loki-mode 11.17.67 → 11.17.69

package/packages/control-plane/dist/server.js

@@ -9418,15 +9418,15 @@ function classifyRisk(files, env = process.env) {
     summary
   };
 }
-function changedFiles(repoDir, baseSha) {
+function changedFiles(repoDir, baseSha, skip) {
   const run = (args) => safeGit(repoDir, args).split(`
 `).map((l) => l.trim()).filter(Boolean);
   const tracked = run(["diff", "--name-only", baseSha]);
   const untracked = run(["ls-files", "--others", "--exclude-standard"]);
-  return [...new Set([...tracked, ...untracked])].filter((f) => !f.startsWith(".loki/"));
+  return [...new Set([...tracked, ...untracked])].filter((f) => !f.startsWith(".loki/") && !skip?.(f));
 }
-function diffFiles(repoDir, baseSha) {
-  const paths = changedFiles(repoDir, baseSha), stat = new Map;
+function diffFiles(repoDir, baseSha, skip) {
+  const paths = changedFiles(repoDir, baseSha, skip), stat = new Map;
   for (const l of safeGit(repoDir, ["diff", "--numstat", baseSha]).split(`
 `)) {
     const [a, d, ...p] = l.split("\t"), path = p.join("\t");
@@ -9710,7 +9710,7 @@ var NO_TESTS_REASON = "no tests executed", GO_EXIT0_REASON = "test count could n
 `).filter((x) => x.trim()).slice(-12), GO_PKG_RE, isExecutedProof = (c) => c.result === "pass" && typeof c.n === "number" && c.n > 0, hasExecutedProof = (checks) => checks.some(isExecutedProof), LLM_JUDGES, NON_RUNNER, normPath = (p) => p.replace(/^(?:\.\/)+/, ""), hasExogenousProof = (checks, ctx) => checks.some((c) => isExecutedProof(c) && ((p) => p !== "agent_authored" && p !== "llm_judge")(checkProvenance(c.name ?? "", ctx))), SENSITIVE, API, TEST_CFG, RANK2, FILES_MEDIUM = 4, FILES_HIGH = 15, LINES_MEDIUM = 100, LINES_HIGH = 500, RAN_ALWAYS, PLAN, LOW_SKIPPED, deferredOf = (tier, selected, executed) => (tier === "low" ? LOW_SKIPPED : selected).filter((c) => !RAN_ALWAYS.includes(c) && !executed.includes(c)), MANIFEST_LOCKS, dirOf = (p) => p.includes("/") ? p.slice(0, p.lastIndexOf("/")) : "", PKG_DEP_KEYS, PYPROJECT_NONDEP, EXCERPT_GROUP_CAP = 1500, EXCERPT_TOTAL_CAP = 6144, verifyJobs = () => {
   const n2 = Number.parseInt(process.env["LOKI_E10_VERIFY_JOBS"] ?? "", 10);
   return Number.isFinite(n2) && n2 >= 1 ? Math.min(n2, 8) : 1;
-};
+}, FULL_SUITE_CMD;
 var init_check_result = __esm(() => {
   init_resolve();
   init_testmap();
@@ -9748,6 +9748,16 @@ var init_check_result = __esm(() => {
   ];
   PKG_DEP_KEYS = ["dependencies", "devDependencies", "peerDependencies", "optionalDependencies"];
   PYPROJECT_NONDEP = /^(name|version|description|readme|license|requires-python|python|authors|maintainers|keywords|classifiers|homepage|repository|documentation|packages|include|exclude)$/;
+  FULL_SUITE_CMD = {
+    pytest: { cmd: "python", args: ["-m", "pytest", "-q"] },
+    vitest: { cmd: "npx", args: ["vitest", "run"] },
+    jest: { cmd: "npx", args: ["jest"] },
+    bun: { cmd: "bun", args: ["test"] },
+    node: { cmd: "node", args: ["--test"] },
+    npm: { cmd: "npm", args: ["test", "--silent"] },
+    go: { cmd: "go", args: ["test", "-json", "./..."] },
+    cargo: { cmd: "cargo", args: ["test"] }
+  };
 });
 
 // ../../loki-ts/src/util/receipt_signer.ts
@@ -10713,7 +10723,7 @@ function failIds(output) {
 }
 var ID_LINE;
 var init_failures = __esm(() => {
-  ID_LINE = /^(?:(?:FAILED|ERROR)\s+(\S+::\S*)(?:\s.*)?|\u25cf\s+(?!Console|Test suite failed)(.+)|not ok \d+ - (.+?)(?:\s+#.*)?|\u2716\s+(?!failing tests:)(.+?)(?:\s+\([\d.]+ms\))?|(?:FAIL|\u00d7)\s+(.+))$/;
+  ID_LINE = /^(?:(?:FAILED|ERROR)\s+(\S+::\S*)(?:\s.*)?|\u25cf\s+(?!Console|Test suite failed)(.+)|not ok \d+ - (.+?)(?:\s+#.*)?|\u2716\s+(?!failing tests:)(.+?)(?:\s+\([\d.]+ms\))?|FAIL\s+(.+)|\u00d7\s+(.+?)(?:\s+\d+(?:\.\d+)?\s*m?s)?)$/;
 });
 
 // ../../loki-ts/src/runner/state.ts
@@ -10785,10 +10795,14 @@ function attribute(repoDir, baseSha, failing) {
   const p = loadProfile(repoDir), none = { preExistingChecks: [], preExistingIds: [], introducedChecks: failing.map((f) => f.name), line: null };
   if (!p || p.revision !== baseSha || !p.baseline.attributable || p.baseline.failing_ids.length === 0 || failing.length === 0)
     return none;
-  const base = new Set(p.baseline.failing_ids), pre = failing.filter((f) => f.eligible && f.ids?.length && f.ids.every((i) => base.has(i)));
+  const base = new Set(p.baseline.failing_ids);
+  return split(failing.map((f) => ({ ...f, base })), base.size);
+}
+function split(failing, known) {
+  const pre = failing.filter((f) => f.eligible && f.ids?.length && f.ids.every((i) => f.base.has(i)));
   const introduced = failing.filter((f) => !pre.includes(f)).map((f) => f.name);
   if (pre.length === 0)
-    return { ...none, line: `baseline: ${base.size} known failure(s) before this run; none of the failing checks match them, ${introduced.length} introduced (blocking)` };
+    return { preExistingChecks: [], preExistingIds: [], introducedChecks: introduced, line: `baseline: ${known} known failure(s) before this run; none of the failing checks match them, ${introduced.length} introduced (blocking)` };
   return {
     preExistingChecks: pre.map((f) => f.name),
     preExistingIds: pre.flatMap((f) => f.ids ?? []),
@@ -10797,14 +10811,20 @@ function attribute(repoDir, baseSha, failing) {
   };
 }
 function attributeFullSuite(repoDir, baseSha, full, blocked, changed) {
-  const bad = full.filter((c) => c.result === "fail"), none = { preExistingChecks: [], preExistingIds: [], introducedChecks: bad.map((c) => c.name), line: null };
-  const norm3 = (s) => s.replace(/\s+--silent\b/, "").trim(), p = loadProfile(repoDir);
-  if (!bad.length || !p || p.revision !== baseSha || !p.baseline.attributable || !p.baseline.failing_ids.length)
+  const bad = full.filter((c) => c.result === "fail"), none = { preExistingChecks: [], preExistingIds: [], introducedChecks: bad.map((c) => c.name), line: null }, p = loadProfile(repoDir);
+  if (!bad.length || !p || p.revision !== baseSha)
     return none;
-  if (bad.some((c) => norm3(c.cmd) !== norm3(p.baseline.command ?? "")))
-    return { ...none, line: `baseline: ran "${p.baseline.command}", not the full suite command, ids not comparable, full suite failures not excused` };
-  const block = new Set(blocked);
-  return attribute(repoDir, baseSha, bad.map((c) => ({ name: c.name, ...c.ids ? { ids: c.ids } : {}, eligible: (c.ids ?? []).every((i) => !block.has(i) && !changed.some((f) => i.includes(f))) })));
+  const runs2 = [p.baseline, ...p.suites ?? []].filter((b) => b.ran), of = (cmd) => runs2.find((b) => normCmd(b.command ?? "") === normCmd(cmd));
+  const ids = (cmd) => {
+    const b = of(cmd);
+    return b?.attributable ? b.failing_ids : [];
+  }, miss = bad.find((c) => !of(c.cmd));
+  if (miss)
+    return { ...none, line: `baseline: ran ${runs2.map((b) => `"${b.command}"`).join(", ") || "nothing"}, not the full suite command "${miss.cmd}", ids not comparable, full suite failures not excused` };
+  const known = new Set(bad.flatMap((c) => ids(c.cmd))), block = new Set(blocked);
+  if (known.size === 0)
+    return none;
+  return split(bad.map((c) => ({ name: c.name, ...c.ids ? { ids: c.ids } : {}, eligible: (c.ids ?? []).every((i) => !block.has(i) && !changed.some((f) => i.includes(f))), base: new Set(ids(c.cmd)) })), known.size);
 }
 function parseStatic(tool, out2) {
   const re = STATIC_DIAG[tool], m = new Map;
@@ -10872,7 +10892,7 @@ var commandProfilePath = (repoDir) => join39(repoDir, ".loki", "state", "repo-pr
   } catch {
     return "";
   }
-}, STATIC_DIAG, STATIC_NOISE, STATIC_SUMMARY;
+}, normCmd = (s) => s.replace(/\s+--silent\b/, "").trim(), STATIC_DIAG, STATIC_NOISE, STATIC_SUMMARY;
 var init_repo_profile = __esm(() => {
   init_failures();
   init_check_result();
@@ -12388,9 +12408,278 @@ function recordHoldoutTriage(runDir, entry) {
 var sha2 = (s) => createHash13("sha256").update(s).digest("hex"), WALL_HOLDOUT_DEFAULT_RATIO = 0.2, isHoldoutCheck = (name) => name.startsWith("holdout:"), holdoutDirFor = (runId2, repoDir) => join44(tmpdir6(), `loki-e10-holdout-${sha2(`${runId2}:${repoDir}`).slice(0, 16)}`), MANIFEST = "manifest.json", WALL_HOLDOUT_MIN = 5, HOLDOUT_TRIAGE_FILE = "holdout-triage.jsonl";
 var init_holdout = () => {};
 
+// ../../loki-ts/src/runner/runner_errors.ts
+function hasRealTestFailure(out2) {
+  return /^\s*Tests:?\s+.*\b[1-9]\d* failed\b/m.test(out2) || /^(?:=+ )?.*\b[1-9]\d* failed\b.* in [\d.]+s/m.test(out2) || /^FAILED \S+::/m.test(out2) || /^(?:#|\u2139) fail [1-9]/m.test(out2) || /^\s*[1-9]\d*\s+fail\s*$/m.test(out2) || /^\s*(?:FAIL|\u00D7)\s+\S.*\s>\s/m.test(out2) || /\bAssertionError\b/.test(out2);
