "add")
+            i += 1;
+        const addRun = lines.slice(addStart, i);
+        if (removeRun.length === addRun.length) {
+            for (let k = 0; k < removeRun.length; k++) {
+                const removed = removeRun[k];
+                const added = addRun[k];
+                pairs.push({ removed: removed.content, added: added.content, newLine: added.newLine });
+            }
+        }
+    }
+    return pairs;
+}
+const NON_MINIMAL_MIN_CHANGED_LINES = 6;
+const NON_MINIMAL_NO_DELTA_RATIO = 0.5;
+function totalOfKind(hunk, kind) {
+    return hunk.lines.reduce((count, line) => (line.kind === kind ? count + 1 : count), 0);
+}
+/**
+ * Is this hunk PURE indentation churn: every removed and every added line accounted for by a
+ * whitespace-only pair, with nothing left unpaired?
+ *
+ * The "fully paired" requirement (every remove and every add line in the hunk is consumed by a
+ * 1:1 pair) is what makes the auto-fix in `fix.ts` safe: dropping a fully-paired churn hunk
+ * removes an equal number of old-side and new-side lines, so it can never shift another hunk's
+ * line numbers. A hunk containing an unequal-length remove/add run alongside pure churn is NOT
+ * flagged here — `pairedRemoveAddRuns` silently skips unequal runs, and treating the REST of the
+ * hunk as "100% churn" while ignoring lines it could not pair would both misreport the hunk and
+ * make an auto-fix unsafe.
+ */
+export function isPureIndentationChurnHunk(hunk) {
+    const pairs = pairedRemoveAddRuns(hunk);
+    if (pairs.length === 0)
+        return false;
+    if (pairs.length !== totalOfKind(hunk, "remove") || pairs.length !== totalOfKind(hunk, "add"))
+        return false;
+    return pairs.every((p) => isWhitespaceOnlyChange(p.removed, p.added));
+}
+/**
+ * Flag indentation-only churn and count changed lines with no semantic delta.
+ *
+ * Two finding shapes:
+ *  - `indentation-churn`: a hunk whose every line is accounted for by a whitespace-only
+ *    remove/add pair — the hunk changed formatting and nothing else. Auto-fixable: dropping the
+ *    whole hunk is safe (see `isPureIndentationChurnHunk`).
+ *  - `non-minimal-diff`: a hunk that is NOT pure churn but where at least half its PAIRED changed
+ *    lines (≥6 of them) carry no semantic delta — evidence of a diff that reformats lines it did
+ *    not need to touch alongside a real change, i.e. class (e), "non-minimal diffs touching
+ *    unrelated lines". Not auto-fixable: a partial hunk mixes a real edit with the noise, and
+ *    removing only the noise without re-deriving the hunk boundaries risks corrupting the real
+ *    change.
+ */
+export function analyzeDiffMinimality(files) {
+    const findings = [];
+    for (const file of files) {
+        const path = reportedPath(file);
+        for (const hunk of file.hunks) {
+            if (isPureIndentationChurnHunk(hunk)) {
+                const pairs = pairedRemoveAddRuns(hunk);
+                findings.push({
+                    class: "indentation-churn",
+                    file: path,
+                    line: pairs[0].newLine,
+                    detail: `hunk @@ -${hunk.oldStart},${hunk.oldLines} +${hunk.newStart},${hunk.newLines} @@ changes ${pairs.length} line(s) by leading whitespace only`,
+                    autoFixable: true,
+                });
+                continue;
+            }
+            const pairs = pairedRemoveAddRuns(hunk);
+            if (pairs.length === 0)
+                continue;
+            const noDeltaPairs = pairs.filter((p) => hasNoSemanticDelta(p.removed, p.added));
+            if (pairs.length >= NON_MINIMAL_MIN_CHANGED_LINES
+                && noDeltaPairs.length / pairs.length >= NON_MINIMAL_NO_DELTA_RATIO) {
+                findings.push({
+                    class: "non-minimal-diff",
+                    file: path,
+                    line: noDeltaPairs[0].newLine,
+                    detail: `hunk @@ -${hunk.oldStart},${hunk.oldLines} +${hunk.newStart},${hunk.newLines} @@ has no semantic delta on ${noDeltaPairs.length}/${pairs.length} changed lines — likely touches lines unrelated to the actual edit`,
+                    autoFixable: false,
+                });
+            }
+        }
+    }
+    return findings;
+}
+//# sourceMappingURL=minimality.js.map

