mocode-ai 0.7.0 → 0.7.1

package/dist/tools/builtins/index.js

@@ -46,7 +46,33 @@ const _projectSkillEnabledAtBoot = process.env.MOCODE_PROJECT_SKILL === 'true';
 const _projectSkillTools = _projectSkillEnabledAtBoot
     ? [projectSkillUpdateTool]
     : [];
-export const builtinTools = [
+const pathResource = (args) => typeof args.path === 'string' && args.path ? [`file:${args.path}`] : ['workspace'];
+const workspaceResource = () => ['workspace'];
+const memoryResource = () => ['memory-store'];
+const CAPABILITIES = {
+    read_file: { effect: 'read', concurrency: 'parallel', retry: 'safe', resources: pathResource },
+    write_file: { effect: 'write', concurrency: 'resource-locked', retry: 'never', resources: pathResource },
+    edit_file: { effect: 'write', concurrency: 'resource-locked', retry: 'never', resources: pathResource },
+    run_command: { effect: 'process', concurrency: 'serial', retry: 'never', resources: workspaceResource, supportsAbort: true },
+    glob: { effect: 'read', concurrency: 'parallel', retry: 'safe', resources: workspaceResource },
+    grep: { effect: 'read', concurrency: 'parallel', retry: 'safe', resources: workspaceResource },
+    codegraph: { effect: 'read', concurrency: 'parallel', retry: 'safe', resources: workspaceResource, supportsAbort: true },
+    web_search: { effect: 'network', concurrency: 'parallel', retry: 'safe', supportsAbort: true },
+    web_fetch: { effect: 'network', concurrency: 'parallel', retry: 'safe', supportsAbort: true },
+    use_skill: { effect: 'read', concurrency: 'serial', retry: 'safe' },
+    ask_human: { effect: 'read', concurrency: 'serial', retry: 'never' },
+    switch_mode: { effect: 'write', concurrency: 'serial', retry: 'never', resources: () => ['agent-mode'] },
+    drop_context: { effect: 'write', concurrency: 'serial', retry: 'never', resources: () => ['conversation-context'] },
+    memory_save: { effect: 'write', concurrency: 'serial', retry: 'never', resources: memoryResource },
+    memory_search: { effect: 'write', concurrency: 'serial', retry: 'never', resources: memoryResource },
+    memory_list: { effect: 'read', concurrency: 'serial', retry: 'safe', resources: memoryResource },
+    memory_update: { effect: 'write', concurrency: 'serial', retry: 'never', resources: memoryResource },
+    memory_forget: { effect: 'write', concurrency: 'serial', retry: 'never', resources: memoryResource },
+    project_skill_update: { effect: 'write', concurrency: 'serial', retry: 'never', resources: workspaceResource },
+    // 子 Agent 共享主工作区；在隔离 workspace / write-set 锁实现前必须串行。
+    task: { effect: 'write', concurrency: 'serial', retry: 'never', resources: workspaceResource, supportsAbort: true },
+};
+const rawBuiltinTools = [
     readFileTool,
     writeFileTool,
     editFileTool,
@@ -58,9 +84,14 @@ export const builtinTools = [
     webFetchTool,
     useSkillTool,
     askHumanTool,
-    switchModeTool, // plan↔auto 自切(两模式都可见,不进 PLAN_DISABLED_TOOLS;副作用控制工具→串行分支)
-    dropContextTool, // 运行中剔除无关 tool 结果(上下文管理,无副作用;两模式都可见,串行分支)
+    switchModeTool,
+    dropContextTool,
     ..._memoryTools,
     ..._projectSkillTools,
-    taskTool, // 派生子 agent(独立 history + 可受限工具集);plan 模式禁用(见 PLAN_DISABLED_TOOLS)
+    taskTool,
 ];
+/** 所有内置工具均携带显式能力；新增工具遗漏声明时 registry 会保守串行。 */
+export const builtinTools = rawBuiltinTools.map((tool) => ({
+    ...tool,
+    capabilities: CAPABILITIES[tool.name],
+}));

package/dist/tools/builtins/run-command.js

@@ -1,6 +1,6 @@
 import { spawn, spawnSync } from 'node:child_process';
 import { MAX_OUTPUT } from '../constants.js';
-import { getSandboxRoot, filterEnv, isCommandDenied } from '../../sandbox/index.js';