+}
+function firstLoadLine(out2) {
+  const lines = out2.split(`
+`).map((l2) => l2.trim()).filter(Boolean);
+  const l = lines.find((x) => /^(?:E\s+)?(?:Error|\w*Error|ERROR|Failed|FAIL)\b|Cannot find|Interrupted:|No test files found|\d+: [\w.-]+: not found$|: command not found$|canceled due to missing packages/.test(x)) ?? lines[0] ?? "";
+  return l.replace(/\s+/g, " ").slice(0, 160);
+}
+function classifyRunnerOutput(out2) {
+  if (!hasRealTestFailure(out2)) {
+    for (const [re, why] of LOAD_PATTERNS) {
+      if (re.test(out2))
+        return { kind: "load_error", owner: "harness", reason: `runner could not load: ${why}: ${firstLoadLine(out2)}` };
+    }
+  }
+  return { kind: "test_failure", owner: "code" };
+}
+var LOAD_PATTERNS;
+var init_runner_errors = __esm(() => {
+  LOAD_PATTERNS = [
+    [/Failed Suites\s+[1-9]/, "test suite failed to load"],
+    [/Test suite failed to run/, "test suite failed to run"],
+    [/Failed to load (?:url|config)|failed to load config|Failed to resolve (?:import|entry)/i, "runner config or import could not be loaded"],
+    [/^\s*(?:\w*Error: )?Cannot find (?:module|package) '[^']+'/m, "module not found while loading tests"],
+    [/ERR_MODULE_NOT_FOUND/, "module not found while loading tests"],
+    [/Interrupted: \d+ errors? during collection/, "collection error"],
+    [/^_+ ERROR collecting /m, "collection error"],
+    [/ImportError while importing test module/, "test module import error"],
+    [/ImportError: Failed to import test module/, "unittest test module import error"],
+    [/^ERROR: (?:file or directory not found|not found:)/m, "test path not found by the runner"],
+    [/No test files found, exiting with code [1-9]/, "runner found no test files (wrong cwd or path)"],
+    [/\[setup failed\]|cannot find package|no required module provides package/, "go package could not be set up"],
+    [/could not determine executable to run/i, "test runner executable not found"],
+    [/^(?:\S+: )?(?:line \d+: )?[\w.-]+: command not found$/m, "test runner executable not found"],
+    [/^(?:\S+: )?\d+: [\w.-]+: not found$/m, "test runner executable not found (not installed)"],
+    [/^npm (?:error|ERR!) (?:npx )?canceled due to missing packages/m, "test runner package not installed"]
+  ];
+});
+
+// ../../loki-ts/src/runner/load_owner.ts
+import { spawnSync as spawnSync5 } from "child_process";
+import { mkdtempSync as mkdtempSync5, realpathSync as realpathSync19, rmSync as rmSync13 } from "fs";
+import { tmpdir as tmpdir7 } from "os";
+import { basename as basename18, extname as extname2, join as join45 } from "path";
+function changedFilesNamed(out2, repoDir, changed) {
+  return changed.filter((f) => {
+    if (out2.includes(f) || out2.includes(join45(repoDir, f)))
+      return true;
+    const segs = f.split("/");
+    if (suffixes(segs, 2).some((x) => x !== f && bounded(out2, x, "(?![\\w-])")))
+      return true;
+    if (extname2(f) === ".go" && segs.length > 1 && suffixes(segs.slice(0, -1), 1).some((d) => new RegExp(`(?<=[\\w-])/${esc(d)}(?![\\w./-])`).test(out2)))
+      return true;
+    const stem = basename18(f, extname2(f));
+    if (stem.length < 2 || stem === "index" || stem === "__init__")
+      return false;
+    return new RegExp(`(?<![\\w-])${esc(stem)}(?![\\w-])`).test(out2);
+  });
+}
+function loadSignature(out2, roots) {
+  let o = out2;
+  for (const r of roots.flatMap((x) => {
+    try {
+      return [x, realpathSync19(x)];
+    } catch {
+      return [x];
+    }
+  }).sort((a, b) => b.length - a.length))
+    o = o.split(r).join("<repo>");
+  const keys = new Set;
+  for (const m of o.matchAll(/Cannot find (?:module|package) '([^']+)'/g))
+    keys.add(`mod:${m[1]}`);
+  for (const m of o.matchAll(/([\w.-]+): command not found/g))
+    keys.add(`cmd:${m[1]}`);
+  for (const m of o.matchAll(/^(?:\S+: )?\d+: ([\w.-]+): not found$/gm))
+    keys.add(`cmd:${m[1]}`);
+  for (const m of o.matchAll(/canceled due to missing packages[^\[\n]*\[([^\]\n]*)\]/g))
+    for (const p of (m[1] ?? "").split(",")) {
+      const n2 = p.trim().replace(/^["']|["']$/g, "").replace(/(?<=.)@[^@/]*$/, "");
+      if (n2)
+        keys.add(`pkg:${n2}`);
+    }
+  return { keys, reason: (classifyRunnerOutput(o).reason ?? "").replace(/:\d+(?::\d+)?/g, "") };
+}
+function sameLoadError(head, base, headRoots, baseRoots) {
+  const h = loadSignature(head, headRoots), b = loadSignature(base, baseRoots);
+  if (b.keys.size)
+    return h.keys.size > 0 && [...b.keys].every((k) => h.keys.has(k));
+  return h.keys.size === 0 && h.reason === b.reason;
+}
+function killTree(pid) {
+  const all = [pid];
+  for (let k = 0;k < all.length; k++) {
+    const kids = spawnSync5("pgrep", ["-P", String(all[k])], { encoding: "utf8", env: process.env }).stdout.split(/\s+/).filter(Boolean).map(Number);
+    all.push(...kids.filter((x) => Number.isInteger(x) && !all.includes(x)));
+  }
+  try {
+    if (Number.isInteger(pid) && pid > 1)
+      process.kill(-pid, "SIGKILL");
+  } catch {}
+  for (const p of all.reverse()) {
+    try {
+      process.kill(p, "SIGKILL");
+    } catch {}
+  }
+}
+async function runOnBase(i, dir) {
+  const sub2 = (s) => s.split(i.repoDir).join(dir);
+  const stop = AbortSignal.any([i.signal, AbortSignal.timeout(i.timeoutMs ?? 60000)]);
+  try {
+    const proc = Bun.spawn([sub2(i.cmd), ...i.args.map(sub2)], {
+      cwd: sub2(i.cwd ?? i.repoDir),
+      stdin: "ignore",
+      stdout: "pipe",
+      stderr: "pipe",
+      detached: true,
+      env: { ...plainTestEnv(), ...i.env ?? {} }
+    });
+    let tail = "";
+    const rs = [proc.stdout, proc.stderr].map((x) => x.getReader());
+    const pumps = rs.map(async (r) => {
+      const d = new TextDecoder;
+      for (;; ) {
+        const c = await r.read().catch(() => ({ done: true, value: undefined }));
+        if (c.done)
+          return;
+        tail = (tail + d.decode(c.value, { stream: true })).slice(-65536);
+      }
+    });
+    const cut = new Promise((res) => {
+      if (stop.aborted)
+        res(null);
+      else
+        stop.addEventListener("abort", () => res(null), { once: true });
+    });
+    const code = await Promise.race([proc.exited, cut]);
+    if (code === null) {
+      killTree(proc.pid);
+      return null;
+    }
+    await Promise.race([Promise.all(pumps), new Promise((r) => setTimeout(r, 300))]);
+    rs.forEach((r) => r.cancel().catch(() => {}));
+    return stop.aborted || code === 0 ? null : stripAnsi(tail);
+  } catch {
+    return null;
+  }
+}
+function changedSince(repoDir, baseSha, skip) {
+  const g = (a) => safeGit(repoDir, a).split(`
+`).map((l) => l.trim()).filter(Boolean);
+  return [...new Set([...g(["diff", "--name-only", baseSha]), ...g(["ls-files", "--others", "--exclude-standard"])])].filter((f) => !f.startsWith(".loki/") && !skip?.(f));
+}
+async function loadErrorIsHarnessOwned(i) {
+  if (i.protect || !i.baseSha || i.signal.aborted)
+    return false;
+  let changed;
+  try {
+    changed = changedSince(i.repoDir, i.baseSha, i.skip);
+  } catch {
+    return false;
+  }
+  if (changedFilesNamed(i.out, i.repoDir, changed).length > 0)
+    return false;
+  if (i.args.some((a) => changed.includes(a.replace(/^\.\//, ""))))
+    return false;
+  const dir = mkdtempSync5(join45(tmpdir7(), "e10-loadown-"));
+  const git3 = (args) => {
+    safeGit(i.repoDir, args, { stdio: "ignore" });
+  };
+  try {
+    git3(["worktree", "add", "--detach", dir, i.baseSha]);
+    const base = await runOnBase(i, dir);
+    return base !== null && classifyRunnerOutput(base).kind === "load_error" && sameLoadError(i.out, base, [i.repoDir, ...i.cwd ? [i.cwd] : []], [dir]);
+  } catch {
+    return false;
+  } finally {
+    try {
+      git3(["worktree", "remove", "--force", dir]);
+    } catch {}
+    rmSync13(dir, { recursive: true, force: true });
+    try {
+      git3(["worktree", "prune"]);
+    } catch {}
+  }
+}
+async function harnessLoadReason(i) {
+  const c = classifyRunnerOutput(i.out);
+  return c.kind === "load_error" && await loadErrorIsHarnessOwned(i) ? c.reason : undefined;
+}
+var esc = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), suffixes = (segs, min) => segs.map((_, k) => segs.slice(k).join("/")).filter((x) => x.split("/").length >= min), bounded = (out2, tok2, tail) => new RegExp(`(?<![\\w.-])${esc(tok2)}${tail}`).test(out2);
