loki-mode 11.17.45 → 11.17.46

package/packages/control-plane/dist/server.js

@@ -7594,201 +7594,13 @@ var init_paths = __esm(() => {
   REPO_ROOT = findRepoRoot();
 });
 
-// ../../loki-ts/src/util/receipt_signer.ts
-import { createHash as createHash6, randomBytes as randomBytes3, createPrivateKey, createPublicKey as createPublicKey2, generateKeyPairSync, sign, verify as verify2 } from "crypto";
-import { chmodSync as chmodSync4, linkSync, mkdirSync as mkdirSync5, readdirSync as readdirSync9, readFileSync as readFileSync18, renameSync as renameSync4, statSync as statSync12, unlinkSync as unlinkSync3, writeFileSync as writeFileSync8 } from "fs";
-import { homedir as homedir8 } from "os";
-import { dirname as dirname7, join as join27 } from "path";
-function canonicalJson(x) {
-  const walk = (v) => {
-    if (Array.isArray(v))
-      return `[${v.map(walk).join(",")}]`;
-    if (v !== null && typeof v === "object") {
-      const o = v;
-      return `{${Object.keys(o).filter((k) => o[k] !== undefined).sort().map((k) => `${JSON.stringify(k)}:${walk(o[k])}`).join(",")}}`;
-    }
-    return JSON.stringify(v ?? null);
-  };
-  return walk(x).replace(/[\u0080-\uFFFF]/g, (c) => `\\u${c.charCodeAt(0).toString(16).padStart(4, "0")}`);
-}
-function loadSigningKey(generate = true) {
-  try {
-    const inline = process.env["LOKI_RECEIPT_SIGNING_KEY"]?.trim();
-    let pem = inline ?? "";
-    if (!inline) {
-      const given = process.env["LOKI_RECEIPT_SIGNING_KEY_FILE"]?.trim();
-      const file = given || join27(process.env["HOME"] || homedir8(), ".loki", "keys", RECEIPT_SIGNER_BASENAME);
-      try {
-        pem = readFileSync18(file);
-        if (!given) {
-          for (const [f, m] of [[file, 384], [dirname7(file), 448]])
-            if (statSync12(f).mode & 63)
-              chmodSync4(f, m);
-        }
-      } catch (e) {
-        if (e.code !== "ENOENT" || !generate)
-          return null;
-        mkdirSync5(dirname7(dirname7(file)), { recursive: true, mode: 448 });
-        mkdirSync5(dirname7(file), { recursive: true, mode: 448 });
-        const tmp = `${file}.${randomBytes3(6).toString("hex")}.tmp`;
-        writeFileSync8(tmp, generateKeyPairSync("ed25519").privateKey.export({ type: "pkcs8", format: "pem" }), { flag: "wx", mode: 384 });
-        try {
-          linkSync(tmp, file);
-        } catch (l) {
-          if (l.code !== "EEXIST")
-            throw l;
-        } finally {
-          unlinkSync3(tmp);
-        }
-        pem = readFileSync18(file);
-      }
-    }
-    const k = createPrivateKey(pem);
-    return k.asymmetricKeyType === "ed25519" ? k : null;
-  } catch {
-    return null;
-  }
-}
-function signReceipt(runId, hash) {
-  const key = loadSigningKey();
-  if (!key)
-    return { jwt: null, kid: null };
-  const kid = kidOf2(createPublicKey2(key));
-  const input = `${b64u(canonicalJson({ alg: "EdDSA", typ: "JWT", kid }))}.${b64u(canonicalJson({ job_id: runId, run_id: runId, receipt_sha256: hash, iat: Math.floor(Date.now() / 1000) }))}`;
-  return { jwt: `${input}.${b64u(sign(null, Buffer.from(input), key))}`, kid };
-}
-var RECEIPT_SIGNER_BASENAME = "receipt-ed25519.pem", b64u = (b) => Buffer.from(b).toString("base64url"), kidOf2 = (pub) => b64u(createHash6("sha256").update(`{"crv":"Ed25519","kty":"OKP","x":"${pub.export({ format: "jwk" }).x}"}`).digest());
-var init_receipt_signer = () => {};
-
-// ../../loki-ts/src/engine10/registry.ts
-var init_registry = () => {};
-
-// ../../loki-ts/src/engine10/types.ts
-function pushArgv(a) {
-  switch (a.cmd) {
-    case "push-pr":
-      return ["push-pr", a.repoDir, a.branch, a.title, a.bodyFile, a.draft ? "1" : "0"];
-    case "comment":
-      return ["comment", a.runId, a.prUrl, a.file];
-    case "status":
-      return ["status", a.sha, a.state, a.description];
-    case "issue-comment":
-      return a.update ? ["issue-comment", "--update", a.issueRef, a.bodyFile] : ["issue-comment", a.issueRef, a.bodyFile];
-  }
-}
-function taskBlock(task) {
-  return ["Task (untrusted, quoted verbatim):", "<<<TASK", task, "TASK"];
-}
-var STAGE_BUDGETS;
-var init_types = __esm(() => {
-  STAGE_BUDGETS = {
-    intake: { targetS: 15, limitS: 60 },
-    plan: { targetS: 45, limitS: 90 },
-    wall: { targetS: 45, limitS: 90 },
-    implement: { targetS: 180, limitS: 480 },
-    verify: { targetS: 60, limitS: 120 },
-    fix: { targetS: 90, limitS: 180 },
-    commit: { targetS: 5, limitS: 30 },
-    seal: { targetS: 15, limitS: 60 },
-    pr: { targetS: 15, limitS: 60 },
-    deep: { targetS: null, limitS: 2700 }
-  };
-});
-
-// ../../loki-ts/src/engine10/output.ts
-var init_output = __esm(() => {
-  init_registry();
-  init_redact();
-  init_types();
-});
-
-// ../../loki-ts/src/util/atomic.ts
-import {
-  closeSync as closeSync5,
-  fstatSync as fstatSync4,
-  fsyncSync as fsyncSync2,
-  lstatSync as lstatSync5,
-  mkdirSync as mkdirSync6,
-  openSync as openSync5,
-  readSync as readSync4,
-  renameSync as renameSync5,
-  rmSync as rmSync5,
-  statSync as statSync13,
-  unlinkSync as unlinkSync4,
-  writeFileSync as writeFileSync9,
-  writeSync as writeSync3
-} from "fs";
-import { dirname as dirname8 } from "path";
-function durableWriteThenRename(target, body) {
-  mkdirSync6(dirname8(target), { recursive: true });
-  const tmp = tmpPathFor(target);
-  const fd = openSync5(tmp, "w");
-  try {
-    writeSync3(fd, body);
-    fsyncSync2(fd);
-  } finally {
-    closeSync5(fd);
-  }
-  renameSync5(tmp, target);
-  fsyncParentDir(target);
-}
-function fsyncParentDir(target) {
-  let dfd = null;
-  try {
-    dfd = openSync5(dirname8(target), "r");
-    fsyncSync2(dfd);
-  } catch {} finally {
-    if (dfd !== null) {
-      try {
-        closeSync5(dfd);
-      } catch {}
-    }
-  }
-}
-function atomicWriteJson(target, data) {
-  durableWriteThenRename(target, `${JSON.stringify(data, null, 2)}
-`);
-}
-function tmpPathFor(target) {
-  return `${target}.tmp.${process.pid}.${++_tmpCounter}`;
-}
-var _tmpCounter = 0, _appendChains;
-var init_atomic = __esm(() => {
-  _appendChains = new Map;
-});
-
-// ../../loki-ts/src/util/engine_origin.ts
-function readOriginUrl(repoDir) {
-  try {
-    const url = safeGit(repoDir, ["config", "--get", "remote.origin.url"]).trim();
-    return url || null;
-  } catch {
-    return null;
-  }
-}
-var init_engine_origin = __esm(() => {
-  init_atomic();
-  init_safe_git();
-});
-
-// ../../loki-ts/src/e10ext/stop_restore.ts
-var init_stop_restore = __esm(() => {
-  init_safe_git();
-});
-
-// ../../loki-ts/src/util/base_guard.ts
-var init_base_guard = __esm(() => {
-  init_run_status();
-  init_safe_git();
-});
-
 // ../../loki-ts/src/engine10/cache.ts
-import { createHash as createHash7 } from "crypto";
-import { existsSync as existsSync15, mkdirSync as mkdirSync7, readFileSync as readFileSync19, writeFileSync as writeFileSync10 } from "fs";
+import { createHash as createHash6 } from "crypto";
+import { existsSync as existsSync15, mkdirSync as mkdirSync5, readFileSync as readFileSync18, writeFileSync as writeFileSync8 } from "fs";
 import { resolve as resolve8 } from "path";
 function repoKey(originUrl, repoDir) {
   const basis = originUrl && originUrl.trim() !== "" ? originUrl : resolve8(repoDir);
-  return createHash7("sha256").update(basis).digest("hex");
+  return createHash6("sha256").update(basis).digest("hex");
 }
 function defaultCacheRoot() {
   return resolve8(homeLokiDir(), "cache", "v10");
@@ -7800,7 +7612,7 @@ function readJson3(path, isValid = (_v) => true) {
   if (!existsSync15(path))
     return null;
   try {
-    const parsed = JSON.parse(readFileSync19(path, "utf8"));
+    const parsed = JSON.parse(readFileSync18(path, "utf8"));
     return isValid(parsed) ? parsed : null;
   } catch {
     return null;
@@ -7924,12 +7736,12 @@ var init_lean_select = __esm(() => {
 });
 
 // ../../loki-ts/src/util/claude_model.ts
-import { readFileSync as readFileSync20 } from "fs";
+import { readFileSync as readFileSync19 } from "fs";
 import { resolve as resolve9 } from "path";
 function resolveClaudeModel(want) {
   try {
     const path = process.env["LOKI_MODEL_CATALOG"] || resolve9(REPO_ROOT, "providers/model_catalog.json");
-    return JSON.parse(readFileSync20(path, "utf8")).providers?.claude?.cli_aliases?.[want] ?? want;
+    return JSON.parse(readFileSync19(path, "utf8")).providers?.claude?.cli_aliases?.[want] ?? want;
   } catch {
     return want;
   }
@@ -7939,6 +7751,13 @@ var init_claude_model = __esm(() => {
   init_paths();
   FAMILY_ALIASES = new Set(["haiku", "sonnet", "opus", "fable"]);
 });
+
+// ../../loki-ts/src/runner/watchdog.ts
+var warned;
+var init_watchdog = __esm(() => {
+  warned = new Set;
+});
+
 // ../../loki-ts/src/providers/price_table.ts
 var PRICE_TABLE;
 var init_price_table = __esm(() => {
@@ -7961,25 +7780,25 @@ var init_price_table = __esm(() => {
 });
 
 // ../../loki-ts/src/providers/provider_cost.ts
-import { existsSync as existsSync16, mkdirSync as mkdirSync8, readdirSync as readdirSync10, readFileSync as readFileSync21, renameSync as renameSync6, writeFileSync as writeFileSync11 } from "fs";
-import { dirname as dirname9, join as join28 } from "path";
+import { existsSync as existsSync16, mkdirSync as mkdirSync6, readdirSync as readdirSync9, readFileSync as readFileSync20, renameSync as renameSync4, writeFileSync as writeFileSync9 } from "fs";
+import { dirname as dirname7, join as join27 } from "path";
 function withArchivedCosts(lokiRoot, ids, keep = () => true) {
   let files = [];
   try {
-    files = readdirSync10(join28(lokiRoot, "metrics"));
+    files = readdirSync9(join27(lokiRoot, "metrics"));
   } catch {}
   return [...new Set([...ids, ...ids.flatMap((id) => files.filter((f) => f.startsWith(`result-cost-${id}-q`) && f.endsWith(".json")).map((f) => f.slice("result-cost-".length, -".json".length)).filter(keep))])];
 }
 function neverRan(path, unmeteredMarker) {
   try {
-    const r = JSON.parse(readFileSync21(path, "utf8")), n2 = (v) => typeof v === "number" && Number.isFinite(v) ? v : 0;
+    const r = JSON.parse(readFileSync20(path, "utf8")), n2 = (v) => typeof v === "number" && Number.isFinite(v) ? v : 0;
     return r["total_cost_usd"] === 0 && r["source"] !== unmeteredMarker && ["input_tokens", "output_tokens", "cache_read_tokens", "cache_creation_tokens"].every((k) => n2(r[k]) === 0);
   } catch {
     return false;
   }
 }
 function liveArchivedCosts(lokiRoot, ids, unmeteredMarker) {
-  return withArchivedCosts(lokiRoot, ids, (id) => !neverRan(join28(lokiRoot, "metrics", `result-cost-${id}.json`), unmeteredMarker));
+  return withArchivedCosts(lokiRoot, ids, (id) => !neverRan(join27(lokiRoot, "metrics", `result-cost-${id}.json`), unmeteredMarker));
 }
 var ESTIMATED_PROVIDERS;
 var init_provider_cost = __esm(() => {
@@ -8031,8 +7850,8 @@ function routerMode(env = process.env) {
 var routerEnabled = (env = process.env) => routerMode(env) === "on";
 
 // ../../loki-ts/src/engine10/cost.ts
-import { readdirSync as readdirSync11, readFileSync as readFileSync22 } from "fs";
-import { join as join29 } from "path";
+import { readdirSync as readdirSync10, readFileSync as readFileSync21 } from "fs";
+import { join as join28 } from "path";
 function routerTelemetryOn(env = process.env) {
   return routerEnabled(env);
 }
@@ -8040,7 +7859,7 @@ function num3(v) {
   return typeof v === "number" && Number.isFinite(v) ? v : 0;
 }
 function resultCostPath(lokiRoot, iteration) {
-  return join29(lokiRoot, "metrics", `result-cost-${iteration}.json`);
+  return join28(lokiRoot, "metrics", `result-cost-${iteration}.json`);
 }
 function sumResultCosts(lokiRoot, iterations, context = []) {
   const out2 = {
@@ -8071,7 +7890,7 @@ function sumResultCosts(lokiRoot, iterations, context = []) {
   const parsed = new Map;
   for (const iter of iterations) {
     try {
-      parsed.set(iter, JSON.parse(readFileSync22(resultCostPath(lokiRoot, iter), "utf8")));
+      parsed.set(iter, JSON.parse(readFileSync21(resultCostPath(lokiRoot, iter), "utf8")));
     } catch {}
   }
   const own = new Set(iterations);
@@ -8080,7 +7899,7 @@ function sumResultCosts(lokiRoot, iterations, context = []) {
     if (own.has(iter))
       continue;
     try {
-      lookup.push({ iter, rec: JSON.parse(readFileSync22(resultCostPath(lokiRoot, iter), "utf8")) });
+      lookup.push({ iter, rec: JSON.parse(readFileSync21(resultCostPath(lokiRoot, iter), "utf8")) });
     } catch {}
   }
   const verdicts = hooks.costRecords?.resumeVerdicts(lookup) ?? { ambiguous: [], separate: [] };
@@ -8181,28 +8000,88 @@ var init_cost = __esm(() => {
   init_provider_cost();
 });
 
+// ../../loki-ts/src/util/atomic.ts
+import {
+  closeSync as closeSync5,
+  fstatSync as fstatSync4,
+  fsyncSync as fsyncSync2,
+  lstatSync as lstatSync5,
+  mkdirSync as mkdirSync8,
+  openSync as openSync5,
+  readSync as readSync4,
+  renameSync as renameSync5,
+  rmSync as rmSync5,
+  statSync as statSync12,
+  unlinkSync as unlinkSync3,
+  writeFileSync as writeFileSync11,
+  writeSync as writeSync3
+} from "fs";
+import { dirname as dirname8 } from "path";
+function durableWriteThenRename(target, body) {
+  mkdirSync8(dirname8(target), { recursive: true });
+  const tmp = tmpPathFor(target);
+  const fd = openSync5(tmp, "w");
+  try {
+    writeSync3(fd, body);
+    fsyncSync2(fd);
+  } finally {
+    closeSync5(fd);
+  }
+  renameSync5(tmp, target);
+  fsyncParentDir(target);
+}
+function fsyncParentDir(target) {
+  let dfd = null;
+  try {
+    dfd = openSync5(dirname8(target), "r");
+    fsyncSync2(dfd);
+  } catch {} finally {
+    if (dfd !== null) {
+      try {
+        closeSync5(dfd);
+      } catch {}
+    }
+  }
+}
+function atomicWriteJson(target, data) {
+  durableWriteThenRename(target, `${JSON.stringify(data, null, 2)}
+`);
+}
+function tmpPathFor(target) {
+  return `${target}.tmp.${process.pid}.${++_tmpCounter}`;
+}
+var _tmpCounter = 0, _appendChains;
+var init_atomic = __esm(() => {
+  _appendChains = new Map;
+});
+
 // ../../loki-ts/src/runner/budget.ts
-import { existsSync as existsSync17, mkdirSync as mkdirSync10, readdirSync as readdirSync12, readFileSync as readFileSync23, writeFileSync as writeFileSync13 } from "fs";
-import { dirname as dirname10, join as join30, resolve as resolve10 } from "path";
+import { existsSync as existsSync17, mkdirSync as mkdirSync9, readdirSync as readdirSync11, readFileSync as readFileSync22, writeFileSync as writeFileSync12 } from "fs";
+import { dirname as dirname9, join as join29, resolve as resolve10 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
-function loadDefaultMaxCostUsd() {
-  const here = dirname10(fileURLToPath2(import.meta.url));
-  for (const rel of [["..", "..", "data"], ["..", "data"]]) {
+function loadDefaultMaxCostUsd(dataDirs = [["..", "..", "data"], ["..", "data"]]) {
+  const here = dirname9(fileURLToPath2(import.meta.url));
+  for (const rel of dataDirs) {
     try {
-      const j = JSON.parse(readFileSync23(resolve10(here, ...rel, "model-pricing.json"), "utf8"));
+      const j = JSON.parse(readFileSync22(resolve10(here, ...rel, "model-pricing.json"), "utf8"));
       if (typeof j.default_max_cost_usd === "number" && Number.isFinite(j.default_max_cost_usd) && j.default_max_cost_usd > 0)
         return j.default_max_cost_usd;
     } catch {}
   }
+  if (!pricingFallbackWarned) {
+    pricingFallbackWarned = true;
+    process.stderr.write(`loki: warning: model-pricing.json is missing or unreadable (looked in ${dataDirs.map((r) => resolve10(here, ...r)).join(", ")}); using fallback default max cost $${DEFAULT_FALLBACK_USD}
+`);
+  }
   return DEFAULT_FALLBACK_USD;
 }
 function _loadPricing() {
   try {
-    const moduleDir = dirname10(fileURLToPath2(import.meta.url));
+    const moduleDir = dirname9(fileURLToPath2(import.meta.url));
     const jsonPath = resolve10(moduleDir, "..", "..", "data", "model-pricing.json");
     if (!existsSync17(jsonPath))
       return _FALLBACK_PRICING;
-    const raw2 = JSON.parse(readFileSync23(jsonPath, "utf8"));
+    const raw2 = JSON.parse(readFileSync22(jsonPath, "utf8"));
     const pricing2 = raw2["pricing"];
     if (!pricing2 || typeof pricing2 !== "object")
       return _FALLBACK_PRICING;
@@ -8267,7 +8146,7 @@ function calculateCostFromRecords(records) {
   }
   return round4(total);
 }
-var DEFAULT_FALLBACK_USD = 100, _FALLBACK_PRICING, PRICING, DEFAULT_PRICING_KEY = "sonnet";
+var DEFAULT_FALLBACK_USD = 100, pricingFallbackWarned = false, _FALLBACK_PRICING, PRICING, DEFAULT_PRICING_KEY = "sonnet", warnedCorruptBudget;
 var init_budget = __esm(() => {
   init_atomic();
   init_paths();
@@ -8296,37 +8175,70 @@ var init_budget = __esm(() => {
     "gpt-5.3-codex": { input: 1.75, output: 14, cache_read: 0.175, cache_write: 2.1875 }
   };
   PRICING = Object.freeze(_loadPricing());
+  warnedCorruptBudget = new Set;
 });
 
-// ../../loki-ts/src/runner/router/decision.ts
-var init_decision = () => {};
-
-// ../../loki-ts/src/project_model/schema.ts
-import { existsSync as existsSync18, lstatSync as lstatSync6, realpathSync as realpathSync14, statSync as statSync14 } from "fs";
-import { isAbsolute, join as join31, normalize, sep as sep9 } from "path";
-function safeRel(p) {
-  const n2 = normalize(p.trim()).split(sep9).join("/").replace(/\/$/, "");
-  if (n2 === "" || isAbsolute(n2) || n2 === ".." || n2.startsWith("../"))
-    return null;
-  return n2;
-}
-function insideRepo(repoDir, rel) {
-  try {
-    const real2 = realpathSync14(join31(repoDir, rel));
-    const base = realpathSync14(repoDir);
-    return real2 === base || real2.startsWith(base + sep9);
-  } catch {
-    return false;
+// ../../loki-ts/src/engine10/types.ts
+function pushArgv(a) {
+  switch (a.cmd) {
+    case "push-pr":
+      return ["push-pr", a.repoDir, a.branch, a.title, a.bodyFile, a.draft ? "1" : "0"];
+    case "comment":
+      return ["comment", a.runId, a.prUrl, a.file];
+    case "status":
+      return ["status", a.sha, a.state, a.description];
+    case "issue-comment":
+      return a.update ? ["issue-comment", "--update", a.issueRef, a.bodyFile] : ["issue-comment", a.issueRef, a.bodyFile];
   }
 }
-function checkCitation(repoDir, raw2) {
-  if (!isStr(raw2))
+function taskBlock(task) {
+  return ["Task (untrusted, quoted verbatim):", "<<<TASK", task, "TASK"];
+}
+var STAGE_BUDGETS;
+var init_types = __esm(() => {
+  STAGE_BUDGETS = {
+    intake: { targetS: 15, limitS: 60 },
+    plan: { targetS: 45, limitS: 90 },
+    wall: { targetS: 45, limitS: 90 },
+    implement: { targetS: 180, limitS: 480 },
+    verify: { targetS: 60, limitS: 120 },
+    fix: { targetS: 90, limitS: 180 },
+    commit: { targetS: 5, limitS: 30 },
+    seal: { targetS: 15, limitS: 60 },
+    pr: { targetS: 15, limitS: 60 },
+    deep: { targetS: null, limitS: 2700 }
+  };
+});
+
+// ../../loki-ts/src/runner/router/decision.ts
+var init_decision = () => {};
+
+// ../../loki-ts/src/project_model/schema.ts
+import { existsSync as existsSync18, lstatSync as lstatSync6, realpathSync as realpathSync14, statSync as statSync13 } from "fs";
+import { isAbsolute, join as join30, normalize, sep as sep9 } from "path";
+function safeRel(p) {
+  const n2 = normalize(p.trim()).split(sep9).join("/").replace(/\/$/, "");
+  if (n2 === "" || isAbsolute(n2) || n2 === ".." || n2.startsWith("../"))
+    return null;
+  return n2;
+}
+function insideRepo(repoDir, rel) {
+  try {
+    const real2 = realpathSync14(join30(repoDir, rel));
+    const base = realpathSync14(repoDir);
+    return real2 === base || real2.startsWith(base + sep9);
+  } catch {
+    return false;
+  }
+}
+function checkCitation(repoDir, raw2) {
+  if (!isStr(raw2))
     return "citation is not a non-empty string";
   const rel = safeRel(raw2.replace(/:\d+(?:-\d+)?$/, ""));
   if (rel === null)
     return `citation "${raw2}" is not a repo-relative path`;
-  const abs = join31(repoDir, rel);
-  if (!existsSync18(abs) || !statSync14(abs).isFile() || !insideRepo(repoDir, rel))
+  const abs = join30(repoDir, rel);
+  if (!existsSync18(abs) || !statSync13(abs).isFile() || !insideRepo(repoDir, rel))
     return `citation "${raw2}" names a file that does not exist`;
   return null;
 }
@@ -8337,7 +8249,7 @@ function checkFingerprint(repoDir, raw2) {
   if (rel === null)
     return `fingerprint "${raw2}" is not a repo-relative path`;
   try {
-    if (!lstatSync6(join31(repoDir, rel)).isFile() || !insideRepo(repoDir, rel))
+    if (!lstatSync6(join30(repoDir, rel)).isFile() || !insideRepo(repoDir, rel))
       return `fingerprint "${raw2}" is not a regular file inside the repo`;
   } catch {
     return `fingerprint "${raw2}" names a file that does not exist`;
@@ -8365,8 +8277,8 @@ function checkDir(repoDir, v, where, errs) {
     errs.push(`${where}: must be a repo-relative directory ("." for the repo root)`);
     return ".";
   }
-  const abs = join31(repoDir, rel);
-  if (!existsSync18(abs) || !statSync14(abs).isDirectory() || !insideRepo(repoDir, rel))
+  const abs = join30(repoDir, rel);
+  if (!existsSync18(abs) || !statSync13(abs).isDirectory() || !insideRepo(repoDir, rel))
     errs.push(`${where}: directory "${rel}" does not exist`);
   return rel;
 }
@@ -8468,7 +8380,7 @@ var init_schema = __esm(() => {
 });
 