+import { getSandboxRoot, filterEnv, isCommandDenied, jailResolve } from '../../sandbox/index.js';
 import { t } from '../../i18n/index.js';
 const OUTPUT_HEAD_LIMIT = Math.floor(MAX_OUTPUT * 0.4);
 const OUTPUT_TAIL_LIMIT = MAX_OUTPUT - OUTPUT_HEAD_LIMIT;
@@ -25,6 +25,119 @@ class BoundedCommandOutput {
         return `${this.head}\n${t('command.outputTruncated', { count: removed })}\n${this.tail}`;
     }
 }
+/** Execute a command with the same sandbox, output cap and cancellation semantics as run_command. */
+export async function runCommandRaw(command, timeout = 120000, signal, cwd) {
+    const startedAt = Date.now();
+    const deny = isCommandDenied(command);
+    if (deny) {
+        return { status: 'denied', exitCode: null, output: `错误:${deny}`, durationMs: 0 };
+    }
+    let executionCwd = getSandboxRoot() ?? process.cwd();
+    if (cwd) {
+        try {
+            executionCwd = jailResolve(cwd);
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            return { status: 'denied', exitCode: null, output: `错误:${message}`, durationMs: 0 };
+        }
+    }
+    return new Promise((done) => {
+        const isWin = process.platform === 'win32';
+        const child = spawn(isWin ? 'cmd.exe' : 'bash', isWin ? ['/d', '/s', '/c', command] : ['-c', command], {
+            cwd: executionCwd,
+            env: filterEnv(process.env),
+            // Without this, Node re-quotes cmd.exe arguments and `node -e "..."` can become
+            // a string literal that exits 0, causing false-positive validation on Windows.
+            windowsVerbatimArguments: isWin,
+        });
+        const output = new BoundedCommandOutput();
+        let finished = false;
+        let timer;
+        const killTree = () => {
+            try {
+                if (isWin) {
+                    if (child.pid != null) {
+                        spawnSync('taskkill', ['/PID', String(child.pid), '/T', '/F'], { stdio: 'ignore' });
+                    }
+                }
+                else {
+                    child.kill('SIGTERM');
+                }
+            }
+            catch {
+                // Process already exited or best-effort termination failed.
+            }
+        };
+        const finish = (result) => {
+            if (finished)
+                return;
+            finished = true;
+            if (timer)
+                clearTimeout(timer);
+            signal?.removeEventListener('abort', onAbort);
+            done({ ...result, durationMs: Date.now() - startedAt });
+        };
+        const onAbort = () => {
+            killTree();
+            finish({ status: 'aborted', exitCode: null, output: output.render().trim() });
+        };
+        const onChunk = (chunk) => output.append(chunk.toString('utf8'));
+        child.stdout.on('data', onChunk);
+        child.stderr.on('data', onChunk);
+        child.on('error', (error) => {
+            finish({ status: 'spawn_error', exitCode: null, output: error.message });
+        });
+        child.on('close', (code) => {
+            finish({
+                status: code === 0 ? 'passed' : 'failed',
+                exitCode: code,
+                output: output.render().trim(),
+            });
+        });
+        timer = setTimeout(() => {
+            killTree();
+            finish({ status: 'timed_out', exitCode: null, output: output.render().trim() });
+        }, timeout);
+        if (signal) {
+            if (signal.aborted)
+                onAbort();
+            else
+                signal.addEventListener('abort', onAbort, { once: true });
+        }
+    });
+}