+var init_load_owner = __esm(() => {
+  init_runner_errors();
+  init_safe_git();
+  init_check_result();
+});
+
+// ../../loki-ts/src/project_model/package_suite.ts
+import { join as join46 } from "path";
+function packageSuiteSpecs(api) {
+  if (!isMultiRoot(api))
+    return null;
+  const specs = api.packages().filter((p) => p.commands.test).map((p) => {
+    const tc = p.commands.test;
+    return { name: `full suite: ${p.name}`, cmd: `(cd ${tc.cwd} && ${tc.cmd})`, cwd: tc.cwd, run: tc.cmd };
+  });
+  return specs.length ? specs : null;
+}
+async function runPackageSuites(repoDir, signal, opts, checks, notProven) {
+  const api = loadProjectApi(repoDir), specs = packageSuiteSpecs(api);
+  if (!api || !specs)
+    return false;
+  for (const { name, cmd: cmd2, cwd, run: line2 } of specs) {
+    const started = Date.now();
+    const r = await run(["bash", "-c", line2], { cwd: join46(repoDir, cwd), timeoutMs: opts.timeoutMs, ...opts.path ? { env: { PATH: opts.path } } : {} });
+    const duration_s = (Date.now() - started) / 1000;
+    if (signal.aborted) {
+      checks.push({ name, cmd: cmd2, result: "not_run", duration_s });
+      notProven.add(`not run: ${name} (aborted)`);
+      continue;
+    }
+    const out2 = `${r.stdout}
+${r.stderr}`;
+    const lr = r.exitCode === 0 || !opts.baseSha ? undefined : await harnessLoadReason({ repoDir, baseSha: opts.baseSha, ...opts.skip ? { skip: opts.skip } : {}, out: out2, cmd: "bash", args: ["-c", line2], signal, cwd: join46(repoDir, cwd), ...opts.path ? { env: { PATH: opts.path } } : {} });
+    if (lr) {
+      checks.push({ name, cmd: cmd2, result: "not_run", duration_s });
+      notProven.add(`${lr} (${name}; harness-owned)`);
+      continue;
+    }
+    const cls = classifyCheck({ kind: "test", ok: r.exitCode === 0, out: out2, ...goRunner(line2) });
+    checks.push({ name, cmd: cmd2, result: cls.result, duration_s, ...cls.result === "fail" ? { ids: failIds(out2) } : {} });
+    if (cls.result === "not_run")
+      notProven.add(`not run: ${name} (${cls.reason ?? NO_TESTS_REASON})`);
+  }
+  for (const pkg of api.packages().filter((p) => !p.commands.test))
+    notProven.add(`full suite: package ${pkg.name} defines no test command`);
+  return true;
+}
+var init_package_suite = __esm(() => {
+  init_load_owner();
+  init_check_result();
+  init_shell();
+  init_failures();
+  init_resolve();
+});
+
+// ../../loki-ts/src/project_model/install.ts
+function installOwned(repoDir, rec, env = process.env) {
+  const r = rec, files = r && typeof r.files === "object" && r.files ? r.files : {}, dirs = Array.isArray(r?.dirs) ? r.dirs : [];
+  return (f) => dirs.some((d) => typeof d === "string" && f.startsWith(d)) || Object.hasOwn(files, f) && (() => {
+    try {
+      return hashOf(repoDir, f, env) === files[f];
+    } catch {
+      return false;
+    }
+  })();
+}
+var memo3, STATUS_MAX_BUFFER, hashOf = (repoDir, path, env = process.env) => safeGit(repoDir, ["hash-object", "--no-filters", "--", path], { env }).trim();
+var init_install = __esm(() => {
+  init_safe_git();
+  init_yaml_key();
+  init_repo_profile();
+  init_package_suite();
+  init_resolve();
+  memo3 = new Set;
+  STATUS_MAX_BUFFER = 64 * 1024 * 1024;
+});
+
 // ../../loki-ts/src/features/runner_config.ts
 import { readFileSync as readFileSync37 } from "fs";
-import { dirname as dirname17, join as join45, normalize as normalize2 } from "path";
+import { dirname as dirname17, join as join47, normalize as normalize2 } from "path";
 function tomlKey2(s, i = 0, eq2 = true) {
   const parts = [], ws = () => {
     while (/\s/.test(s[i] ?? "x"))
@@ -12667,8 +12956,8 @@ function referenced(cfg, text2) {
     }
   const dir = dirname17(cfg), explicit = ROOT_DIR.exec(text2), roots = [dir];
   if (explicit)
-    roots.push("", ...explicit[1] ? [join45(dir, explicit[1])] : []);
-  return [...raw2.flatMap((r) => r.startsWith("/") ? [normalize2(r.slice(1))] : roots.map((root) => normalize2(join45(root, r.replace(/^<rootDir>\/?/, ""))))), ...patchedTargets(cfg, text2).map((t) => normalize2(join45(dir, t)))];
+    roots.push("", ...explicit[1] ? [join47(dir, explicit[1])] : []);
+  return [...raw2.flatMap((r) => r.startsWith("/") ? [normalize2(r.slice(1))] : roots.map((root) => normalize2(join47(root, r.replace(/^<rootDir>\/?/, ""))))), ...patchedTargets(cfg, text2).map((t) => normalize2(join47(dir, t)))];
 }
 function runnerConfigNotes(repoDir, baseSha, head, changed, signal) {
   const notes = new Set, ch = new Set(changed.map((c) => normalize2(c)));
@@ -12748,7 +13037,7 @@ var PKG_KEYS, RAW_CONFIGS, RUNNER_CONFIGS, DEP_MAPS, RUNNER_DEP, LOCAL_SPEC, dep
   }
 }, headText = (dir, f) => {
   try {
-    return readFileSync37(join45(dir, f), "utf8");
+    return readFileSync37(join47(dir, f), "utf8");
   } catch {
     return "";
   }
@@ -12787,21 +13076,21 @@ var init_runner_config = __esm(() => {
 });
 
 // ../../loki-ts/src/e10ext/assert_delta.ts
-import { execFileSync as execFileSync3 } from "child_process";
-import { mkdtempSync as mkdtempSync5, readFileSync as readFileSync38, rmSync as rmSync13 } from "fs";
-import { tmpdir as tmpdir7 } from "os";
-import { join as join46 } from "path";
-import { basename as basename18 } from "path";
+import { execFileSync as execFileSync4 } from "child_process";
+import { mkdtempSync as mkdtempSync6, readFileSync as readFileSync38, rmSync as rmSync14 } from "fs";
+import { tmpdir as tmpdir8 } from "os";
+import { join as join48 } from "path";
+import { basename as basename19 } from "path";
 function classifyAssertDelta(inp) {
-  const f = basename18(inp.path);
+  const f = basename19(inp.path);
   if (!/^(test_.*|.*_test)\.py$/.test(f))
     return WEAKENED;
   if (inp.headCounts.run !== inp.baseCounts.run || inp.headCounts.skipped !== inp.baseCounts.skipped)
     return WEAKENED;
   let cwd = "";
   try {
-    cwd = mkdtempSync5(join46(tmpdir7(), "loki-ad-"));
-    const raw2 = execFileSync3("python3", ["-I", "-c", PY], {
+    cwd = mkdtempSync6(join48(tmpdir8(), "loki-ad-"));
+    const raw2 = execFileSync4("python3", ["-I", "-c", PY], {
       input: JSON.stringify({ path: inp.path, base: inp.base, head: inp.head, task: inp.task }),
       cwd,
       env: process.env,
@@ -12823,7 +13112,7 @@ function classifyAssertDelta(inp) {
     return WEAKENED;
   } finally {
     if (cwd)
-      rmSync13(cwd, { recursive: true, force: true });
+      rmSync14(cwd, { recursive: true, force: true });
   }
 }
 function assertDeltaNotes(repoDir, baseSha, headRef, path, task, baseCounts, headCounts) {
@@ -12831,7 +13120,7 @@ function assertDeltaNotes(repoDir, baseSha, headRef, path, task, baseCounts, hea
     return null;
   try {
     const show = (ref) => safeGit(repoDir, ["show", `${ref}:${path}`]);
-    const head = headRef ? show(headRef) : readFileSync38(join46(repoDir, path), "utf8");
+    const head = headRef ? show(headRef) : readFileSync38(join48(repoDir, path), "utf8");
     const r = classifyTestEdit(path, show(baseSha), head, task, baseCounts, headCounts);
     return r[0]?.kind === "literal-only" ? r.map((e) => `assertion value changed (not shown to be required by the task): ${e.file}:${e.line} ${e.old} -> ${e.new}`) : null;
   } catch {
@@ -13013,196 +13302,8 @@ var init_select = __esm(() => {
   PYTEST_COLLECTION_EXITS = new Set([2, 3, 4, 5]);
 });
 
-// ../../loki-ts/src/runner/runner_errors.ts
-function hasRealTestFailure(out2) {
-  return /^\s*Tests:?\s+.*\b[1-9]\d* failed\b/m.test(out2) || /^(?:=+ )?.*\b[1-9]\d* failed\b.* in [\d.]+s/m.test(out2) || /^FAILED \S+::/m.test(out2) || /^(?:#|\u2139) fail [1-9]/m.test(out2) || /^\s*[1-9]\d*\s+fail\s*$/m.test(out2) || /^\s*(?:FAIL|\u00D7)\s+\S.*\s>\s/m.test(out2) || /\bAssertionError\b/.test(out2);
-}
-function firstLoadLine(out2) {
-  const lines2 = out2.split(`
-`).map((l2) => l2.trim()).filter(Boolean);
-  const l = lines2.find((x) => /^(?:E\s+)?(?:Error|\w*Error|ERROR|Failed|FAIL)\b|Cannot find|Interrupted:|No test files found/.test(x)) ?? lines2[0] ?? "";
-  return l.replace(/\s+/g, " ").slice(0, 160);
-}
-function classifyRunnerOutput(out2) {
-  if (!hasRealTestFailure(out2)) {
-    for (const [re, why] of LOAD_PATTERNS) {
-      if (re.test(out2))
-        return { kind: "load_error", owner: "harness", reason: `runner could not load: ${why}: ${firstLoadLine(out2)}` };
-    }
-  }
-  return { kind: "test_failure", owner: "code" };
-}
-var LOAD_PATTERNS;
-var init_runner_errors = __esm(() => {
-  LOAD_PATTERNS = [
