mason-context 0.18.0 → 0.19.0

package/dist/mason-auto.js

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+if (!import.meta.url.endsWith("/mason-runtime.js")) await import("./mason-runtime.js").then(m => m.registerRuntime());
 var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __esm = (fn, res) => function __init() {
@@ -1987,6 +1988,10 @@ var init_release_metadata = __esm({
 });
 
 // src/audit/checks/deps-changed.ts
+function hasDependencyContent(content2) {
+  const text2 = content2.replace(/<!-- mason:start -->[\s\S]*?<!-- mason:end -->/g, "").replace(/<!--[\s\S]*?-->/g, "");
+  return /\b(?:dependenc(?:y|ies)|librar(?:y|ies)|frameworks?|tech(?:nology)? stack|prerequisites|requirements)\b/i.test(text2) || /\b(?:package\.json|build\.gradle(?:\.kts)?|settings\.gradle(?:\.kts)?|libs\.versions\.toml|Cargo\.toml|go\.mod|pyproject\.toml|requirements\.txt|Gemfile|composer\.json)\b/i.test(text2) || /\b(?:node(?:\.js)?|npm|pnpm|yarn|bun|deno|python|ruby|rust|go|java|jdk|kotlin|gradle|swift|php|react|vue|angular|compose|ktor|room)\s*(?:version\s*)?[`*:=>~^v\s-]*\d+(?:\.\d+)*\b/i.test(text2) || /\b(?:npm|pnpm|yarn|pip3?|cargo|gem|composer)\s+(?:install|add|require)\b/i.test(text2);
+}
 function manifestPathspecs(doc) {
   const scope = documentScope(doc);
   if (scope === ".") return MANIFEST_PATHSPECS;
@@ -2013,6 +2018,19 @@ async function checkDepsChanged(ctx) {
         reason: `${doc.path} has uncommitted edits \u2013 suppressed while in flight`
       });
     }
+    let content2 = doc.content;
+    if (doc.dirty) {
+      try {
+        content2 = (await inspectionGit(
+          ["show", `${doc.lastCommit.hash}:${doc.path}`],
+          { cwd: ctx.root, maxBuffer: 10 * 1024 * 1024, timeout: 1e4 }
+        )).stdout;
+      } catch {
+        result.skipped.push({ check: "deps-changed", doc: doc.path, reason: `${doc.path}: committed dependency content is unavailable` });
+        continue;
+      }
+    }
+    if (!hasDependencyContent(content2)) continue;
     const range = await commitsTouchingSince(
       ctx.root,
       doc.lastCommit.hash,
@@ -2058,6 +2076,7 @@ var init_deps_changed = __esm({
     init_docs();
     init_release_metadata();
     init_git();
+    init_inspection();
     init_checks();
     MANIFEST_COMMITS_CAP = 10;
     MANIFEST_PATHSPECS = [
@@ -2953,7 +2972,7 @@ async function verifyOriginal(rootDir, baselinePath, options, session) {
       return {
         ...base,
         status: "review-required",
-        reason: "An audit cannot establish that this advisory was reviewed. Retain its original evidence and report a separate assessment; editing or committing the doc is not approval."
+        reason: (now ? "The current check still reports this advisory. " : finding.type === "deps-changed" ? "The current check no longer reports this condition; the historical advisory remains awaiting assessment. " : "The current check no longer reports the original finding; retained evidence still requires assessment. ") + "An audit cannot establish that this advisory was reviewed. Retain its original evidence and report a separate assessment; editing or committing the doc is not approval."