package/dist/delegate-gate/minimality.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"minimality.js","sourceRoot":"","sources":["../../src/delegate-gate/minimality.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAGhD,2EAA2E;AAC3E,SAAS,sBAAsB,CAAC,OAAe,EAAE,KAAa;IAC5D,OAAO,OAAO,KAAK,KAAK,IAAI,OAAO,CAAC,SAAS,EAAE,KAAK,KAAK,CAAC,SAAS,EAAE,CAAC;AACxE,CAAC;AAED;mGACmG;AACnG,SAAS,kBAAkB,CAAC,OAAe,EAAE,KAAa;IACxD,OAAO,OAAO,KAAK,KAAK,IAAI,OAAO,CAAC,IAAI,EAAE,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC;AAC9D,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,mBAAmB,CAAC,IAAc;IACzC,MAAM,KAAK,GAA+D,EAAE,CAAC;IAC7E,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IACzB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;QACxB,IAAI,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAChC,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,MAAM,WAAW,GAAG,CAAC,CAAC;QACtB,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,KAAK,QAAQ;YAAE,CAAC,IAAI,CAAC,CAAC;QAC/D,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QAC9C,MAAM,QAAQ,GAAG,CAAC,CAAC;QACnB,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,KAAK,KAAK;YAAE,CAAC,IAAI,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QACxC,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;YACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC1C,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAE,CAAC;gBAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC;gBACzB,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAQ,EAAE,CAAC,CAAC;YAC1F,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,6BAA6B,GAAG,CAAC,CAAC;AACxC,MAAM,0BAA0B,GAAG,GAAG,CAAC;AAEvC,SAAS,WAAW,CAAC,IAAc,EAAE,IAAsB;IACzD,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;AACzF,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAAc;IACvD,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,IAAI,KAAK,CAAC,MAAM,KAAK,WAAW,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5G,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,sBAAsB,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AACxE,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAA0B;IAC9D,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAChC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,IAAI,0BAA0B,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrC,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;gBACxC,QAAQ,CAAC,IAAI,CAAC;oBACZ,KAAK,EAAE,mBAAmB;oBAC1B,IAAI,EAAE,IAAI;oBACV,IAAI,EAAE,KAAK,CAAC,CAAC,CAAE,CAAC,OAAO;oBACvB,MAAM,EAAE,YAAY,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,eAAe,KAAK,CAAC,MAAM,qCAAqC;oBACrJ,WAAW,EAAE,IAAI;iBAClB,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YAED,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;YACxC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YACjC,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;YACjF,IAAI,KAAK,CAAC,MAAM,IAAI,6BAA6B;mBAC5C,YAAY,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,0BAA0B,EAAE,CAAC;gBACtE,QAAQ,CAAC,IAAI,CAAC;oBACZ,KAAK,EAAE,kBAAkB;oBACzB,IAAI,EAAE,IAAI;oBACV,IAAI,EAAE,YAAY,CAAC,CAAC,CAAE,CAAC,OAAO;oBAC9B,MAAM,EAAE,YAAY,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,gCAAgC,YAAY,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,oEAAoE;oBAC5N,WAAW,EAAE,KAAK;iBACnB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/delegate-gate/post-image.d.ts

@@ -0,0 +1,10 @@
+import type { DiffFile } from "./diff-parser.js";
+export interface PostImage {
+    /** The reconstructed post-patch file content, one line per array entry (no trailing newline
+     * entries). */
+    readonly lines: readonly string[];
+    /** 1-based post-image line numbers the diff actually ADDED — the only lines an AST detector
+     * may report a finding against ("introduced by the diff"). */
+    readonly addedLines: ReadonlySet<number>;
+}
+export declare function reconstructPostImage(original: string | null, file: DiffFile): PostImage;