 // ../../loki-ts/src/runner/router/history_store.ts
-import { existsSync as existsSync19, mkdirSync as mkdirSync11, readFileSync as readFileSync24, renameSync as renameSync7, rmSync as rmSync6, writeFileSync as writeFileSync14 } from "fs";
+import { existsSync as existsSync19, mkdirSync as mkdirSync10, readFileSync as readFileSync23, renameSync as renameSync6, rmSync as rmSync6, writeFileSync as writeFileSync13 } from "fs";
 import { resolve as resolve11 } from "path";
 function validRun(v) {
   if (typeof v !== "object" || v === null)
@@ -8484,7 +8396,7 @@ function readRunHistory(key, cacheRoot) {
   if (!existsSync19(path))
     return [];
   try {
-    const parsed = JSON.parse(readFileSync24(path, "utf8"));
+    const parsed = JSON.parse(readFileSync23(path, "utf8"));
     const runs2 = parsed?.runs;
     return Array.isArray(runs2) ? runs2.filter(validRun) : [];
   } catch {
@@ -8494,12 +8406,12 @@ function readRunHistory(key, cacheRoot) {
 function appendRunOutcome(key, outcome, cacheRoot) {
   try {
     const runs2 = [...readRunHistory(key, cacheRoot), outcome].slice(-HISTORY_CAP);
-    mkdirSync11(repoCacheDir(key, cacheRoot), { recursive: true });
+    mkdirSync10(repoCacheDir(key, cacheRoot), { recursive: true });
     const target = historyPath(key, cacheRoot);
     const tmp = `${target}.${process.pid}.tmp`;
     try {
-      writeFileSync14(tmp, JSON.stringify({ runs: runs2 }));
-      renameSync7(tmp, target);
+      writeFileSync13(tmp, JSON.stringify({ runs: runs2 }));
+      renameSync6(tmp, target);
     } catch (e) {
       rmSync6(tmp, { force: true, recursive: false });
       throw e;
@@ -8517,18 +8429,10 @@ var init_history_store = __esm(() => {
   OWNERS = ["code", "harness", "env", "provider"];
 });
 
-// ../../loki-ts/src/runner/model_downgrades.ts
-var init_model_downgrades = __esm(() => {
-  init_sizing();
-  init_model_rank();
-  init_claude_model();
-  init_decision();
-});
-
 // ../../loki-ts/src/project_model/gather.ts
-import { createHash as createHash8 } from "crypto";
-import { closeSync as closeSync6, lstatSync as lstatSync7, openSync as openSync6, readFileSync as readFileSync25, readSync as readSync5 } from "fs";
-import { dirname as dirname11, join as join32 } from "path";
+import { createHash as createHash7 } from "crypto";
+import { closeSync as closeSync6, lstatSync as lstatSync7, openSync as openSync6, readFileSync as readFileSync24, readSync as readSync5 } from "fs";
+import { dirname as dirname10, join as join31 } from "path";
 function listShallow(repoDir) {
   try {
     const out2 = safeGit(repoDir, ["ls-files", "-z"], { maxBuffer: 256 * 1024 * 1024 });
@@ -8538,10 +8442,10 @@ function listShallow(repoDir) {
   }
 }
 function shallowDirs(repoDir) {
-  return [...new Set(listShallow(repoDir).map((p) => dirname11(p)))].sort();
+  return [...new Set(listShallow(repoDir).map((p) => dirname10(p)))].sort();
 }
 function computeKey(repoDir, fingerprintFiles, dirs, committedHash = null) {
-  const h = createHash8("sha256");
+  const h = createHash7("sha256");
   h.update(`${MODEL_REV}
 `);
   if (committedHash !== null)
@@ -8554,9 +8458,9 @@ function computeKey(repoDir, fingerprintFiles, dirs, committedHash = null) {
       if (checkFingerprint(repoDir, f) !== null)
         h.update("invalid");
       else {
-        const abs = join32(repoDir, f);
+        const abs = join31(repoDir, f);
         const size = lstatSync7(abs).size;
-        h.update(size <= GATHER_CAPS.maxHashBytes ? readFileSync25(abs) : `too-large:${size}`);
+        h.update(size <= GATHER_CAPS.maxHashBytes ? readFileSync24(abs) : `too-large:${size}`);
       }
     } catch {
       h.update("missing");
@@ -8581,7 +8485,7 @@ function committedModelHash(raw2) {
   if (typeof raw2 !== "object" || raw2 === null || Array.isArray(raw2))
     return null;
   const { key: _key, expiresAt: _exp, ...rest } = raw2;
-  return createHash8("sha256").update(JSON.stringify(rest)).digest("hex");
+  return createHash7("sha256").update(JSON.stringify(rest)).digest("hex");
 }
 var GATHER_CAPS, depthOf = (p) => p.split("/").length, MODEL_REV = "model-rev:2";
 var init_gather = __esm(() => {
@@ -8598,55 +8502,22 @@ var init_gather = __esm(() => {
   };
 });
 
-// ../../loki-ts/src/project_model/discover.ts
-import { existsSync as existsSync20, mkdirSync as mkdirSync12, readFileSync as readFileSync26, rmSync as rmSync7, writeFileSync as writeFileSync15 } from "fs";
-import { join as join33 } from "path";
-function projectModelEnabled(env = process.env) {
-  return env["LOKI_E10_PROJECT_MODEL"] !== "0";
-}
-function loadCached(repoDir, now2 = Date.now()) {
+// ../../loki-ts/src/util/engine_origin.ts
+function readOriginUrl(repoDir) {
   try {
-    return parseCached(repoDir, JSON.parse(readFileSync26(join33(repoDir, PROJECT_FILE), "utf8")), now2);
+    const url = safeGit(repoDir, ["config", "--get", "remote.origin.url"]).trim();
+    return url || null;
   } catch {
     return null;
   }
 }
-function loadCommitted(repoDir) {
-  if (!isGitTracked(repoDir, PROJECT_FILE))
-    return null;
-  const ignore = (why) => {
-    process.stderr.write(`loki: ignoring committed ${PROJECT_FILE}: ${why}; falling back to discovery
-`);
-    return null;
-  };
-  let raw2;
-  try {
-    raw2 = JSON.parse(readFileSync26(join33(repoDir, PROJECT_FILE), "utf8"));
-  } catch (e) {
-    return ignore(`unreadable JSON (${e instanceof Error ? e.message : String(e)})`);
-  }
-  const hash = committedModelHash(raw2);
-  if (hash === null)
-    return ignore("not a JSON object");
-  const r = raw2;
-  if (r["schema"] !== PROJECT_MODEL_SCHEMA || r["status"] !== "ok")
-    return ignore(`needs schema "${PROJECT_MODEL_SCHEMA}" and status "ok"`);
-  const v = validateAnswer(repoDir, raw2);
-  if (!v.ok)
-    return ignore(v.errors.slice(0, 3).join("; "));
-  return { model: { ...v.model, key: "" }, hash };
-}
-var PROJECT_FILE = ".loki/project.json", UNKNOWN_TTL_MS;
-var init_discover2 = __esm(() => {
-  init_model_downgrades();
-  init_types();
-  init_gather();
-  init_schema();
-  UNKNOWN_TTL_MS = 60 * 60 * 1000;
+var init_engine_origin = __esm(() => {
+  init_atomic();
+  init_safe_git();
 });
 
 // ../../loki-ts/src/runner/router/history.ts
-import { dirname as dirname12, join as join34, resolve as resolve12 } from "path";
+import { dirname as dirname11, join as join32, resolve as resolve12 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 function shapeKey(model) {
   if (!model || model.status !== "ok")
@@ -8678,7 +8549,7 @@ var init_history = __esm(() => {
   init_cache();
   init_engine_origin();
   init_history_store();
-  SHAPE_DEFAULTS_FILE = resolve12(dirname12(fileURLToPath3(import.meta.url)), "..", "..", "..", "data", "router-shape-defaults.json");
+  SHAPE_DEFAULTS_FILE = resolve12(dirname11(fileURLToPath3(import.meta.url)), "..", "..", "..", "data", "router-shape-defaults.json");
 });
 
 // ../../loki-ts/src/runner/router/unit_model.ts
@@ -8740,6 +8611,7 @@ var init_budget_cap = __esm(() => {
 // ../../loki-ts/src/engine10/session.ts
 var STDERR_TAIL_BYTES, ADVISOR_MARKED_STAGES;
 var init_session = __esm(() => {
+  init_watchdog();
   init_run_pid();
   init_provider_cost();
   init_model_routes();
@@ -8764,7 +8636,7 @@ var init_model_rank = __esm(() => {
 });
 
 // ../../loki-ts/src/engine10/sizing.ts
-import { existsSync as existsSync21, readFileSync as readFileSync27 } from "fs";
+import { existsSync as existsSync20, readFileSync as readFileSync25 } from "fs";
 import { basename as basename8 } from "path";
 function namedFiles(task, map) {
   return (map?.files ?? []).filter((f) => task.toLowerCase().includes(basename8(f).toLowerCase()));
@@ -8786,7 +8658,7 @@ function sizeTask(task, map, tests) {
 }
 function loadRepoMap(repomapRef) {
   try {
-    return repomapRef && existsSync21(repomapRef) ? JSON.parse(readFileSync27(repomapRef, "utf8")) : null;
+    return repomapRef && existsSync20(repomapRef) ? JSON.parse(readFileSync25(repomapRef, "utf8")) : null;
   } catch {
     return null;
   }
@@ -8820,1536 +8692,1690 @@ var init_sizing = __esm(() => {
   resolveModelAlias = resolveClaudeModel;
 });
 