+/** Preserve the public run_command text protocol while exposing structured status internally. */
+export function formatCommandResult(result) {
+    const output = result.output.trim();
+    if (result.status === 'denied')
+        return result.output;
+    if (result.status === 'aborted')
+        return `${t('command.interrupted')}\n${output}`;
+    if (result.status === 'timed_out')
+        return `${t('command.timedOut')}\n${output}`;
+    if (result.status === 'spawn_error')
+        return t('command.executionFailed', { message: result.output });
+    return `${t('command.exitCode', { code: result.exitCode ?? 'null' })}\n${output || t('toolSummary.noOutput')}`;
+}
+/** Convert the raw process status into the common structured tool contract. */
+function commandOutcome(result) {
+    const output = formatCommandResult(result);
+    switch (result.status) {
+        case 'passed':
+            return { status: 'success', code: 'OK', retryable: false, output, durationMs: result.durationMs };
+        case 'aborted':
+            return { status: 'aborted', code: 'ABORTED', retryable: false, output, durationMs: result.durationMs };
+        case 'denied':
+            return { status: 'denied', code: 'SANDBOX_DENIED', retryable: false, output, durationMs: result.durationMs };
+        case 'timed_out':
+            return { status: 'error', code: 'TIMEOUT', retryable: false, output, durationMs: result.durationMs };
+        case 'failed':
+            return { status: 'error', code: 'PROCESS_FAILED', retryable: false, output, durationMs: result.durationMs };
+        case 'spawn_error':
+            return { status: 'error', code: 'EXECUTION_ERROR', retryable: false, output, durationMs: result.durationMs };
+    }
+}
 // ---------- run_command ----------
 export const runCommandTool = {
     name: 'run_command',
@@ -41,70 +154,6 @@ export const runCommandTool = {
     async execute(args, ctx) {
         const command = String(args.command);
         const timeout = Number(args.timeout ?? 120000);
-        // 沙箱 best-effort:灾难性文件操作 denylist(非安全边界,只挡误操作;真隔离需 OS jailer)。
-        const deny = isCommandDenied(command);
-        if (deny)
-            return `错误:${deny}`;
-        return new Promise((done) => {
-            const isWin = process.platform === 'win32';
-            // 沙箱 best-effort:cwd 钉死 sandbox root(相对路径写落在牢内)+ env 脱敏(剥 *KEY/*TOKEN 等,防 LLM_API_KEY 泄子进程)
-            const child = spawn(isWin ? 'cmd.exe' : 'bash', isWin ? ['/c', command] : ['-c', command], { cwd: getSandboxRoot() ?? process.cwd(), env: filterEnv(process.env) });
-            const output = new BoundedCommandOutput();
-            let finished = false;
-            let timer;
-            // 杀整棵进程树。child.kill() 在 Windows 只杀 cmd.exe、npm 等子进程会孤儿继续跑(占锁、污染下一步),
-            // 故 Win 用 taskkill /T /F 树杀;Unix child.kill('SIGTERM')(bash -c 通常转发给前台子进程,best-effort)。
-            const killTree = () => {
-                try {
-                    if (isWin) {
-                        if (child.pid != null) {
-                            spawnSync('taskkill', ['/PID', String(child.pid), '/T', '/F'], {
-                                stdio: 'ignore',
-                            });
-                        }
-                    }
-                    else {
-                        child.kill('SIGTERM');
-                    }
-                }
-                catch {
-                    // 进程已退出 / kill 失败:忽略(close 事件会兜底 finish)
-                }
-            };
-            // abort(用户 Ctrl+C,经 executeTool ctx.signal 透传)→ 杀子进程树 + 返[已中断]
-            const onAbort = () => {
-                killTree();
-                finish(`${t('command.interrupted')}\n${output.render().trim()}`);