package/dist/delegate-gate/post-image.js

@@ -0,0 +1,45 @@
+/**
+ * Reconstruct a file's post-patch content from its pre-image plus the diff's hunks.
+ *
+ * `original` is the pre-image content (read from `--repo`), or `null` for a newly created file —
+ * a `null` pre-image is only valid when every hunk's removed-line count is zero, which is what a
+ * `diff --git` "new file" section always produces.
+ *
+ * Lines outside any hunk are copied through unchanged from the pre-image; a hunk's `context`
+ * lines are trusted as given (this is a diff CONSUMER, not a patch verifier — a hunk that lies
+ * about context is the delegate's problem, not this gate's to detect).
+ */
+function applyHunkLines(hunk, out, added, startOldCursor) {
+    let oldCursor = startOldCursor;
+    for (const line of hunk.lines) {
+        if (line.kind === "remove") {
+            oldCursor += 1;
+            continue;
+        }
+        out.push(line.content);
+        if (line.kind === "add")
+            added.add(out.length);
+        if (line.kind === "context")
+            oldCursor += 1;
+    }
+    return oldCursor;
+}
+export function reconstructPostImage(original, file) {
+    const originalLines = original === null ? [] : original.replace(/\r\n/g, "\n").split("\n");
+    const out = [];
+    const added = new Set();
+    let oldCursor = 0; // 0-based index into originalLines, next unconsumed line
+    for (const hunk of file.hunks) {
+        const hunkStartIndex = hunk.oldStart === 0 ? 0 : hunk.oldStart - 1;
+        // Copy the untouched span between the previous hunk (or file start) and this one.
+        for (; oldCursor < hunkStartIndex; oldCursor++) {
+            out.push(originalLines[oldCursor] ?? "");
+        }
+        oldCursor = applyHunkLines(hunk, out, added, oldCursor);
+    }
+    for (; oldCursor < originalLines.length; oldCursor++) {
+        out.push(originalLines[oldCursor] ?? "");
+    }
+    return { lines: out, addedLines: added };
+}
+//# sourceMappingURL=post-image.js.map

package/dist/delegate-gate/post-image.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"post-image.js","sourceRoot":"","sources":["../../src/delegate-gate/post-image.ts"],"names":[],"mappings":"AAWA;;;;;;;;;;GAUG;AACH,SAAS,cAAc,CAAC,IAA+B,EAAE,GAAa,EAAE,KAAkB,EAAE,cAAsB;IAChH,IAAI,SAAS,GAAG,cAAc,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC9B,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC3B,SAAS,IAAI,CAAC,CAAC;YACf,SAAS;QACX,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACvB,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK;YAAE,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,SAAS,IAAI,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,QAAuB,EAAE,IAAc;IAC1E,MAAM,aAAa,GAAG,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3F,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAEhC,IAAI,SAAS,GAAG,CAAC,CAAC,CAAC,yDAAyD;IAC5E,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC9B,MAAM,cAAc,GAAG,IAAI,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC;QACnE,kFAAkF;QAClF,OAAO,SAAS,GAAG,cAAc,EAAE,SAAS,EAAE,EAAE,CAAC;YAC/C,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3C,CAAC;QACD,SAAS,GAAG,cAAc,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,SAAS,GAAG,aAAa,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC;QACrD,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;AAC3C,CAAC"}

package/dist/delegate-gate/shared-state.d.ts

@@ -0,0 +1,15 @@
+import type { DiffFile } from "./diff-parser.js";
+import type { Finding } from "./types.js";
+/**
+ * Flag statements the diff ADDS that assign into module-level (top-level, exported, or
+ * object-shaped) state from inside a function body.
+ *
+ * A tracked binding is either exported, or a top-level `const`/`let`/`var` initialized to an
+ * object/array literal or a `new X(...)` instance — the shapes a mutation actually changes for
+ * every future reader of the module, as opposed to a local primitive that happens to sit at
+ * module scope. Both a direct assignment (`state.x = …`, compound operators included) and a call
+ * to a known mutating method (`push`, `set`, `delete`, …) on a property/element-access chain
+ * rooted at that binding count. Only sites on lines the diff ADDED are reported — a mutation the
+ * delegate did not touch is not this diff's defect.
+ */
+export declare function analyzeSharedStateMutation(files: readonly DiffFile[], readOriginal: (path: string) => string | null): Finding[];