-    [/Failed Suites\s+[1-9]/, "test suite failed to load"],
-    [/Test suite failed to run/, "test suite failed to run"],
-    [/Failed to load (?:url|config)|failed to load config|Failed to resolve (?:import|entry)/i, "runner config or import could not be loaded"],
-    [/^\s*(?:\w*Error: )?Cannot find (?:module|package) '[^']+'/m, "module not found while loading tests"],
-    [/ERR_MODULE_NOT_FOUND/, "module not found while loading tests"],
-    [/Interrupted: \d+ errors? during collection/, "collection error"],
-    [/^_+ ERROR collecting /m, "collection error"],
-    [/ImportError while importing test module/, "test module import error"],
-    [/ImportError: Failed to import test module/, "unittest test module import error"],
-    [/^ERROR: (?:file or directory not found|not found:)/m, "test path not found by the runner"],
-    [/No test files found, exiting with code [1-9]/, "runner found no test files (wrong cwd or path)"],
-    [/\[setup failed\]|cannot find package|no required module provides package/, "go package could not be set up"],
-    [/could not determine executable to run/i, "test runner executable not found"],
-    [/^(?:\S+: )?(?:line \d+: )?[\w.-]+: command not found$/m, "test runner executable not found"]
-  ];
-});
-
-// ../../loki-ts/src/runner/load_owner.ts
-import { spawnSync as spawnSync5 } from "child_process";
-import { mkdtempSync as mkdtempSync6, realpathSync as realpathSync19, rmSync as rmSync14 } from "fs";
-import { tmpdir as tmpdir8 } from "os";
-import { basename as basename19, extname as extname2, join as join47 } from "path";
-function changedFilesNamed(out2, repoDir, changed) {
-  return changed.filter((f) => {
-    if (out2.includes(f) || out2.includes(join47(repoDir, f)))
-      return true;
-    const segs = f.split("/");
-    if (suffixes(segs, 2).some((x) => x !== f && bounded(out2, x, "(?![\\w-])")))
-      return true;
-    if (extname2(f) === ".go" && segs.length > 1 && suffixes(segs.slice(0, -1), 1).some((d) => new RegExp(`(?<=[\\w-])/${esc(d)}(?![\\w./-])`).test(out2)))
-      return true;
-    const stem = basename19(f, extname2(f));
-    if (stem.length < 2 || stem === "index" || stem === "__init__")
-      return false;
-    return new RegExp(`(?<![\\w-])${esc(stem)}(?![\\w-])`).test(out2);
-  });
-}
-function loadSignature(out2, roots) {
-  let o = out2;
-  for (const r of roots.flatMap((x) => {
-    try {
-      return [x, realpathSync19(x)];
-    } catch {
-      return [x];
-    }
-  }).sort((a, b) => b.length - a.length))
-    o = o.split(r).join("<repo>");
-  const keys = new Set;
-  for (const m of o.matchAll(/Cannot find (?:module|package) '([^']+)'/g))
-    keys.add(`mod:${m[1]}`);
-  for (const m of o.matchAll(/([\w.-]+): command not found/g))
-    keys.add(`cmd:${m[1]}`);
-  return { keys, reason: (classifyRunnerOutput(o).reason ?? "").replace(/:\d+(?::\d+)?/g, "") };
-}
-function sameLoadError(head, base, headRoots, baseRoots) {
-  const h = loadSignature(head, headRoots), b = loadSignature(base, baseRoots);
-  if (b.keys.size)
-    return h.keys.size > 0 && [...b.keys].every((k) => h.keys.has(k));
-  return h.keys.size === 0 && h.reason === b.reason;
-}
-function killTree(pid) {
-  const all = [pid];
-  for (let k = 0;k < all.length; k++) {
-    const kids = spawnSync5("pgrep", ["-P", String(all[k])], { encoding: "utf8", env: process.env }).stdout.split(/\s+/).filter(Boolean).map(Number);
-    all.push(...kids.filter((x) => Number.isInteger(x) && !all.includes(x)));
-  }
-  try {
-    if (Number.isInteger(pid) && pid > 1)
-      process.kill(-pid, "SIGKILL");
-  } catch {}
-  for (const p of all.reverse()) {
-    try {
-      process.kill(p, "SIGKILL");
-    } catch {}
-  }
-}
-async function runOnBase(i, dir) {
-  const sub2 = (s) => s.split(i.repoDir).join(dir);
-  const stop = AbortSignal.any([i.signal, AbortSignal.timeout(i.timeoutMs ?? 60000)]);
-  try {
-    const proc = Bun.spawn([sub2(i.cmd), ...i.args.map(sub2)], {
-      cwd: sub2(i.cwd ?? i.repoDir),
-      stdin: "ignore",
-      stdout: "pipe",
-      stderr: "pipe",
-      detached: true,
-      env: { ...plainTestEnv(), ...i.env ?? {} }
-    });
-    let tail = "";
-    const rs = [proc.stdout, proc.stderr].map((x) => x.getReader());
-    const pumps = rs.map(async (r) => {
-      const d = new TextDecoder;
-      for (;; ) {
-        const c = await r.read().catch(() => ({ done: true, value: undefined }));
-        if (c.done)
-          return;
-        tail = (tail + d.decode(c.value, { stream: true })).slice(-65536);
-      }
-    });
-    const cut = new Promise((res) => {
-      if (stop.aborted)
-        res(null);
-      else
-        stop.addEventListener("abort", () => res(null), { once: true });
-    });
-    const code = await Promise.race([proc.exited, cut]);
-    if (code === null) {
-      killTree(proc.pid);
-      return null;
-    }
-    await Promise.race([Promise.all(pumps), new Promise((r) => setTimeout(r, 300))]);
-    rs.forEach((r) => r.cancel().catch(() => {}));
-    return stop.aborted || code === 0 ? null : stripAnsi(tail);
-  } catch {
-    return null;
-  }
-}
-function changedSince(repoDir, baseSha) {
-  const g = (a) => safeGit(repoDir, a).split(`
-`).map((l) => l.trim()).filter(Boolean);
-  return [...new Set([...g(["diff", "--name-only", baseSha]), ...g(["ls-files", "--others", "--exclude-standard"])])].filter((f) => !f.startsWith(".loki/"));
-}
-async function loadErrorIsHarnessOwned(i) {
-  if (i.protect || !i.baseSha || i.signal.aborted)
-    return false;
-  let changed;
-  try {
-    changed = changedSince(i.repoDir, i.baseSha);
-  } catch {
-    return false;
-  }
-  if (changedFilesNamed(i.out, i.repoDir, changed).length > 0)
-    return false;
-  if (i.args.some((a) => changed.includes(a.replace(/^\.\//, ""))))
-    return false;
-  const dir = mkdtempSync6(join47(tmpdir8(), "e10-loadown-"));
-  const git3 = (args) => {
-    safeGit(i.repoDir, args, { stdio: "ignore" });
-  };
-  try {
-    git3(["worktree", "add", "--detach", dir, i.baseSha]);
-    const base = await runOnBase(i, dir);
-    return base !== null && classifyRunnerOutput(base).kind === "load_error" && sameLoadError(i.out, base, [i.repoDir, ...i.cwd ? [i.cwd] : []], [dir]);
-  } catch {
-    return false;
-  } finally {
-    try {
-      git3(["worktree", "remove", "--force", dir]);
-    } catch {}
-    rmSync14(dir, { recursive: true, force: true });
-    try {
-      git3(["worktree", "prune"]);
-    } catch {}
-  }
-}
-async function harnessLoadReason(i) {
-  const c = classifyRunnerOutput(i.out);
-  return c.kind === "load_error" && await loadErrorIsHarnessOwned(i) ? c.reason : undefined;
-}
-var esc = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), suffixes = (segs, min) => segs.map((_, k) => segs.slice(k).join("/")).filter((x) => x.split("/").length >= min), bounded = (out2, tok2, tail) => new RegExp(`(?<![\\w.-])${esc(tok2)}${tail}`).test(out2);
-var init_load_owner = __esm(() => {
-  init_runner_errors();
-  init_safe_git();
-  init_check_result();
-});
-
 // ../../loki-ts/src/util/wall_owned.ts
-import { isAbsolute as isAbsolute7, join as join48, relative as relative6 } from "path";
+import { isAbsolute as isAbsolute7, join as join49, relative as relative6 } from "path";
 function failingLocations(raw2, cwd, repoDir) {
   const out2 = raw2.replace(ANSI2, "").replace(/\r\n?/g, `
 `), files = new Set;
@@ -13234,7 +13335,7 @@ function failingLocations(raw2, cwd, repoDir) {
   }
   if (errors2 === 0 || located !== errors2)
     return null;
-  return [...files].map((f) => relative6(repoDir, isAbsolute7(f) ? f : join48(cwd, f)));
+  return [...files].map((f) => relative6(repoDir, isAbsolute7(f) ? f : join49(cwd, f)));
 }
 function wallOwnedFailure(raw2, cwd, repoDir, wall) {
   const locs = failingLocations(raw2, cwd, repoDir);
@@ -13248,7 +13349,7 @@ var init_wall_owned = __esm(() => {
 // ../../loki-ts/src/util/app_probe.ts
 import { spawnSync as spawnSync6 } from "child_process";
 import { existsSync as existsSync30, mkdirSync as mkdirSync19, readFileSync as readFileSync39, renameSync as renameSync11, writeFileSync as writeFileSync22 } from "fs";
-import { join as join49 } from "path";
+import { join as join50 } from "path";
 function readJson4(p) {
   try {
     const v = JSON.parse(readFileSync39(p, "utf8"));
@@ -13258,14 +13359,14 @@ function readJson4(p) {
   }
 }
 function stopApp(repoDir, opts = {}) {
-  const runner = opts.runnerPath ?? join49(REPO_ROOT, "autonomy", "app-runner.sh");