-// ../../loki-ts/src/features/speed/unit_mode.ts
-import { closeSync as closeSync7, constants, fstatSync as fstatSync5, lstatSync as lstatSync8, openSync as openSync7, readSync as readSync6, realpathSync as realpathSync15 } from "fs";
-function readBounded(path) {
-  const l = lstatSync8(path);
-  if (l.isSymbolicLink() || !l.isFile() || l.size > MAX_SPEC_BYTES)
-    return null;
-  const fd = openSync7(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+// ../../loki-ts/src/runner/model_downgrades.ts
+var init_model_downgrades = __esm(() => {
+  init_sizing();
+  init_model_rank();
+  init_claude_model();
+  init_decision();
+});
+
+// ../../loki-ts/src/project_model/discover.ts
+import { existsSync as existsSync21, mkdirSync as mkdirSync11, readFileSync as readFileSync26, rmSync as rmSync7, writeFileSync as writeFileSync14 } from "fs";
+import { join as join34 } from "path";
+function projectModelEnabled(env = process.env) {
+  return env["LOKI_E10_PROJECT_MODEL"] !== "0";
+}
+function loadCached(repoDir, now2 = Date.now()) {
   try {
-    const st = fstatSync5(fd);
-    if (!st.isFile() || st.size > MAX_SPEC_BYTES)
-      return null;
-    const buf = Buffer.alloc(st.size + 1);
-    let n2 = 0;
-    for (;; ) {
-      const r = readSync6(fd, buf, n2, buf.length - n2, null);
-      if (r <= 0)
-        break;
-      n2 += r;
-      if (n2 >= buf.length)
-        return null;
-    }
-    return buf.subarray(0, n2).toString("utf8");
-  } finally {
-    closeSync7(fd);
+    return parseCached(repoDir, JSON.parse(readFileSync26(join34(repoDir, PROJECT_FILE), "utf8")), now2);
+  } catch {
+    return null;
   }
 }
-function parseText(txt) {
+function loadCommitted(repoDir) {
+  if (!isGitTracked(repoDir, PROJECT_FILE))
+    return null;
+  const ignore = (why) => {
+    process.stderr.write(`loki: ignoring committed ${PROJECT_FILE}: ${why}; falling back to discovery
+`);
+    return null;
+  };
+  let raw2;
   try {
-    const j = JSON.parse(txt), ws = strs(j.writeSet), pack = strs(j.pack), tb = j.tokenBudget;
-    if (typeof j.id !== "string" || !j.id || !ws || ws.length === 0 || !pack || typeof tb !== "number" || !Number.isFinite(tb) || !(tb > 0) || tb > MAX_TOKEN_BUDGET)
+    raw2 = JSON.parse(readFileSync26(join34(repoDir, PROJECT_FILE), "utf8"));
+  } catch (e) {
+    return ignore(`unreadable JSON (${e instanceof Error ? e.message : String(e)})`);
+  }
+  const hash = committedModelHash(raw2);
+  if (hash === null)
+    return ignore("not a JSON object");
+  const r = raw2;
+  if (r["schema"] !== PROJECT_MODEL_SCHEMA || r["status"] !== "ok")
+    return ignore(`needs schema "${PROJECT_MODEL_SCHEMA}" and status "ok"`);
+  const v = validateAnswer(repoDir, raw2);
+  if (!v.ok)
+    return ignore(v.errors.slice(0, 3).join("; "));
+  return { model: { ...v.model, key: "" }, hash };
+}
+var PROJECT_FILE = ".loki/project.json", UNKNOWN_TTL_MS;
+var init_discover2 = __esm(() => {
+  init_model_downgrades();
+  init_types();
+  init_gather();
+  init_schema();
+  UNKNOWN_TTL_MS = 60 * 60 * 1000;
+});
+
+// ../../loki-ts/src/project_model/api.ts
+import { posix } from "path";
+function projectApi(model) {
+  const known = isRec2(model) && model.status === "ok";
+  const packages = known && Array.isArray(model.packages) ? model.packages.filter(wellFormed) : [];
+  const packageOf = (file) => {
+    const f = clean(file);
+    if (f === "")
       return null;
-    const acc = j.acceptance === undefined ? [] : strs(j.acceptance);
-    if (acc === null)
+    let best = null;
+    for (const p of packages) {
+      const hit = p.root === "." || f === p.root || f.startsWith(`${p.root}/`);
+      if (hit && (best === null || p.root !== "." && (best.root === "." || p.root.length > best.root.length)))
+        best = p;
+    }
+    return best;
+  };
+  return {
+    model,
+    known: () => known,
+    packages: () => packages,
+    workspaceKind: () => isRec2(model) && typeof model.workspaceKind === "string" ? model.workspaceKind : "unknown",
+    packageRootOf: (file) => packageOf(file)?.root ?? null,
+    packageOf,
+    relativeToRoot: (file) => {
+      const p = packageOf(file);
+      return p ? p.root === "." ? clean(file) : clean(file).slice(p.root.length + 1) : null;
+    },
+    commandFor: (pkg, kind) => (packages.find((p) => p.root === clean(pkg) || p.name === pkg) ?? null)?.commands?.[kind] ?? null,
+    dependsOn: (pkg) => {
+      const d = (packages.find((p) => p.root === clean(pkg) || p.name === pkg) ?? null)?.dependsOn;
+      return Array.isArray(d) ? d.filter((x) => typeof x === "string") : null;
+    },
+    installFor: (pkg) => {
+      const i = (packages.find((p) => p.root === clean(pkg) || p.name === pkg) ?? null)?.install;
+      return isRec2(i) && typeof i.cmd === "string" ? i : null;
+    },
+    hasUI: () => packages.some((p) => isRec2(p.ui) && p.ui.present === true),
+    uiBoot: () => {
+      for (const p of packages)
+        if (isRec2(p.ui) && p.ui.present === true && isRec2(p.ui.boot))
+          return { pkg: p, boot: p.ui.boot };
       return null;
-    return { id: j.id, writeSet: ws, pack, tokenBudget: tb, ...acc.length ? { acceptance: acc.map((a) => a.slice(0, 500)).slice(0, 50) } : {} };
-  } catch {
-    return null;
-  }
+    }
+  };
 }
-function parseSpec(path) {
+var clean = (p) => typeof p === "string" ? posix.normalize(p.replace(/\\/g, "/")).replace(/^\.\//, "") : "", isRec2 = (v) => typeof v === "object" && v !== null, wellFormed = (p) => isRec2(p) && typeof p.root === "string" && typeof p.name === "string";
+var init_api = () => {};
+
+// ../../loki-ts/src/project_model/resolve.ts
+import { join as join35 } from "path";
+function loadProjectApi(repoDir, env = process.env) {
+  if (!projectModelEnabled(env))
+    return null;
   try {
-    const txt = readBounded(path);
-    return txt === null ? null : parseText(txt);
+    const model = loadCached(repoDir);
+    const api = model ? projectApi(model) : null;
+    return api && api.known() ? api : null;
   } catch {
     return null;
   }
 }
-function unitSpec(env = process.env) {
-  const path = env["LOKI_UNIT_SPEC"], frozen = env["LOKI_UNIT_SPEC_FROZEN"];
-  if (env["LOKI_SPEED"] === "0" || !path)
+function isMultiRoot(api) {
+  return !!api && api.known() && api.packages().some((p) => p.root !== ".");
+}
+function siteFor(api, repoDir, file) {
+  if (!isMultiRoot(api))
     return null;
-  if (frozen !== undefined)
-    return frozen.length <= MAX_SPEC_BYTES ? parseText(frozen) : null;
-  if (!memo.has(path))
-    memo.set(path, parseSpec(path));
-  return memo.get(path) ?? null;
+  const pkg = api.packageOf(file);
+  const rel = api.relativeToRoot(file);
+  if (!pkg || pkg.root === "." || rel === null)
+    return null;
+  return { pkg, root: pkg.root, cwd: join35(repoDir, pkg.root), file: rel };
 }
-function unitFlags(staged, env = process.env, pre = {}) {
-  const s = unitSpec(env);
-  return s ? staged.filter(({ f }) => !inWriteSet(s, f) && !Object.hasOwn(pre, f)).map(({ f }) => f) : null;
+function groupByPackage(api, repoDir, files) {
+  const out2 = new Map;
+  for (const f of files) {
+    const s = siteFor(api, repoDir, f);
+    const root = s?.root ?? ".";
+    const g = out2.get(root) ?? { root, cwd: s?.cwd ?? repoDir, files: [], rel: [] };
+    g.files.push(f);
+    g.rel.push(s?.file ?? f);
+    out2.set(root, g);
+  }
+  return [...out2.values()];
 }
-var MAX_SPEC_BYTES, MAX_TOKEN_BUDGET = 1e9, norm2 = (p) => p.replace(/^\.\//, ""), CTRL, strs = (v) => Array.isArray(v) && v.every((x) => typeof x === "string" && !CTRL.test(x)) ? v.map(norm2) : null, memo, inWriteSet = (spec, f) => spec.writeSet.some((w) => w.endsWith("/") ? f.startsWith(w) : f === w);
-var init_unit_mode = __esm(() => {
-  MAX_SPEC_BYTES = 1024 * 1024;
-  CTRL = /[\x00-\x1f\x7f]/;
-  memo = new Map;
+var init_resolve = __esm(() => {
+  init_discover2();
+  init_api();
 });
-
-// ../../loki-ts/src/util/ts_signatures.ts
-function templateEnd(s, i) {
-  for (let j = i + 1;j < s.length; ) {
-    const c = s[j];
-    if (c === "\\")
-      j += 2;
-    else if (c === "`")
-      return j + 1;
-    else if (c === "$" && s[j + 1] === "{") {
-      let depth = 1;
-      j += 2;
-      while (j < s.length && depth > 0) {
-        const k = skipLiteral(s, j);
-        if (k !== j) {
-          j = k;
-          continue;
-        }
-        if (s[j] === "{")
-          depth++;
-        else if (s[j] === "}")
-          depth--;
-        j++;
-      }
-    } else
-      j++;
-  }
-  return s.length;
+// ../../loki-ts/src/project_model/scope.ts
+function scopedOutOf(map) {
+  return [...dropped.get(map) ?? []].sort();
 }
-function commentBefore(s, i) {
-  let p = i - 1;
-  while (p >= 0 && /\s/.test(s[p]))
-    p--;
-  if (p < 1)
-    return false;
-  if (s[p] === "/" && s[p - 1] === "*")
-    return true;
-  return s.slice(s.lastIndexOf(`
-`, p) + 1, p + 1).includes("//");
+var apis, imports, dropped;
+var init_scope = __esm(() => {
+  init_resolve();
+  apis = new WeakMap;
+  imports = new WeakMap;
+  dropped = new WeakMap;
+});
+
+// ../../loki-ts/src/util/test_file_text.ts
+import { basename as basename9 } from "path";
+function isTestFile(rel) {
+  const name = basename9(rel);
+  return JS_TEST_RE.test(name) || PY_TEST_RE.test(name) || GO_TEST_RE.test(name);
 }
-function regexEnd(s, i) {
-  if (commentBefore(s, i))
-    return i;
-  let p = i - 1;
-  while (p >= 0 && /\s/.test(s[p]))
-    p--;
-  if (p >= 1 && (s[p] === "+" || s[p] === "-") && s[p - 1] === s[p])
-    return i;
-  if (p >= 0 && !REGEX_PREV.includes(s[p]) && !/\b(return|typeof|case|in|of|void|delete|throw)$/.test(s.slice(Math.max(0, p - 7), p + 1)))
-    return i;
-  let inClass = false;
-  for (let j = i + 1;j < s.length; j++) {
-    const c = s[j];
-    if (c === `
-`)
-      return i;
-    if (c === "\\")
-      j++;
-    else if (c === "[")
-      inClass = true;
-    else if (c === "]")
-      inClass = false;
-    else if (c === "/" && !inClass) {
-      j++;
-      while (j < s.length && /[a-z]/i.test(s[j]))
-        j++;
-      return j;
+var JS_TEST_RE, PY_TEST_RE, GO_TEST_RE;
+var init_test_file_text = __esm(() => {
+  JS_TEST_RE = /\.(test|spec)\.[cm]?[jt]sx?$/;
+  PY_TEST_RE = /^(test_.+|.+_test)\.py$/;
+  GO_TEST_RE = /_test\.go$/;
+});
+
+// ../../loki-ts/src/engine10/testmap.ts
+import { existsSync as existsSync22, readdirSync as readdirSync12, readFileSync as readFileSync27, realpathSync as realpathSync15 } from "fs";
+import { basename as basename10, extname, isAbsolute as isAbsolute2, join as join36, relative, sep as sep10 } from "path";
+function projectInterpreter(root) {
+  const ve = process.env["VIRTUAL_ENV"], inRepo = (p) => {
+    try {
+      const r = relative(realpathSync15(root), realpathSync15(p));
+      return r !== "" && !r.startsWith("..") && !isAbsolute2(r);
+    } catch {
+      return false;
     }
-  }
-  return i;
+  };
+  return [join36(root, ".venv", "bin", "python"), join36(root, "venv", "bin", "python"), ...ve && inRepo(ve) ? [join36(ve, "bin", "python")] : []].some(existsSync22) ? "project" : "system";
 }
-function stripComments(t) {
-  let out2 = "";
-  for (let i = 0;i < t.length; ) {
-    if (isComment(t, i)) {
-      const e = t[i + 1] === "/" ? t.indexOf(`
-`, i) < 0 ? t.length : t.indexOf(`
-`, i) : t.indexOf("*/", i + 2) < 0 ? t.length : t.indexOf("*/", i + 2) + 2;
-      out2 += t[i + 1] === "/" ? "" : " ";
-      i = e;
-      continue;
-    }
-    const c = t[i];
-    const k = c === '"' || c === "'" || c === "`" ? skipLiteral(t, i) : i;
-    if (k !== i) {
-      out2 += t.slice(i, k);
-      i = k;
-      continue;
-    }
-    out2 += c;
-    i++;
-  }
-  return out2;
+var SKIP_DIRS;
+var init_testmap = __esm(() => {
+  init_resolve();
+  init_scope();
+  init_test_file_text();
+  SKIP_DIRS = new Set([
+    ".git",
+    "node_modules",
+    "dist",
+    "build",
+    "target",
+    "coverage",
+    ".venv",
+    "venv",
+    "__pycache__",
+    ".tox",
+    ".pytest_cache",
+    ".loki",
+    ".next"
+  ]);
+});
+
+// ../../loki-ts/src/util/check_result.ts
+import { existsSync as existsSync23, mkdirSync as mkdirSync12, readFileSync as readFileSync28, realpathSync as realpathSync16, renameSync as renameSync7, writeFileSync as writeFileSync15 } from "fs";
+import { basename as basename11, isAbsolute as isAbsolute3, join as join37 } from "path";
+function plainTestEnv(base = process.env) {
+  const e = {};
+  for (const [k, v] of Object.entries(tokenFreeEnv(base)))
+    if (typeof v === "string")
+      e[k] = v;
+  e["FORCE_COLOR"] = "0";
+  e["NO_COLOR"] = "1";
+  delete e["CLICOLOR_FORCE"];
+  return e;
 }
-function skipLiteral(s, i) {
-  const c = s[i];
-  if (c === "/" && s[i + 1] === "/") {
-    const n2 = s.indexOf(`
-`, i);
-    return n2 < 0 ? s.length : n2;
+function ran(raw2, path, ok) {
+  const out2 = stripAnsi(raw2);
+  const n2 = (s, re) => +(s.match(re)?.[1] ?? 0);
+  const blk = out2.trimEnd().match(/(?:^|\n)((?:(?:#|\u2139) \w+ [\d.]+(?:\n|$)){5,})$/)?.[1];
+  if (blk) {
+    const c = n2(blk, /(?:#|\u2139) pass (\d+)/) + n2(blk, /(?:#|\u2139) fail (\d+)/);
+    const nm = out2.match(/^(?:ok \d+ - |\u2714 )(\S+\.[cm]?[jt]s)(?: \(|$)/m)?.[1];
+    return c === 1 && nm && (!path || basename11(nm) === basename11(path)) ? 0 : c;
   }
-  if (c === "/" && s[i + 1] === "*") {
-    const n2 = s.indexOf("*/", i + 2);
-    return n2 < 0 ? s.length : n2 + 2;
+  const cg = cargoTrailer(out2);
+  if (cg.length)
+    return cg.reduce((t, l2) => t + n2(l2, /(\d+) passed/) + n2(l2, /(\d+) failed/), 0);
+  const g = goCount(out2, ok);
+  if (g !== undefined)
+    return g;
+  const tail = tailLines(out2);
+  const l = tail.filter((x) => /^(?:=+ )?(?:\d+ \w+.*|no tests ran) in [\d.]+s|^\s*Tests?:?\s+\d|^No tests found/.test(x) && (!/^\s*Tests?:?\s+\d/.test(x) || tail.some((y) => /^\s*Test (?:Files|Suites):?\s+\d/.test(y)))).pop();
+  if (!l)
+    return null;
+  return /^(?:=+ )?no tests (?:ran|found)|^No tests found|skipped/i.test(l) || /\d+ (?:passed|failed|errors?)/.test(l) ? n2(l, /(\d+) passed/) + n2(l, /(\d+) failed/) + n2(l, /(\d+) errors?/) : null;
+}
+function cargoTrailer(out2) {
+  const ls = out2.split(`
+`).filter((x) => x.trim());
+  while (ls.length && /^error: /.test(ls[ls.length - 1]))
+    ls.pop();
+  const segs = [];
+  for (const l of ls) {
+    if (/^running \d+ tests?\b/.test(l))
+      segs.push([]);
+    else if (segs.length && !/^\s*(?:Running |Doc-tests |Doctest)/.test(l))
+      segs[segs.length - 1].push(l);
   }
-  if (c === "/")
-    return regexEnd(s, i);
-  if (c === "`")
-    return templateEnd(s, i);
-  if (c !== '"' && c !== "'")
-    return i;
-  for (let j = i + 1;j < s.length; j++) {
-    if (s[j] === "\\")
-      j++;
-    else if (s[j] === c)
-      return j + 1;
-    else if (s[j] === `
-`)
-      return i;
+  const lastOf = (g) => g[g.length - 1]?.startsWith("test result: ") ? g[g.length - 1] : undefined;
+  if (!segs.length) {
+    const g = [];
+    for (let k = ls.length - 1;k >= 0 && ls[k].startsWith("test result: "); k--)
+      g.push(ls[k]);
+    return g;
   }
-  return s.length;
+  if (!lastOf(segs[segs.length - 1]))
+    return [];
+  return segs.flatMap((g) => lastOf(g) ?? []);
 }
-function matchingBrace(s, open) {
-  let depth = 0;
-  for (let i = open;i < s.length; ) {
-    const j = skipLiteral(s, i);
-    if (j !== i) {
-      i = j;
-      continue;
-    }
-    if (s[i] === "{")
-      depth++;
-    else if (s[i] === "}" && --depth === 0)
-      return i;
-    i++;
-  }
-  return s.length;
+function bunCount(out2) {
+  const ls = out2.split(`
+`).filter((x) => x.trim());
+  if (!/^Ran \d+ tests? across \d+ files?\./.test(ls[ls.length - 1] ?? ""))
+    return null;
+  const blk = ls.slice(-9, -1);
+  const last = (k) => +(blk.map((x) => x.match(new RegExp(`^\\s*(\\d+) ${k}\\s*$`))?.[1]).filter(Boolean).pop() ?? 0);
+  return last("pass") + last("fail");
 }
-function items(src) {
-  const out2 = [];
-  let start = 0, head = "", p = 0, i = 0;
-  const push = (end, body, stop, balanced = true) => {
-    if (head.trim())
-      out2.push({ head, raw: src.slice(start, stop).trim(), end, body, balanced });
-    head = "";
-    p = 0;
-    start = stop;
-  };
-  while (i < src.length) {
-    const j = skipLiteral(src, i);
-    if (j !== i) {
-      if (!isComment(src, i))
-        head += src.slice(i, j);
-      i = j;
-      continue;
-    }
-    const c = src[i];
-    if (c === "(" || c === "[")
-      p++;
-    else if (c === ")" || c === "]")
-      p--;
-    if (c === "{" && p === 0) {
-      const close = matchingBrace(src, i);
-      const h = head.trim();
-      const declaration = /^(export\s+)?(declare\s+)?(type|interface|enum)\b/.test(h);
-      if (declaration || h === "" || /^export(\s+type)?$/.test(h) || /[:|&]$/.test(h)) {
-        head += stripComments(src.slice(i, close + 1));
-        i = close + 1;
-        if (declaration && !/^(export\s+)?(declare\s+)?type\b/.test(h))
-          push("", null, i);
-        continue;
-      }
-      const body = src.slice(i + 1, close);
-      const balanced = close < src.length;
-      i = close + 1;
-      if (src[i] === ";")
-        i++;
-      push("{", body, i, balanced);
-      continue;
-    }
-    if (c === ";" && p === 0) {
-      i++;
-      push(";", null, i);
-      continue;
-    }
-    if (c === `
-` && p === 0 && head.trim() && /^\s*(export|import)\b/.test(src.slice(i + 1, i + 40))) {
-      push("", null, i);
-      i++;
-      start = i;
-      continue;
-    }
-    head += c;
-    i++;
-  }
-  push("", null, src.length);
-  return out2;
+function unittestCount(out2, ok) {
+  const ls = out2.split(`
+`).filter((x) => x.trim()), v = ls[ls.length - 1] ?? "", r = ls[ls.length - 2]?.match(/^Ran (\d+) tests? in [\d.]+s$/);
+  if (!r || !/^(?:OK|FAILED)\b/.test(v))
+    return null;
+  if (ls.filter((x) => /^Ran \d+ tests? in [\d.]+s$/.test(x)).length > 1)
+    return null;
+  if (ok === true && v.startsWith("FAILED") || ok === false && v.startsWith("OK"))
+    return null;
+  return Math.max(0, +r[1] - +(v.match(/skipped=(\d+)/)?.[1] ?? 0) - +(v.match(/expected failures=(\d+)/)?.[1] ?? 0));
 }
-function arrowHeadLen(s) {
-  const n2 = s.length;
-  let i = 0;
-  const ws = () => {
-    while (i < n2 && /\s/.test(s[i]))
-      i++;
-  };
-  if (/^async\s/.test(s)) {
-    i = 5;
-    ws();
-  }
-  if (s[i] === "<") {
-    let d2 = 0;
-    for (;i < n2; i++) {
-      if (s[i] === "=" && s[i + 1] === ">")
-        i++;
-      else if (s[i] === "<")
-        d2++;
-      else if (s[i] === ">" && --d2 === 0) {
-        i++;
-        break;
-      }
+function goCount(out2, ok) {
+  const lines = out2.split(`
+`);
+  if (!lines.some((x) => GO_PKG_RE.test(x)))
+    return;
+  const last = new Map, seen = new Set, skip = new Set, failPkg = ok !== true && lines.some((x) => /^FAIL\s+\S+\s+[\d.]+s\b/.test(x));
+  for (const x of lines) {
+    const r = x.match(/^=== RUN\s+(\S+)/), m = x.match(/^--- (PASS|FAIL|SKIP): (\S+)/);
+    if (r)
+      seen.add(r[1]);
+    else if (m && (seen.has(m[2]) || m[1] === "FAIL" && failPkg)) {
+      last.set(m[2], m[1]);
+      if (m[1] === "SKIP")
+        skip.add(m[2]);
     }
-    if (d2 !== 0)
-      return -1;
-    ws();
   }
-  if (s[i] === "(") {
-    let d2 = 0;
-    for (;i < n2; ) {
-      const k = skipLiteral(s, i);
-      if (k !== i) {
-        i = k;
+  for (const k of skip)
+    last.set(k, "SKIP");
+  if (ok === true && [...last.values()].includes("FAIL"))
+    return null;
+  const t = [...last.values()].filter((v) => v !== "SKIP").length;
+  if (t > 0)
+    return t;
+  if (lines.some((x) => /^(?:=== RUN|PASS$|FAIL$|testing: warning: no tests to run)/.test(x)))
+    return 0;
+  return lines.filter((x) => GO_PKG_RE.test(x)).every((x) => /\[no tests? (?:files|to run)\]/.test(x)) ? 0 : null;
+}
+function goRunner(cmd, args) {
+  const segs = args ? [[cmd, ...args]] : cmd.split(/&&|\|\||[;|\n]/).map((x) => x.trim().split(/\s+/).filter(Boolean));
+  for (const t0 of segs) {
+    const t = t0.map((x) => x.replace(/^["']|["']$/g, ""));
+    let k = 0;
+    for (;k < t.length; k++) {
+      const x = t[k];
+      if (/^[A-Za-z_]\w*=/.test(x) || /^(?:env|command|exec|time|nohup)$/.test(basename11(x)))
+        continue;
+      if (/^-/.test(x) && k > 0 && basename11(t[k - 1]) === "env") {
+        if (x === "-u" || x === "-C" || x === "-S")
+          k++;
         continue;
       }
-      if (s[i] === "(")
-        d2++;
-      else if (s[i] === ")" && --d2 === 0) {
-        i++;
-        break;
-      }
-      i++;
+      break;
     }
-    if (d2 !== 0)
-      return -1;
-  } else {
-    const st = i;
-    while (i < n2 && /[\w$]/.test(s[i]))
-      i++;
-    if (i === st)
-      return -1;
+    if (t[k] !== undefined && basename11(t[k]) === "go")
+      return { runner: "go" };
   }
-  ws();
-  if (s[i] === "=" && s[i + 1] === ">")
-    return i + 2;
-  if (s[i] !== ":")
-    return -1;
-  let d = 0;
-  for (i++;i < n2; ) {
-    const k = skipLiteral(s, i);
-    if (k !== i) {
-      i = k;
+  return {};
+}
+function goJson(out2) {
+  let any = false, failed2 = false;
+  for (const x of out2.split(`
+`)) {
+    if (!x.trim() || /^go: /.test(x))
       continue;
+    let e;
+    try {
+      e = JSON.parse(x);
+    } catch {
+      return null;
     }
-    const c = s[i];
-    if ("([{".includes(c))
-      d++;
-    else if (")]}".includes(c))
-      d--;
-    else if (d === 0 && c === "=")
-      return s[i + 1] === ">" ? i + 2 : -1;
-    else if (d === 0 && c === ";")
-      return -1;
-    i++;
+    if (!e || typeof e !== "object" || typeof e.Action !== "string")
+      return null;
+    any = true;
+    if (e.Action === "fail")
+      failed2 = true;
   }
-  return -1;
+  return any ? { failed: failed2 } : null;
 }
-function memberSig(h) {
-  if (!h || /^(private|protected|#)/.test(h))
-    return null;
-  let depth = 0, angle = 0;
-  for (let i = 0;i < h.length; i++) {
-    const c = h[i];
-    if ("([{".includes(c))
-      depth++;
-    else if (")]}".includes(c))
-      depth--;
-    else if (depth === 0 && c === "<")
-      angle++;
-    else if (depth === 0 && c === ">" && h[i - 1] !== "=" && angle > 0)
-      angle--;
-    else if (c === "=" && depth === 0 && angle === 0 && !"=!<".includes(h[i - 1] ?? " ") && h[i + 1] !== "=" && h[i + 1] !== ">") {
-      const rhs = h.slice(i + 1).trim();
-      if (rhs.endsWith("=>") || /^(async\s+)?function\b/.test(rhs))
-        return h;
-      const len = arrowHeadLen(rhs);
-      return `${h.slice(0, i).trim()}${len > 0 ? ` = ${rhs.slice(0, len)}` : ""}`;
-    }
-  }
-  return h;
+function summaryPassFailCount(out2) {
+  return ["pass", "fail"].reduce((t, k) => t + +([...out2.matchAll(new RegExp(`^(?:#|\\u2139) ${k} (\\d+)$`, "gm"))].pop()?.[1] ?? 0), 0);
 }
-function splitDeclarators(h) {
-  const parts = [];
-  let depth = 0, angle = 0, init = false, from = 0;
-  for (let i = 0;i < h.length; ) {
-    const k = skipLiteral(h, i);
-    if (k !== i) {
-      i = k;
-      continue;
-    }
-    const c = h[i];
-    if ("([{".includes(c))
-      depth++;
-    else if (")]}".includes(c))
-      depth--;
-    else if (depth === 0 && !init && c === "<")
-      angle++;
-    else if (depth === 0 && !init && c === ">" && h[i - 1] !== "=")
-      angle = Math.max(0, angle - 1);
-    else if (depth === 0 && angle === 0 && !init && c === "=" && h[i + 1] !== "=" && h[i + 1] !== ">" && !"=!<".includes(h[i - 1] ?? " ")) {
-      init = true;
-      const rest = h.slice(i + 1);
-      const len = arrowHeadLen(rest.trimStart());
-      if (len > 0) {
-        i += 1 + (rest.length - rest.trimStart().length) + len;
-        continue;
-      }
-    } else if (depth === 0 && angle === 0 && c === ",") {
-      parts.push(h.slice(from, i));
-      from = i + 1;
-      init = false;
-    }
-    i++;
-  }
-  parts.push(h.slice(from));
-  return parts;
+function skipped(raw2) {
+  return stripAnsi(raw2).split(`
+`).filter((l) => /^(?:=+ )?\d+ \w+.* in [\d.]+s|^\s*Tests?:?\s+\d|^(?:#|\u2139) skipped \d/.test(l.trim())).reduce((t, l) => t + [...l.matchAll(/(\d+) (?:skipped|deselected|xfailed)|skipped (\d+)/g)].reduce((u, m) => u + +(m[1] ?? m[2]), 0), 0);
 }
-function exportHead(h, end) {
-  let depth = 0, last = -1, nn = -1;
-  const star = /^export\s*(type\s*)?\*/.test(h.slice(0, 40));
-  for (let i = 0;i < h.length; ) {
-    const k = skipLiteral(h, i);
-    if (k !== i) {
-      last = k - 1;
-      i = k;
-      continue;
-    }
-    const c = h[i];
-    if ("([{".includes(c))
-      depth++;
-    else if (")]}".includes(c))
-      depth--;
-    else if (depth === 0 && c === ";")
-      return h.slice(0, i + 1);
-    else if (depth === 0 && c === `
-` && last >= 0) {
-      if (nn < i) {
-        nn = i;
-        while (nn < h.length && /\s/.test(h[nn]))
-          nn++;
-      }
-      const tail = h.slice(Math.max(0, last - 300), last + 1);
-      const next = h.slice(nn, nn + 12);
-      const open = /[=|&,<(:?.+\-*/]$|=>$|\b(from|as|extends|keyof|typeof|type)$/.test(tail) || /^(from\b|extends\b|as\b|[|&?:.,=])/.test(next);
-      if (!open && (!star || /\bfrom\s*(["'])[^"']*\1$/.test(tail)))
-        return h.slice(0, last + 1);
-    }
-    if (!/\s/.test(c))
-      last = i;
-    i++;
+function testCount(raw2, path, ok) {
+  const out2 = stripAnsi(raw2);
+  const bu = bunCount(out2), ut = unittestCount(out2, ok);
+  if (bu !== null)
+    return bu;
+  if (ut !== null)
+    return ut;
+  if (/^\s*(?:Test Files\s+0\b|No test files found)/m.test(out2) && !/^\s*Tests?\s+\d/m.test(out2))
+    return 0;
+  const r = ran(out2, path, ok);
+  if (r !== null)
+    return r;
+  const tl = tailLines(out2);
+  const pw = tl.filter((x) => /^\s*\d+ (?:passed|failed|flaky)\b/.test(x));
+  if (pw.length && tl.some((x) => /^\s*\d+ passed \([\d.]+m?s\)/.test(x) || /^\s*\d+ failed$/.test(x)))
+    return pw.reduce((t, x) => t + +x.trim().split(" ")[0], 0);
+  const lastNum = (re) => {
+    const m = [...out2.matchAll(re)].pop();
+    return m ? +m[1] : null;
+  };
+  const mp = lastNum(/^\s*(\d+) passing\b/gm), mf = lastNum(/^\s*(\d+) failing\b/gm);
+  if (mp !== null || mf !== null)
+    return (mp ?? 0) + (mf ?? 0);
+  return null;
+}
+function classifyCheck(i) {
+  if (i.missing)
+    return { result: "not_run", reason: "tool not found on PATH" };
+  if (i.cut)
+    return { result: "not_run", reason: "timed out or aborted" };
+  if (i.kind === "static")
+    return { result: i.ok ? "pass" : "fail" };
+  const text2 = stripAnsi(i.out);
+  if (i.runner === "go") {
+    if (i.ok)
+      return { result: "not_run", reason: GO_EXIT0_REASON };
+    const j = goJson(text2);
+    if (j)
+      return j.failed ? { result: "fail" } : { result: "not_run", reason: UNCONFIRMED_REASON };
+    return FAIL_EVIDENCE.test(text2) || GO_FAIL_EVIDENCE.test(text2) ? { result: "fail" } : { result: "not_run", reason: UNCONFIRMED_REASON };
   }
-  return h.trimEnd() + (end === ";" ? ";" : "");
+  const n2 = testCount(i.out, i.path, i.ok);
+  if (!i.ok && FAIL_EVIDENCE.test(text2))
+    return { result: "fail", ...n2 !== null ? { n: n2 } : {} };
+  if (n2 === 0)
+    return { result: "not_run", n: 0, reason: `${NO_TESTS_REASON} (ran 0 tests, empty or all skipped)` };
+  if (!i.ok)
+    return { result: "fail", ...n2 !== null ? { n: n2 } : {} };
+  if (n2 === null)
+    return { result: "not_run", reason: UNMEASURED_REASON };
+  return { result: "pass", n: n2 };
 }
-function hasTopSemi(line2) {
-  let depth = 0;
-  for (let i = 0;i < line2.length; ) {
-    const k = skipLiteral(line2, i);
-    if (k !== i) {
-      i = k;
-      continue;
-    }
-    const c = line2[i];
-    if ("([{".includes(c))
-      depth++;
-    else if (")]}".includes(c))
-      depth--;
-    else if (c === ";" && depth <= 0 && line2.slice(i + 1).trim())
-      return true;
-    i++;
+function checkProvenance(name, ctx) {
+  const head = name.split(":")[0];
+  if (LLM_JUDGES.has(head))
+    return "llm_judge";
+  if (head === "holdout")
+    return "independent";
+  if (!NON_RUNNER.has(head) && name.includes(":")) {
+    const p = normPath(name.slice(name.indexOf(":") + 1));
+    if (ctx.wallFiles.some((w) => normPath(w) === p))
+      return "independent";
+    if (ctx.addedFiles.some((a) => normPath(a) === p))
+      return "agent_authored";
+    if (ctx.modifiedFiles?.some((m) => normPath(m) === p))
+      return "agent_authored";
   }
-  return false;
+  return "exogenous";
 }
-function strictMember(m) {
-  const h = m.head.trim();
-  if (!MEMBER_GRAMMAR.test(h) || NOT_MEMBER.test(h))
-    return false;
-  if (m.end !== "{" && /^[^=:<]*\(/.test(h) && !/^(?:(?:public|protected|private)\s+)?constructor\b/.test(h) && !/\)\s*:/.test(h))
-    return false;
-  return true;
+function summaryOf(a) {
+  const why = a.tier === a.computed ? a.reasons.slice(0, 2).join("; ") : `computed ${a.computed}; override ${a.override?.from} to ${a.override?.to}: ${a.override?.reason}`;
+  const def = a.checks_deferred;
+  return `risk: ${a.tier} (${why}), ${def.length ? def.join(", ") : "no deeper checks"} not run`;
 }
-function tsAmbiguous(s, jsx) {
-  const n2 = s.length, stack = [];
-  const tpl = (from) => {
-    for (let j = from;j < n2; ) {
-      const c = s[j];
-      if (c === "\\")
-        j += 2;
-      else if (c === "`")
-        return j + 1;
-      else if (c === "$" && s[j + 1] === "{") {
-        stack.push("$");
-        return j + 2;
-      } else
-        j++;
-    }
-    return -1;
-  };
-  let prev = "", prev2 = "";
-  const set = (c) => {
-    prev2 = prev;
-    prev = c;
-  };
-  for (let i = 0;i < n2; ) {
-    const c = s[i];
-    if (/\s/.test(c)) {
-      i++;
-      continue;
-    }
-    if (c === "/" && s[i + 1] === "/") {
-      const e = s.indexOf(`
-`, i);
-      if (e < 0)
-        break;
-      i = e;
-      continue;
-    }
-    if (c === "/" && s[i + 1] === "*") {
-      const e = s.indexOf("*/", i + 2);
-      if (e < 0)
-        return true;
-      i = e + 2;
-      continue;
-    }
-    if (c === "`" || c === "}" && stack[stack.length - 1] === "$") {
-      if (c === "`" && jsx)
-        return true;
-      if (c === "}")
-        stack.pop();
-      const e = tpl(i + 1);
-      if (e < 0)
-        return true;
-      i = e;
-      set("a");
-      continue;
-    }
-    if (c === '"' || c === "'") {
-      let j = i + 1;
-      for (;j < n2 && s[j] !== c; j++) {
-        if (s[j] === "\\")