package/dist/delegate-gate/shared-state.js

@@ -0,0 +1,158 @@
+import ts from "typescript";
+import { reportedPath } from "./diff-parser.js";
+import { reconstructPostImage } from "./post-image.js";
+const TS_FILE = /\.(ts|tsx|mts|cts)$/;
+/** Top-level bindings whose value shape makes an in-place mutation meaningful: object/array
+ * literals and `new X(...)` instances (Map, Set, a class instance holding its own state) — plus
+ * every EXPORTED top-level binding regardless of shape, since exporting it makes it part of the
+ * module's shared surface by declaration. */
+function collectModuleScopeBindings(sourceFile) {
+    const names = new Set();
+    for (const statement of sourceFile.statements) {
+        if (!ts.isVariableStatement(statement))
+            continue;
+        const isExported = statement.modifiers?.some((m) => m.kind === ts.SyntaxKind.ExportKeyword) ?? false;
+        for (const decl of statement.declarationList.declarations) {
+            if (!ts.isIdentifier(decl.name))
+                continue;
+            const initializer = decl.initializer;
+            const isStateShaped = initializer !== undefined
+                && (ts.isObjectLiteralExpression(initializer)
+                    || ts.isArrayLiteralExpression(initializer)
+                    || ts.isNewExpression(initializer));
+            if (isExported || isStateShaped)
+                names.add(decl.name.text);
+        }
+    }
+    return names;
+}
+/** Walk up from an expression to the root identifier of a member/index-access chain:
+ * `state.rows[0].value` -> `state`. Returns null for anything else (a call result, `this`, …). */
+function rootIdentifier(node) {
+    let current = node;
+    while (ts.isPropertyAccessExpression(current) || ts.isElementAccessExpression(current)) {
+        current = current.expression;
+    }
+    return ts.isIdentifier(current) ? current.text : null;
+}
+const MUTATING_METHODS = new Set([
+    "push", "pop", "shift", "unshift", "splice", "sort", "reverse", "fill", "copyWithin",
+    "set", "delete", "clear", "add",
+]);
+function isAssignmentTarget(node) {
+    if (ts.isBinaryExpression(node) && isAssignmentOperator(node.operatorToken.kind)) {
+        return node.left;
+    }
+    return null;
+}
+function isAssignmentOperator(kind) {
+    switch (kind) {
+        case ts.SyntaxKind.EqualsToken:
+        case ts.SyntaxKind.PlusEqualsToken:
+        case ts.SyntaxKind.MinusEqualsToken:
+        case ts.SyntaxKind.AsteriskEqualsToken:
+        case ts.SyntaxKind.SlashEqualsToken:
+        case ts.SyntaxKind.AmpersandEqualsToken:
+        case ts.SyntaxKind.BarEqualsToken:
+        case ts.SyntaxKind.CaretEqualsToken:
+        case ts.SyntaxKind.QuestionQuestionEqualsToken:
+            return true;
+        default:
+            return false;
+    }
+}
+/** `state.rows.push(x)` / `cache.set(k, v)` / `seen.delete(k)` — a call to a known mutating
+ * built-in method on a member-access chain rooted at a tracked binding. */
+function mutatingCallTarget(node) {
+    if (!ts.isCallExpression(node))
+        return null;
+    const callee = node.expression;
+    if (!ts.isPropertyAccessExpression(callee))
+        return null;
+    if (!MUTATING_METHODS.has(callee.name.text))
+        return null;
+    return callee.expression;
+}
+function isFunctionLikeContainer(node) {
+    return ts.isFunctionDeclaration(node)
+        || ts.isFunctionExpression(node)
+        || ts.isArrowFunction(node)
+        || ts.isMethodDeclaration(node)
+        || ts.isGetAccessor(node)