       };
     }
     return { ...base, status: "resolved", reason: "The original check ran and no longer reports this claim. Inspect the edit for semantic correctness." };
@@ -3131,7 +3150,7 @@ async function collectInputs(root) {
     git3(root, "status", "--porcelain=v1", "-z", "--untracked-files=all", "--", ".", ":(exclude).mason/reports"),
     git3(root, "ls-files", "--stage", "-z", "--", ".", ":(exclude).mason/reports")
   ]) : ["", ""];
-  const common = [5, engineVersion, head, shallow, replacements, docContents];
+  const common = [6, engineVersion, head, shallow, replacements, docContents];
   const keys = {
     "deleted-reference": hash([common, claims, docStatus]),
     "new-module": hash([common, modules]),
@@ -3191,7 +3210,7 @@ var init_evidence = __esm({
     init_dead_command();
     init_storage();
     init_advisory_review();
-    engineVersion = true ? "0.18.0" : "development";
+    engineVersion = true ? "0.19.0" : "development";
     hash = (value) => createHash3("sha256").update(JSON.stringify(value)).digest("hex");
     content = readAuditInput;
     cacheSchema = z8.object({ version: z8.literal(1), entries: z8.record(z8.object({ key: z8.string(), result: checkResultSchema })), digest: z8.string() });
@@ -3405,13 +3424,17 @@ async function observeReadOnlyTool(dir, event) {
 }
 function summarize(report) {
   const open = report.findings.filter((f) => f.status !== "resolved");
+  const onlyReview = report.status === "incomplete" && !report.diagnostics.length && !report.counts.unresolved && !report.counts.unverified && report.counts["review-required"] > 0;
   return [
-    `Mason: ${report.status}; ${report.counts.unresolved} unresolved, ${report.counts["review-required"]} need review, ${report.counts.unverified} unverified.`,
-    ...open.slice(0, 4).map((f) => `[${f.status}] ${cleanText(f.original.anchor.doc)}: ${cleanText(f.original.message)}`),
+    onlyReview ? `Mason: ${report.counts["review-required"]} advisor${report.counts["review-required"] === 1 ? "y" : "ies"} awaiting review; no unresolved issues.` : `Mason: ${report.status}; ${report.counts.unresolved} unresolved, ${report.counts["review-required"]} need review, ${report.counts.unverified} unverified.`,
+    ...open.slice(0, 4).map((f) => {
+      const detail = f.current ? f.current.message : f.status === "review-required" ? `${f.original.type}: current check no longer reports ${f.original.type === "deps-changed" ? "this condition" : "the original finding"}; historical evidence awaits assessment.` : `Original evidence: ${f.original.message}. ${f.reason}`;
+      return `[${f.status}] ${cleanText(f.original.anchor.doc)}: ${cleanText(detail)}`;
+    }),
     ...open.length > 4 ? [`${open.length - 4} more findings in the report.`] : [],
     ...report.diagnostics.slice(0, 2).map(cleanText),
     `Evidence: ${report.reportPath}. Resume/check with mason_automation(action: "check") or mason-auto check.`,
-    "Keep original evidence. Address findings relevant to the authorized task; report unrelated findings and unresolved advisories without approving them."
+    "Keep original evidence. Address findings relevant to the authorized task; report unrelated findings with a brief scope reason and suggested follow-up. Use review_advisory for authorized assessments; otherwise leave advisories open without approving them."
   ].join("\n");
 }
 async function loadState(ws) {
@@ -3635,7 +3658,7 @@ async function automate(dir, event) {
         if (event.event === "after_tool" && event.mutating) {
           session.mutationObserved = true;
           if (!event.toolId || !session.pending[event.toolId]) {
-            const gap = "A tool completed without an observed matching pre-tool capture; pre-edit coverage is unknown.";
+            const gap = "A tool completed without an observed matching pre-tool capture in this checkout; pre-edit coverage is unknown. The tool may have changed checkouts; captures are kept separately for each worktree.";