-          j++;
-        else if (s[j] === `
-`)
-          return true;
-      }
-      if (j >= n2)
-        return true;
-      i = j + 1;
-      set("a");
-      continue;
-    }
-    if (c === "/") {
-      if (jsx && prev === "<") {
-        i++;
-        set("/");
-        continue;
-      }
-      if (commentBefore(s, i))
-        return true;
-      if (prev && !"(,=:[!&|?{;+-*%~^".includes(prev))
-        return true;
-      if ((prev === "+" || prev === "-") && prev2 === prev)
-        return true;
-      let j = i + 1, cls = false, closed = false;
-      for (;j < n2; j++) {
-        const d = s[j];
-        if (d === `
-`)
-          return true;
-        if (d === "\\")
-          j++;
-        else if (d === "[")
-          cls = true;
-        else if (d === "]")
-          cls = false;
-        else if (d === "/" && !cls) {
-          closed = true;
-          break;
-        }
-      }
-      if (!closed)
-        return true;
-      i = j + 1;
-      while (i < n2 && /[a-z]/i.test(s[i]))
-        i++;
-      set("a");
-      continue;
-    }
-    if (c === "(" || c === "[" || c === "{")
-      stack.push(c);
-    else if (c === ")" || c === "]" || c === "}") {
-      const o = stack.pop();
-      if (o !== (c === ")" ? "(" : c === "]" ? "[" : "{"))
-        return true;
-    }
-    set(c);
-    i++;
-  }
-  return stack.length > 0;
+function markExecuted(a, executed) {
+  const checks_deferred = deferredOf(a.tier, a.checks_selected, executed);
+  return { ...a, checks_deferred, summary: summaryOf({ ...a, checks_deferred }) + (a.advisories?.length ? `; advisory: ${a.advisories.join(", ")}` : "") };
 }
-function maskDefaults(sig) {
-  let out2 = "", pd = 0;
-  for (let i = 0;i < sig.length; ) {
-    const k = skipLiteral(sig, i);
-    if (k !== i) {
-      out2 += sig.slice(i, k);
-      i = k;
-      continue;
-    }
-    const c = sig[i];
-    if (c === "(")
-      pd++;
-    else if (c === ")")
-      pd--;
-    else if (c === "=" && pd > 0 && sig[i + 1] !== "=" && sig[i + 1] !== ">" && !"=!<".includes(sig[i - 1] ?? " ")) {
-      out2 = out2.trimEnd() + " = ...";
-      let d = 0, angle = 0, j = i + 1;
-      for (;j < sig.length; ) {
-        const l = skipLiteral(sig, j);
-        if (l !== j) {
-          j = l;
-          continue;
-        }
-        const e = sig[j];
-        if ("([{".includes(e))
-          d++;
-        else if (")]}".includes(e)) {
-          if (d === 0)
-            break;
-          d--;
-        } else if (e === "<" && /[\w$]/.test(sig[j - 1] ?? ""))
-          angle++;
-        else if (e === ">" && sig[j - 1] !== "=" && angle > 0)
-          angle--;
-        else if (e === "," && d === 0 && angle === 0)
-          break;
-        j++;
-      }
-      i = j;
-      continue;
+function manifestDepsChanged(path, oldText, newText, patch) {
+  if (/(^|\/)package\.json$/.test(path)) {
+    try {
+      const o = oldText.trim() ? JSON.parse(oldText) : {}, n2 = newText.trim() ? JSON.parse(newText) : {};
+      return PKG_DEP_KEYS.some((k) => JSON.stringify(o?.[k] ?? {}) !== JSON.stringify(n2?.[k] ?? {}));
+    } catch {
+      return true;
     }
-    out2 += c;
-    i++;
   }
-  return out2;
+  const changed = patch.split(`
+`).filter((l) => /^[+-]/.test(l) && !/^(\+\+\+|---)/.test(l));
+  if (/(^|\/)go\.mod$/.test(path))
+    return changed.some((l) => {
+      const b = l.slice(1).trim();
+      return b !== "" && !b.startsWith("//") && !/^(module|go|toolchain)\b/.test(b);
+    });
+  return changed.some((l) => {
+    const b = l.slice(1).trim();
+    if (/^"[A-Za-z][\w.-]*(\[[\w,.-]+\])?\s*([<>=~!]|;|@|"\s*,?\s*$)/.test(b))
+      return true;
+    const m = /^([A-Za-z][\w.-]*)\s*=\s*("[\^~<>=!*\d]|\{[^}]*version)/.exec(b);
+    return !!m && !PYPROJECT_NONDEP.test(m[1]);
+  });
 }
-function maskDecorators(sig) {
-  let out2 = "";
-  const badNext = (at) => {
-    const r = sig.slice(at).trimStart();
-    return !/[A-Za-z_$@]/.test(r[0] ?? "") || RESERVED_AFTER_DECORATOR.test(r);
+function manifestsWithoutLock(files) {
+  return files.filter((f) => f.deps && f.status !== "deleted").flatMap((f) => {
+    const pair = MANIFEST_LOCKS.find(([m]) => m.test(f.path));
+    if (!pair)
+      return [];
+    const d = dirOf(f.path);
+    const locked = files.some((g) => pair[1].test(g.path) && (dirOf(g.path) === "" || d === dirOf(g.path) || d.startsWith(dirOf(g.path) + "/")));
+    return locked ? [] : [f.path];
+  });
+}
+function classifyRisk(files, env = process.env) {
+  const lines = files.reduce((n2, f) => n2 + f.added + f.deleted, 0);
+  const sensitive = files.flatMap((f) => {
+    const hit = SENSITIVE.find(([, re]) => re.test(f.path));
+    return hit && !isTestFile(f.path) ? [`${f.path} (${hit[0]})`] : [];
+  });
+  const testFiles = files.filter((f) => isTestFile(f.path));
+  const testsDeleted = testFiles.filter((f) => f.status === "deleted").map((f) => f.path);
+  const testsModified = [...testFiles.filter((f) => f.status !== "added" && f.status !== "deleted").map((f) => f.path), ...files.filter((f) => TEST_CFG.test(f.path)).map((f) => f.path)];
+  const api = files.filter((f) => API.test(f.path) && !isTestFile(f.path)).map((f) => f.path);
+  const high = [], med = [];
+  if (sensitive.length)
+    high.push(`sensitive paths: ${sensitive.slice(0, 5).join(", ")}${sensitive.length > 5 ? ` (+${sensitive.length - 5})` : ""}`);
+  if (testsDeleted.length)
+    high.push(`test files deleted: ${testsDeleted.join(", ")}`);
+  if (api.length)
+    high.push(`public API surface: ${api.slice(0, 3).join(", ")}`);
+  if (files.length >= FILES_HIGH)
+    high.push(`${files.length} files >= ${FILES_HIGH}`);
+  if (lines >= LINES_HIGH)
+    high.push(`${lines} changed lines >= ${LINES_HIGH}`);
+  if (testsModified.length)
+    med.push(`existing tests or test config modified: ${testsModified.slice(0, 3).join(", ")}`);
+  if (files.length >= FILES_MEDIUM)
+    med.push(`${files.length} files >= ${FILES_MEDIUM}`);
+  if (lines >= LINES_MEDIUM)
+    med.push(`${lines} changed lines >= ${LINES_MEDIUM}`);
+  const computed = high.length ? "high" : med.length ? "medium" : "low";
+  const reasons = high.length ? [...high, ...med] : med.length ? med : [`${files.length} file${files.length === 1 ? "" : "s"}, no sensitive paths`];
+  let tier = computed, override, ignored;
+  const asked = (env["LOKI_RISK_TIER"] ?? "").trim().toLowerCase();
+  if (asked in RANK2 && asked !== computed) {
+    const reason = (env["LOKI_RISK_OVERRIDE_REASON"] ?? "").trim();
+    if (RANK2[asked] > RANK2[computed]) {
+      tier = asked;
+      override = { from: computed, to: asked, reason: reason || "raised by LOKI_RISK_TIER" };
+    } else if (reason) {
+      tier = asked;
+      override = { from: computed, to: asked, reason };
+    } else
+      ignored = `LOKI_RISK_TIER=${asked} ignored: lowering from ${computed} needs LOKI_RISK_OVERRIDE_REASON`;
+  }
+  const plan = PLAN[tier], checks_deferred = deferredOf(tier, plan.selected, []);
+  const advisories = manifestsWithoutLock(files).map((p) => `manifest changed without lockfile: ${p}`);
+  const summary = summaryOf({ tier, computed, reasons, ...override ? { override } : {}, checks_deferred }) + (advisories.length ? `; advisory: ${advisories.join(", ")}` : "");
+  return {
+    version: 1,
+    tier,
+    computed,
+    reasons,
+    stats: { files: files.length, lines, sensitive, tests_modified: testsModified, tests_deleted: testsDeleted, api },
+    checks_selected: plan.selected,
+    checks_deferred,
+    ...override ? { override } : {},
+    ...ignored ? { override_ignored: ignored } : {},
+    ...advisories.length ? { advisories } : {},
+    summary
   };
-  for (let i = 0;i < sig.length; ) {
-    const k = skipLiteral(sig, i);
-    if (k !== i) {
-      out2 += sig.slice(i, k);
-      i = k;
-      continue;
-    }
-    if (sig[i] !== "@") {
-      out2 += sig[i];
-      i++;
+}
+function changedFiles(repoDir, baseSha) {
+  const run = (args) => safeGit(repoDir, args).split(`
+`).map((l) => l.trim()).filter(Boolean);
+  const tracked = run(["diff", "--name-only", baseSha]);
+  const untracked = run(["ls-files", "--others", "--exclude-standard"]);
+  return [...new Set([...tracked, ...untracked])].filter((f) => !f.startsWith(".loki/"));
+}
+function diffFiles(repoDir, baseSha) {
+  const paths = changedFiles(repoDir, baseSha), stat = new Map;
+  for (const l of safeGit(repoDir, ["diff", "--numstat", baseSha]).split(`
+`)) {
+    const [a, d, ...p] = l.split("\t"), path = p.join("\t");
+    if (path)
+      stat.set(path, { path, added: Number(a) || 0, deleted: Number(d) || 0 });
+  }
+  for (const l of safeGit(repoDir, ["diff", "--name-status", baseSha]).split(`
+`)) {
+    const [s, ...p] = l.split("\t"), f = stat.get(p[p.length - 1] ?? "");
+    if (f)
+      f.status = s?.startsWith("A") ? "added" : s?.startsWith("D") ? "deleted" : "modified";
+  }
+  const out2 = paths.map((path) => {
+    const f = stat.get(path);
+    if (f)
+      return f;
+    let n2 = 0;
+    try {
+      n2 = readFileSync28(join37(repoDir, path), "utf8").split(`
+`).length;
+    } catch {}
+    return { path, added: n2, deleted: 0, status: "added" };
+  });
+  for (const f of out2) {
+    if (f.status === "deleted" || !MANIFEST_LOCKS.some(([m]) => m.test(f.path)))
       continue;
-    }
-    const m = /^@[A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*/.exec(sig.slice(i, i + 200));
-    if (!m)
-      return null;
-    out2 += m[0];
-    i += m[0].length;
-    if (sig[i] === "(") {
-      out2 += "(...)";
-      i = skipBalanced(sig, i);
-    }
-    if (badNext(i))
-      return null;
+    try {
+      const oldText = f.status === "added" ? "" : safeGit(repoDir, ["show", `${baseSha}:${f.path}`]);
+      const newText = readFileSync28(join37(repoDir, f.path), "utf8");
+      const patch = f.status === "added" ? newText.split(`
+`).map((l) => `+${l}`).join(`
+`) : safeGit(repoDir, ["diff", "-U0", baseSha, "--", f.path]);
+      if (manifestDepsChanged(f.path, oldText, newText, patch))
+        f.deps = true;
+    } catch {}
   }
   return out2;
 }
-function skipBalanced(s, i) {
-  let d = 0;
-  while (i < s.length) {
-    const k = skipLiteral(s, i);
-    if (k !== i) {
-      i = k;
-      continue;
-    }
-    if ("([{".includes(s[i]))
-      d++;
-    else if (")]}".includes(s[i]) && --d === 0)
-      return i + 1;
-    i++;
+function recordRisk(repoDir, a) {
+  try {
+    const dir = join37(repoDir, ".loki", "state"), p = join37(dir, "risk-tier.json");
+    mkdirSync12(dir, { recursive: true });
+    writeFileSync15(`${p}.tmp`, JSON.stringify(a, null, 2) + `
+`);
+    renameSync7(`${p}.tmp`, p);
+    return p;
+  } catch {
+    return null;
   }
-  return s.length;
 }
-function maskExtends(head) {
-  let angle = 0, depth = 0;
-  for (let i = 0;i < head.length; ) {
-    const k = skipLiteral(head, i);
-    if (k !== i) {
-      i = k;
-      continue;
-    }
-    const c = head[i];
-    if ("([{".includes(c))
-      depth++;
-    else if (")]}".includes(c))
-      depth--;
-    else if (c === "<")
-      angle++;
-    else if (c === ">" && head[i - 1] !== "=")
-      angle = Math.max(0, angle - 1);
-    else if (depth === 0 && angle === 0 && /^extends\s/.test(head.slice(i)) && /\W/.test(head[i - 1] ?? " ")) {
-      const from = i + 7;
-      const im = /\simplements\s/.exec(head.slice(from));
-      const end = im ? from + im.index : head.length;
-      const expr = head.slice(from, end).trim();
-      const ok = /^[A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*(?:<[^()]*>)?$/.test(expr);
-      const tail = head.slice(end).trim();
-      return `${head.slice(0, i)}extends ${ok ? expr : "..."}${tail ? ` ${tail}` : ""}`;
+function truncateBytes(s, cap) {
+  const buf = Buffer.from(s, "utf8");
+  return buf.length <= cap ? s : buf.subarray(0, Math.max(0, cap)).toString("utf8").replace(/\uFFFD$/, "");
+}
+function failureExcerpt(out2, repoDir = "", cap = EXCERPT_GROUP_CAP) {
+  let t = stripAnsi(out2.slice(-65536)).replace(/\r/g, "");
+  if (repoDir)
+    t = t.split(repoDir.replace(/\/+$/, "") + "/").join("");
+  const lines = t.split(`
+`).map((l) => l.replace(/\s+$/, ""));
+  const pick = new Set;
+  const take = (i, n2 = 1) => {
+    for (let k = 0;k < n2 && i + k < lines.length; k++)
+      if (lines[i + k].trim())
+        pick.add(i + k);
+  };
+  lines.forEach((l, i) => {
+    if (/^E\s/.test(l))
+      take(i);
+    else if (/^\s*(Expected|Received)\b/.test(l) || /^\s*expect\(.*\)\.\w+/.test(l))
+      take(i);
+    else if (/^[\w./@-]+\.py:\d+: /.test(l))
+      take(i);
+    else if (/AssertionError|^\s*(expected|actual)\b.*[:=]|^\s*(not ok|FAILED)\b/.test(l))
+      take(i, 3);
+    else if (/^\s*--- FAIL/.test(l))
+      take(i, 4);
+    else if (/^[\w./@-]+\.\w+(\(\d+,\d+\)|:\d+(:\d+)?)[:\s].*\b(error|TS\d+|[A-Z]{1,3}\d{3,4})\b/.test(l))
+      take(i);
+  });
+  const lastFrame = lines.map((l, i) => /^[\w./@-]+\.py:\d+: /.test(l) ? i : -1).filter((i) => i >= 0).pop();
+  if (lastFrame !== undefined && [...pick].some((i) => /^E\s/.test(lines[i])))
+    take(lastFrame);
+  let body = [...pick].sort((a, b) => a - b).map((i) => lines[i]).join(`
+`);
+  if (!body)
+    body = lines.filter((l) => l.trim()).slice(-6).join(`
+`);
+  body = redactSecrets(body);
+  return truncateBytes(body, cap);
+}
+function pytestCollectionIsRed(output, repoDir) {
+  if (/ModuleNotFoundError/.test(output))
+    return false;
+  const real2 = (p) => {
+    try {
+      return realpathSync16(isAbsolute3(p) ? p : join37(repoDir, p));
+    } catch {
+      return null;
     }
-    i++;
+  };
+  const repoReal = real2(repoDir);
+  const under = (p) => {
+    const r = real2(p);
+    return !!repoReal && !!r && (r === repoReal || r.startsWith(`${repoReal}/`));
+  };
+  const imp = /ImportError: cannot import name .* from ['"][\w.]+['"] \(([^)]+)\)/.exec(output);
+  if (imp)
+    return under(imp[1]);
+  const hdr = [...output.matchAll(/^=+ short test summary info =+$/gm)].pop();
+  if (!hdr)
+    return false;
+  const cls = [...output.slice(hdr.index).matchAll(/^ERROR \S+ - (\w+Error): /gm)].pop()?.[1];
+  if (cls !== "AttributeError" && cls !== "NameError")
+    return false;
+  const start = output.search(/^_+ ERROR collecting /m);
+  if (start < 0 || start > hdr.index)
+    return false;
+  const block = output.slice(start, hdr.index).split(/^-+ Captured .*$/m)[0];
+  const eLines = [...block.matchAll(new RegExp(`^E {3}${cls}: (.*)$`, "gm"))];
+  const eLine = eLines[eLines.length - 1];
+  if (!eLine)
+    return false;
+  if (cls === "AttributeError") {
+    const m = /^module ['"]([\w.]+)['"] has no attribute/.exec(eLine[1]);
+    return !!m && moduleUnderRepo(repoDir, m[1]);
   }
-  return head;
+  const frames = [...block.slice(0, eLine.index).matchAll(/^(.+?):\d+: in \S+\n\s*(.*)$/gm)];
+  const last = frames[frames.length - 1];
+  return !!last && under(last[1]) && !/^\s*(import\s|from\s\S+\s+import\b)/.test(last[2] ?? "");
 }
-function enumSig(h) {
-  const open = h.indexOf("{");
-  if (open < 0)
-    return null;
-  const close = matchingBrace(h, open);
-  if (close >= h.length)
-    return null;
-  const names = [];
-  let depth = 0, from = open + 1;
-  const take = (to) => {
-    const nm = h.slice(from, to).split("=")[0].trim();
-    if (nm)
-      names.push(nm);
+function moduleUnderRepo(repoDir, name) {
+  const rel = name.replace(/\./g, "/");
+  return existsSync23(join37(repoDir, `${rel}.py`)) || existsSync23(join37(repoDir, rel, "__init__.py"));
+}
+function pytestExit1IsRed(output) {
+  if (/^!+ _pytest\.outcomes\.Exit\b/m.test(output))
+    return false;
+  if (/^=*\s*(\d+ \w+(, )?)*\d+ failed\b.* in [\d.]+s/.test(output.trimEnd().split(`
+`).pop() ?? ""))
+    return true;
+  const hdr = [...output.matchAll(/^=+ short test summary info =+$/gm)].pop();
+  return !!hdr && /^FAILED \S+/m.test(output.slice(hdr.index));
+}
+function parsedFailCount(runner, output) {
+  const m = runner === "bun" ? /^\s*(\d+)\s+fail\s*$/m.exec(output) : runner === "jest" ? /Tests:\s*(\d+)\s+failed/i.exec(output) : runner === "vitest" ? /Tests\s+(\d+)\s+failed/i.exec(output) : null;
+  return m ? Number(m[1]) : 0;
+}
+function nodeIsRed(f, raw2) {
+  const o = raw2.replace(/^# (?!(?:tests|suites|pass|fail|cancelled|skipped|todo|duration_ms|Subtest)\b)/gm, "");
+  const mod = /^Error(?: \[\w+\])?: Cannot find (?:module|package) '([^']+)'(?:(?!\u2716)[\s\S])*?\nNode\.js v/m.exec(o), top = /^(\S+):\d+\n.*\n.*\n\n?(?:ReferenceError|SyntaxError)\b/m.exec(o);
+  const named = [...o.matchAll(/^(?:\u2716|\s*not ok \d+ -) (?!failing tests:)(.+?)(?: \(|$)/gm)].some((m) => !f.path.endsWith(m[1]) && !m[1].endsWith(f.path)), blk = o.split("failing tests:")[1] ?? "", esm = /^SyntaxError: The requested module '([^']+)' does not provide an export named/m.exec(o), errs = [...blk.matchAll(/^ {2}(\w+Error): .*\n\s+at (?:.*\()?([^\s()]+?):\d+:\d+/gm), ...o.matchAll(/^ +name: '(\w+Error)'\n(?:.*\n)*? +stack: \|-\n\s+(?:.*\()?([^\s()]+?):\d+:\d+/gm)];
+  return /^(?:#|\u2139) fail [1-9]/m.test(raw2) && (/^ {2}AssertionError\b/m.test(blk) || /^ +name: 'AssertionError'/m.test(o) || (mod && !named ? /^[./]/.test(mod[1]) : esm ? /^[./]/.test(esm[1]) : top ? !top[1].endsWith(f.path) : !errs.length || errs.some((e) => !/^(?:Reference|Syntax)Error$/.test(e[1]) || !(e[2].startsWith("node:") || e[2].endsWith(f.path)))));
+}
+function notRunReason(status, interpreter) {
+  if (interpreter === "system")
+    return "ran under the system interpreter, not the project's, so the result proves nothing";
+  if (status === null)
+    return "the test runner did not start or timed out";
+  if (status === 126 || status === 127)
+    return `the test runner command was not found or not executable (exit ${status})`;
+  return status === 0 ? "exit 0 but no executed test count could be confirmed" : `exit ${status} but the runner output showed no readable failing test`;
+}
+function classify(f, status, output, repoDir, interpreter) {
+  if (interpreter === "system")
+    return "not_run";
+  output = stripAnsi(output);
+  if (status === null || status === 126 || status === 127)
+    return "not_run";
+  if (status === 0)
+    return classifyCheck({ kind: "test", ok: true, out: output, path: f.path, ...f.runner === "go" ? { runner: "go" } : {} }).result === "pass" ? "pass" : "not_run";
+  if (f.runner === "pytest")
+    return status === 1 ? pytestExit1IsRed(output) ? "fail" : "not_run" : status === 2 ? pytestCollectionIsRed(output, repoDir) ? "fail" : "not_run" : "not_run";
+  if (f.runner === "jest" || f.runner === "vitest" || f.runner === "bun")
+    return parsedFailCount(f.runner, output) > 0 ? "fail" : "not_run";
+  return f.runner === "node" && nodeIsRed(f, output) ? "fail" : "not_run";
+}
+var NO_TESTS_REASON = "no tests executed", GO_EXIT0_REASON = "test count could not be confirmed: go test output is produced by the code under test and cannot confirm execution (a Go exit 0 is never a pass)", UNCONFIRMED_REASON = "test count could not be confirmed", FAIL_EVIDENCE, GO_FAIL_EVIDENCE, UNMEASURED_REASON = "executed count unmeasured (Loki could not parse the runner summary, harness-owned)", stripAnsi = (s) => s.replace(/\u001b\][^\u0007\u001b]*(?:\u0007|\u001b\\)/g, "").replace(/(?:\u001b\[|\u009b)[0-9;?]*[ -\/]*[@-~]/g, "").replace(/\r\n?/g, `
+`), tailLines = (out2) => out2.split(`
+`).filter((x) => x.trim()).slice(-12), GO_PKG_RE, isExecutedProof = (c) => c.result === "pass" && typeof c.n === "number" && c.n > 0, hasExecutedProof = (checks) => checks.some(isExecutedProof), LLM_JUDGES, NON_RUNNER, normPath = (p) => p.replace(/^(?:\.\/)+/, ""), hasExogenousProof = (checks, ctx) => checks.some((c) => isExecutedProof(c) && ((p) => p !== "agent_authored" && p !== "llm_judge")(checkProvenance(c.name ?? "", ctx))), SENSITIVE, API, TEST_CFG, RANK2, FILES_MEDIUM = 4, FILES_HIGH = 15, LINES_MEDIUM = 100, LINES_HIGH = 500, RAN_ALWAYS, PLAN, LOW_SKIPPED, deferredOf = (tier, selected, executed) => (tier === "low" ? LOW_SKIPPED : selected).filter((c) => !RAN_ALWAYS.includes(c) && !executed.includes(c)), MANIFEST_LOCKS, dirOf = (p) => p.includes("/") ? p.slice(0, p.lastIndexOf("/")) : "", PKG_DEP_KEYS, PYPROJECT_NONDEP, EXCERPT_GROUP_CAP = 1500, EXCERPT_TOTAL_CAP = 6144;
+var init_check_result = __esm(() => {
+  init_testmap();
+  init_safe_git();
+  init_redact();
+  FAIL_EVIDENCE = /\[(?:build|setup) failed\]|^--- FAIL|^[\w./-]+\.go:\d+:\d+: \S|\b[1-9]\d* (?:failed|errors?)\b/m;
+  GO_FAIL_EVIDENCE = /^FAIL\t\S+\t[\d.]+s$|^panic: /m;
+  GO_PKG_RE = /^(?:ok|FAIL|\?)\s+\S+\s+(?:\(cached\)|[\d.]+s\b|\[(?:no test files|build failed|setup failed)\])/;
+  LLM_JUDGES = new Set(["council", "xreview", "code_review", "devils_advocate", "magic_debate"]);
+  NON_RUNNER = new Set(["lint", "typecheck", "holdout", "select-tests"]);
+  SENSITIVE = [
+    ["auth", /(^|\/)(auth|oauth|sso|session|login|permission|rbac|acl)[\w.-]*(\/|\.|$)/i],
+    ["crypto", /(^|\/)(crypt|crypto|jwt|signing|keys?|secrets?|tokens?|credential|password)[\w.-]*(\/|\.|$)/i],
+    ["payments", /(^|\/)(payments?|billing|checkout|stripe|invoice)[\w.-]*(\/|\.|$)/i],
+    ["migration", /(^|\/)(migrations?|alembic)\/|\.sql$/i],
+    ["ci", /(^|\/)(\.github\/(workflows|actions)|\.gitlab-ci\.yml|\.circleci|Jenkinsfile|azure-pipelines)/i],
+    ["lockfile", /(^|\/)(package-lock\.json|pnpm-lock\.yaml|bun\.lockb?|go\.sum|[\w-]+\.lock)$/],
+    ["infra", /(^|\/)(Dockerfile[\w.-]*|docker-compose[\w.-]*\.ya?ml|terraform|helm|k8s|kubernetes|infra|deploy)(\/|\.|$)|\.tf$/i],
+    ["env", /(^|\/)\.env[\w.]*$/]
+  ];
+  API = /(^|\/)(openapi|swagger)[\w.-]*\.(ya?ml|json)$|\.proto$|\.d\.ts$|(^|\/)(api|routes|public)\/|(^|\/)index\.(ts|js|py)$/i;
+  TEST_CFG = /(^|\/)(conftest\.py|\.?pytest\.(ini|toml)|tox\.ini|jest\.config\.[\w.]+|vitest\.config\.[\w.]+)$/;
+  RANK2 = { low: 0, medium: 1, high: 2 };
+  RAN_ALWAYS = ["targeted tests", "lint of changed files"];
+  PLAN = {
+    low: { selected: [...RAN_ALWAYS] },
+    medium: { selected: [...RAN_ALWAYS, "full test command", "one reviewer"] },
+    high: { selected: [...RAN_ALWAYS, "full test command", "full suite", "council", "security scan"] }
   };
-  for (let i = open + 1;i < close; ) {
-    const k = skipLiteral(h, i);
-    if (k !== i) {
-      i = k;
-      continue;
+  LOW_SKIPPED = ["full test command", "reviewer", "council", "security scan"];
+  MANIFEST_LOCKS = [
+    [/(^|\/)package\.json$/, /(^|\/)(package-lock\.json|npm-shrinkwrap\.json|pnpm-lock\.yaml|yarn\.lock|bun\.lockb?)$/],
+    [/(^|\/)pyproject\.toml$/, /(^|\/)(poetry\.lock|uv\.lock|pdm\.lock|Pipfile\.lock)$/],
+    [/(^|\/)go\.mod$/, /(^|\/)go\.sum$/]
+  ];
+  PKG_DEP_KEYS = ["dependencies", "devDependencies", "peerDependencies", "optionalDependencies"];
+  PYPROJECT_NONDEP = /^(name|version|description|readme|license|requires-python|python|authors|maintainers|keywords|classifiers|homepage|repository|documentation|packages|include|exclude)$/;
+});
+
+// ../../loki-ts/src/util/receipt_signer.ts
+import { createHash as createHash8, randomBytes as randomBytes3, createPrivateKey, createPublicKey as createPublicKey2, generateKeyPairSync, sign, verify as verify2 } from "crypto";
+import { chmodSync as chmodSync4, linkSync, mkdirSync as mkdirSync13, readdirSync as readdirSync13, readFileSync as readFileSync29, renameSync as renameSync8, statSync as statSync14, unlinkSync as unlinkSync4, writeFileSync as writeFileSync16 } from "fs";
+import { homedir as homedir8 } from "os";
+import { spawnSync as spawnSync2 } from "child_process";
+import { dirname as dirname12, join as join38 } from "path";
+function canonicalJson(x) {
+  const walk = (v) => {
+    if (Array.isArray(v))
+      return `[${v.map(walk).join(",")}]`;
+    if (v !== null && typeof v === "object") {
+      const o = v;
+      return `{${Object.keys(o).filter((k) => o[k] !== undefined).sort().map((k) => `${JSON.stringify(k)}:${walk(o[k])}`).join(",")}}`;
     }
-    const c = h[i];
-    if ("([{".includes(c))
-      depth++;
-    else if (")]}".includes(c))
-      depth--;
-    else if (c === "," && depth === 0) {
-      take(i);
-      from = i + 1;
+    return JSON.stringify(v ?? null);
+  };
+  return walk(x).replace(/[\u0080-\uFFFF]/g, (c) => `\\u${c.charCodeAt(0).toString(16).padStart(4, "0")}`);
+}
+function loadSigningKey(generate = true) {
+  try {
+    const inline = process.env["LOKI_RECEIPT_SIGNING_KEY"]?.trim();
+    let pem = inline ?? "";
+    if (!inline) {
+      const given = process.env["LOKI_RECEIPT_SIGNING_KEY_FILE"]?.trim();
+      const file = given || join38(process.env["HOME"] || homedir8(), ".loki", "keys", RECEIPT_SIGNER_BASENAME);
+      try {
+        pem = readFileSync29(file);
+        if (!given) {
+          for (const [f, m] of [[file, 384], [dirname12(file), 448]])
+            if (statSync14(f).mode & 63)
+              chmodSync4(f, m);
+        }
+      } catch (e) {
+        if (e.code !== "ENOENT" || !generate)
+          return null;
+        mkdirSync13(dirname12(dirname12(file)), { recursive: true, mode: 448 });
+        mkdirSync13(dirname12(file), { recursive: true, mode: 448 });
+        const tmp = `${file}.${randomBytes3(6).toString("hex")}.tmp`;
+        writeFileSync16(tmp, generateKeyPairSync("ed25519").privateKey.export({ type: "pkcs8", format: "pem" }), { flag: "wx", mode: 384 });
+        try {
+          linkSync(tmp, file);
+        } catch (l) {
+          if (l.code !== "EEXIST")
+            throw l;
+        } finally {
+          unlinkSync4(tmp);
+        }
+        pem = readFileSync29(file);
+      }
     }
-    i++;
+    const k = createPrivateKey(pem);
+    return k.asymmetricKeyType === "ed25519" ? k : null;
+  } catch {
+    return null;
   }
-  take(close);
-  return `${h.slice(0, open).trim()} { ${names.join(", ")} }`;
 }
-function tsSignatures(src, jsx) {
-  const out2 = [];
-  for (const it of items(src)) {
-    const h = it.head.trim();
-    if (!/^export\b/.test(h))
-      continue;
-    const lines = [];
-    if (/^export\s+(declare\s+)?enum\b/.test(h)) {
-      lines.push(enumSig(h) ?? exportHead(h, it.end));
-    } else if (/^export\s+(declare\s+)?(type|interface)\b|^export\s*(type\s*)?[{*]/.test(h)) {
-      lines.push(exportHead(h, it.end));
-    } else if (/^export\s+(default\s+)?(abstract\s+)?class\b/.test(h)) {
-      const ms = jsx || !it.balanced ? [] : items(it.body ?? "");
-      const sigs = ms.map((m) => strictMember(m) ? memberSig(m.head.trim()) : null).map((m) => m === null ? null : maskDefaults(m));
-      const dropped = ms.some((m) => !strictMember(m)) || sigs.some((m) => m !== null && (hasTopSemi(m) || NOT_MEMBER.test(m)));
-      const keep = dropped ? [] : sigs.filter((m) => !!m);
-      const headM = maskDecorators(exportHead(h, ""));
-      const memM = keep.map(maskDecorators);
-      if (headM !== null && !memM.includes(null))
-        lines.push(`${maskExtends(headM)} {`, ...memM.map((m) => `  ${m};`), "}");
-    } else if (/^export\s+(default\s+)?@/.test(h)) {
-      const dm = maskDecorators(h);
-      if (dm !== null)
-        lines.push(maskExtends(dm));
-    } else if (/^export\s+default\s/.test(h)) {
-      const rest = h.replace(/^export\s+default\s+/, "");
-      const len = arrowHeadLen(rest);
-      if (len > 0)
-        lines.push(`export default ${rest.slice(0, len)}`);
-      else if (/^(async\s+)?function\b/.test(rest))
-        lines.push(memberSig(h) ?? h);
-      else
-        lines.push(/^[\w$.]+$/.test(rest) ? h : "export default ...");
-    } else if (/^export\s+(const|let|var)\b/.test(h)) {
-      lines.push(splitDeclarators(h).map((p) => memberSig(p.trim()) ?? p.trim()).join(", "));
-    } else {
-      lines.push(memberSig(h) ?? h);
-    }
-    if (!lines.length)
-      continue;
-    const masked = /^export\s+(declare\s+)?(type|interface|enum)\b|^export\s*(type\s*)?[{*]|^export\s+(default\s+)?(abstract\s+)?class\b/.test(h) ? lines : lines.map((l) => {
-      const d = maskDecorators(l);
-      return d === null ? null : maskDefaults(d);
-    });
-    if (masked.includes(null))
-      continue;
-    const done = masked;
-    if (!done.some(hasTopSemi))
-      out2.push(...done);
+function signReceipt(runId, hash) {
+  const key = loadSigningKey();
+  if (!key)
+    return { jwt: null, kid: null };
+  const kid = kidOf2(createPublicKey2(key));
+  const input = `${b64u(canonicalJson({ alg: "EdDSA", typ: "JWT", kid }))}.${b64u(canonicalJson({ job_id: runId, run_id: runId, receipt_sha256: hash, iat: Math.floor(Date.now() / 1000) }))}`;
+  return { jwt: `${input}.${b64u(sign(null, Buffer.from(input), key))}`, kid };
+}
+function toolVersion(bin) {
+  try {
+    const r = spawnSync2(bin, ["--version"], { env: plainTestEnv(), encoding: "utf8", timeout: 5000, killSignal: "SIGKILL", stdio: ["ignore", "pipe", "ignore"] });
+    return r.status === 0 ? /\d+(\.\d+)+\S*/.exec(String(r.stdout))?.[0] ?? null : null;
+  } catch {
+    return null;
   }
-  return out2;
 }
-var REGEX_PREV = "(,=:[!&|?{;+-*%~^", isComment = (s, i) => s[i] === "/" && (s[i + 1] === "/" || s[i + 1] === "*"), MODS = "(?:(?:public|private|protected|static|readonly|abstract|async|get|set|declare|override)\\s+)*", MEMBER_GRAMMAR, NOT_MEMBER, RESERVED_AFTER_DECORATOR;
-var init_ts_signatures = __esm(() => {
-  MEMBER_GRAMMAR = new RegExp(`^(?:@[\\w$.]+(?:\\([^)]*\\))?\\s*)*${MODS}\\*?\\s*(?:[A-Za-z_$][\\w$]*|#[A-Za-z_$][\\w$]*|\\[[^\\]]*\\])\\s*[?!]?\\s*(?:[(<:=]|$)`);
-  NOT_MEMBER = /^(return|const|let|var|if|else|for|while|do|switch|case|default|throw|try|catch|finally|new|await|yield|break|continue|import|export|function|delete|typeof|void)\b/;
-  RESERVED_AFTER_DECORATOR = /^(?:if|else|for|while|do|switch|case|try|catch|finally|return|throw|with|var|let|const|function|new|delete|typeof|void|yield|await|break|continue|import|debugger|instanceof|this|super|null|true|false)(?![\w$])/;
+var RECEIPT_SIGNER_BASENAME = "receipt-ed25519.pem", b64u = (b) => Buffer.from(b).toString("base64url"), kidOf2 = (pub) => b64u(createHash8("sha256").update(`{"crv":"Ed25519","kty":"OKP","x":"${pub.export({ format: "jwk" }).x}"}`).digest()), TOOLCHAIN_KEYS, collectToolchain = (probe = toolVersion) => ({ bun: process.versions["bun"] ?? probe("bun"), node: probe("node"), python3: probe("python3"), git: probe("git") });
+var init_receipt_signer = __esm(() => {
+  init_check_result();
+  TOOLCHAIN_KEYS = ["bun", "node", "python3", "git"];
 });
 
