mustflow 2.84.0 → 2.99.0

package/dist/core/repo-manifest-lock-drift.js

@@ -0,0 +1,321 @@
+import { createHash } from 'node:crypto';
+import { existsSync } from 'node:fs';
+import path from 'node:path';
+import { isRecord } from './config-loading.js';
+import { ensureInside, ensureInsideWithoutSymlinks, readFileInsideWithoutSymlinks, readUtf8FileInsideWithoutSymlinks } from './safe-filesystem.js';
+import { parseTomlText } from './toml.js';
+export const REPO_MANIFEST_LOCK_DRIFT_PACK_ID = 'repo';
+export const REPO_MANIFEST_LOCK_DRIFT_SCRIPT_ID = 'manifest-lock-drift';
+export const REPO_MANIFEST_LOCK_DRIFT_SCRIPT_REF = `${REPO_MANIFEST_LOCK_DRIFT_PACK_ID}/${REPO_MANIFEST_LOCK_DRIFT_SCRIPT_ID}`;
+export const REPO_MANIFEST_LOCK_DRIFT_LOCK_PATH = '.mustflow/config/manifest.lock.toml';
+const DEFAULT_MAX_ENTRIES = 500;
+const SHA256_PATTERN = /^sha256:[a-f0-9]{64}$/u;
+function sha256(value) {
+    return `sha256:${createHash('sha256').update(value).digest('hex')}`;
+}
+function positiveInteger(value, fallback) {
+    return typeof value === 'number' && Number.isInteger(value) && value > 0 ? value : fallback;
+}
+function normalizeRelativePath(value) {
+    return value.replace(/\\/gu, '/').replace(/^\.\/+/u, '').replace(/\/+$/u, '') || '.';
+}
+function readOptionalString(value) {
+    return typeof value === 'string' && value.trim().length > 0 ? value : null;
+}
+function parseManifestLock(content) {
+    const raw = parseTomlText(content);
+    if (!isRecord(raw)) {
+        throw new Error('manifest lock must contain a TOML table');
+    }
+    const template = isRecord(raw.template) ? raw.template : {};
+    const files = raw.files;
+    if (!isRecord(files)) {
+        throw new Error('[files] must be a TOML table');
+    }
+    const lockedFiles = [];
+    for (const [relativePath, file] of Object.entries(files)) {
+        if (!isRecord(file)) {
+            throw new Error(`[files.${relativePath}] must be a TOML table`);
+        }
+        lockedFiles.push({
+            relativePath: normalizeRelativePath(relativePath),
+            source: readOptionalString(file.source),
+            lastAction: readOptionalString(file.last_action),
+            contentHash: readOptionalString(file.content_hash),
+        });
+    }
+    return {
+        schemaVersion: readOptionalString(raw.schema_version),
+        templateId: readOptionalString(template.id),
+        templateVersion: readOptionalString(template.version),
+        templateProfile: readOptionalString(template.profile),
+        templateLocale: readOptionalString(template.locale),
+        files: lockedFiles.sort((left, right) => left.relativePath.localeCompare(right.relativePath)),
+    };
+}
+function makeFinding(code, severity, pathValue, message, expectedHash, actualHash) {
+    return {
+        code,
+        severity,
+        path: pathValue,
+        expected_hash: expectedHash,
+        actual_hash: actualHash,
+        message,
+        json_pointer: null,
+        metric: null,
+        actual: null,
+        expected: null,
+    };
+}
+function resolveRequestedPaths(root, paths, findings, issues) {
+    const resolved = [];
+    const seen = new Set();
+    for (const inputPath of paths) {
+        const absolutePath = path.resolve(root, inputPath);
+        try {
+            ensureInside(root, absolutePath);
+            ensureInsideWithoutSymlinks(root, existsSync(absolutePath) ? absolutePath : path.dirname(absolutePath), {
+                allowMissingDescendant: true,
+            });
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            issues.push(`${inputPath}: ${message}`);
+            findings.push(makeFinding('manifest_lock_entry_path_outside_root', 'high', inputPath, message, null, null));
+            continue;
+        }
+        const relativePath = normalizeRelativePath(path.relative(root, absolutePath));
+        if (!seen.has(relativePath)) {
+            seen.add(relativePath);
+            resolved.push(relativePath);
+        }
+    }
+    return resolved.sort((left, right) => left.localeCompare(right));
+}
+function shouldCheckEntry(entryPath, requestedPaths) {
+    if (requestedPaths.length === 0) {
+        return true;
+    }
+    return requestedPaths.some((requestedPath) => entryPath === requestedPath || entryPath.startsWith(`${requestedPath}/`));
+}
+function hashProjectFile(root, relativePath) {
+    return sha256(readFileInsideWithoutSymlinks(root, path.join(root, ...relativePath.split('/'))));
+}
+function safeEntryExists(root, relativePath) {
+    const absolutePath = path.join(root, ...relativePath.split('/'));
+    try {
+        ensureInside(root, absolutePath);
+        ensureInsideWithoutSymlinks(root, existsSync(absolutePath) ? absolutePath : path.dirname(absolutePath), {
+            allowMissingDescendant: true,
+        });
+        return existsSync(absolutePath);
+    }
+    catch {
+        return false;
+    }
+}
+function inspectEntry(root, lockedFile, findings) {
+    const relativePath = lockedFile.relativePath;
+    const absolutePath = path.join(root, ...relativePath.split('/'));
+    try {
+        ensureInside(root, absolutePath);
+        ensureInsideWithoutSymlinks(root, existsSync(absolutePath) ? absolutePath : path.dirname(absolutePath), {
+            allowMissingDescendant: true,
+        });