-  if (!existsSync30(runner) || !existsSync30(join49(repoDir, ".loki", "app-runner", "app.pid")))
+  const runner = opts.runnerPath ?? join50(REPO_ROOT, "autonomy", "app-runner.sh");
+  if (!existsSync30(runner) || !existsSync30(join50(repoDir, ".loki", "app-runner", "app.pid")))
     return;
   spawnSync6("bash", ["-c", STOP, "app-probe", repoDir, runner], { cwd: repoDir, env: plainTestEnv(), timeout: opts.timeoutMs ?? 60000, killSignal: "SIGKILL", stdio: "ignore" });
 }
 async function appProbe(repoDir, lokiDir2, opts = {}) {
-  const timeoutMs = opts.timeoutMs ?? 60000, runner = opts.runnerPath ?? join49(REPO_ROOT, "autonomy", "app-runner.sh");
-  const dir = join49(repoDir, ".loki", "app-runner"), checks = [];
+  const timeoutMs = opts.timeoutMs ?? 60000, runner = opts.runnerPath ?? join50(REPO_ROOT, "autonomy", "app-runner.sh");
+  const dir = join50(repoDir, ".loki", "app-runner"), checks = [];
   const t0 = Date.now();
   const mk2 = (name, result, reason) => ({ name, cmd: "autonomy/app-runner.sh", result, duration_s: (Date.now() - t0) / 1000, reason });
   const sh = (script) => {
@@ -13283,9 +13384,9 @@ async function appProbe(repoDir, lokiDir2, opts = {}) {
       return { checks, pid, url };
     }
     const ir = Number(m[1]), sr = Number(m[2]), hr = Number(m[3]);
-    const pidTxt = existsSync30(join49(dir, "app.pid")) ? readFileSync39(join49(dir, "app.pid"), "utf8").trim() : "";
+    const pidTxt = existsSync30(join50(dir, "app.pid")) ? readFileSync39(join50(dir, "app.pid"), "utf8").trim() : "";
     pid = /^\d+$/.test(pidTxt) && sr >= 0 ? Number(pidTxt) : null;
-    const st = readJson4(join49(dir, "state.json"));
+    const st = readJson4(join50(dir, "state.json"));
     url = typeof st?.["url"] === "string" ? st["url"] : null;
     if (sr < 0) {
       checks.push(mk2("app boot", "not_run", ir === 0 ? "app-runner detected no app" : "no runnable app detected or runtime missing"), mk2("http probe", "not_run", "app not booted"));
@@ -13296,7 +13397,7 @@ async function appProbe(repoDir, lokiDir2, opts = {}) {
       return { checks, pid, url };
     }
     checks.push(mk2("app boot", "pass", "app process started"));
-    const health = readJson4(join49(dir, "health.json"));
+    const health = readJson4(join50(dir, "health.json"));
     checks.push(hr === 0 && health?.["ok"] === true ? mk2("http probe", "pass", "health.json ok") : mk2("http probe", "fail", "app-runner health check failed"));
     if (opts.specText !== undefined && checks[1]?.result === "pass" && url)
       checks.push(await functionalVerify(opts, url, dir, lokiDir2, timeoutMs));
@@ -13309,10 +13410,10 @@ async function appProbe(repoDir, lokiDir2, opts = {}) {
 async function functionalVerify(opts, url, dir, lokiDir2, timeoutMs) {
   const t0 = Date.now();
   const res = (result, reason) => ({ name: "functional verify", cmd: "autonomy/lib/functional-verify.py", result, duration_s: (Date.now() - t0) / 1000, reason });
-  const py = await findPython3(), script = opts.verifyPath ?? join49(REPO_ROOT, "autonomy", "lib", "functional-verify.py");
+  const py = await findPython3(), script = opts.verifyPath ?? join50(REPO_ROOT, "autonomy", "lib", "functional-verify.py");
   if (!py || !existsSync30(script))
     return res("not_run", "python3 or functional-verify.py unavailable");
-  const specFile = join49(dir, "spec.txt");
+  const specFile = join50(dir, "spec.txt");
   writeFileSync22(specFile, opts.specText ?? "");
   const r = spawnSync6(py, ["-I", script, specFile, url], { env: plainTestEnv(), encoding: "utf8", timeout: timeoutMs, killSignal: "SIGKILL", stdio: ["ignore", "pipe", "ignore"] });
   let out2 = null;
@@ -13324,11 +13425,11 @@ async function functionalVerify(opts, url, dir, lokiDir2, timeoutMs) {
   }
   if (!out2 || r.status !== 0)
     return res("not_run", "functional harness produced no result");
-  const q = join49(lokiDir2, "quality");
+  const q = join50(lokiDir2, "quality");
   mkdirSync19(q, { recursive: true });
-  const tmp = join49(q, `functional-results.json.tmp.${process.pid}`);
+  const tmp = join50(q, `functional-results.json.tmp.${process.pid}`);
   writeFileSync22(tmp, JSON.stringify(out2, null, 2));
-  renameSync11(tmp, join49(q, "functional-results.json"));
+  renameSync11(tmp, join50(q, "functional-results.json"));
   const s = String(out2["functional_status"] ?? "inconclusive");
   return res(s === "verified" ? "pass" : s === "failed" ? "fail" : "not_run", `functional_status ${s}`);
 }
@@ -13361,12 +13462,12 @@ app_runner_stop >/dev/null 2>&1
 import { existsSync as existsSync31, mkdirSync as mkdirSync20, mkdtempSync as mkdtempSync7, readFileSync as readFileSync40, realpathSync as realpathSync20, rmSync as rmSync15, statSync as statSync19, writeFileSync as writeFileSync23 } from "fs";
 import { randomBytes as randomBytes5 } from "crypto";
 import { tmpdir as tmpdir9 } from "os";
-import { basename as basename20, dirname as dirname18, join as join50, resolve as resolve15, sep as sep11 } from "path";
+import { basename as basename20, dirname as dirname18, join as join51, resolve as resolve15, sep as sep11 } from "path";
 function fail(error) {
   return { ok: false, findings: [], error };
 }
 async function runSecureScan(targetDir, opts = {}) {
-  const script = opts.scriptPath ?? join50(REPO_ROOT, "autonomy", "lib", "secure-scan.py");
+  const script = opts.scriptPath ?? join51(REPO_ROOT, "autonomy", "lib", "secure-scan.py");
   if (!existsSync31(script))
     return fail(`secure-scan script not found: ${script}`);
   const py = await findPython3();
@@ -13536,7 +13637,7 @@ async function scanAddedLines(repoDir, opts = {}) {
   const skipped2 = [];
   for (const p of untracked.split("\x00").filter(Boolean)) {
     try {
-      const st = statSync19(join50(repoDir, p));
+      const st = statSync19(join51(repoDir, p));
       if (!st.isFile())
         continue;
       if (st.size > MAX_ADDED_FILE_BYTES) {
@@ -13551,14 +13652,14 @@ async function scanAddedLines(repoDir, opts = {}) {
         continue;
       }
       const lines2 = new Map;
-      readFileSync40(join50(repoDir, p), "utf8").split(`
+      readFileSync40(join51(repoDir, p), "utf8").split(`
 `).forEach((t, i) => lines2.set(i + 1, t));
       added.set(p, lines2);
     } catch {}
   }
   if (added.size === 0)
     return { ok: true, findings: skipped2 };
-  const mirror = mkdtempSync7(join50(tmpdir9(), "loki-secure-added-"));
+  const mirror = mkdtempSync7(join51(tmpdir9(), "loki-secure-added-"));
   try {
     const root = resolve15(mirror) + sep11;
     const chunkMap = new Map;
@@ -13604,7 +13705,7 @@ async function scanAddedLines(repoDir, opts = {}) {
         chunks.push(cur);
       const whole = chunks.length === 1;
       for (const c of chunks) {
-        const rel = whole ? p : join50(chunkRoot, String(chunkSeq++), basename20(p));
+        const rel = whole ? p : join51(chunkRoot, String(chunkSeq++), basename20(p));
         const out2 = whole ? dest : resolve15(mirror, rel);
         if (!out2.startsWith(root))
           break;
@@ -13756,7 +13857,7 @@ import { spawn as spawn8 } from "child_process";
 import { createHash as createHash14, randomBytes as randomBytes6 } from "crypto";
 import { existsSync as existsSync32, lstatSync as lstatSync12, mkdirSync as mkdirSync21, readdirSync as readdirSync18, readFileSync as readFileSync41, writeFileSync as writeFileSync24 } from "fs";
 import { createServer } from "net";
-import { dirname as dirname19, isAbsolute as isAbsolute8, join as join51, normalize as normalize3, relative as relative7, sep as sep12 } from "path";
+import { dirname as dirname19, isAbsolute as isAbsolute8, join as join52, normalize as normalize3, relative as relative7, sep as sep12 } from "path";
 function routeFor(file) {
   let r = file.replace(/^(?:.*?\/)?(?:app|pages|src|public)\//, "").replace(/^(?:routes|pages)\//, "");
   r = r.replace(/\.(?:html|jsx|tsx|vue|svelte)$/, "").replace(/\/?(?:page|index|\+page)$/, "");
@@ -13766,7 +13867,7 @@ function hashScreens(runDir, rels) {
   const out2 = [];
   for (const rel of rels) {
     try {
-      out2.push({ path: rel, sha256: sha256File(join51(runDir, rel)) });
+      out2.push({ path: rel, sha256: sha256File(join52(runDir, rel)) });
     } catch {}
   }
   return out2;
@@ -13779,10 +13880,10 @@ function checkScreens(runDir, screens) {
       return "evidence_screens entry is malformed";
     if (isAbsolute8(s.path) || normalize3(s.path).startsWith(".."))