-// ../../loki-ts/src/util/failure_memory.ts
-var init_failure_memory = __esm(() => {
-  init_cache();
-  init_safe_git();
+// ../../loki-ts/src/engine10/registry.ts
+var init_registry = () => {};
+
+// ../../loki-ts/src/engine10/output.ts
+var init_output = __esm(() => {
+  init_registry();
+  init_redact();
+  init_types();
 });
 
-// ../../loki-ts/src/e10ext/repomemory.ts
-var init_repomemory = __esm(() => {
-  init_cache();
-  init_failure_memory();
+// ../../loki-ts/src/e10ext/stop_restore.ts
+var init_stop_restore = __esm(() => {
+  init_safe_git();
 });
 
-// ../../loki-ts/src/engine10/failures.ts
-function failCount(out2) {
-  const n2 = (s, re) => +(s.match(re)?.[1] ?? 0);
-  const l = out2.split(`
-`).reverse().map((x) => x.trim()).find((x) => /^(?:=+ )?\d+ \w+.* in [\d.]+s|^Tests?:?\s+\d/.test(x)), m = /^(?:#|\u2139) fail (\d+)$/m.exec(out2);
-  return l ? n2(l, /(\d+) failed/) + n2(l, /(\d+) errors?/) : m ? +m[1] : null;
-}
-function failIds(output) {
-  const ids = [...new Set(output.split(`
-`).map((l) => ID_LINE.exec(l.trim())).flatMap((m) => m ? [(m.slice(1).find(Boolean) ?? "").trim()] : []).filter(Boolean))];
-  const c = failCount(output);
-  return c && ids.length >= c ? ids : [];
-}
-var ID_LINE;
-var init_failures = __esm(() => {
-  ID_LINE = /^(?:(?:FAILED|ERROR)\s+(\S+::\S*)(?:\s.*)?|\u25cf\s+(?!Console|Test suite failed)(.+)|not ok \d+ - (.+?)(?:\s+#.*)?|\u2716\s+(?!failing tests:)(.+?)(?:\s+\([\d.]+ms\))?|(?:FAIL|\u00d7)\s+(.+))$/;
+// ../../loki-ts/src/util/base_guard.ts
+var init_base_guard = __esm(() => {
+  init_run_status();
+  init_safe_git();
 });
 
-// ../../loki-ts/src/project_model/api.ts
-import { posix } from "path";
-function projectApi(model) {
-  const known = isRec2(model) && model.status === "ok";
-  const packages = known && Array.isArray(model.packages) ? model.packages.filter(wellFormed) : [];
-  const packageOf = (file) => {
-    const f = clean(file);
-    if (f === "")
-      return null;
-    let best = null;
-    for (const p of packages) {
-      const hit = p.root === "." || f === p.root || f.startsWith(`${p.root}/`);
-      if (hit && (best === null || p.root !== "." && (best.root === "." || p.root.length > best.root.length)))
-        best = p;
-    }
-    return best;
-  };
-  return {
-    model,
-    known: () => known,
-    packages: () => packages,
-    workspaceKind: () => isRec2(model) && typeof model.workspaceKind === "string" ? model.workspaceKind : "unknown",
-    packageRootOf: (file) => packageOf(file)?.root ?? null,
-    packageOf,
-    relativeToRoot: (file) => {
-      const p = packageOf(file);
-      return p ? p.root === "." ? clean(file) : clean(file).slice(p.root.length + 1) : null;
-    },
-    commandFor: (pkg, kind) => (packages.find((p) => p.root === clean(pkg) || p.name === pkg) ?? null)?.commands?.[kind] ?? null,
-    dependsOn: (pkg) => {
-      const d = (packages.find((p) => p.root === clean(pkg) || p.name === pkg) ?? null)?.dependsOn;
-      return Array.isArray(d) ? d.filter((x) => typeof x === "string") : null;
-    },
-    installFor: (pkg) => {
-      const i = (packages.find((p) => p.root === clean(pkg) || p.name === pkg) ?? null)?.install;
-      return isRec2(i) && typeof i.cmd === "string" ? i : null;
-    },
-    hasUI: () => packages.some((p) => isRec2(p.ui) && p.ui.present === true),
-    uiBoot: () => {
-      for (const p of packages)
-        if (isRec2(p.ui) && p.ui.present === true && isRec2(p.ui.boot))
-          return { pkg: p, boot: p.ui.boot };
+// ../../loki-ts/src/features/speed/unit_mode.ts
+import { closeSync as closeSync7, constants, fstatSync as fstatSync5, lstatSync as lstatSync8, openSync as openSync7, readSync as readSync6, realpathSync as realpathSync17 } from "fs";
+function readBounded(path) {
+  const l = lstatSync8(path);
+  if (l.isSymbolicLink() || !l.isFile() || l.size > MAX_SPEC_BYTES)
+    return null;
+  const fd = openSync7(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+  try {
+    const st = fstatSync5(fd);
+    if (!st.isFile() || st.size > MAX_SPEC_BYTES)
       return null;
+    const buf = Buffer.alloc(st.size + 1);
+    let n2 = 0;
+    for (;; ) {
+      const r = readSync6(fd, buf, n2, buf.length - n2, null);
+      if (r <= 0)
+        break;
+      n2 += r;
+      if (n2 >= buf.length)
+        return null;
     }
-  };
+    return buf.subarray(0, n2).toString("utf8");
+  } finally {
+    closeSync7(fd);
+  }
 }
-var clean = (p) => typeof p === "string" ? posix.normalize(p.replace(/\\/g, "/")).replace(/^\.\//, "") : "", isRec2 = (v) => typeof v === "object" && v !== null, wellFormed = (p) => isRec2(p) && typeof p.root === "string" && typeof p.name === "string";
-var init_api = () => {};
-
-// ../../loki-ts/src/project_model/resolve.ts
-import { join as join36 } from "path";
-function loadProjectApi(repoDir, env = process.env) {
-  if (!projectModelEnabled(env))
-    return null;
+function parseText(txt) {
   try {
-    const model = loadCached(repoDir);
-    const api = model ? projectApi(model) : null;
-    return api && api.known() ? api : null;
+    const j = JSON.parse(txt), ws = strs(j.writeSet), pack = strs(j.pack), tb = j.tokenBudget;
+    if (typeof j.id !== "string" || !j.id || !ws || ws.length === 0 || !pack || typeof tb !== "number" || !Number.isFinite(tb) || !(tb > 0) || tb > MAX_TOKEN_BUDGET)
+      return null;
+    const acc = j.acceptance === undefined ? [] : strs(j.acceptance);
+    if (acc === null)
+      return null;
+    return { id: j.id, writeSet: ws, pack, tokenBudget: tb, ...acc.length ? { acceptance: acc.map((a) => a.slice(0, 500)).slice(0, 50) } : {} };
   } catch {
     return null;
   }
 }
-function isMultiRoot(api) {
-  return !!api && api.known() && api.packages().some((p) => p.root !== ".");
-}
-function siteFor(api, repoDir, file) {
-  if (!isMultiRoot(api))
-    return null;
-  const pkg = api.packageOf(file);
-  const rel = api.relativeToRoot(file);
-  if (!pkg || pkg.root === "." || rel === null)
+function parseSpec(path) {
+  try {
+    const txt = readBounded(path);
+    return txt === null ? null : parseText(txt);
+  } catch {
     return null;
-  return { pkg, root: pkg.root, cwd: join36(repoDir, pkg.root), file: rel };
-}
-function groupByPackage(api, repoDir, files) {
-  const out2 = new Map;
-  for (const f of files) {
-    const s = siteFor(api, repoDir, f);
-    const root = s?.root ?? ".";
-    const g = out2.get(root) ?? { root, cwd: s?.cwd ?? repoDir, files: [], rel: [] };
-    g.files.push(f);
-    g.rel.push(s?.file ?? f);
-    out2.set(root, g);
   }
-  return [...out2.values()];
 }
-var init_resolve = __esm(() => {
-  init_discover2();
-  init_api();
-});
-// ../../loki-ts/src/project_model/scope.ts
-function scopedOutOf(map) {
-  return [...dropped.get(map) ?? []].sort();
+function unitSpec(env = process.env) {
+  const path = env["LOKI_UNIT_SPEC"], frozen = env["LOKI_UNIT_SPEC_FROZEN"];
+  if (env["LOKI_SPEED"] === "0" || !path)
+    return null;
+  if (frozen !== undefined)
+    return frozen.length <= MAX_SPEC_BYTES ? parseText(frozen) : null;
+  if (!memo.has(path))
+    memo.set(path, parseSpec(path));
+  return memo.get(path) ?? null;
 }
-var apis, imports, dropped;
-var init_scope = __esm(() => {
-  init_resolve();
-  apis = new WeakMap;
-  imports = new WeakMap;
-  dropped = new WeakMap;
-});
-
-// ../../loki-ts/src/util/test_file_text.ts
-import { basename as basename9 } from "path";
-function isTestFile(rel) {
-  const name = basename9(rel);
-  return JS_TEST_RE.test(name) || PY_TEST_RE.test(name) || GO_TEST_RE.test(name);
+function unitFlags(staged, env = process.env, pre = {}) {
+  const s = unitSpec(env);
+  return s ? staged.filter(({ f }) => !inWriteSet(s, f) && !Object.hasOwn(pre, f)).map(({ f }) => f) : null;
 }
-var JS_TEST_RE, PY_TEST_RE, GO_TEST_RE;
-var init_test_file_text = __esm(() => {
-  JS_TEST_RE = /\.(test|spec)\.[cm]?[jt]sx?$/;
-  PY_TEST_RE = /^(test_.+|.+_test)\.py$/;
-  GO_TEST_RE = /_test\.go$/;
+var MAX_SPEC_BYTES, MAX_TOKEN_BUDGET = 1e9, norm2 = (p) => p.replace(/^\.\//, ""), CTRL, strs = (v) => Array.isArray(v) && v.every((x) => typeof x === "string" && !CTRL.test(x)) ? v.map(norm2) : null, memo, inWriteSet = (spec, f) => spec.writeSet.some((w) => w.endsWith("/") ? f.startsWith(w) : f === w);
+var init_unit_mode = __esm(() => {
+  MAX_SPEC_BYTES = 1024 * 1024;
+  CTRL = /[\x00-\x1f\x7f]/;
+  memo = new Map;
 });
 