+        || ts.isSetAccessor(node)
+        || ts.isConstructorDeclaration(node);
+}
+/** Is `node` lexically inside a function body (as opposed to sitting directly among a source
+ * file's top-level statements)? `node` itself is never function-like here (it is an assignment or
+ * call expression), so this only ever matches an ANCESTOR. */
+function isInsideFunctionBody(node) {
+    return ts.findAncestor(node, isFunctionLikeContainer) !== undefined;
+}
+function findMutationSites(sourceFile) {
+    const sites = [];
+    const visit = (node) => {
+        const assignmentTarget = isAssignmentTarget(node);
+        if (assignmentTarget !== null && isInsideFunctionBody(node)) {
+            sites.push({ node, target: assignmentTarget });
+        }
+        const mutatingTarget = mutatingCallTarget(node);
+        if (mutatingTarget !== null && isInsideFunctionBody(node)) {
+            sites.push({ node, target: mutatingTarget });
+        }
+        ts.forEachChild(node, visit);
+    };
+    visit(sourceFile);
+    return sites;
+}
+function findingsForFile(file, path, readOriginal) {
+    const original = file.isNew ? null : readOriginal(path);
+    const { lines, addedLines } = reconstructPostImage(original, file);
+    if (addedLines.size === 0)
+        return [];
+    const content = lines.join("\n");
+    const sourceFile = ts.createSourceFile(path, content, ts.ScriptTarget.Latest, true, path.endsWith(".tsx") ? ts.ScriptKind.TSX : ts.ScriptKind.TS);
+    const moduleScope = collectModuleScopeBindings(sourceFile);
+    if (moduleScope.size === 0)
+        return [];
+    const findings = [];
+    for (const site of findMutationSites(sourceFile)) {
+        const { line } = sourceFile.getLineAndCharacterOfPosition(site.node.getStart(sourceFile));
+        const lineNo = line + 1;
+        if (!addedLines.has(lineNo))
+            continue;
+        const root = rootIdentifier(site.target);
+        if (root === null || !moduleScope.has(root))
+            continue;
+        findings.push({
+            class: "shared-state-mutation",
+            file: path,
+            line: lineNo,
+            detail: `\`${site.node.getText().slice(0, 120)}\` mutates module-level state \`${root}\` from inside a function`,
+            autoFixable: false,
+        });
+    }
+    return findings;
+}
+/**
+ * Flag statements the diff ADDS that assign into module-level (top-level, exported, or
+ * object-shaped) state from inside a function body.
+ *
+ * A tracked binding is either exported, or a top-level `const`/`let`/`var` initialized to an
+ * object/array literal or a `new X(...)` instance — the shapes a mutation actually changes for
+ * every future reader of the module, as opposed to a local primitive that happens to sit at
+ * module scope. Both a direct assignment (`state.x = …`, compound operators included) and a call
+ * to a known mutating method (`push`, `set`, `delete`, …) on a property/element-access chain
+ * rooted at that binding count. Only sites on lines the diff ADDED are reported — a mutation the
+ * delegate did not touch is not this diff's defect.
+ */
+export function analyzeSharedStateMutation(files, readOriginal) {
+    const findings = [];
+    for (const file of files) {
+        const path = reportedPath(file);
+        if (!TS_FILE.test(path) || file.hunks.length === 0)
+            continue;
+        findings.push(...findingsForFile(file, path, readOriginal));
+    }
+    return findings;
+}
+//# sourceMappingURL=shared-state.js.map