-            };
-            const finish = (s) => {
-                if (finished)
-                    return;
-                finished = true;
-                clearTimeout(timer);
-                ctx?.signal?.removeEventListener('abort', onAbort);
-                done(s);
-            };
-            const onChunk = (chunk) => {
-                output.append(chunk.toString('utf8'));
-            };
-            child.stdout.on('data', onChunk);
-            child.stderr.on('data', onChunk);
-            child.on('error', (e) => finish(t('command.executionFailed', { message: e.message })));
-            child.on('close', (code) => {
-                const result = output.render().trim();
-                finish(`${t('command.exitCode', { code: code ?? 'null' })}\n${result || t('toolSummary.noOutput')}`);
-            });
-            timer = setTimeout(() => {
-                killTree();
-                finish(`${t('command.timedOut')}\n${output.render().trim()}`);
-            }, timeout);
-            // 外部 abort signal:已 aborted 即时杀(防御;agent 循环顶检查通常会先拦),否则挂监听
-            if (ctx?.signal) {
-                if (ctx.signal.aborted)
-                    onAbort();
-                else
-                    ctx.signal.addEventListener('abort', onAbort, { once: true });
-            }
-        });
+        return commandOutcome(await runCommandRaw(command, timeout, ctx?.signal));
     },
 };

package/dist/tools/builtins/task.js

@@ -1,12 +1,13 @@
 import { spawnAgent } from '../../agent/spawn.js';
 import { MAX_OUTPUT } from '../constants.js';
 import { t } from '../../i18n/index.js';
+import { isSubAgentEnabled } from '../../config/index.js';
 // ---------- task ----------
 // 派生子 agent 执行独立子任务。子 agent 有独立 history(不污染主对话),
 // 可受限工具子集 + 低步数上限,最终摘要回灌主 history 供主 agent 继续。
 //
-// 适用:并行探查多个文件 / 分而治之的复杂任务 / 隔离上下文避免子任务工具噪声撑爆主窗口。
-// 子 agent 中间过程不写主屏,只返回最终摘要;主 agent 据摘要决定下一步。
+// 适用:分而治之的复杂任务 / 隔离上下文避免子任务工具噪声撑爆主窗口。
+// 多个 task 在共享工作区期间由 capability scheduler 串行执行；隔离 workspace 落地后再开放并行写。
 export const taskTool = {
     name: 'task',
     risk: 'dangerous',
@@ -35,6 +36,8 @@ export const taskTool = {
         required: ['prompt'],
     },
     async execute(args, ctx) {
+        if (!isSubAgentEnabled())
+            return t('task.disabled');
         const prompt = String(args.prompt ?? '');
         if (!prompt)
             return t('task.missingPrompt');

package/dist/tools/constants.js

@@ -1,5 +1,5 @@
 /** 工具共享的截断 / 上限 / 忽略规则。 */
-import { isMemoryEnabled } from '../config/index.js';
+import { isMemoryEnabled, isSubAgentEnabled } from '../config/index.js';
 export const MAX_FILE_LINES = 2000;
 export const MAX_OUTPUT = 20000;
 export const MAX_RESULTS = 100;
@@ -54,3 +54,7 @@ export function getPlanDisabledTools() {
     next.delete('memory_forget');
     return next;
 }
+/** auto/plan 共用的运行时功能开关防线；关闭时即使模型幻觉调用也不得执行。 */
+export function getRuntimeDisabledTools() {
+    return isSubAgentEnabled() ? new Set() : new Set(['task']);
+}

package/dist/tools/registry.js

@@ -1,7 +1,8 @@
 import { builtinTools } from './builtins/index.js';
-import { beginPathMutation, beginWorkspaceMutation, endPathMutation, endWorkspaceMutation, } from '../rollback/index.js';
+import { beginPathMutation, beginWorkspaceMutation, endPathMutation, endWorkspaceMutation, getCurrentTurnMutationState, } from '../rollback/index.js';
 import { enforceSandbox } from '../sandbox/index.js';
 import { t } from '../i18n/index.js';
+import { isToolErrorOutput } from './result.js';
 /**
  * 可扩展工具注册表。数组实例始终稳定，使已经持有 tools 引用的 agent/LLM 能看到运行时新增工具。
  * 扩展按 source 替换，MCP 重连或配置刷新不会累积旧工具。
@@ -33,40 +34,103 @@ function rebuildTools() {