       return `evidence screenshot path escapes the evidence dir: ${s.path}`;
-    const file = join51(runDir, s.path);
+    const file = join52(runDir, s.path);
     let cur = runDir;
     for (const seg of normalize3(s.path).split(sep12)) {
-      cur = join51(cur, seg);
+      cur = join52(cur, seg);
       if (isSymlink(cur))
         return `evidence screenshot path is a symlink: ${s.path}`;
     }
@@ -13829,7 +13930,7 @@ async function waitUp(url, ms, signal) {
 }
 function openapiPaths(repoDir) {
   for (const f of ["openapi.json", "openapi.yaml", "openapi.yml", "swagger.json"]) {
-    const p = join51(repoDir, f);
+    const p = join52(repoDir, f);
     if (!existsSync32(p))
       continue;
     try {
@@ -13847,24 +13948,24 @@ async function recordE2eMedia(repoDir, runDir, relDir, base, routes, ms, signal)
   if (!pw || !pkg)
     return { rels: [], skipped: "playwright e2e video and trace skipped: @playwright/test is not installed in the repo" };
   try {
-    const dir = join51(runDir, relDir, "e2e");
+    const dir = join52(runDir, relDir, "e2e");
     mkdirSync21(dir, { recursive: true });
-    writeFileSync24(join51(dir, "walk.spec.cjs"), e2eSpecSource(pkg, base, routes));
-    writeFileSync24(join51(dir, "playwright.config.cjs"), `module.exports = { testDir: ".", testMatch: "walk.spec.cjs", outputDir: "./out", reporter: "null", use: { video: "on", trace: "on" } };
+    writeFileSync24(join52(dir, "walk.spec.cjs"), e2eSpecSource(pkg, base, routes));
+    writeFileSync24(join52(dir, "playwright.config.cjs"), `module.exports = { testDir: ".", testMatch: "walk.spec.cjs", outputDir: "./out", reporter: "null", use: { video: "on", trace: "on" } };
 `);
-    if (!await shoot(pw, ["test", "--config", join51(dir, "playwright.config.cjs")], repoDir, ms, signal))
+    if (!await shoot(pw, ["test", "--config", join52(dir, "playwright.config.cjs")], repoDir, ms, signal))
       return { rels: [], skipped: "playwright e2e video and trace skipped: the run failed or timed out" };
     const rels = [];
     const walk = (d) => {
       for (const e of readdirSync18(d, { withFileTypes: true })) {
-        const full = join51(d, e.name);
+        const full = join52(d, e.name);
         if (e.isDirectory())
           walk(full);
         else if (e.isFile() && /\.(webm|zip)$/.test(e.name))
-          rels.push(join51(relDir, "e2e", relative7(dir, full)));
+          rels.push(join52(relDir, "e2e", relative7(dir, full)));
       }
     };
-    walk(join51(dir, "out"));
+    walk(join52(dir, "out"));
     return rels.length > 0 ? { rels, skipped: null } : { rels, skipped: "playwright e2e video and trace skipped: no video or trace was produced" };
   } catch (e) {
     return { rels: [], skipped: `playwright e2e video and trace skipped: ${String(e?.message ?? e).slice(0, 120)}` };
@@ -13943,15 +14044,15 @@ async function captureVisualEvidence(repoDir, runDir, changed, opts = {}) {
     if (!visualEvidenceEnabled(opts.env))
       return skip("LOKI_VISUAL_EVIDENCE is 0");
     const api = loadProjectApi(repoDir), boot = isMultiRoot(api) ? api.uiBoot() : null;
-    const appDir = boot ? join51(repoDir, boot.boot.cwd) : repoDir;
-    const pkgPath = join51(appDir, "package.json");
+    const appDir = boot ? join52(repoDir, boot.boot.cwd) : repoDir;
+    const pkgPath = join52(appDir, "package.json");
     let script = null;
     if (!boot) {
       if (!existsSync32(pkgPath)) {
-        const subs = ["backend", "frontend"].filter((d) => existsSync32(join51(repoDir, d, "package.json")));
+        const subs = ["backend", "frontend"].filter((d) => existsSync32(join52(repoDir, d, "package.json")));
         const has = (d) => {
           try {
-            return pickScript(JSON.parse(readFileSync41(join51(repoDir, d, "package.json"), "utf8"))) !== null;
+            return pickScript(JSON.parse(readFileSync41(join52(repoDir, d, "package.json"), "utf8"))) !== null;
           } catch {
             return false;
           }
@@ -13985,20 +14086,20 @@ async function captureVisualEvidence(repoDir, runDir, changed, opts = {}) {
     }
     if (!await waitUp(base, left(), signal))
       return skip(aborted() ? "aborted" : `${script} server did not answer within ${Math.round(budget / 1000)}s`);
-    const evRoot = join51(runDir, "evidence");
+    const evRoot = join52(runDir, "evidence");
     if (isSymlink(evRoot))
       return skip("evidence dir is a symlink");
     mkdirSync21(evRoot, { recursive: true });
     if (pages.length > 0) {
-      const rel0 = join51("evidence", randomBytes6(6).toString("hex"));
-      mkdirSync21(join51(runDir, rel0));
+      const rel0 = join52("evidence", randomBytes6(6).toString("hex"));
+      mkdirSync21(join52(runDir, rel0));
       const rels = [];
       for (const route of [...new Set(pages.map(routeFor))].slice(0, opts.maxRoutes ?? MAX_ROUTES)) {
         if (aborted() || left() <= 0)
           break;
-        const rel = join51(rel0, `${screenName(route)}.png`);
-        const ok = await shoot(pw, ["screenshot", `${base}${route}`, join51(runDir, rel)], appDir, left(), signal);
-        if (ok && !aborted() && !isSymlink(join51(runDir, rel)) && existsSync32(join51(runDir, rel)))
+        const rel = join52(rel0, `${screenName(route)}.png`);
+        const ok = await shoot(pw, ["screenshot", `${base}${route}`, join52(runDir, rel)], appDir, left(), signal);
+        if (ok && !aborted() && !isSymlink(join52(runDir, rel)) && existsSync32(join52(runDir, rel)))
           rels.push(rel);
       }
       if (aborted())
@@ -14023,9 +14124,9 @@ async function captureVisualEvidence(repoDir, runDir, changed, opts = {}) {
     }
     if (aborted())
       return skip("aborted");
-    const hdir = join51(evRoot, randomBytes6(6).toString("hex"));
+    const hdir = join52(evRoot, randomBytes6(6).toString("hex"));
     mkdirSync21(hdir);
-    writeFileSync24(join51(hdir, "http.json"), JSON.stringify(rows, null, 2) + `
+    writeFileSync24(join52(hdir, "http.json"), JSON.stringify(rows, null, 2) + `
 `);
     return { screens: [], http: true, skipped: null };
   } catch (e) {
@@ -14055,11 +14156,11 @@ function receiptScreensProblem(receiptPath, receipt) {
   return receipt["evidence_screens"] === undefined ? null : checkScreens(dirname19(receiptPath), receipt["evidence_screens"]);
 }
 var visualEvidenceEnabled = (env = process.env) => env["LOKI_VISUAL_EVIDENCE"] !== "0", visualGateEnabled = (env = process.env) => env["LOKI_VISUAL_GATE"] === "1", PAGE_RE, isPageFile = (p) => PAGE_RE.test(p), screenName = (route) => (route === "/" ? "index" : route.slice(1).replace(/[^A-Za-z0-9._-]+/g, "_")) || "index", sha256File = (p) => createHash14("sha256").update(readFileSync41(p)).digest("hex"), playwrightBin = (repoDir) => {
-  const bin = join51(repoDir, "node_modules", ".bin", "playwright");
+  const bin = join52(repoDir, "node_modules", ".bin", "playwright");
   return existsSync32(bin) ? bin : null;
 }, playwrightTestPkg = (repoDir) => {
-  const d = join51(repoDir, "node_modules", "@playwright", "test");
-  return existsSync32(join51(d, "package.json")) ? d : null;
+  const d = join52(repoDir, "node_modules", "@playwright", "test");
+  return existsSync32(join52(d, "package.json")) ? d : null;
 }, e2eSpecSource = (pkgDir, base, routes) => `const { test } = require(${JSON.stringify(pkgDir)});
 test("loki e2e walkthrough", async ({ page }) => {
   for (const r of ${JSON.stringify(routes)}) { await page.goto(${JSON.stringify(base)} + r); await page.waitForLoadState("load"); }
@@ -14105,7 +14206,7 @@ var init_outbox = __esm(() => {
 });
 
 // ../../loki-ts/src/engine10/stages/pr.ts
-import { join as join52 } from "path";
+import { join as join53 } from "path";
 var DEFAULT_PUSH_SH, DEFAULT_PUSH_GITLAB_SH;
 var init_pr = __esm(() => {
   init_types();
@@ -14124,13 +14225,13 @@ var init_pr = __esm(() => {
   init_receipt_surface();
   init_yaml_key();
   init_outbox();
-  DEFAULT_PUSH_SH = join52(REPO_ROOT, "autonomy/lib/engine10-push.sh");
-  DEFAULT_PUSH_GITLAB_SH = join52(REPO_ROOT, "autonomy/lib/engine10-push-gitlab.sh");
+  DEFAULT_PUSH_SH = join53(REPO_ROOT, "autonomy/lib/engine10-push.sh");
+  DEFAULT_PUSH_GITLAB_SH = join53(REPO_ROOT, "autonomy/lib/engine10-push-gitlab.sh");