package/dist/delegate-gate/shared-state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared-state.js","sourceRoot":"","sources":["../../src/delegate-gate/shared-state.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,YAAY,CAAC;AAE5B,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAGvD,MAAM,OAAO,GAAG,qBAAqB,CAAC;AAEtC;;;6CAG6C;AAC7C,SAAS,0BAA0B,CAAC,UAAyB;IAC3D,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,SAAS,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;QAC9C,IAAI,CAAC,EAAE,CAAC,mBAAmB,CAAC,SAAS,CAAC;YAAE,SAAS;QACjD,MAAM,UAAU,GAAG,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC;QACrG,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,eAAe,CAAC,YAAY,EAAE,CAAC;YAC1D,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC1C,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;YACrC,MAAM,aAAa,GAAG,WAAW,KAAK,SAAS;mBAC1C,CAAC,EAAE,CAAC,yBAAyB,CAAC,WAAW,CAAC;uBACxC,EAAE,CAAC,wBAAwB,CAAC,WAAW,CAAC;uBACxC,EAAE,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC,CAAC;YACxC,IAAI,UAAU,IAAI,aAAa;gBAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;kGACkG;AAClG,SAAS,cAAc,CAAC,IAAmB;IACzC,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,OAAO,EAAE,CAAC,0BAA0B,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,yBAAyB,CAAC,OAAO,CAAC,EAAE,CAAC;QACvF,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC;IAC/B,CAAC;IACD,OAAO,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACxD,CAAC;AAED,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC/B,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY;IACpF,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK;CAChC,CAAC,CAAC;AAEH,SAAS,kBAAkB,CAAC,IAAa;IACvC,IAAI,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,oBAAoB,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;QACjF,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAmB;IAC/C,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC;QAC/B,KAAK,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC;QACnC,KAAK,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC;QACpC,KAAK,EAAE,CAAC,UAAU,CAAC,mBAAmB,CAAC;QACvC,KAAK,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC;QACpC,KAAK,EAAE,CAAC,UAAU,CAAC,oBAAoB,CAAC;QACxC,KAAK,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC;QAClC,KAAK,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC;QACpC,KAAK,EAAE,CAAC,UAAU,CAAC,2BAA2B;YAC5C,OAAO,IAAI,CAAC;QACd;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAED;2EAC2E;AAC3E,SAAS,kBAAkB,CAAC,IAAa;IACvC,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC;IAC/B,IAAI,CAAC,EAAE,CAAC,0BAA0B,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACxD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACzD,OAAO,MAAM,CAAC,UAAU,CAAC;AAC3B,CAAC;AAED,SAAS,uBAAuB,CAAC,IAAa;IAC5C,OAAO,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC;WAChC,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC;WAC7B,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC;WACxB,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC;WAC5B,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC;WACtB,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC;WACtB,EAAE,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC;AACzC,CAAC;AAED;;8DAE8D;AAC9D,SAAS,oBAAoB,CAAC,IAAa;IACzC,OAAO,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,uBAAuB,CAAC,KAAK,SAAS,CAAC;AACtE,CAAC;AAOD,SAAS,iBAAiB,CAAC,UAAyB;IAClD,MAAM,KAAK,GAAmB,EAAE,CAAC;IACjC,MAAM,KAAK,GAAG,CAAC,IAAa,EAAQ,EAAE;QACpC,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,gBAAgB,KAAK,IAAI,IAAI,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5D,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,cAAc,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,cAAc,KAAK,IAAI,IAAI,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1D,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;QAC/C,CAAC;QACD,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC,CAAC;IACF,KAAK,CAAC,UAAU,CAAC,CAAC;IAClB,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,eAAe,CAAC,IAAc,EAAE,IAAY,EAAE,YAA6C;IAClG,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACxD,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,oBAAoB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACnE,IAAI,UAAU,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAErC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,UAAU,GAAG,EAAE,CAAC,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IAClJ,MAAM,WAAW,GAAG,0BAA0B,CAAC,UAAU,CAAC,CAAC;IAC3D,IAAI,WAAW,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEtC,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,iBAAiB,CAAC,UAAU,CAAC,EAAE,CAAC;QACjD,MAAM,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;QAC1F,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC;QACxB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,SAAS;QACtC,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QACtD,QAAQ,CAAC,IAAI,CAAC;YACZ,KAAK,EAAE,uBAAuB;YAC9B,IAAI,EAAE,IAAI;YACV,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,KAAK,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,mCAAmC,IAAI,2BAA2B;YAChH,WAAW,EAAE,KAAK;SACnB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAA0B,EAAE,YAA6C;IAClH,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAC7D,QAAQ,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,IAAI,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/delegate-gate/test-assertions.d.ts

@@ -0,0 +1,18 @@
+import type { DiffFile } from "./diff-parser.js";
+import type { Finding } from "./types.js";
+/**
+ * Flag assertions added by the diff, in changed TEST files, that cannot fail or that show no
+ * traceable connection to the code under test.
+ *
+ * Sharp (always correct) checks: `expect(<literal>).toBeDefined()`, `expect(true).toBe(true)` /
+ * `expect(false).toBe(false)`, `expect(x).toBe(x)` on the identical identifier, and the
+ * `toBeTruthy`/`toBeFalsy` equivalents on a constant.
+ *
+ * Best-effort (may under-report on purpose, per the "prefer false negatives" rule): an assertion
+ * whose value is produced by calling a function DECLARED LOCALLY in the same test file rather
+ * than one it imported — the "hand-copied replica of production control flow, asserted against
+ * the replica" shape from `docs/delegate-gate.md`'s cited real defect. Narrower than "no reference
+ * to any import at all" on purpose: that broader form flags ordinary local-variable assertions
+ * (`const a = 1; expect(a + 1).toBe(2)`), which is legitimate and common.
+ */
+export declare function analyzeTestAssertions(files: readonly DiffFile[], readOriginal: (path: string) => string | null): Finding[];