     }
     tools.splice(0, tools.length, ...next);
 }
+const DEFAULT_CAPABILITIES = Object.freeze({
+    effect: 'unknown',
+    concurrency: 'serial',
+    retry: 'never',
+});
+export function findTool(name) {
+    return tools.find((tool) => tool.name === name);
+}
+/** 缺少声明或找不到工具时返回保守能力，绝不把未知扩展并发执行。 */
+export function getToolCapabilities(toolOrName) {
+    const tool = typeof toolOrName === 'string' ? findTool(toolOrName) : toolOrName;
+    return tool?.capabilities ?? DEFAULT_CAPABILITIES;
+}
+export function getToolResourceKeys(toolOrName, args) {
+    const capabilities = getToolCapabilities(toolOrName);
+    try {
+        return capabilities.resources?.(args) ?? [];
+    }
+    catch {
+        return [];
+    }
+}
+/** resource-locked write 是可生成文件 diff/按路径记 rollback 的文件 mutation。 */
+export function isFileMutationTool(name) {
+    const capabilities = getToolCapabilities(name);
+    return capabilities.effect === 'write' && capabilities.concurrency === 'resource-locked';
+}
+function isStructuredOutcome(value) {
+    return typeof value === 'object' && value !== null &&
+        typeof value.status === 'string' && typeof value.code === 'string' &&
+        typeof value.retryable === 'boolean' && typeof value.output === 'string';
+}
+function normalizeOutcome(value, capabilities, durationMs, changedFiles) {
+    if (isStructuredOutcome(value)) {
+        return {
+            ...value,
+            durationMs: value.durationMs ?? durationMs,
+            changedFiles: value.changedFiles ?? changedFiles,
+        };
+    }
+    const failed = isToolErrorOutput(value);
+    return {
+        status: failed ? 'error' : 'success',
+        code: failed ? 'EXECUTION_ERROR' : 'OK',
+        retryable: failed && capabilities.retry !== 'never',
+        output: value,
+        changedFiles,
+        durationMs,
+    };
+}
+function terminalOutcome(status, code, output, startedAt, changedFiles = []) {
+    return {
+        status,
+        code,
+        retryable: false,
+        output,
+        changedFiles,
+        durationMs: Date.now() - startedAt,
+    };
+}
 /**
- * 按名调度工具,统一 try/catch + JSON 解析,返回字符串而非抛错。
- * signal 透传给 tool.execute(经 ctx):长任务工具(run_command/web_fetch)abort 即时取消,
- * 让用户 Ctrl+C 能跟手中断工具执行(而非等命令跑完 / 超时)。
- * opts.dropContext:上下文剔除回调(drop_context 工具用),透传给 tool.execute 经 ctx。
+ * 结构化工具调度入口。永不抛错；旧字符串工具在此归一化为 ToolOutcome。
+ * 权限仍由 Agent 在展示工具头之前预检，保持现有交互时序。
  */
-export async function executeTool(name, argsRaw, signal, opts) {
-    const tool = tools.find((t) => t.name === name);
-    if (!tool)
-        return t('toolError.unknown', { name });
+export async function executeToolOutcome(name, argsRaw, signal, opts) {
+    const startedAt = Date.now();
+    if (signal?.aborted) {
+        return terminalOutcome('aborted', 'ABORTED', t('command.interrupted'), startedAt);
+    }
+    const tool = findTool(name);
+    if (!tool) {
+        return terminalOutcome('error', 'UNKNOWN_TOOL', t('toolError.unknown', { name }), startedAt);
+    }
     let args;
     try {
         args = argsRaw.trim() ? JSON.parse(argsRaw) : {};
     }
     catch {
-        return t('toolError.invalidJson', { name, arguments: argsRaw });
+        return terminalOutcome('error', 'INVALID_JSON', t('toolError.invalidJson', { name, arguments: argsRaw }), startedAt);
     }
+    const capabilities = getToolCapabilities(tool);
+    const mutationBefore = getCurrentTurnMutationState();
     try {
-        // 沙箱先重写/校验路径，保证快照与实际执行目标完全一致。
-        const sbErr = enforceSandbox(name, args);
-        if (sbErr)
-            return sbErr;
-        const pathCapture = (name === 'write_file' || name === 'edit_file') &&