             if (!session.coverageGaps.includes(gap)) session.coverageGaps.push(gap);
           }
           if (event.toolId) delete session.pending[event.toolId];
@@ -3778,11 +3801,39 @@ var init_hook_root = __esm({
 
 // src/setup/model.ts
 import { z as z11 } from "zod";
+import fs16 from "fs/promises";
+import path23 from "path";
 async function loadSetup(root) {
   const raw = await readStoreJson(root, SETUP_PATH);
   if (raw === null) return null;
   return setupSchema.parse(raw);
 }
+async function effectiveSetup(root) {
+  const local = await loadSetup(root);
+  if (local) return { root, setup: local };
+  const common = await fs16.realpath(path23.resolve(root, (await git3(root, "rev-parse", "--git-common-dir")).trim()));
+  const own = await fs16.realpath((await git3(root, "rev-parse", "--absolute-git-dir")).trim());
+  if (common === own) return { root, setup: null };
+  const primary = (await git3(root, "worktree", "list", "--porcelain", "-z")).split("\0\0")[0].split("\0");
+  const candidate = primary.find((field) => field.startsWith("worktree "))?.slice(9);
+  if (!candidate || primary.includes("bare")) return { root, setup: null };
+  let inheritedRoot;
+  try {
+    inheritedRoot = await fs16.realpath((await git3(candidate, "rev-parse", "--show-toplevel")).trim());
+  } catch (error) {
+    if (/must be run in a work tree/.test(String(error.stderr))) return { root, setup: null };
+    throw error;
+  }
+  const inheritedCommon = await fs16.realpath(path23.resolve(
+    inheritedRoot,
+    (await git3(inheritedRoot, "rev-parse", "--git-common-dir")).trim()
+  ));
+  if (inheritedCommon !== common) throw new Error("Linked worktree setup does not belong to the same Git repository.");
+  const setup = await loadSetup(inheritedRoot);
+  const inactive = await readStoreJson(root, INACTIVE_HOSTS_PATH);
+  if (inactive && setup) for (const host of inactiveHostsSchema.parse(inactive).hosts) delete setup.hosts[host];
+  return { root: inheritedRoot, setup };
+}
 async function loadSetupReceipt(root, directory, host) {
   const raw = await readStoreJson(root, directory + "/setup-" + host + ".json");
   if (raw === null) return null;
@@ -3790,10 +3841,11 @@ async function loadSetupReceipt(root, directory, host) {
   if (receipt.root !== root || receipt.host !== host) throw new Error("Setup receipt belongs to another installation.");
   return receipt;
 }
-var setupHostSchema, setupSchema, SETUP_PATH, receiptSchema;
+var setupHostSchema, setupSchema, SETUP_PATH, INACTIVE_HOSTS_PATH, inactiveHostsSchema, receiptSchema;
 var init_model = __esm({
   "src/setup/model.ts"() {
     "use strict";
+    init_evidence();
     init_storage();
     setupHostSchema = z11.object({
       configuredVersion: z11.string(),
@@ -3807,6 +3859,8 @@ var init_model = __esm({
       claude: setupHostSchema.optional()
     }) });
     SETUP_PATH = ".mason/local/setup.json";
+    INACTIVE_HOSTS_PATH = ".mason/local/inactive-hosts.json";
+    inactiveHostsSchema = z11.object({ version: z11.literal(1), hosts: z11.array(z11.enum(["claude", "codex"])) });
     receiptSchema = z11.object({
       version: z11.literal(1),
       host: z11.enum(["codex", "claude"]),
@@ -3833,7 +3887,7 @@ __export(launcher_exports, {
 });
 import { execFile as execFile2 } from "child_process";
 import { promisify as promisify2 } from "util";
-import fs16 from "fs/promises";
+import fs17 from "fs/promises";
 function globalCommand(args, platform = process.platform) {
   return platform === "win32" ? { command: "cmd.exe", args: ["/d", "/s", "/c", "mason", ...args] } : { command: "mason", args };
 }
@@ -3853,8 +3907,8 @@ async function installedCommand() {
   }
 }
 async function prepareLaunch(host, options = {}) {
-  const root = await fs16.realpath((await git3(options.dir ?? process.cwd(), "rev-parse", "--show-toplevel")).trim());
-  const entry = (await loadSetup(root))?.hosts[host];
+  const root = await fs17.realpath((await git3(options.dir ?? process.cwd(), "rev-parse", "--show-toplevel")).trim());