-// ../../loki-ts/src/engine10/testmap.ts
-import { existsSync as existsSync22, readdirSync as readdirSync13, readFileSync as readFileSync28, realpathSync as realpathSync16 } from "fs";
-import { basename as basename10, extname, isAbsolute as isAbsolute2, join as join37, relative, sep as sep10 } from "path";
-function projectInterpreter(root) {
-  const ve = process.env["VIRTUAL_ENV"], inRepo = (p) => {
-    try {
-      const r = relative(realpathSync16(root), realpathSync16(p));
-      return r !== "" && !r.startsWith("..") && !isAbsolute2(r);
-    } catch {
-      return false;
-    }
-  };
-  return [join37(root, ".venv", "bin", "python"), join37(root, "venv", "bin", "python"), ...ve && inRepo(ve) ? [join37(ve, "bin", "python")] : []].some(existsSync22) ? "project" : "system";
+// ../../loki-ts/src/util/ts_signatures.ts
+function templateEnd(s, i) {
+  for (let j = i + 1;j < s.length; ) {
+    const c = s[j];
+    if (c === "\\")
+      j += 2;
+    else if (c === "`")
+      return j + 1;
+    else if (c === "$" && s[j + 1] === "{") {
+      let depth = 1;
+      j += 2;
+      while (j < s.length && depth > 0) {
+        const k = skipLiteral(s, j);
+        if (k !== j) {
+          j = k;
+          continue;
+        }
+        if (s[j] === "{")
+          depth++;
+        else if (s[j] === "}")
+          depth--;
+        j++;
+      }
+    } else
+      j++;
+  }
+  return s.length;
 }
-var SKIP_DIRS;
-var init_testmap = __esm(() => {
-  init_resolve();
-  init_scope();
-  init_test_file_text();
-  SKIP_DIRS = new Set([
-    ".git",
-    "node_modules",
-    "dist",
-    "build",
-    "target",
-    "coverage",
-    ".venv",
-    "venv",
-    "__pycache__",
-    ".tox",
-    ".pytest_cache",
-    ".loki",
-    ".next"
-  ]);
-});
-
-// ../../loki-ts/src/util/check_result.ts
-import { existsSync as existsSync23, mkdirSync as mkdirSync13, readFileSync as readFileSync29, realpathSync as realpathSync17, renameSync as renameSync8, writeFileSync as writeFileSync16 } from "fs";
-import { basename as basename11, isAbsolute as isAbsolute3, join as join38 } from "path";
-function plainTestEnv(base = process.env) {
-  const e = {};
-  for (const [k, v] of Object.entries(tokenFreeEnv(base)))
-    if (typeof v === "string")
-      e[k] = v;
-  e["FORCE_COLOR"] = "0";
-  e["NO_COLOR"] = "1";
-  delete e["CLICOLOR_FORCE"];
-  return e;
+function commentBefore(s, i) {
+  let p = i - 1;
+  while (p >= 0 && /\s/.test(s[p]))
+    p--;
+  if (p < 1)
+    return false;
+  if (s[p] === "/" && s[p - 1] === "*")
+    return true;
+  return s.slice(s.lastIndexOf(`
+`, p) + 1, p + 1).includes("//");
 }
-function ran(raw2, path, ok) {
-  const out2 = stripAnsi(raw2);
-  const n2 = (s, re) => +(s.match(re)?.[1] ?? 0);
-  const blk = out2.trimEnd().match(/(?:^|\n)((?:(?:#|\u2139) \w+ [\d.]+(?:\n|$)){5,})$/)?.[1];
-  if (blk) {
-    const c = n2(blk, /(?:#|\u2139) pass (\d+)/) + n2(blk, /(?:#|\u2139) fail (\d+)/);
-    const nm = out2.match(/^(?:ok \d+ - |\u2714 )(\S+\.[cm]?[jt]s)(?: \(|$)/m)?.[1];
-    return c === 1 && nm && (!path || basename11(nm) === basename11(path)) ? 0 : c;
+function regexEnd(s, i) {
+  if (commentBefore(s, i))
+    return i;
+  let p = i - 1;
+  while (p >= 0 && /\s/.test(s[p]))
+    p--;
+  if (p >= 1 && (s[p] === "+" || s[p] === "-") && s[p - 1] === s[p])
+    return i;
+  if (p >= 0 && !REGEX_PREV.includes(s[p]) && !/\b(return|typeof|case|in|of|void|delete|throw)$/.test(s.slice(Math.max(0, p - 7), p + 1)))
+    return i;
+  let inClass = false;
+  for (let j = i + 1;j < s.length; j++) {
+    const c = s[j];
+    if (c === `
+`)
+      return i;
+    if (c === "\\")
+      j++;
+    else if (c === "[")
+      inClass = true;
+    else if (c === "]")
+      inClass = false;
+    else if (c === "/" && !inClass) {
+      j++;
+      while (j < s.length && /[a-z]/i.test(s[j]))
+        j++;
+      return j;
+    }
   }
-  const cg = cargoTrailer(out2);
-  if (cg.length)
-    return cg.reduce((t, l2) => t + n2(l2, /(\d+) passed/) + n2(l2, /(\d+) failed/), 0);
-  const g = goCount(out2, ok);
-  if (g !== undefined)
-    return g;
-  const tail = tailLines(out2);
-  const l = tail.filter((x) => /^(?:=+ )?(?:\d+ \w+.*|no tests ran) in [\d.]+s|^\s*Tests?:?\s+\d|^No tests found/.test(x) && (!/^\s*Tests?:?\s+\d/.test(x) || tail.some((y) => /^\s*Test (?:Files|Suites):?\s+\d/.test(y)))).pop();
-  if (!l)
-    return null;
-  return /^(?:=+ )?no tests (?:ran|found)|^No tests found|skipped/i.test(l) || /\d+ (?:passed|failed|errors?)/.test(l) ? n2(l, /(\d+) passed/) + n2(l, /(\d+) failed/) + n2(l, /(\d+) errors?/) : null;
+  return i;
 }
-function cargoTrailer(out2) {
-  const ls = out2.split(`
-`).filter((x) => x.trim());
-  while (ls.length && /^error: /.test(ls[ls.length - 1]))
-    ls.pop();
-  const segs = [];
-  for (const l of ls) {
-    if (/^running \d+ tests?\b/.test(l))
-      segs.push([]);
-    else if (segs.length && !/^\s*(?:Running |Doc-tests |Doctest)/.test(l))
-      segs[segs.length - 1].push(l);
-  }
-  const lastOf = (g) => g[g.length - 1]?.startsWith("test result: ") ? g[g.length - 1] : undefined;
-  if (!segs.length) {
-    const g = [];
-    for (let k = ls.length - 1;k >= 0 && ls[k].startsWith("test result: "); k--)
-      g.push(ls[k]);
-    return g;
+function stripComments(t) {
+  let out2 = "";
+  for (let i = 0;i < t.length; ) {
+    if (isComment(t, i)) {
+      const e = t[i + 1] === "/" ? t.indexOf(`
+`, i) < 0 ? t.length : t.indexOf(`
+`, i) : t.indexOf("*/", i + 2) < 0 ? t.length : t.indexOf("*/", i + 2) + 2;
+      out2 += t[i + 1] === "/" ? "" : " ";
+      i = e;
+      continue;
+    }
+    const c = t[i];
+    const k = c === '"' || c === "'" || c === "`" ? skipLiteral(t, i) : i;
+    if (k !== i) {
+      out2 += t.slice(i, k);
+      i = k;
+      continue;
+    }
+    out2 += c;
+    i++;
   }
-  if (!lastOf(segs[segs.length - 1]))
-    return [];
-  return segs.flatMap((g) => lastOf(g) ?? []);
-}
-function bunCount(out2) {
-  const ls = out2.split(`
-`).filter((x) => x.trim());
-  if (!/^Ran \d+ tests? across \d+ files?\./.test(ls[ls.length - 1] ?? ""))
-    return null;
-  const blk = ls.slice(-9, -1);
-  const last = (k) => +(blk.map((x) => x.match(new RegExp(`^\\s*(\\d+) ${k}\\s*$`))?.[1]).filter(Boolean).pop() ?? 0);
-  return last("pass") + last("fail");
+  return out2;
 }
-function unittestCount(out2, ok) {
-  const ls = out2.split(`
-`).filter((x) => x.trim()), v = ls[ls.length - 1] ?? "", r = ls[ls.length - 2]?.match(/^Ran (\d+) tests? in [\d.]+s$/);
-  if (!r || !/^(?:OK|FAILED)\b/.test(v))
-    return null;
-  if (ls.filter((x) => /^Ran \d+ tests? in [\d.]+s$/.test(x)).length > 1)
-    return null;
-  if (ok === true && v.startsWith("FAILED") || ok === false && v.startsWith("OK"))
-    return null;
-  return Math.max(0, +r[1] - +(v.match(/skipped=(\d+)/)?.[1] ?? 0) - +(v.match(/expected failures=(\d+)/)?.[1] ?? 0));
+function skipLiteral(s, i) {
+  const c = s[i];
+  if (c === "/" && s[i + 1] === "/") {
+    const n2 = s.indexOf(`
+`, i);
+    return n2 < 0 ? s.length : n2;
+  }
+  if (c === "/" && s[i + 1] === "*") {
+    const n2 = s.indexOf("*/", i + 2);
+    return n2 < 0 ? s.length : n2 + 2;
+  }
+  if (c === "/")
+    return regexEnd(s, i);
+  if (c === "`")
+    return templateEnd(s, i);
+  if (c !== '"' && c !== "'")
+    return i;
+  for (let j = i + 1;j < s.length; j++) {
+    if (s[j] === "\\")
+      j++;
+    else if (s[j] === c)
+      return j + 1;
+    else if (s[j] === `
+`)
+      return i;
+  }
+  return s.length;
 }
-function goCount(out2, ok) {
-  const lines = out2.split(`
-`);
-  if (!lines.some((x) => GO_PKG_RE.test(x)))
-    return;
-  const last = new Map, seen = new Set, skip = new Set, failPkg = ok !== true && lines.some((x) => /^FAIL\s+\S+\s+[\d.]+s\b/.test(x));
-  for (const x of lines) {
-    const r = x.match(/^=== RUN\s+(\S+)/), m = x.match(/^--- (PASS|FAIL|SKIP): (\S+)/);
-    if (r)
-      seen.add(r[1]);
-    else if (m && (seen.has(m[2]) || m[1] === "FAIL" && failPkg)) {
-      last.set(m[2], m[1]);
-      if (m[1] === "SKIP")
-        skip.add(m[2]);
+function matchingBrace(s, open) {
+  let depth = 0;
+  for (let i = open;i < s.length; ) {
+    const j = skipLiteral(s, i);
+    if (j !== i) {
+      i = j;
+      continue;
     }
+    if (s[i] === "{")
+      depth++;
+    else if (s[i] === "}" && --depth === 0)
+      return i;
+    i++;
   }
-  for (const k of skip)
-    last.set(k, "SKIP");
-  if (ok === true && [...last.values()].includes("FAIL"))
-    return null;
-  const t = [...last.values()].filter((v) => v !== "SKIP").length;
-  if (t > 0)
-    return t;
-  if (lines.some((x) => /^(?:=== RUN|PASS$|FAIL$|testing: warning: no tests to run)/.test(x)))
-    return 0;
-  return lines.filter((x) => GO_PKG_RE.test(x)).every((x) => /\[no tests? (?:files|to run)\]/.test(x)) ? 0 : null;
+  return s.length;
 }
-function goRunner(cmd, args) {
-  const segs = args ? [[cmd, ...args]] : cmd.split(/&&|\|\||[;|\n]/).map((x) => x.trim().split(/\s+/).filter(Boolean));
-  for (const t0 of segs) {
-    const t = t0.map((x) => x.replace(/^["']|["']$/g, ""));
-    let k = 0;
-    for (;k < t.length; k++) {
-      const x = t[k];
-      if (/^[A-Za-z_]\w*=/.test(x) || /^(?:env|command|exec|time|nohup)$/.test(basename11(x)))
-        continue;
-      if (/^-/.test(x) && k > 0 && basename11(t[k - 1]) === "env") {
-        if (x === "-u" || x === "-C" || x === "-S")
-          k++;
+function items(src) {
+  const out2 = [];
+  let start = 0, head = "", p = 0, i = 0;
+  const push = (end, body, stop, balanced = true) => {
+    if (head.trim())
+      out2.push({ head, raw: src.slice(start, stop).trim(), end, body, balanced });
+    head = "";
+    p = 0;
+    start = stop;
+  };
+  while (i < src.length) {
+    const j = skipLiteral(src, i);
+    if (j !== i) {
+      if (!isComment(src, i))
+        head += src.slice(i, j);
+      i = j;
+      continue;
+    }
+    const c = src[i];
+    if (c === "(" || c === "[")
+      p++;
+    else if (c === ")" || c === "]")
+      p--;
+    if (c === "{" && p === 0) {
+      const close = matchingBrace(src, i);
+      const h = head.trim();
+      const declaration = /^(export\s+)?(declare\s+)?(type|interface|enum)\b/.test(h);
+      if (declaration || h === "" || /^export(\s+type)?$/.test(h) || /[:|&]$/.test(h)) {
+        head += stripComments(src.slice(i, close + 1));
+        i = close + 1;
+        if (declaration && !/^(export\s+)?(declare\s+)?type\b/.test(h))
+          push("", null, i);
         continue;
       }
-      break;
+      const body = src.slice(i + 1, close);
+      const balanced = close < src.length;
+      i = close + 1;
+      if (src[i] === ";")
+        i++;
+      push("{", body, i, balanced);
+      continue;
     }
-    if (t[k] !== undefined && basename11(t[k]) === "go")
-      return { runner: "go" };
-  }
-  return {};
-}
-function goJson(out2) {
-  let any = false, failed2 = false;
-  for (const x of out2.split(`
-`)) {
-    if (!x.trim() || /^go: /.test(x))
+    if (c === ";" && p === 0) {
+      i++;
+      push(";", null, i);
       continue;
-    let e;
-    try {
-      e = JSON.parse(x);
-    } catch {
-      return null;
     }
-    if (!e || typeof e !== "object" || typeof e.Action !== "string")
-      return null;
-    any = true;
-    if (e.Action === "fail")
-      failed2 = true;
+    if (c === `
+` && p === 0 && head.trim() && /^\s*(export|import)\b/.test(src.slice(i + 1, i + 40))) {
+      push("", null, i);
+      i++;
+      start = i;
+      continue;
+    }
+    head += c;
+    i++;
   }
-  return any ? { failed: failed2 } : null;
-}
-function summaryPassFailCount(out2) {
-  return ["pass", "fail"].reduce((t, k) => t + +([...out2.matchAll(new RegExp(`^(?:#|\\u2139) ${k} (\\d+)$`, "gm"))].pop()?.[1] ?? 0), 0);
-}
-function skipped(raw2) {
-  return stripAnsi(raw2).split(`
-`).filter((l) => /^(?:=+ )?\d+ \w+.* in [\d.]+s|^\s*Tests?:?\s+\d|^(?:#|\u2139) skipped \d/.test(l.trim())).reduce((t, l) => t + [...l.matchAll(/(\d+) (?:skipped|deselected|xfailed)|skipped (\d+)/g)].reduce((u, m) => u + +(m[1] ?? m[2]), 0), 0);
+  push("", null, src.length);
+  return out2;
 }
-function testCount(raw2, path, ok) {
-  const out2 = stripAnsi(raw2);
-  const bu = bunCount(out2), ut = unittestCount(out2, ok);
-  if (bu !== null)
-    return bu;
-  if (ut !== null)
-    return ut;
-  if (/^\s*(?:Test Files\s+0\b|No test files found)/m.test(out2) && !/^\s*Tests?\s+\d/m.test(out2))
-    return 0;
-  const r = ran(out2, path, ok);
-  if (r !== null)
-    return r;
-  const tl = tailLines(out2);
-  const pw = tl.filter((x) => /^\s*\d+ (?:passed|failed|flaky)\b/.test(x));
-  if (pw.length && tl.some((x) => /^\s*\d+ passed \([\d.]+m?s\)/.test(x) || /^\s*\d+ failed$/.test(x)))
-    return pw.reduce((t, x) => t + +x.trim().split(" ")[0], 0);
-  const lastNum = (re) => {
-    const m = [...out2.matchAll(re)].pop();
-    return m ? +m[1] : null;
+function arrowHeadLen(s) {
+  const n2 = s.length;
+  let i = 0;
+  const ws = () => {
+    while (i < n2 && /\s/.test(s[i]))
+      i++;
   };
-  const mp = lastNum(/^\s*(\d+) passing\b/gm), mf = lastNum(/^\s*(\d+) failing\b/gm);
-  if (mp !== null || mf !== null)
-    return (mp ?? 0) + (mf ?? 0);
-  return null;
-}
-function classifyCheck(i) {
-  if (i.missing)
-    return { result: "not_run", reason: "tool not found on PATH" };
-  if (i.cut)
-    return { result: "not_run", reason: "timed out or aborted" };
-  if (i.kind === "static")
-    return { result: i.ok ? "pass" : "fail" };
-  const text2 = stripAnsi(i.out);
-  if (i.runner === "go") {
-    if (i.ok)
-      return { result: "not_run", reason: GO_EXIT0_REASON };
-    const j = goJson(text2);
-    if (j)
-      return j.failed ? { result: "fail" } : { result: "not_run", reason: UNCONFIRMED_REASON };
-    return FAIL_EVIDENCE.test(text2) || GO_FAIL_EVIDENCE.test(text2) ? { result: "fail" } : { result: "not_run", reason: UNCONFIRMED_REASON };
+  if (/^async\s/.test(s)) {
+    i = 5;
+    ws();
   }
-  const n2 = testCount(i.out, i.path, i.ok);
-  if (!i.ok && FAIL_EVIDENCE.test(text2))
-    return { result: "fail", ...n2 !== null ? { n: n2 } : {} };
-  if (n2 === 0)
-    return { result: "not_run", n: 0, reason: `${NO_TESTS_REASON} (ran 0 tests, empty or all skipped)` };
-  if (!i.ok)
-    return { result: "fail", ...n2 !== null ? { n: n2 } : {} };
-  if (n2 === null)
-    return { result: "not_run", reason: UNMEASURED_REASON };
-  return { result: "pass", n: n2 };
+  if (s[i] === "<") {
+    let d2 = 0;
+    for (;i < n2; i++) {
+      if (s[i] === "=" && s[i + 1] === ">")
+        i++;
+      else if (s[i] === "<")
+        d2++;
+      else if (s[i] === ">" && --d2 === 0) {
+        i++;
+        break;
+      }
+    }
+    if (d2 !== 0)
+      return -1;
+    ws();
+  }
+  if (s[i] === "(") {
+    let d2 = 0;
+    for (;i < n2; ) {
+      const k = skipLiteral(s, i);
+      if (k !== i) {
+        i = k;
+        continue;
+      }
+      if (s[i] === "(")
+        d2++;
+      else if (s[i] === ")" && --d2 === 0) {
+        i++;
+        break;
+      }
+      i++;
+    }
+    if (d2 !== 0)
+      return -1;
+  } else {
+    const st = i;
+    while (i < n2 && /[\w$]/.test(s[i]))
+      i++;
+    if (i === st)
+      return -1;
+  }
+  ws();
+  if (s[i] === "=" && s[i + 1] === ">")
+    return i + 2;
+  if (s[i] !== ":")
+    return -1;
+  let d = 0;
+  for (i++;i < n2; ) {
+    const k = skipLiteral(s, i);
+    if (k !== i) {
+      i = k;
+      continue;
+    }
+    const c = s[i];
+    if ("([{".includes(c))
+      d++;
+    else if (")]}".includes(c))
+      d--;
+    else if (d === 0 && c === "=")
+      return s[i + 1] === ">" ? i + 2 : -1;
+    else if (d === 0 && c === ";")
+      return -1;
+    i++;
+  }
+  return -1;
 }
-function checkProvenance(name, ctx) {
-  const head = name.split(":")[0];
-  if (LLM_JUDGES.has(head))
-    return "llm_judge";
-  if (head === "holdout")
-    return "independent";
-  if (!NON_RUNNER.has(head) && name.includes(":")) {
-    const p = normPath(name.slice(name.indexOf(":") + 1));
-    if (ctx.wallFiles.some((w) => normPath(w) === p))
-      return "independent";
-    if (ctx.addedFiles.some((a) => normPath(a) === p))
-      return "agent_authored";
-    if (ctx.modifiedFiles?.some((m) => normPath(m) === p))
-      return "agent_authored";
+function memberSig(h) {
+  if (!h || /^(private|protected|#)/.test(h))
+    return null;
+  let depth = 0, angle = 0;
+  for (let i = 0;i < h.length; i++) {
+    const c = h[i];
+    if ("([{".includes(c))
+      depth++;
+    else if (")]}".includes(c))
+      depth--;
+    else if (depth === 0 && c === "<")
+      angle++;
+    else if (depth === 0 && c === ">" && h[i - 1] !== "=" && angle > 0)
+      angle--;
+    else if (c === "=" && depth === 0 && angle === 0 && !"=!<".includes(h[i - 1] ?? " ") && h[i + 1] !== "=" && h[i + 1] !== ">") {
+      const rhs = h.slice(i + 1).trim();
+      if (rhs.endsWith("=>") || /^(async\s+)?function\b/.test(rhs))
+        return h;
+      const len = arrowHeadLen(rhs);
+      return `${h.slice(0, i).trim()}${len > 0 ? ` = ${rhs.slice(0, len)}` : ""}`;
+    }
   }
-  return "exogenous";
-}
-function summaryOf(a) {
-  const why = a.tier === a.computed ? a.reasons.slice(0, 2).join("; ") : `computed ${a.computed}; override ${a.override?.from} to ${a.override?.to}: ${a.override?.reason}`;
-  const def = a.checks_deferred;
-  return `risk: ${a.tier} (${why}), ${def.length ? def.join(", ") : "no deeper checks"} not run`;
+  return h;
 }
-function markExecuted(a, executed) {
-  const checks_deferred = deferredOf(a.tier, a.checks_selected, executed);
-  return { ...a, checks_deferred, summary: summaryOf({ ...a, checks_deferred }) + (a.advisories?.length ? `; advisory: ${a.advisories.join(", ")}` : "") };
+function splitDeclarators(h) {
+  const parts = [];
+  let depth = 0, angle = 0, init = false, from = 0;
+  for (let i = 0;i < h.length; ) {
+    const k = skipLiteral(h, i);
+    if (k !== i) {
+      i = k;
+      continue;
+    }
+    const c = h[i];
+    if ("([{".includes(c))
+      depth++;
+    else if (")]}".includes(c))
+      depth--;
+    else if (depth === 0 && !init && c === "<")
+      angle++;
+    else if (depth === 0 && !init && c === ">" && h[i - 1] !== "=")
+      angle = Math.max(0, angle - 1);
+    else if (depth === 0 && angle === 0 && !init && c === "=" && h[i + 1] !== "=" && h[i + 1] !== ">" && !"=!<".includes(h[i - 1] ?? " ")) {
+      init = true;
+      const rest = h.slice(i + 1);
+      const len = arrowHeadLen(rest.trimStart());
+      if (len > 0) {
+        i += 1 + (rest.length - rest.trimStart().length) + len;
+        continue;
+      }
+    } else if (depth === 0 && angle === 0 && c === ",") {
+      parts.push(h.slice(from, i));
+      from = i + 1;
+      init = false;
+    }
+    i++;
+  }
+  parts.push(h.slice(from));
+  return parts;
 }
-function manifestDepsChanged(path, oldText, newText, patch) {
-  if (/(^|\/)package\.json$/.test(path)) {
-    try {
-      const o = oldText.trim() ? JSON.parse(oldText) : {}, n2 = newText.trim() ? JSON.parse(newText) : {};
-      return PKG_DEP_KEYS.some((k) => JSON.stringify(o?.[k] ?? {}) !== JSON.stringify(n2?.[k] ?? {}));
-    } catch {
-      return true;
+function exportHead(h, end) {
+  let depth = 0, last = -1, nn = -1;
+  const star = /^export\s*(type\s*)?\*/.test(h.slice(0, 40));
+  for (let i = 0;i < h.length; ) {
+    const k = skipLiteral(h, i);
+    if (k !== i) {
+      last = k - 1;
+      i = k;
+      continue;
+    }
+    const c = h[i];
+    if ("([{".includes(c))
+      depth++;
+    else if (")]}".includes(c))
+      depth--;
+    else if (depth === 0 && c === ";")
+      return h.slice(0, i + 1);
+    else if (depth === 0 && c === `
+` && last >= 0) {
+      if (nn < i) {
+        nn = i;
+        while (nn < h.length && /\s/.test(h[nn]))
+          nn++;
+      }
+      const tail = h.slice(Math.max(0, last - 300), last + 1);
+      const next = h.slice(nn, nn + 12);
+      const open = /[=|&,<(:?.+\-*/]$|=>$|\b(from|as|extends|keyof|typeof|type)$/.test(tail) || /^(from\b|extends\b|as\b|[|&?:.,=])/.test(next);
+      if (!open && (!star || /\bfrom\s*(["'])[^"']*\1$/.test(tail)))
+        return h.slice(0, last + 1);
     }
+    if (!/\s/.test(c))
+      last = i;
+    i++;
   }
-  const changed = patch.split(`
-`).filter((l) => /^[+-]/.test(l) && !/^(\+\+\+|---)/.test(l));
-  if (/(^|\/)go\.mod$/.test(path))
-    return changed.some((l) => {
-      const b = l.slice(1).trim();
-      return b !== "" && !b.startsWith("//") && !/^(module|go|toolchain)\b/.test(b);
-    });
-  return changed.some((l) => {
-    const b = l.slice(1).trim();
-    if (/^"[A-Za-z][\w.-]*(\[[\w,.-]+\])?\s*([<>=~!]|;|@|"\s*,?\s*$)/.test(b))
+  return h.trimEnd() + (end === ";" ? ";" : "");
+}
+function hasTopSemi(line2) {
+  let depth = 0;
+  for (let i = 0;i < line2.length; ) {
+    const k = skipLiteral(line2, i);
+    if (k !== i) {
+      i = k;
+      continue;
+    }
+    const c = line2[i];
+    if ("([{".includes(c))
+      depth++;
+    else if (")]}".includes(c))
+      depth--;
+    else if (c === ";" && depth <= 0 && line2.slice(i + 1).trim())
       return true;
-    const m = /^([A-Za-z][\w.-]*)\s*=\s*("[\^~<>=!*\d]|\{[^}]*version)/.exec(b);
-    return !!m && !PYPROJECT_NONDEP.test(m[1]);
-  });
+    i++;
+  }
+  return false;
 }
-function manifestsWithoutLock(files) {
-  return files.filter((f) => f.deps && f.status !== "deleted").flatMap((f) => {
-    const pair = MANIFEST_LOCKS.find(([m]) => m.test(f.path));
-    if (!pair)
-      return [];
-    const d = dirOf(f.path);
-    const locked = files.some((g) => pair[1].test(g.path) && (dirOf(g.path) === "" || d === dirOf(g.path) || d.startsWith(dirOf(g.path) + "/")));
-    return locked ? [] : [f.path];
-  });
+function strictMember(m) {
+  const h = m.head.trim();
+  if (!MEMBER_GRAMMAR.test(h) || NOT_MEMBER.test(h))
+    return false;
+  if (m.end !== "{" && /^[^=:<]*\(/.test(h) && !/^(?:(?:public|protected|private)\s+)?constructor\b/.test(h) && !/\)\s*:/.test(h))
+    return false;
+  return true;
 }
-function classifyRisk(files, env = process.env) {
-  const lines = files.reduce((n2, f) => n2 + f.added + f.deleted, 0);
-  const sensitive = files.flatMap((f) => {
-    const hit = SENSITIVE.find(([, re]) => re.test(f.path));
-    return hit && !isTestFile(f.path) ? [`${f.path} (${hit[0]})`] : [];
-  });
-  const testFiles = files.filter((f) => isTestFile(f.path));
-  const testsDeleted = testFiles.filter((f) => f.status === "deleted").map((f) => f.path);
-  const testsModified = [...testFiles.filter((f) => f.status !== "added" && f.status !== "deleted").map((f) => f.path), ...files.filter((f) => TEST_CFG.test(f.path)).map((f) => f.path)];
-  const api = files.filter((f) => API.test(f.path) && !isTestFile(f.path)).map((f) => f.path);
-  const high = [], med = [];
-  if (sensitive.length)
-    high.push(`sensitive paths: ${sensitive.slice(0, 5).join(", ")}${sensitive.length > 5 ? ` (+${sensitive.length - 5})` : ""}`);
-  if (testsDeleted.length)
-    high.push(`test files deleted: ${testsDeleted.join(", ")}`);
-  if (api.length)
-    high.push(`public API surface: ${api.slice(0, 3).join(", ")}`);
-  if (files.length >= FILES_HIGH)
-    high.push(`${files.length} files >= ${FILES_HIGH}`);
-  if (lines >= LINES_HIGH)
-    high.push(`${lines} changed lines >= ${LINES_HIGH}`);
-  if (testsModified.length)
-    med.push(`existing tests or test config modified: ${testsModified.slice(0, 3).join(", ")}`);
-  if (files.length >= FILES_MEDIUM)
-    med.push(`${files.length} files >= ${FILES_MEDIUM}`);
-  if (lines >= LINES_MEDIUM)
-    med.push(`${lines} changed lines >= ${LINES_MEDIUM}`);
-  const computed = high.length ? "high" : med.length ? "medium" : "low";
-  const reasons = high.length ? [...high, ...med] : med.length ? med : [`${files.length} file${files.length === 1 ? "" : "s"}, no sensitive paths`];
-  let tier = computed, override, ignored;
-  const asked = (env["LOKI_RISK_TIER"] ?? "").trim().toLowerCase();
-  if (asked in RANK2 && asked !== computed) {
-    const reason = (env["LOKI_RISK_OVERRIDE_REASON"] ?? "").trim();
-    if (RANK2[asked] > RANK2[computed]) {
-      tier = asked;
-      override = { from: computed, to: asked, reason: reason || "raised by LOKI_RISK_TIER" };
-    } else if (reason) {
-      tier = asked;
-      override = { from: computed, to: asked, reason };
-    } else
-      ignored = `LOKI_RISK_TIER=${asked} ignored: lowering from ${computed} needs LOKI_RISK_OVERRIDE_REASON`;
+function tsAmbiguous(s, jsx) {
+  const n2 = s.length, stack = [];
+  const tpl = (from) => {
+    for (let j = from;j < n2; ) {
+      const c = s[j];
+      if (c === "\\")