-            typeof args.path === 'string' &&
-            args.path
+        const sandboxError = enforceSandbox(name, args);
+        if (sandboxError) {
+            return terminalOutcome('denied', 'SANDBOX_DENIED', sandboxError, startedAt);
+        }
+        const pathCapture = isFileMutationTool(name) && typeof args.path === 'string' && args.path
             ? beginPathMutation(args.path)
             : null;
-        // shell 与 MCP 的副作用无法从参数可靠推断：以工作区前后状态识别实际改动。
-        // task 本身不扫描；其子 agent 共享当前轮，并在各自真实写工具处记账。
-        const workspaceCapture = name === 'run_command' || name.startsWith('mcp__')
+        // 进程和未知扩展可能间接改动任意文件；已声明 write 的非文件工具自行管理其状态。
+        const workspaceCapture = capabilities.effect === 'process' || capabilities.effect === 'unknown'
             ? beginWorkspaceMutation()
             : null;
+        let raw;
         try {
-            return await tool.execute(args, {
+            raw = await tool.execute(args, {
                 signal,
                 dropContext: opts?.dropContext,
             });
@@ -77,11 +141,30 @@ export async function executeTool(name, argsRaw, signal, opts) {
             if (workspaceCapture)
                 endWorkspaceMutation(workspaceCapture, name);
         }
+        const mutationAfter = getCurrentTurnMutationState();
+        const changedFiles = mutationAfter.version !== mutationBefore.version
+            ? mutationAfter.changedFiles.map((item) => item.path)
+            : [];
+        if (signal?.aborted) {
+            return terminalOutcome('aborted', 'ABORTED', String(isStructuredOutcome(raw) ? raw.output : raw), startedAt, changedFiles);
+        }
+        return normalizeOutcome(raw, capabilities, Date.now() - startedAt, changedFiles);
     }
-    catch (e) {
-        return t('toolError.execution', {
+    catch (error) {
+        const mutationAfter = getCurrentTurnMutationState();
+        const changedFiles = mutationAfter.version !== mutationBefore.version
+            ? mutationAfter.changedFiles.map((item) => item.path)
+            : [];
+        if (signal?.aborted || (error instanceof Error && error.name === 'AbortError')) {
+            return terminalOutcome('aborted', 'ABORTED', t('command.interrupted'), startedAt, changedFiles);
+        }
+        return terminalOutcome('error', 'EXECUTION_ERROR', t('toolError.execution', {
             name,
-            message: e instanceof Error ? e.message : String(e),
-        });
+            message: error instanceof Error ? error.message : String(error),
+        }), startedAt, changedFiles);
     }
 }
+/** 字符串兼容入口：现有调用方、TUI 和 LLM history 无需同步迁移。 */
+export async function executeTool(name, argsRaw, signal, opts) {
+    return (await executeToolOutcome(name, argsRaw, signal, opts)).output;
+}

package/dist/verification/affected.js

@@ -0,0 +1,149 @@
+import path from 'node:path';
+const isWindows = process.platform === 'win32';
+const ROOT_CONFIG_NAMES = new Set([
+    'package.json', 'pnpm-workspace.yaml', 'pnpm-workspace.yml',
+    'package-lock.json', 'pnpm-lock.yaml', 'yarn.lock', 'bun.lock', 'bun.lockb',
+]);
+function comparisonKey(value) {
+    const resolved = path.resolve(value);
+    return isWindows ? resolved.toLowerCase() : resolved;
+}
+function isInside(parent, child) {
+    const relative = path.relative(comparisonKey(parent), comparisonKey(child));
+    return relative === '' || (!relative.startsWith(`..${path.sep}`) && relative !== '..' && !path.isAbsolute(relative));
+}
+function toNativeSeparators(value) {
+    return value.replace(/[\\/]/g, path.sep);
+}
+function canonicalize(profile, input, base) {
+    if (!input.trim() || input.includes('\0'))