+  const entry = (await effectiveSetup(root)).setup?.hosts[host];
   process.env.MASON_SETUP_ROOT = root;
   process.env.MASON_SETUP_HOST = host;
   delete process.env.MASON_SETUP_REVISION;
@@ -3876,7 +3930,7 @@ var init_launcher = __esm({
     "use strict";
     init_evidence();
     init_model();
-    executingVersion = () => true ? "0.18.0" : "development";
+    executingVersion = () => true ? "0.19.0" : "development";
     mcpCommand = (host) => globalCommand(["--setup-host", host, "mcp"]);
     hookCommand = (host) => `mason --setup-host ${host} auto`;
   }
@@ -3889,7 +3943,7 @@ __export(observations_exports, {
   observeActivation: () => observeActivation,
   readObservation: () => readObservation
 });
-import fs17 from "fs/promises";
+import fs18 from "fs/promises";
 import { z as z12 } from "zod";
 function observationPath(directory, host, revision, version = executingVersion()) {
   return `${directory}/activation/${host}-${revision}-${hash(version).slice(0, 12)}.json`;
@@ -3906,15 +3960,15 @@ async function observeActivation(dir, event, options = {}) {
   if (host !== "codex" && host !== "claude" || !process.env.MASON_SETUP_ROOT) return null;
   try {
     if (!revision) {
-      if ((await loadSetup(process.env.MASON_SETUP_ROOT))?.hosts[host]) {
+      if ((await effectiveSetup(process.env.MASON_SETUP_ROOT)).setup?.hosts[host]) {
         return "Mason setup is now present. Restart the assistant to connect this MCP session to the configured integration; activation has not been established by this session.";
       }
       return inactiveSetupMessage();
     }
     const capturedDirectory = options.directory?.match(/^\.mason\/reports\/automation\/[a-f0-9]{24}$/)?.[0] ?? options.reportPath?.match(/^(\.mason\/reports\/automation\/[a-f0-9]{24})\/checks\//)?.[1];
-    const ws = capturedDirectory ? { root: await fs17.realpath(dir), directory: capturedDirectory } : await workspace(dir);
-    if (ws.root !== await fs17.realpath(process.env.MASON_SETUP_ROOT)) return null;
-    const setup = await loadSetup(ws.root);
+    const ws = capturedDirectory ? { root: await fs18.realpath(dir), directory: capturedDirectory } : await workspace(dir);
+    if (ws.root !== await fs18.realpath(process.env.MASON_SETUP_ROOT)) return null;
+    const { setup } = await effectiveSetup(ws.root);
     if (setup?.hosts[host]?.revision !== revision) return "Mason setup changed; restart the assistant to observe the current integration.";
     const directory = ws.directory + "/activation";
     await withLock(ws.root, directory, async () => {
@@ -4091,8 +4145,8 @@ __export(files_exports, {
   managedBlock: () => managedBlock,
   readText: () => readText
 });
-import fs18 from "fs/promises";
-import path23 from "path";
+import fs19 from "fs/promises";
+import path24 from "path";
 import { randomUUID as randomUUID5 } from "crypto";
 async function readText(root, file) {
   try {
@@ -4121,14 +4175,14 @@ async function applyEdit(root, edit) {
   if (edit.after === null) {
     const file2 = await storePath(root, edit.path);
     if (await readText(root, edit.path) !== edit.before) throw new Error("Input changed during removal: " + edit.path);
-    await fs18.unlink(file2);
+    await fs19.unlink(file2);
     return true;
   }
   const file = await storePath(root, edit.path, true);
-  const temporary = path23.join(path23.dirname(file), ".mason-setup-" + randomUUID5() + ".tmp");
+  const temporary = path24.join(path24.dirname(file), ".mason-setup-" + randomUUID5() + ".tmp");
   try {
-    const mode = await fs18.stat(file).then((s) => s.mode & 511, () => 384);
-    const handle = await fs18.open(temporary, "wx", mode);
+    const mode = await fs19.stat(file).then((s) => s.mode & 511, () => 384);
+    const handle = await fs19.open(temporary, "wx", mode);
     try {
       await handle.writeFile(edit.after, "utf8");
       await handle.sync();
@@ -4136,10 +4190,10 @@ async function applyEdit(root, edit) {