+        j += 2;
+      else if (c === "`")
+        return j + 1;
+      else if (c === "$" && s[j + 1] === "{") {
+        stack.push("$");
+        return j + 2;
+      } else
+        j++;
+    }
+    return -1;
+  };
+  let prev = "", prev2 = "";
+  const set = (c) => {
+    prev2 = prev;
+    prev = c;
+  };
+  for (let i = 0;i < n2; ) {
+    const c = s[i];
+    if (/\s/.test(c)) {
+      i++;
+      continue;
+    }
+    if (c === "/" && s[i + 1] === "/") {
+      const e = s.indexOf(`
+`, i);
+      if (e < 0)
+        break;
+      i = e;
+      continue;
+    }
+    if (c === "/" && s[i + 1] === "*") {
+      const e = s.indexOf("*/", i + 2);
+      if (e < 0)
+        return true;
+      i = e + 2;
+      continue;
+    }
+    if (c === "`" || c === "}" && stack[stack.length - 1] === "$") {
+      if (c === "`" && jsx)
+        return true;
+      if (c === "}")
+        stack.pop();
+      const e = tpl(i + 1);
+      if (e < 0)
+        return true;
+      i = e;
+      set("a");
+      continue;
+    }
+    if (c === '"' || c === "'") {
+      let j = i + 1;
+      for (;j < n2 && s[j] !== c; j++) {
+        if (s[j] === "\\")
+          j++;
+        else if (s[j] === `
+`)
+          return true;
+      }
+      if (j >= n2)
+        return true;
+      i = j + 1;
+      set("a");
+      continue;
+    }
+    if (c === "/") {
+      if (jsx && prev === "<") {
+        i++;
+        set("/");
+        continue;
+      }
+      if (commentBefore(s, i))
+        return true;
+      if (prev && !"(,=:[!&|?{;+-*%~^".includes(prev))
+        return true;
+      if ((prev === "+" || prev === "-") && prev2 === prev)
+        return true;
+      let j = i + 1, cls = false, closed = false;
+      for (;j < n2; j++) {
+        const d = s[j];
+        if (d === `
+`)
+          return true;
+        if (d === "\\")
+          j++;
+        else if (d === "[")
+          cls = true;
+        else if (d === "]")
+          cls = false;
+        else if (d === "/" && !cls) {
+          closed = true;
+          break;
+        }
+      }
+      if (!closed)
+        return true;
+      i = j + 1;
+      while (i < n2 && /[a-z]/i.test(s[i]))
+        i++;
+      set("a");
+      continue;
+    }
+    if (c === "(" || c === "[" || c === "{")
+      stack.push(c);
+    else if (c === ")" || c === "]" || c === "}") {
+      const o = stack.pop();
+      if (o !== (c === ")" ? "(" : c === "]" ? "[" : "{"))
+        return true;
+    }
+    set(c);
+    i++;
   }
-  const plan = PLAN[tier], checks_deferred = deferredOf(tier, plan.selected, []);
-  const advisories = manifestsWithoutLock(files).map((p) => `manifest changed without lockfile: ${p}`);
-  const summary = summaryOf({ tier, computed, reasons, ...override ? { override } : {}, checks_deferred }) + (advisories.length ? `; advisory: ${advisories.join(", ")}` : "");
-  return {
-    version: 1,
-    tier,
-    computed,
-    reasons,
-    stats: { files: files.length, lines, sensitive, tests_modified: testsModified, tests_deleted: testsDeleted, api },
-    checks_selected: plan.selected,
-    checks_deferred,
-    ...override ? { override } : {},
-    ...ignored ? { override_ignored: ignored } : {},
-    ...advisories.length ? { advisories } : {},
-    summary
-  };
-}
-function changedFiles(repoDir, baseSha) {
-  const run = (args) => safeGit(repoDir, args).split(`
-`).map((l) => l.trim()).filter(Boolean);
-  const tracked = run(["diff", "--name-only", baseSha]);
-  const untracked = run(["ls-files", "--others", "--exclude-standard"]);
-  return [...new Set([...tracked, ...untracked])].filter((f) => !f.startsWith(".loki/"));
+  return stack.length > 0;
 }
-function diffFiles(repoDir, baseSha) {
-  const paths = changedFiles(repoDir, baseSha), stat = new Map;
-  for (const l of safeGit(repoDir, ["diff", "--numstat", baseSha]).split(`
-`)) {
-    const [a, d, ...p] = l.split("\t"), path = p.join("\t");
-    if (path)
-      stat.set(path, { path, added: Number(a) || 0, deleted: Number(d) || 0 });
-  }
-  for (const l of safeGit(repoDir, ["diff", "--name-status", baseSha]).split(`
-`)) {
-    const [s, ...p] = l.split("\t"), f = stat.get(p[p.length - 1] ?? "");
-    if (f)
-      f.status = s?.startsWith("A") ? "added" : s?.startsWith("D") ? "deleted" : "modified";
-  }
-  const out2 = paths.map((path) => {
-    const f = stat.get(path);
-    if (f)
-      return f;
-    let n2 = 0;
-    try {
-      n2 = readFileSync29(join38(repoDir, path), "utf8").split(`
-`).length;
-    } catch {}
-    return { path, added: n2, deleted: 0, status: "added" };
-  });
-  for (const f of out2) {
-    if (f.status === "deleted" || !MANIFEST_LOCKS.some(([m]) => m.test(f.path)))
+function maskDefaults(sig) {
+  let out2 = "", pd = 0;
+  for (let i = 0;i < sig.length; ) {
+    const k = skipLiteral(sig, i);
+    if (k !== i) {
+      out2 += sig.slice(i, k);
+      i = k;
       continue;
-    try {
-      const oldText = f.status === "added" ? "" : safeGit(repoDir, ["show", `${baseSha}:${f.path}`]);
-      const newText = readFileSync29(join38(repoDir, f.path), "utf8");
-      const patch = f.status === "added" ? newText.split(`
-`).map((l) => `+${l}`).join(`
-`) : safeGit(repoDir, ["diff", "-U0", baseSha, "--", f.path]);
-      if (manifestDepsChanged(f.path, oldText, newText, patch))
-        f.deps = true;
-    } catch {}
+    }
+    const c = sig[i];
+    if (c === "(")
+      pd++;
+    else if (c === ")")
+      pd--;
+    else if (c === "=" && pd > 0 && sig[i + 1] !== "=" && sig[i + 1] !== ">" && !"=!<".includes(sig[i - 1] ?? " ")) {
+      out2 = out2.trimEnd() + " = ...";
+      let d = 0, angle = 0, j = i + 1;
+      for (;j < sig.length; ) {
+        const l = skipLiteral(sig, j);
+        if (l !== j) {
+          j = l;
+          continue;
+        }
+        const e = sig[j];
+        if ("([{".includes(e))
+          d++;
+        else if (")]}".includes(e)) {
+          if (d === 0)
+            break;
+          d--;
+        } else if (e === "<" && /[\w$]/.test(sig[j - 1] ?? ""))
+          angle++;
+        else if (e === ">" && sig[j - 1] !== "=" && angle > 0)
+          angle--;
+        else if (e === "," && d === 0 && angle === 0)
+          break;
+        j++;
+      }
+      i = j;
+      continue;
+    }
+    out2 += c;
+    i++;
   }
   return out2;
 }
-function recordRisk(repoDir, a) {
-  try {
-    const dir = join38(repoDir, ".loki", "state"), p = join38(dir, "risk-tier.json");
-    mkdirSync13(dir, { recursive: true });
-    writeFileSync16(`${p}.tmp`, JSON.stringify(a, null, 2) + `
-`);
-    renameSync8(`${p}.tmp`, p);
-    return p;
-  } catch {
-    return null;
-  }
-}
-function truncateBytes(s, cap) {
-  const buf = Buffer.from(s, "utf8");
-  return buf.length <= cap ? s : buf.subarray(0, Math.max(0, cap)).toString("utf8").replace(/\uFFFD$/, "");
-}
-function failureExcerpt(out2, repoDir = "", cap = EXCERPT_GROUP_CAP) {
-  let t = stripAnsi(out2.slice(-65536)).replace(/\r/g, "");
-  if (repoDir)
-    t = t.split(repoDir.replace(/\/+$/, "") + "/").join("");
-  const lines = t.split(`
-`).map((l) => l.replace(/\s+$/, ""));
-  const pick = new Set;
-  const take = (i, n2 = 1) => {
-    for (let k = 0;k < n2 && i + k < lines.length; k++)
-      if (lines[i + k].trim())
-        pick.add(i + k);
+function maskDecorators(sig) {
+  let out2 = "";
+  const badNext = (at) => {
+    const r = sig.slice(at).trimStart();
+    return !/[A-Za-z_$@]/.test(r[0] ?? "") || RESERVED_AFTER_DECORATOR.test(r);
   };
-  lines.forEach((l, i) => {
-    if (/^E\s/.test(l))
-      take(i);
-    else if (/^\s*(Expected|Received)\b/.test(l) || /^\s*expect\(.*\)\.\w+/.test(l))
-      take(i);
-    else if (/^[\w./@-]+\.py:\d+: /.test(l))
-      take(i);
-    else if (/AssertionError|^\s*(expected|actual)\b.*[:=]|^\s*(not ok|FAILED)\b/.test(l))
-      take(i, 3);
-    else if (/^\s*--- FAIL/.test(l))
-      take(i, 4);
-    else if (/^[\w./@-]+\.\w+(\(\d+,\d+\)|:\d+(:\d+)?)[:\s].*\b(error|TS\d+|[A-Z]{1,3}\d{3,4})\b/.test(l))
-      take(i);
-  });
-  const lastFrame = lines.map((l, i) => /^[\w./@-]+\.py:\d+: /.test(l) ? i : -1).filter((i) => i >= 0).pop();
-  if (lastFrame !== undefined && [...pick].some((i) => /^E\s/.test(lines[i])))
-    take(lastFrame);
-  let body = [...pick].sort((a, b) => a - b).map((i) => lines[i]).join(`
-`);
-  if (!body)
-    body = lines.filter((l) => l.trim()).slice(-6).join(`
-`);
-  body = redactSecrets(body);
-  return truncateBytes(body, cap);
-}
-function pytestCollectionIsRed(output, repoDir) {
-  if (/ModuleNotFoundError/.test(output))
-    return false;
-  const real2 = (p) => {
-    try {
-      return realpathSync17(isAbsolute3(p) ? p : join38(repoDir, p));
-    } catch {
-      return null;
+  for (let i = 0;i < sig.length; ) {
+    const k = skipLiteral(sig, i);
+    if (k !== i) {
+      out2 += sig.slice(i, k);
+      i = k;
+      continue;
     }
-  };
-  const repoReal = real2(repoDir);
-  const under = (p) => {
-    const r = real2(p);
-    return !!repoReal && !!r && (r === repoReal || r.startsWith(`${repoReal}/`));
-  };
-  const imp = /ImportError: cannot import name .* from ['"][\w.]+['"] \(([^)]+)\)/.exec(output);
-  if (imp)
-    return under(imp[1]);
-  const hdr = [...output.matchAll(/^=+ short test summary info =+$/gm)].pop();
-  if (!hdr)
-    return false;
-  const cls = [...output.slice(hdr.index).matchAll(/^ERROR \S+ - (\w+Error): /gm)].pop()?.[1];
-  if (cls !== "AttributeError" && cls !== "NameError")
-    return false;
-  const start = output.search(/^_+ ERROR collecting /m);
-  if (start < 0 || start > hdr.index)
-    return false;
-  const block = output.slice(start, hdr.index).split(/^-+ Captured .*$/m)[0];
-  const eLines = [...block.matchAll(new RegExp(`^E {3}${cls}: (.*)$`, "gm"))];
-  const eLine = eLines[eLines.length - 1];
-  if (!eLine)
-    return false;
-  if (cls === "AttributeError") {
-    const m = /^module ['"]([\w.]+)['"] has no attribute/.exec(eLine[1]);
-    return !!m && moduleUnderRepo(repoDir, m[1]);
+    if (sig[i] !== "@") {
+      out2 += sig[i];
+      i++;
+      continue;
+    }
+    const m = /^@[A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*/.exec(sig.slice(i, i + 200));
+    if (!m)
+      return null;
+    out2 += m[0];
+    i += m[0].length;
+    if (sig[i] === "(") {
+      out2 += "(...)";
+      i = skipBalanced(sig, i);
+    }
+    if (badNext(i))
+      return null;
   }
-  const frames = [...block.slice(0, eLine.index).matchAll(/^(.+?):\d+: in \S+\n\s*(.*)$/gm)];
-  const last = frames[frames.length - 1];
-  return !!last && under(last[1]) && !/^\s*(import\s|from\s\S+\s+import\b)/.test(last[2] ?? "");
+  return out2;
 }
-function moduleUnderRepo(repoDir, name) {
-  const rel = name.replace(/\./g, "/");
-  return existsSync23(join38(repoDir, `${rel}.py`)) || existsSync23(join38(repoDir, rel, "__init__.py"));
+function skipBalanced(s, i) {
+  let d = 0;
+  while (i < s.length) {
+    const k = skipLiteral(s, i);
+    if (k !== i) {
+      i = k;
+      continue;
+    }
+    if ("([{".includes(s[i]))
+      d++;
+    else if (")]}".includes(s[i]) && --d === 0)
+      return i + 1;
+    i++;
+  }
+  return s.length;
 }
-function pytestExit1IsRed(output) {
-  if (/^!+ _pytest\.outcomes\.Exit\b/m.test(output))
-    return false;
-  if (/^=*\s*(\d+ \w+(, )?)*\d+ failed\b.* in [\d.]+s/.test(output.trimEnd().split(`
-`).pop() ?? ""))
-    return true;
-  const hdr = [...output.matchAll(/^=+ short test summary info =+$/gm)].pop();
-  return !!hdr && /^FAILED \S+/m.test(output.slice(hdr.index));
+function maskExtends(head) {
+  let angle = 0, depth = 0;
+  for (let i = 0;i < head.length; ) {
+    const k = skipLiteral(head, i);
+    if (k !== i) {
+      i = k;
+      continue;
+    }
+    const c = head[i];
+    if ("([{".includes(c))
+      depth++;
+    else if (")]}".includes(c))
+      depth--;
+    else if (c === "<")
+      angle++;
+    else if (c === ">" && head[i - 1] !== "=")
+      angle = Math.max(0, angle - 1);
+    else if (depth === 0 && angle === 0 && /^extends\s/.test(head.slice(i)) && /\W/.test(head[i - 1] ?? " ")) {
+      const from = i + 7;
+      const im = /\simplements\s/.exec(head.slice(from));
+      const end = im ? from + im.index : head.length;
+      const expr = head.slice(from, end).trim();
+      const ok = /^[A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*(?:<[^()]*>)?$/.test(expr);
+      const tail = head.slice(end).trim();
+      return `${head.slice(0, i)}extends ${ok ? expr : "..."}${tail ? ` ${tail}` : ""}`;
+    }
+    i++;
+  }
+  return head;
 }
-function parsedFailCount(runner, output) {
-  const m = runner === "bun" ? /^\s*(\d+)\s+fail\s*$/m.exec(output) : runner === "jest" ? /Tests:\s*(\d+)\s+failed/i.exec(output) : runner === "vitest" ? /Tests\s+(\d+)\s+failed/i.exec(output) : null;
-  return m ? Number(m[1]) : 0;
+function enumSig(h) {
+  const open = h.indexOf("{");
+  if (open < 0)
+    return null;
+  const close = matchingBrace(h, open);
+  if (close >= h.length)
+    return null;
+  const names = [];
+  let depth = 0, from = open + 1;
+  const take = (to) => {
+    const nm = h.slice(from, to).split("=")[0].trim();
+    if (nm)
+      names.push(nm);
+  };
+  for (let i = open + 1;i < close; ) {
+    const k = skipLiteral(h, i);
+    if (k !== i) {
+      i = k;
+      continue;
+    }
+    const c = h[i];
+    if ("([{".includes(c))
+      depth++;
+    else if (")]}".includes(c))
+      depth--;
+    else if (c === "," && depth === 0) {
+      take(i);
+      from = i + 1;
+    }
+    i++;
+  }
+  take(close);
+  return `${h.slice(0, open).trim()} { ${names.join(", ")} }`;
 }
-function nodeIsRed(f, raw2) {
-  const o = raw2.replace(/^# (?!(?:tests|suites|pass|fail|cancelled|skipped|todo|duration_ms|Subtest)\b)/gm, "");
-  const mod = /^Error(?: \[\w+\])?: Cannot find (?:module|package) '([^']+)'(?:(?!\u2716)[\s\S])*?\nNode\.js v/m.exec(o), top = /^(\S+):\d+\n.*\n.*\n\n?(?:ReferenceError|SyntaxError)\b/m.exec(o);
-  const named = [...o.matchAll(/^(?:\u2716|\s*not ok \d+ -) (?!failing tests:)(.+?)(?: \(|$)/gm)].some((m) => !f.path.endsWith(m[1]) && !m[1].endsWith(f.path)), blk = o.split("failing tests:")[1] ?? "", esm = /^SyntaxError: The requested module '([^']+)' does not provide an export named/m.exec(o), errs = [...blk.matchAll(/^ {2}(\w+Error): .*\n\s+at (?:.*\()?([^\s()]+?):\d+:\d+/gm), ...o.matchAll(/^ +name: '(\w+Error)'\n(?:.*\n)*? +stack: \|-\n\s+(?:.*\()?([^\s()]+?):\d+:\d+/gm)];
-  return /^(?:#|\u2139) fail [1-9]/m.test(raw2) && (/^ {2}AssertionError\b/m.test(blk) || /^ +name: 'AssertionError'/m.test(o) || (mod && !named ? /^[./]/.test(mod[1]) : esm ? /^[./]/.test(esm[1]) : top ? !top[1].endsWith(f.path) : !errs.length || errs.some((e) => !/^(?:Reference|Syntax)Error$/.test(e[1]) || !(e[2].startsWith("node:") || e[2].endsWith(f.path)))));
+function tsSignatures(src, jsx) {
+  const out2 = [];
+  for (const it of items(src)) {
+    const h = it.head.trim();
+    if (!/^export\b/.test(h))
+      continue;
+    const lines = [];
+    if (/^export\s+(declare\s+)?enum\b/.test(h)) {
+      lines.push(enumSig(h) ?? exportHead(h, it.end));
+    } else if (/^export\s+(declare\s+)?(type|interface)\b|^export\s*(type\s*)?[{*]/.test(h)) {
+      lines.push(exportHead(h, it.end));
+    } else if (/^export\s+(default\s+)?(abstract\s+)?class\b/.test(h)) {
+      const ms = jsx || !it.balanced ? [] : items(it.body ?? "");
+      const sigs = ms.map((m) => strictMember(m) ? memberSig(m.head.trim()) : null).map((m) => m === null ? null : maskDefaults(m));
+      const dropped2 = ms.some((m) => !strictMember(m)) || sigs.some((m) => m !== null && (hasTopSemi(m) || NOT_MEMBER.test(m)));
+      const keep = dropped2 ? [] : sigs.filter((m) => !!m);
+      const headM = maskDecorators(exportHead(h, ""));
+      const memM = keep.map(maskDecorators);
+      if (headM !== null && !memM.includes(null))
+        lines.push(`${maskExtends(headM)} {`, ...memM.map((m) => `  ${m};`), "}");
+    } else if (/^export\s+(default\s+)?@/.test(h)) {
+      const dm = maskDecorators(h);
+      if (dm !== null)
+        lines.push(maskExtends(dm));
+    } else if (/^export\s+default\s/.test(h)) {
+      const rest = h.replace(/^export\s+default\s+/, "");
+      const len = arrowHeadLen(rest);
+      if (len > 0)
+        lines.push(`export default ${rest.slice(0, len)}`);
+      else if (/^(async\s+)?function\b/.test(rest))
+        lines.push(memberSig(h) ?? h);
+      else
+        lines.push(/^[\w$.]+$/.test(rest) ? h : "export default ...");
+    } else if (/^export\s+(const|let|var)\b/.test(h)) {
+      lines.push(splitDeclarators(h).map((p) => memberSig(p.trim()) ?? p.trim()).join(", "));
+    } else {
+      lines.push(memberSig(h) ?? h);
+    }
+    if (!lines.length)
+      continue;
+    const masked = /^export\s+(declare\s+)?(type|interface|enum)\b|^export\s*(type\s*)?[{*]|^export\s+(default\s+)?(abstract\s+)?class\b/.test(h) ? lines : lines.map((l) => {
+      const d = maskDecorators(l);
+      return d === null ? null : maskDefaults(d);
+    });
+    if (masked.includes(null))
+      continue;
+    const done = masked;
+    if (!done.some(hasTopSemi))
+      out2.push(...done);
+  }
+  return out2;
 }
-function notRunReason(status, interpreter) {
-  if (interpreter === "system")
-    return "ran under the system interpreter, not the project's, so the result proves nothing";
-  if (status === null)
-    return "the test runner did not start or timed out";
-  if (status === 126 || status === 127)
-    return `the test runner command was not found or not executable (exit ${status})`;
-  return status === 0 ? "exit 0 but no executed test count could be confirmed" : `exit ${status} but the runner output showed no readable failing test`;
+var REGEX_PREV = "(,=:[!&|?{;+-*%~^", isComment = (s, i) => s[i] === "/" && (s[i + 1] === "/" || s[i + 1] === "*"), MODS = "(?:(?:public|private|protected|static|readonly|abstract|async|get|set|declare|override)\\s+)*", MEMBER_GRAMMAR, NOT_MEMBER, RESERVED_AFTER_DECORATOR;
+var init_ts_signatures = __esm(() => {
+  MEMBER_GRAMMAR = new RegExp(`^(?:@[\\w$.]+(?:\\([^)]*\\))?\\s*)*${MODS}\\*?\\s*(?:[A-Za-z_$][\\w$]*|#[A-Za-z_$][\\w$]*|\\[[^\\]]*\\])\\s*[?!]?\\s*(?:[(<:=]|$)`);
+  NOT_MEMBER = /^(return|const|let|var|if|else|for|while|do|switch|case|default|throw|try|catch|finally|new|await|yield|break|continue|import|export|function|delete|typeof|void)\b/;
+  RESERVED_AFTER_DECORATOR = /^(?:if|else|for|while|do|switch|case|try|catch|finally|return|throw|with|var|let|const|function|new|delete|typeof|void|yield|await|break|continue|import|debugger|instanceof|this|super|null|true|false)(?![\w$])/;
+});
+
+// ../../loki-ts/src/util/failure_memory.ts
+var init_failure_memory = __esm(() => {
+  init_cache();
+  init_safe_git();
+});
+
+// ../../loki-ts/src/e10ext/repomemory.ts
+var init_repomemory = __esm(() => {
+  init_cache();
+  init_failure_memory();
+});
+
+// ../../loki-ts/src/engine10/failures.ts
+function failCount(out2) {
+  const n2 = (s, re) => +(s.match(re)?.[1] ?? 0);
+  const l = out2.split(`
+`).reverse().map((x) => x.trim()).find((x) => /^(?:=+ )?\d+ \w+.* in [\d.]+s|^Tests?:?\s+\d/.test(x)), m = /^(?:#|\u2139) fail (\d+)$/m.exec(out2);
+  return l ? n2(l, /(\d+) failed/) + n2(l, /(\d+) errors?/) : m ? +m[1] : null;
 }
-function classify(f, status, output, repoDir, interpreter) {
-  if (interpreter === "system")
-    return "not_run";
-  output = stripAnsi(output);
-  if (status === null || status === 126 || status === 127)
-    return "not_run";
-  if (status === 0)
-    return classifyCheck({ kind: "test", ok: true, out: output, path: f.path, ...f.runner === "go" ? { runner: "go" } : {} }).result === "pass" ? "pass" : "not_run";
-  if (f.runner === "pytest")
-    return status === 1 ? pytestExit1IsRed(output) ? "fail" : "not_run" : status === 2 ? pytestCollectionIsRed(output, repoDir) ? "fail" : "not_run" : "not_run";
-  if (f.runner === "jest" || f.runner === "vitest" || f.runner === "bun")
-    return parsedFailCount(f.runner, output) > 0 ? "fail" : "not_run";
-  return f.runner === "node" && nodeIsRed(f, output) ? "fail" : "not_run";
+function failIds(output) {
+  const ids = [...new Set(output.split(`
+`).map((l) => ID_LINE.exec(l.trim())).flatMap((m) => m ? [(m.slice(1).find(Boolean) ?? "").trim()] : []).filter(Boolean))];
+  const c = failCount(output);
+  return c && ids.length >= c ? ids : [];
 }
-var NO_TESTS_REASON = "no tests executed", GO_EXIT0_REASON = "test count could not be confirmed: go test output is produced by the code under test and cannot confirm execution (a Go exit 0 is never a pass)", UNCONFIRMED_REASON = "test count could not be confirmed", FAIL_EVIDENCE, GO_FAIL_EVIDENCE, UNMEASURED_REASON = "executed count unmeasured (Loki could not parse the runner summary, harness-owned)", stripAnsi = (s) => s.replace(/\u001b\][^\u0007\u001b]*(?:\u0007|\u001b\\)/g, "").replace(/(?:\u001b\[|\u009b)[0-9;?]*[ -\/]*[@-~]/g, "").replace(/\r\n?/g, `
-`), tailLines = (out2) => out2.split(`
-`).filter((x) => x.trim()).slice(-12), GO_PKG_RE, isExecutedProof = (c) => c.result === "pass" && typeof c.n === "number" && c.n > 0, hasExecutedProof = (checks) => checks.some(isExecutedProof), LLM_JUDGES, NON_RUNNER, normPath = (p) => p.replace(/^(?:\.\/)+/, ""), hasExogenousProof = (checks, ctx) => checks.some((c) => isExecutedProof(c) && ((p) => p !== "agent_authored" && p !== "llm_judge")(checkProvenance(c.name ?? "", ctx))), SENSITIVE, API, TEST_CFG, RANK2, FILES_MEDIUM = 4, FILES_HIGH = 15, LINES_MEDIUM = 100, LINES_HIGH = 500, RAN_ALWAYS, PLAN, LOW_SKIPPED, deferredOf = (tier, selected, executed) => (tier === "low" ? LOW_SKIPPED : selected).filter((c) => !RAN_ALWAYS.includes(c) && !executed.includes(c)), MANIFEST_LOCKS, dirOf = (p) => p.includes("/") ? p.slice(0, p.lastIndexOf("/")) : "", PKG_DEP_KEYS, PYPROJECT_NONDEP, EXCERPT_GROUP_CAP = 1500, EXCERPT_TOTAL_CAP = 6144;
-var init_check_result = __esm(() => {
-  init_testmap();
-  init_safe_git();
-  init_redact();
-  FAIL_EVIDENCE = /\[(?:build|setup) failed\]|^--- FAIL|^[\w./-]+\.go:\d+:\d+: \S|\b[1-9]\d* (?:failed|errors?)\b/m;
-  GO_FAIL_EVIDENCE = /^FAIL\t\S+\t[\d.]+s$|^panic: /m;
-  GO_PKG_RE = /^(?:ok|FAIL|\?)\s+\S+\s+(?:\(cached\)|[\d.]+s\b|\[(?:no test files|build failed|setup failed)\])/;
-  LLM_JUDGES = new Set(["council", "xreview", "code_review", "devils_advocate", "magic_debate"]);
-  NON_RUNNER = new Set(["lint", "typecheck", "holdout", "select-tests"]);
-  SENSITIVE = [
-    ["auth", /(^|\/)(auth|oauth|sso|session|login|permission|rbac|acl)[\w.-]*(\/|\.|$)/i],
-    ["crypto", /(^|\/)(crypt|crypto|jwt|signing|keys?|secrets?|tokens?|credential|password)[\w.-]*(\/|\.|$)/i],
-    ["payments", /(^|\/)(payments?|billing|checkout|stripe|invoice)[\w.-]*(\/|\.|$)/i],
-    ["migration", /(^|\/)(migrations?|alembic)\/|\.sql$/i],
-    ["ci", /(^|\/)(\.github\/(workflows|actions)|\.gitlab-ci\.yml|\.circleci|Jenkinsfile|azure-pipelines)/i],
-    ["lockfile", /(^|\/)(package-lock\.json|pnpm-lock\.yaml|bun\.lockb?|go\.sum|[\w-]+\.lock)$/],
-    ["infra", /(^|\/)(Dockerfile[\w.-]*|docker-compose[\w.-]*\.ya?ml|terraform|helm|k8s|kubernetes|infra|deploy)(\/|\.|$)|\.tf$/i],
-    ["env", /(^|\/)\.env[\w.]*$/]
-  ];
-  API = /(^|\/)(openapi|swagger)[\w.-]*\.(ya?ml|json)$|\.proto$|\.d\.ts$|(^|\/)(api|routes|public)\/|(^|\/)index\.(ts|js|py)$/i;
-  TEST_CFG = /(^|\/)(conftest\.py|\.?pytest\.(ini|toml)|tox\.ini|jest\.config\.[\w.]+|vitest\.config\.[\w.]+)$/;
-  RANK2 = { low: 0, medium: 1, high: 2 };
-  RAN_ALWAYS = ["targeted tests", "lint of changed files"];
-  PLAN = {
-    low: { selected: [...RAN_ALWAYS] },
-    medium: { selected: [...RAN_ALWAYS, "full test command", "one reviewer"] },
-    high: { selected: [...RAN_ALWAYS, "full test command", "full suite", "council", "security scan"] }
-  };
-  LOW_SKIPPED = ["full test command", "reviewer", "council", "security scan"];
-  MANIFEST_LOCKS = [
-    [/(^|\/)package\.json$/, /(^|\/)(package-lock\.json|npm-shrinkwrap\.json|pnpm-lock\.yaml|yarn\.lock|bun\.lockb?)$/],
-    [/(^|\/)pyproject\.toml$/, /(^|\/)(poetry\.lock|uv\.lock|pdm\.lock|Pipfile\.lock)$/],
-    [/(^|\/)go\.mod$/, /(^|\/)go\.sum$/]
-  ];
-  PKG_DEP_KEYS = ["dependencies", "devDependencies", "peerDependencies", "optionalDependencies"];
-  PYPROJECT_NONDEP = /^(name|version|description|readme|license|requires-python|python|authors|maintainers|keywords|classifiers|homepage|repository|documentation|packages|include|exclude)$/;
+var ID_LINE;
+var init_failures = __esm(() => {
+  ID_LINE = /^(?:(?:FAILED|ERROR)\s+(\S+::\S*)(?:\s.*)?|\u25cf\s+(?!Console|Test suite failed)(.+)|not ok \d+ - (.+?)(?:\s+#.*)?|\u2716\s+(?!failing tests:)(.+?)(?:\s+\([\d.]+ms\))?|(?:FAIL|\u00d7)\s+(.+))$/;
 });
 