+        return { input, reason: 'invalid_path' };
+    try {
+        const absolute = path.resolve(base, toNativeSeparators(input));
+        if (!isInside(profile.root, absolute))
+            return { input, reason: 'outside_project' };
+        const relative = path.relative(profile.root, absolute);
+        return {
+            absolute,
+            key: comparisonKey(absolute),
+            display: relative === '' ? '.' : relative.split(path.sep).join('/'),
+        };
+    }
+    catch {
+        return { input, reason: 'invalid_path' };
+    }
+}
+function matchesAnyRoot(file, roots) {
+    return roots.some((root) => isInside(root, file));
+}
+function classify(file, owner) {
+    if (matchesAnyRoot(file, owner.fixtureRoots))
+        return 'fixture';
+    if (matchesAnyRoot(file, owner.generatedRoots))
+        return 'generated';
+    if (matchesAnyRoot(file, owner.vendorRoots))
+        return 'vendor';
+    if (matchesAnyRoot(file, owner.testRoots))
+        return 'test';
+    if (matchesAnyRoot(file, owner.sourceRoots))
+        return 'source';
+    return 'other';
+}
+function rootConfigReason(profile, file) {
+    const workspaceKeys = new Set(profile.workspaceConfigPaths.map(comparisonKey));
+    if (workspaceKeys.has(file.key))
+        return 'workspace_config_change';
+    const rootPackage = profile.packages.find((item) => comparisonKey(item.root) === comparisonKey(profile.root));
+    const configKeys = new Set([
+        ...(rootPackage?.tsconfigPaths ?? []),
+        ...(rootPackage?.testConfigPaths ?? []),
+        ...(rootPackage?.lintConfigPaths ?? []),
+    ].map(comparisonKey));
+    if (configKeys.has(file.key))
+        return 'root_config_change';
+    if (comparisonKey(path.dirname(file.absolute)) !== comparisonKey(profile.root))
+        return null;
+    const name = path.basename(file.absolute).toLowerCase();
+    if (ROOT_CONFIG_NAMES.has(name) || /^tsconfig(?:\..+)?\.json$/i.test(name)) {
+        return name.startsWith('pnpm-workspace') ? 'workspace_config_change' : 'root_config_change';
+    }
+    return null;
+}
+function addReason(selections, packageProfile, reason) {
+    const key = comparisonKey(packageProfile.root);
+    let selected = selections.get(key);
+    if (!selected) {
+        selected = { package: packageProfile, reasons: [] };
+        selections.set(key, selected);
+    }
+    if (!selected.reasons.some((item) => item.kind === reason.kind
+        && item.changedPath === reason.changedPath
+        && item.sourcePackage === reason.sourcePackage)) {
+        selected.reasons.push(reason);
+    }
+}
+/** Map changed paths to their longest matching package roots without touching the filesystem. */
+export function resolveAffectedPackages(profile, changedFiles, options) {
+    const canonicalByKey = new Map();
+    const rejected = [];
+    for (const input of changedFiles) {
+        const result = canonicalize(profile, input, path.resolve(options.changedFilesBase));
+        if ('reason' in result)
+            rejected.push(result);
+        else if (!canonicalByKey.has(result.key))
+            canonicalByKey.set(result.key, result);
+    }
+    const canonical = [...canonicalByKey.values()];
+    const packageByDepth = [...profile.packages].sort((left, right) => comparisonKey(right.root).length - comparisonKey(left.root).length);
+    const selections = new Map();
+    const unmatchedFiles = [];
+    let affectsAll = false;
+    for (const file of canonical) {
+        const configReason = rootConfigReason(profile, file);
+        if (configReason) {
+            affectsAll = true;
+            for (const packageProfile of profile.packages) {