       await handle.close();
     }
     if (await readText(root, edit.path) !== edit.before) throw new Error("Integration input changed during update: " + edit.path);
-    await fs18.rename(temporary, file);
+    await fs19.rename(temporary, file);
     return true;
   } finally {
-    await fs18.rm(temporary, { force: true });
+    await fs19.rm(temporary, { force: true });
   }
 }
 var init_files2 = __esm({
@@ -4547,6 +4601,8 @@ __export(teardown_exports, {
   teardownProject: () => teardownProject
 });
 import { isDeepStrictEqual as isDeepStrictEqual2 } from "util";
+import fs20 from "fs/promises";
+import path25 from "path";
 import { parse as parse3, stringify as stringify2 } from "smol-toml";
 import fg6 from "fast-glob";
 import { z as z18 } from "zod";
@@ -4568,6 +4624,11 @@ async function planTeardown(root, selected) {
   const ownership = ownershipBefore === null ? { version: 1, files: {} } : ownershipSchema.parse(JSON.parse(ownershipBefore));
   const setupBefore = await read(SETUP_PATH);
   const setup = setupBefore === null ? null : setupSchema.parse(JSON.parse(setupBefore));
+  const linked = (await workspace(root)).gitDir !== await fs20.realpath(
+    path25.resolve(root, (await git3(root, "rev-parse", "--git-common-dir")).trim())
+  );
+  const inactiveBefore = linked && !setup ? await read(INACTIVE_HOSTS_PATH) : null;
+  const inactive = inactiveBefore === null ? { version: 1, hosts: [] } : inactiveHostsSchema.parse(JSON.parse(inactiveBefore));
   const automationBefore = await read(AUTOMATION_PATH);
   const automation = automationBefore === null ? null : recordSchema2.parse(JSON.parse(automationBefore));
   const commands2 = (host) => new Set([
@@ -4711,7 +4772,16 @@ async function planTeardown(root, selected) {
         delete ownership.files[configPath(host)];
       }
       if (!remainingHost) for (const file of DOC_CANDIDATES) delete ownership.files[file];
-      if (setupBefore !== null) cleanup.push({ path: SETUP_PATH, before: setupBefore, after: Object.keys(setup.hosts).length ? json(setup) : null });
+      if (setupBefore !== null) cleanup.push({
+        path: SETUP_PATH,
+        before: setupBefore,
+        after: linked || Object.keys(setup.hosts).length ? json(setup) : null
+      });
+      else if (linked) cleanup.push({
+        path: INACTIVE_HOSTS_PATH,
+        before: inactiveBefore,
+        after: json({ version: 1, hosts: [.../* @__PURE__ */ new Set([...inactive.hosts, ...selected])].sort() })
+      });
       if (automationBefore !== null) cleanup.push({ path: AUTOMATION_PATH, before: automationBefore, after: Object.keys(automation.hosts).length ? json(automation) : null });
       if (ownershipBefore !== null) cleanup.push({ path: OWNERSHIP_PATH, before: ownershipBefore, after: Object.keys(ownership.files).length ? json(ownership) : null });
       edits.push(...cleanup);
@@ -5152,10 +5222,10 @@ var init_check = __esm({
 });
 
 // src/review/evidence.ts
-import path24 from "path";
+import path26 from "path";
 import { z as z22 } from "zod";
 function relativeArtifact(root, file) {
-  const relative = path24.isAbsolute(file) ? path24.relative(root, file) : file;
+  const relative = path26.isAbsolute(file) ? path26.relative(root, file) : file;
   const normalized = normalizeRepoPath(relative);
   if (!normalized) throw new Error(`Evidence artifact must be inside the repository: ${file}`);
   return normalized;
@@ -5252,7 +5322,7 @@ async function collectReviewEvidence(root, manifests, changedFiles, decisions, d
         const report = await readStoreJson(root, file);
         if (report === null) throw new Error(`Report artifact is missing: ${file}`);
         const sourceRoot = check.sourceRoot ?? root;
-        if (!path24.posix.isAbsolute(sourceRoot) && !/^[A-Za-z]:[\\/]/.test(sourceRoot)) throw new Error("sourceRoot must identify the absolute checkout root on the check runner.");
+        if (!path26.posix.isAbsolute(sourceRoot) && !/^[A-Za-z]:[\\/]/.test(sourceRoot)) throw new Error("sourceRoot must identify the absolute checkout root on the check runner.");