 // ../../loki-ts/src/runner/state.ts
@@ -10370,7 +10396,7 @@ var init_state = __esm(() => {
 });
 
 // ../../loki-ts/src/runner/repo_profile.ts
-import { spawnSync as spawnSync2 } from "child_process";
+import { spawnSync as spawnSync3 } from "child_process";
 import { existsSync as existsSync24, lstatSync as lstatSync9, readFileSync as readFileSync30, mkdirSync as mkdirSync14, readdirSync as readdirSync14, renameSync as renameSync9, rmSync as rmSync8, writeFileSync as writeFileSync17 } from "fs";
 import { basename as basename12, join as join39, resolve as resolve13, isAbsolute as isAbsolute4 } from "path";
 function detectFormatters(repoDir) {
@@ -10405,7 +10431,7 @@ function runFormatters(repoDir, files, env) {
   }) : [];
   return fmts.flatMap((fm) => {
     const own = mine.filter((f) => fm.exts.test(f));
-    const r = own.length ? spawnSync2(fm.argv[0], [...fm.argv.slice(1), ...own.map((f) => `./${f}`)], { cwd: repoDir, env, stdio: "ignore", timeout: 30000 }) : null;
+    const r = own.length ? spawnSync3(fm.argv[0], [...fm.argv.slice(1), ...own.map((f) => `./${f}`)], { cwd: repoDir, env, stdio: "ignore", timeout: 30000 }) : null;
     return r && !r.error && r.status === 0 ? own : [];
   });
 }
@@ -11213,7 +11239,7 @@ var init_shell = __esm(() => {
 
 // ../../loki-ts/src/util/python.ts
 import { accessSync, constants as constants3, existsSync as existsSync27, mkdtempSync as mkdtempSync4, readFileSync as readFileSync34, realpathSync as realpathSync18, rmSync as rmSync11, statSync as statSync16 } from "fs";
-import { spawnSync as spawnSync3 } from "child_process";
+import { spawnSync as spawnSync4 } from "child_process";
 import { tmpdir as tmpdir5 } from "os";
 async function findPython3() {
   if (_pythonCache !== undefined)
@@ -11250,7 +11276,7 @@ function pySignatures(src) {
     const py = resolvePython3();
     if (!py)
       return [];
-    const r = spawnSync3(py, ["-I", "-S", "-c", PY_SCRIPT], {
+    const r = spawnSync4(py, ["-I", "-S", "-c", PY_SCRIPT], {
       input: src.replace(/\r\n?/g, `
 `),
       cwd: tmpdir5(),
@@ -12402,7 +12428,7 @@ var init_runner_errors = __esm(() => {
 });
 
 // ../../loki-ts/src/runner/load_owner.ts
-import { spawnSync as spawnSync4 } from "child_process";
+import { spawnSync as spawnSync5 } from "child_process";
 import { mkdtempSync as mkdtempSync6, realpathSync as realpathSync19, rmSync as rmSync14 } from "fs";
 import { tmpdir as tmpdir8 } from "os";
 import { basename as basename18, extname as extname2, join as join46 } from "path";
@@ -12447,7 +12473,7 @@ function sameLoadError(head, base, headRoots, baseRoots) {
 function killTree(pid) {
   const all = [pid];
   for (let k = 0;k < all.length; k++) {
-    const kids = spawnSync4("pgrep", ["-P", String(all[k])], { encoding: "utf8", env: process.env }).stdout.split(/\s+/).filter(Boolean).map(Number);
+    const kids = spawnSync5("pgrep", ["-P", String(all[k])], { encoding: "utf8", env: process.env }).stdout.split(/\s+/).filter(Boolean).map(Number);
     all.push(...kids.filter((x) => Number.isInteger(x) && !all.includes(x)));
   }
   try {
@@ -12595,7 +12621,7 @@ var init_wall_owned = __esm(() => {
 });
 
 // ../../loki-ts/src/util/app_probe.ts
-import { spawnSync as spawnSync5 } from "child_process";
+import { spawnSync as spawnSync6 } from "child_process";
 import { existsSync as existsSync29, mkdirSync as mkdirSync18, readFileSync as readFileSync38, renameSync as renameSync11, writeFileSync as writeFileSync21 } from "fs";
 import { join as join48 } from "path";
 function readJson4(p) {
@@ -12610,7 +12636,7 @@ function stopApp(repoDir, opts = {}) {
   const runner = opts.runnerPath ?? join48(REPO_ROOT, "autonomy", "app-runner.sh");
   if (!existsSync29(runner) || !existsSync29(join48(repoDir, ".loki", "app-runner", "app.pid")))
     return;
-  spawnSync5("bash", ["-c", STOP, "app-probe", repoDir, runner], { cwd: repoDir, env: plainTestEnv(), timeout: opts.timeoutMs ?? 60000, killSignal: "SIGKILL", stdio: "ignore" });
+  spawnSync6("bash", ["-c", STOP, "app-probe", repoDir, runner], { cwd: repoDir, env: plainTestEnv(), timeout: opts.timeoutMs ?? 60000, killSignal: "SIGKILL", stdio: "ignore" });
 }
 async function appProbe(repoDir, lokiDir2, opts = {}) {
   const timeoutMs = opts.timeoutMs ?? 60000, runner = opts.runnerPath ?? join48(REPO_ROOT, "autonomy", "app-runner.sh");
@@ -12618,7 +12644,7 @@ async function appProbe(repoDir, lokiDir2, opts = {}) {
   const t0 = Date.now();
   const mk2 = (name, result, reason) => ({ name, cmd: "autonomy/app-runner.sh", result, duration_s: (Date.now() - t0) / 1000, reason });
   const sh = (script) => {
-    const r = spawnSync5("bash", ["-c", script, "app-probe", repoDir, runner], { cwd: repoDir, env: { ...plainTestEnv(), ...opts.env ?? {} }, encoding: "utf8", timeout: timeoutMs, killSignal: "SIGKILL", stdio: ["ignore", "pipe", "ignore"] });
+    const r = spawnSync6("bash", ["-c", script, "app-probe", repoDir, runner], { cwd: repoDir, env: { ...plainTestEnv(), ...opts.env ?? {} }, encoding: "utf8", timeout: timeoutMs, killSignal: "SIGKILL", stdio: ["ignore", "pipe", "ignore"] });
     return { out: r.stdout ?? "", status: r.error ? null : r.status };
   };
   let pid = null, url = null;
@@ -12663,7 +12689,7 @@ async function functionalVerify(opts, url, dir, lokiDir2, timeoutMs) {
     return res("not_run", "python3 or functional-verify.py unavailable");
   const specFile = join48(dir, "spec.txt");
   writeFileSync21(specFile, opts.specText ?? "");
-  const r = spawnSync5(py, ["-I", script, specFile, url], { env: plainTestEnv(), encoding: "utf8", timeout: timeoutMs, killSignal: "SIGKILL", stdio: ["ignore", "pipe", "ignore"] });
+  const r = spawnSync6(py, ["-I", script, specFile, url], { env: plainTestEnv(), encoding: "utf8", timeout: timeoutMs, killSignal: "SIGKILL", stdio: ["ignore", "pipe", "ignore"] });
   let out2 = null;
   try {
     const v = JSON.parse(r.stdout ?? "");
@@ -14569,7 +14595,7 @@ var readJson5 = (p) => {
 var init_conventions = () => {};
 
 // ../../loki-ts/src/engine10/stages/wall.ts
-import { spawnSync as spawnSync6 } from "child_process";
+import { spawnSync as spawnSync7 } from "child_process";
 import { existsSync as existsSync38, mkdirSync as mkdirSync24, mkdtempSync as mkdtempSync11, readFileSync as readFileSync45, readdirSync as readdirSync18, rmSync as rmSync19, writeFileSync as writeFileSync27 } from "fs";
 import { tmpdir as tmpdir12 } from "os";
 import { dirname as dirname23, join as join58, relative as relative8 } from "path";
@@ -14589,7 +14615,7 @@ class RealBaseTestRunner {
     const api = this.api === undefined ? loadProjectApi(repoDir) : this.api;
     for (const f of files) {
       const { cmd, args, interpreter, cwd } = commandFor(f, repoDir, api);
-      const r = spawnSync6(cmd, f.runner === "pytest" ? [...args, "-rfE"] : args, { cwd, encoding: "utf8", timeout: Math.max(1000, this.timeoutMs), env: plainTestEnv() });
+      const r = spawnSync7(cmd, f.runner === "pytest" ? [...args, "-rfE"] : args, { cwd, encoding: "utf8", timeout: Math.max(1000, this.timeoutMs), env: plainTestEnv() });
       const status = r.error ? null : r.status;
       const result = classify(f, status, stripAnsi(`${r.stdout ?? ""}
 ${r.stderr ?? ""}`), repoDir, interpreter);
@@ -16136,6 +16162,7 @@ var init_seal = __esm(() => {
         events_sha256: sha2562(existsSync45(eventsPath) ? readFileSync53(eventsPath) : ""),
         ...await sealEvidence(ctx.repoDir, ctx.runDir, o, notProven, signal, ctx.emit),
         log_seal: true,
+        toolchain: collectToolchain(),
         ...receiptBlock(process.env, cost.usd, cost.unmetered === true, totalS),
         ...reviewReceipt(ctx.provider, xr).review ? { review: reviewReceipt(ctx.provider, xr).review } : {},
         ...mp ? { mutation_proof: mp.line, mutation_outcome: mp.outcome } : {},
@@ -16294,12 +16321,10 @@ function compositeHash(r) {
   const { composite_sha256: _c, verification: _v, ...body } = r;
   return sha3(canonicalJson(body));
 }
-var COMPOSITE_SCHEMA = "loki.v10.composite/1", TOOLCHAIN_KEYS, toolchainProblem = (t) => isObj10(t) && Object.keys(t).length === TOOLCHAIN_KEYS.length && TOOLCHAIN_KEYS.every((k) => t[k] === null || typeof t[k] === "string") ? null : "toolchain section is malformed", slugOf = (repo) => repo.replace(/\//g, "__"), isComposite = (r) => r["schema"] === COMPOSITE_SCHEMA, relOk = (p) => p !== "" && !p.startsWith("/") && !p.split("/").includes("..");
+var COMPOSITE_SCHEMA = "loki.v10.composite/1", toolchainProblem = (t) => isObj10(t) && Object.keys(t).length === TOOLCHAIN_KEYS.length && TOOLCHAIN_KEYS.every((k) => t[k] === null || typeof t[k] === "string") ? null : "toolchain section is malformed", slugOf = (repo) => repo.replace(/\//g, "__"), isComposite = (r) => r["schema"] === COMPOSITE_SCHEMA, relOk = (p) => p !== "" && !p.startsWith("/") && !p.split("/").includes("..");
 var init_composite_seal = __esm(() => {
   init_receipt_signer();
-  init_check_result();
   init_seal_group();
-  TOOLCHAIN_KEYS = ["bun", "node", "python3", "git"];
 });
 
 // ../../loki-ts/src/engine10/keys_cmd.ts