 });
 
 // ../../loki-ts/src/util/pr_lessons.ts
 import { existsSync as existsSync33, mkdirSync as mkdirSync22, mkdtempSync as mkdtempSync8, readFileSync as readFileSync42, rmSync as rmSync16, writeFileSync as writeFileSync25 } from "fs";
-import { dirname as dirname20, join as join53 } from "path";
+import { dirname as dirname20, join as join54 } from "path";
 import { createHash as createHash15 } from "crypto";
 function loadLessons(repoDir) {
   const p = lessonsPath(repoDir);
@@ -14179,7 +14280,7 @@ function recordRunVerdict(repoDir, runId2, verdict) {
   if (dirty)
     save(repoDir, lessons);
 }
-var lessonsPath = (repoDir) => join53(repoDir, ".loki", "memory", "semantic", "pr-lessons.json"), KINDS;
+var lessonsPath = (repoDir) => join54(repoDir, ".loki", "memory", "semantic", "pr-lessons.json"), KINDS;
 var init_pr_lessons = __esm(() => {
   init_atomic();
   init_safe_git();
@@ -14346,10 +14447,10 @@ var init_providers = __esm(() => {
 
 // ../../loki-ts/src/runner/router/route_record.ts
 import { existsSync as existsSync35, lstatSync as lstatSync13, mkdirSync as mkdirSync23, readFileSync as readFileSync44, writeFileSync as writeFileSync26 } from "fs";
-import { join as join54 } from "path";
+import { join as join55 } from "path";
 function loadRouteRecord(runDir) {
   try {
-    const p = join54(runDir, ROUTE_RECORD_FILE);
+    const p = join55(runDir, ROUTE_RECORD_FILE);
     if (!existsSync35(p) || !lstatSync13(p).isFile())
       return;
     const v = JSON.parse(readFileSync44(p, "utf8"));
@@ -14411,6 +14512,7 @@ var init_implement_route = __esm(() => {
 
 // ../../loki-ts/src/engine10/stages/implement.ts
 var init_implement = __esm(() => {
+  init_install();
   init_lean_prefix();
   init_pr_lessons();
   init_context();
@@ -14488,50 +14590,6 @@ var init_worker = __esm(() => {
   init_safe_git();
 });
 
-// ../../loki-ts/src/project_model/package_suite.ts
-import { join as join55 } from "path";
-async function runPackageSuites(repoDir, signal, opts, checks, notProven) {
-  const api = loadProjectApi(repoDir);
-  if (!isMultiRoot(api))
-    return false;
-  const withTests = api.packages().filter((p) => p.commands.test);
-  if (withTests.length === 0)
-    return false;
-  for (const pkg of withTests) {
-    const tc = pkg.commands.test, name = `full suite: ${pkg.name}`, cmd2 = `(cd ${tc.cwd} && ${tc.cmd})`;
-    const started = Date.now();
-    const r = await run(["bash", "-c", tc.cmd], { cwd: join55(repoDir, tc.cwd), timeoutMs: opts.timeoutMs, ...opts.path ? { env: { PATH: opts.path } } : {} });
-    const duration_s = (Date.now() - started) / 1000;
-    if (signal.aborted) {
-      checks.push({ name, cmd: cmd2, result: "not_run", duration_s });
-      notProven.add(`not run: ${name} (aborted)`);
-      continue;
-    }
-    const out2 = `${r.stdout}
-${r.stderr}`;
-    const lr = r.exitCode === 0 || !opts.baseSha ? undefined : await harnessLoadReason({ repoDir, baseSha: opts.baseSha, out: out2, cmd: "bash", args: ["-c", tc.cmd], signal, cwd: join55(repoDir, tc.cwd), ...opts.path ? { env: { PATH: opts.path } } : {} });
-    if (lr) {
-      checks.push({ name, cmd: cmd2, result: "not_run", duration_s });
-      notProven.add(`${lr} (${name}; harness-owned)`);
-      continue;
-    }
-    const cls = classifyCheck({ kind: "test", ok: r.exitCode === 0, out: out2, ...goRunner(tc.cmd) });
-    checks.push({ name, cmd: cmd2, result: cls.result, duration_s, ...cls.result === "fail" ? { ids: failIds(out2) } : {} });
-    if (cls.result === "not_run")
-      notProven.add(`not run: ${name} (${cls.reason ?? NO_TESTS_REASON})`);
-  }
-  for (const pkg of api.packages().filter((p) => !p.commands.test))
-    notProven.add(`full suite: package ${pkg.name} defines no test command`);
-  return true;
-}
-var init_package_suite = __esm(() => {
-  init_load_owner();
-  init_check_result();
-  init_shell();
-  init_failures();
-  init_resolve();
-});
-
 // ../../loki-ts/src/engine10/stages/deep.ts
 var exports_deep = {};
 __export(exports_deep, {
@@ -14577,7 +14635,7 @@ function sessionCouncil(sessions) {
   } };
 }
 async function runFullSuite(ctx, signal, opts, checks, notProven) {
-  if (await runPackageSuites(ctx.repoDir, signal, { path: opts.path, timeoutMs: opts.fullSuiteTimeoutMs ?? FULL_SUITE_TIMEOUT_MS, baseSha: ctx.baseSha }, checks, notProven))
+  if (await runPackageSuites(ctx.repoDir, signal, { path: opts.path, timeoutMs: opts.fullSuiteTimeoutMs ?? FULL_SUITE_TIMEOUT_MS, baseSha: ctx.baseSha, skip: installOwned(ctx.repoDir, ctx.outputs().intake?.install_created) }, checks, notProven))
     return;
   const map = await ctx.tests.detect(ctx.repoDir);
   if (map.runners.length === 0) {
@@ -14605,7 +14663,7 @@ async function runFullSuite(ctx, signal, opts, checks, notProven) {
       continue;
     }
     const out2 = `${r.stdout}
-${r.stderr}`, lr = r.exitCode === 0 ? undefined : await harnessLoadReason({ repoDir: ctx.repoDir, baseSha: ctx.baseSha, out: out2, cmd: spec.cmd, args: spec.args, signal, ...opts.path ? { env: { PATH: opts.path } } : {} });
+${r.stderr}`, lr = r.exitCode === 0 ? undefined : await harnessLoadReason({ repoDir: ctx.repoDir, baseSha: ctx.baseSha, skip: installOwned(ctx.repoDir, ctx.outputs().intake?.install_created), out: out2, cmd: spec.cmd, args: spec.args, signal, ...opts.path ? { env: { PATH: opts.path } } : {} });
     if (lr) {
       checks.push({ name, cmd: [spec.cmd, ...spec.args].join(" "), result: "not_run", duration_s: durationS });
       notProven.add(`${lr} (${name}; harness-owned)`);
@@ -14757,7 +14815,7 @@ async function runDeep(ctx, signal, opts = {}) {
   }
   let changed;
   try {
-    changed = changedFiles(ctx.repoDir, ctx.baseSha);
+    changed = changedFiles(ctx.repoDir, ctx.baseSha, installOwned(ctx.repoDir, ctx.outputs().intake?.install_created));
   } catch (err) {
     return { status: "failed", data: {}, reason: `git diff against base failed: ${err.message}` };
   }
@@ -14789,8 +14847,9 @@ async function runDeep(ctx, signal, opts = {}) {
   ctx.emit("deep.completed", "deep", { checks, status_state: statusState, addendum_sha256: addendumSha256 });
   return { status: "completed", data: { checks, addendum_sha256: addendumSha256, status_state: statusState, not_proven: allNotProven } };
 }
-var DEFAULT_PUSH_SH2, DEFAULT_SECRET_SCAN_SH, MAX_COUNCIL_DIFF_BYTES = 400000, COUNCIL_LIMIT_S = 600, FULL_SUITE_TIMEOUT_MS = 300000, PR_NUMBER_RE, SHA_RE, FULL_SUITE_CMD, deepStage, stage;
+var DEFAULT_PUSH_SH2, DEFAULT_SECRET_SCAN_SH, MAX_COUNCIL_DIFF_BYTES = 400000, COUNCIL_LIMIT_S = 600, FULL_SUITE_TIMEOUT_MS = 300000, PR_NUMBER_RE, SHA_RE, deepStage, stage;
 var init_deep = __esm(() => {
+  init_install();
   init_app_probe();
   init_secure_scan();
   init_shell();
@@ -14808,16 +14867,6 @@ var init_deep = __esm(() => {
   DEFAULT_SECRET_SCAN_SH = new URL("../../../../autonomy/lib/secret-scan.sh", import.meta.url).pathname;
   PR_NUMBER_RE = /\/pull\/(\d+)$/;
   SHA_RE = /^[0-9a-f]{40}$/;
-  FULL_SUITE_CMD = {
-    pytest: { cmd: "python", args: ["-m", "pytest", "-q"] },
-    vitest: { cmd: "npx", args: ["vitest", "run"] },
-    jest: { cmd: "npx", args: ["jest"] },
-    bun: { cmd: "bun", args: ["test"] },
-    node: { cmd: "node", args: ["--test"] },
-    npm: { cmd: "npm", args: ["test", "--silent"] },
-    go: { cmd: "go", args: ["test", "-json", "./..."] },
-    cargo: { cmd: "cargo", args: ["test"] }
-  };
   deepStage = {
     name: "deep",
     ...STAGE_BUDGETS.deep,
@@ -14866,7 +14915,7 @@ async function runCheck(ctx, name, cmd2, args, signal, checks, opts = {}) {
   const cwd = opts.cwd ?? ctx.repoDir;
   const one = async (a) => {
     let c2 = classifyCheck({ kind, ok: a.ok, cut: a.cut, missing: a.missing, out: a.out, ...goRunner(cmd2, args), path: /\.[cm]?[jt]s$/.test(args[args.length - 1] ?? "") ? args[args.length - 1] : undefined });
-    const lr = kind === "test" && !a.ok && !a.cut && !a.missing ? await harnessLoadReason({ repoDir: ctx.repoDir, baseSha: ctx.baseSha, out: a.out, cmd: cmd2, args, signal, cwd, protect: opts.protect, ...opts.path ? { env: { PATH: opts.path } } : {} }) : undefined;