+                addReason(selections, packageProfile, {
+                    kind: configReason,
+                    changedPath: file.display,
+                    classification: 'other',
+                });
+            }
+            continue;
+        }
+        const owner = packageByDepth.find((packageProfile) => isInside(packageProfile.root, file.absolute));
+        if (!owner) {
+            unmatchedFiles.push(file.display);
+            continue;
+        }
+        addReason(selections, owner, {
+            kind: 'direct_change',
+            changedPath: file.display,
+            classification: classify(file.absolute, owner),
+        });
+    }
+    if (!affectsAll && options.expandDependents && selections.size > 0) {
+        const direct = profile.packages.filter((item) => selections.has(comparisonKey(item.root)));
+        const sourcePackage = direct.map((item) => item.name).join(', ');
+        for (const expanded of options.expandDependents(direct, profile)) {
+            const packageProfile = profile.packages.find((item) => comparisonKey(item.root) === comparisonKey(expanded.root));
+            if (!packageProfile || selections.has(comparisonKey(packageProfile.root)))
+                continue;
+            addReason(selections, packageProfile, {
+                kind: 'dependent_change',
+                changedPath: canonical[0]?.display ?? '.',
+                classification: 'other',
+                sourcePackage,
+            });
+        }
+    }
+    return {
+        packages: profile.packages
+            .map((item) => selections.get(comparisonKey(item.root)))
+            .filter((item) => item !== undefined),
+        canonicalChangedFiles: canonical.map((item) => item.display),
+        rejected,
+        unmatchedFiles,
+        affectsAll,
+    };
+}

package/dist/verification/discovery.js

@@ -0,0 +1,40 @@
+import { existsSync } from 'node:fs';
+import path from 'node:path';
+import { discoverProjectProfile } from './profile.js';
+const SCRIPT_PRIORITY = ['typecheck', 'test', 'build'];
+const isWindows = process.platform === 'win32';
+function samePath(left, right) {
+    const normalizedLeft = path.resolve(left);
+    const normalizedRight = path.resolve(right);
+    return isWindows
+        ? normalizedLeft.toLowerCase() === normalizedRight.toLowerCase()
+        : normalizedLeft === normalizedRight;
+}
+/** Discover one lowest-cost validation command for a package in a project profile. */
+export function discoverPackageValidationCommand(profile, packageProfile) {
+    const script = SCRIPT_PRIORITY.find((name) => typeof packageProfile.scripts[name] === 'string');
+    if (!script)
+        return null;
+    return {
+        script,
+        command: `${profile.packageManager} run ${script}`,
+        packageManager: profile.packageManager,
+        cwd: packageProfile.root,
+    };
+}
+/** Compatibility wrapper that discovers the root package validation command. */
+export function discoverValidationCommand(root) {
+    const resolvedRoot = path.resolve(root);
+    if (!existsSync(path.join(resolvedRoot, 'package.json'))) {
+        return { command: null, reason: 'no_package_json' };
+    }
+    try {
+        const profile = discoverProjectProfile(resolvedRoot);
+        const rootPackage = profile.packages.find((item) => samePath(item.root, resolvedRoot));
+        const command = rootPackage ? discoverPackageValidationCommand(profile, rootPackage) : null;
+        return command ? { command } : { command: null, reason: 'no_validation_script' };
+    }
+    catch {
+        return { command: null, reason: 'no_validation_script' };
+    }
+}