         const parsed = check.report.format === "vitest-json" ? parseVitest(report, sourceRoot) : check.report.format === "mason-check-json" ? parseCheck(report, sourceRoot) : parseSarif(report, sourceRoot);
         result.outcome = parsed.outcome;
         result.counts = parsed.counts;
@@ -5373,8 +5443,8 @@ var init_evidence2 = __esm({
 });
 
 // src/review/review.ts
-import fs19 from "fs/promises";
-import path25 from "path";
+import fs21 from "fs/promises";
+import path27 from "path";
 import { execFile as execFile4 } from "child_process";
 import { promisify as promisify4 } from "util";
 async function resolveMergeBase(resolvedRoot, base, head) {
@@ -5403,7 +5473,7 @@ function anchorsTouched(record, changedFiles) {
   return matchingPaths(record.files, changedFiles);
 }
 async function computeReview(rootDir, base, options = {}) {
-  const resolvedRoot = path25.resolve(rootDir);
+  const resolvedRoot = path27.resolve(rootDir);
   const head = await getCurrentGitHash(resolvedRoot);
   if (head === "unknown") return null;
   const mergeBase = await resolveMergeBase(resolvedRoot, base, head);
@@ -5453,7 +5523,7 @@ async function computeReview(rootDir, base, options = {}) {
     analyzed,
     async (relPath) => {
       try {
-        await fs19.access(path25.join(resolvedRoot, relPath));
+        await fs21.access(path27.join(resolvedRoot, relPath));
         return true;
       } catch {
         return false;
@@ -5596,8 +5666,9 @@ __export(status_exports, {
 import { isDeepStrictEqual as isDeepStrictEqual3 } from "util";
 async function setupStatus(dir) {
   const ws = await workspace(dir);
-  const setup = await loadSetup(ws.root);
-  if (!setup) {
+  const activation = await effectiveSetup(ws.root);
+  const setup = activation.setup;
+  if (!setup || !Object.keys(setup.hosts).length) {
     const partial = await Promise.all(["codex", "claude"].map(async (host) => ({
       host,
       receipt: await loadSetupReceipt(ws.root, ws.directory, host)
@@ -5631,7 +5702,7 @@ async function setupStatus(dir) {
     ]));
     const hooks = isDeepStrictEqual3(compatibleHooks, expectedHooks) && !config.disabled;
     const local = await loadSetupReceipt(ws.root, ws.directory, host);
-    const configured = local?.status === "configured" && local.root === ws.root && local.revision === entry.revision;
+    const configured = activation.root !== ws.root || local?.status === "configured" && local.root === ws.root && local.revision === entry.revision;
     const observation = await readObservation(ws.root, ws.directory, host, entry.revision, installed.version ?? "unavailable");
     const sessions = Object.values(observation?.sessions ?? {}).sort((a, b) => b.at.localeCompare(a.at));
     const complete = sessions.find((session) => events.every((event) => session.events.includes(event)));
@@ -5663,6 +5734,7 @@ async function setupStatus(dir) {
     status: statuses.length && statuses.every((status) => status === "active") ? "active" : statuses.includes("attention") ? "attention" : "pending",
     root: ws.root,
     hosts: hosts2,
+    activationRoot: activation.root,
     decisionRecords: decisions.records.length,
     diagnostics: decisions.diagnostics,
     scope: "Activation receipts record observed use after setup, not complete interception, correct repairs, or measured usefulness. Host trust and higher-priority settings may prevent execution. Receipts are local to this worktree and branch."
@@ -5670,6 +5742,9 @@ async function setupStatus(dir) {
 }
 function summarizeActivation(status) {
   const lines = ["Mason setup: " + status.status + "."];
+  if (status.activationRoot && status.activationRoot !== status.root) {
+    lines.push("Activation inherited from " + status.activationRoot + "; evidence belongs to this worktree.");
+  }
   for (const [host, state] of Object.entries(status.hosts)) {
     lines.push(
       `${host}: ${state.status}`,