+    const lr = kind === "test" && !a.ok && !a.cut && !a.missing ? await harnessLoadReason({ repoDir: ctx.repoDir, baseSha: ctx.baseSha, skip: installOwned(ctx.repoDir, ctx.outputs?.().intake?.install_created), out: a.out, cmd: cmd2, args, signal, cwd, protect: opts.protect, ...opts.path ? { env: { PATH: opts.path } } : {} }) : undefined;
     if (lr)
       c2 = { result: "not_run", reason: lr, owner: "harness" };
     if (!lr && kind === "static" && !a.ok && !a.cut && !a.missing && opts.wall?.size && wallOwnedFailure(a.out, cwd, ctx.repoDir, opts.wall))
@@ -14985,6 +15034,7 @@ var CHECK_TIMEOUT_MS = 60000, excerpts, isHold = (c) => isHoldoutCheck(c.name),
   }
 } }), verifyStage;
 var init_verify = __esm(() => {
+  init_install();
   init_scope();
   init_runner_config();
   init_assert_delta();
@@ -15015,7 +15065,7 @@ var init_verify = __esm(() => {
     async run(ctx, signal) {
       let changed;
       try {
-        changed = changedFiles(ctx.repoDir, ctx.baseSha);
+        changed = changedFiles(ctx.repoDir, ctx.baseSha, installOwned(ctx.repoDir, ctx.outputs().intake?.install_created));
       } catch (err) {
         return { status: "failed", data: {}, reason: `git diff against base failed: ${err.message}` };
       }
@@ -15028,7 +15078,7 @@ var init_verify = __esm(() => {
       }
       let risk = (() => {
         try {
-          const r = classifyRisk(diffFiles(ctx.repoDir, ctx.baseSha));
+          const r = classifyRisk(diffFiles(ctx.repoDir, ctx.baseSha, installOwned(ctx.repoDir, ctx.outputs().intake?.install_created)));
           recordRisk(ctx.repoDir, r);
           return r;
         } catch {
@@ -15139,7 +15189,7 @@ ${x}` : c.cmd };
         return [`weakened test: ${t.path}`, ...assertDeltaNotes(ctx.repoDir, ctx.baseSha, null, t.path, intake?.task ?? "", k?.b, k?.h) ?? []];
       });
       const weakened = [...modifiedRel, ...cfgChanged.map((f) => `test configuration changed: ${f}`), ...preRed.weak.map((n2) => `skipped or fewer tests than base: ${n2}`)];
-      const notProven = [...weakened, ...pub.filter((c) => c.name === "holdout" && c.result !== "pass").map((c) => c.result === "not_run" ? "holdout not executed" : "holdout check failed"), ...[...fullNotProven].filter((n2) => !n2.startsWith("full suite (no test runner")), ...pub.filter((c) => c.owner === "harness" && c.name !== "holdout").map((c) => `${c.reason} (${c.name}; harness-owned, no fix rounds)`), ...new Set(checks.filter((c) => c.interpreter === "system" && c.result !== "not_run").map((c) => c.name.startsWith("lint:") ? "lint ran on the system ruff" : "tests ran on the system interpreter"))];
+      const notProven = [...weakened, ...intake?.deps_not_proven ?? [], ...pub.filter((c) => c.name === "holdout" && c.result !== "pass").map((c) => c.result === "not_run" ? "holdout not executed" : "holdout check failed"), ...[...fullNotProven].filter((n2) => !n2.startsWith("full suite (no test runner")), ...pub.filter((c) => c.owner === "harness" && c.name !== "holdout").map((c) => `${c.reason} (${c.name}; harness-owned, no fix rounds)`), ...new Set(checks.filter((c) => c.interpreter === "system" && c.result !== "not_run").map((c) => c.name.startsWith("lint:") ? "lint ran on the system ruff" : "tests ran on the system interpreter"))];
       const wallNames = new Set(wallTests.map(testCheckName)), wallRun = checks.filter((c) => wallNames.has(c.name) || isHold(c)), wallPassed = wallRun.some((c) => c.result === "fail") ? false : wallRun.length > 0 && wallRun.every((c) => c.result === "pass") ? true : undefined;
       return { status: "completed", data: { checks: pub, flaky, ...wallPassed === undefined ? {} : { wall_passed: wallPassed }, failures_grouped: failuresGrouped, holdout_failed: holdoutFailed, changed_files: changed, not_proven: notProven, pre_red: preRed.ids, pre_red_checks: preRed.names, ...attr.line ? { baseline_line: attr.line, introduced_checks: attr.introducedChecks } : {}, test_counts: testCounts, uncovered_changed: uncoveredChanged, target_checks: checks.filter((c) => c.result === "pass" && targetNames.has(c.name)).map((c) => isHold(c) ? "holdout" : c.name), risk } };
     }
@@ -15213,7 +15263,7 @@ function conventionsBrief(c) {
   if (!c)
     return "";
   const decl = `manifest type: ${c.packageType ?? "(unset)"}, compiler module: ${c.tsModule ?? "(unset)"}${c.runner ? `, test runner: ${c.runner}` : ""}`;
-  return c.moduleSystem === "commonjs" ? `Package conventions (${decl}): this package compiles as CommonJS. Never use import.meta or top-level await (TS1470, the package's own tsc rejects them); use __dirname, __filename and require() for paths and modules.` : `Package conventions (${decl}): this package is ES modules. Use import syntax; use import.meta.url for file locations; never use require(), __dirname or __filename.`;
+  return c.moduleSystem === "commonjs" ? `Package conventions (${decl}): this package compiles as CommonJS. Never use import.meta or top-level await (TS1470, the package's own tsc rejects them); use __dirname and __filename for paths. In TypeScript files write import statements (they compile to CommonJS) and never require(): a package lint config commonly forbids require() and runs over your file; use require() only in plain .js or .cjs files.` : `Package conventions (${decl}): this package is ES modules. Use import syntax; use import.meta.url for file locations; never use require(), __dirname or __filename.`;
 }
 function conventionViolation(c, fileName, content) {
   if (!c || c.moduleSystem !== "commonjs" || !/\.[cm]?[jt]sx?$/.test(fileName) || /\.m[jt]s$/.test(fileName))
@@ -15605,12 +15655,14 @@ var init_preexisting_dirty = __esm(() => {
 
 // ../../loki-ts/src/e10ext/commit_filter.ts
 import { dirname as dirname26 } from "path";
-function dropSet(repoDir, staged, preexistingDirty, env = process.env) {
-  return staged.concat(untouchedSinceIntake(repoDir, preexistingDirty, env).map((f) => ({ st: "L", f }))).filter(({ st, f }) => f.startsWith(".loki/") || st === "L" || /(^|\/)loki_wall_[^/]*$/.test(f) || st === "A" && !staged.some(({ f: m }) => /(^|\/)(package\.json|pyproject\.toml|requirements\.txt|Cargo\.toml|go\.mod)$/.test(m) && dirname26(m) === dirname26(f)) && /(^|\/)(package-lock\.json|yarn\.lock|pnpm-lock\.yaml|bun\.lockb?|poetry\.lock|Cargo\.lock|go\.sum)$/.test(f));
+function dropSet(repoDir, staged, preexistingDirty, env = process.env, installCreated) {
+  const owned = installOwned(repoDir, installCreated, env), made = installCreated?.files ?? {};
+  return staged.concat(untouchedSinceIntake(repoDir, preexistingDirty, env).map((f) => ({ st: "L", f })), staged.filter(({ f }) => owned(f)).map(({ f }) => ({ st: "L", f }))).filter(({ st, f }) => f.startsWith(".loki/") || st === "L" || /(^|\/)loki_wall_[^/]*$/.test(f) || st === "A" && !Object.hasOwn(made, f) && !staged.some(({ f: m }) => /(^|\/)(package\.json|pyproject\.toml|requirements\.txt|Cargo\.toml|go\.mod)$/.test(m) && dirname26(m) === dirname26(f)) && /(^|\/)(package-lock\.json|yarn\.lock|pnpm-lock\.yaml|bun\.lockb?|poetry\.lock|Cargo\.lock|go\.sum)$/.test(f));
 }
 var parseStaged = (out2) => out2.split("\x00").reduce((a, t, i, all) => i % 2 === 0 && t ? [...a, { st: t, f: all[i + 1] }] : a, []), formatChanged = (repoDir, staged, dropped2, env = process.env) => runFormatters(repoDir, staged.filter(({ st, f }) => (st === "A" || st === "M") && !dropped2.has(f) && !f.startsWith(".loki/")).map(({ f }) => f), tokenFreeEnv(env));
 var init_commit_filter = __esm(() => {
   init_preexisting_dirty();
+  init_install();
   init_repo_profile();
   init_safe_git();
 });
@@ -16623,7 +16675,7 @@ var init_seal = __esm(() => {
       if (sd.code !== 0)
         return { status: "failed", data: {}, reason: "git diff against base failed" };
       const staged = parseStaged(sd.out);
-      const drop = dropSet(ctx.repoDir, staged, ctx.outputs().intake?.preexisting_dirty);
+      const drop = dropSet(ctx.repoDir, staged, ctx.outputs().intake?.preexisting_dirty, process.env, ctx.outputs().intake?.install_created);
       const sat = await discardIfSatisfied((a) => git4(ctx, a), ctx.baseSha, ctx.outputs(), staged, new Set(drop.filter(({ st }) => st === "L").map(({ f }) => f)), ctx.repoDir);
       if (sat)
         return sat;