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        findings.push(makeFinding('manifest_lock_entry_path_outside_root', 'high', relativePath, message, lockedFile.contentHash, null));
+        return {
+            path: relativePath,
+            source: lockedFile.source,
+            last_action: lockedFile.lastAction,
+            lock_hash: lockedFile.contentHash,
+            actual_hash: null,
+            exists: false,
+            status: 'unsafe_path',
+        };
+    }
+    if (!lockedFile.contentHash || !SHA256_PATTERN.test(lockedFile.contentHash)) {
+        findings.push(makeFinding('manifest_lock_entry_invalid_hash', 'high', relativePath, `Manifest lock entry ${relativePath} has an invalid content_hash.`, lockedFile.contentHash, null));
+        return {
+            path: relativePath,
+            source: lockedFile.source,
+            last_action: lockedFile.lastAction,
+            lock_hash: lockedFile.contentHash,
+            actual_hash: null,
+            exists: existsSync(absolutePath),
+            status: 'unreadable',
+        };
+    }
+    if (!existsSync(absolutePath)) {
+        findings.push(makeFinding('manifest_lock_entry_missing', 'high', relativePath, `Manifest lock entry ${relativePath} points to a missing file.`, lockedFile.contentHash, null));
+        return {
+            path: relativePath,
+            source: lockedFile.source,
+            last_action: lockedFile.lastAction,
+            lock_hash: lockedFile.contentHash,
+            actual_hash: null,
+            exists: false,
+            status: 'missing',
+        };
+    }
+    try {
+        const actualHash = hashProjectFile(root, relativePath);
+        if (actualHash !== lockedFile.contentHash) {
+            findings.push(makeFinding('manifest_lock_hash_mismatch', 'medium', relativePath, `Manifest lock content_hash differs from the current file hash for ${relativePath}.`, lockedFile.contentHash, actualHash));
+            return {
+                path: relativePath,
+                source: lockedFile.source,
+                last_action: lockedFile.lastAction,
+                lock_hash: lockedFile.contentHash,
+                actual_hash: actualHash,
+                exists: true,
+                status: 'hash_mismatch',
+            };
+        }
+        return {
+            path: relativePath,
+            source: lockedFile.source,
+            last_action: lockedFile.lastAction,
+            lock_hash: lockedFile.contentHash,
+            actual_hash: actualHash,
+            exists: true,
+            status: 'clean',
+        };
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        findings.push(makeFinding('manifest_lock_entry_unreadable', 'high', relativePath, message, lockedFile.contentHash, null));
+        return {
+            path: relativePath,
+            source: lockedFile.source,
+            last_action: lockedFile.lastAction,
+            lock_hash: lockedFile.contentHash,
+            actual_hash: null,
+            exists: true,
+            status: 'unreadable',
+        };
+    }
+}
+function summarize(entries, entriesTotal, findings) {
+    return {
+        entries_total: entriesTotal,
+        entries_checked: entries.filter((entry) => entry.status !== 'skipped').length,
+        clean_entries: entries.filter((entry) => entry.status === 'clean').length,
+        missing_entries: entries.filter((entry) => entry.status === 'missing').length,
+        hash_mismatches: entries.filter((entry) => entry.status === 'hash_mismatch').length,
+        unreadable_entries: entries.filter((entry) => entry.status === 'unreadable').length,
+        unsafe_entries: entries.filter((entry) => entry.status === 'unsafe_path').length,
+        skipped_entries: entries.filter((entry) => entry.status === 'skipped').length,
+        findings: findings.length,
+    };
+}
+function createInputHash(reportInput) {
+    return sha256(JSON.stringify(reportInput));
+}
+function createLockMetadata(lock, exists) {
+    return {
+        path: REPO_MANIFEST_LOCK_DRIFT_LOCK_PATH,
+        exists,
+        schema_version: lock?.schemaVersion ?? null,
+        template_id: lock?.templateId ?? null,
+        template_version: lock?.templateVersion ?? null,
+        template_profile: lock?.templateProfile ?? null,
+        template_locale: lock?.templateLocale ?? null,
+        entries_total: lock?.files.length ?? 0,
+    };
+}
+export function checkRepoManifestLockDrift(projectRoot, options) {
+    const root = path.resolve(projectRoot);
+    const findings = [];
+    const issues = [];
+    const requestedPaths = [...options.paths];
+    const policy = {
+        lock_path: REPO_MANIFEST_LOCK_DRIFT_LOCK_PATH,
+        input_mode: requestedPaths.length > 0 ? 'explicit_paths' : 'all_locked_files',
+        max_entries: positiveInteger(options.maxEntries, DEFAULT_MAX_ENTRIES),
+        extra_manifest_file_detection: 'not_authoritative',
+    };
+    const lockPath = path.join(root, ...REPO_MANIFEST_LOCK_DRIFT_LOCK_PATH.split('/'));
+    const normalizedRequestedPaths = resolveRequestedPaths(root, requestedPaths, findings, issues);
+    let lock = null;
+    if (!existsSync(lockPath)) {
+        const message = `Manifest lock is missing: ${REPO_MANIFEST_LOCK_DRIFT_LOCK_PATH}`;
+        findings.push(makeFinding('manifest_lock_missing', 'high', REPO_MANIFEST_LOCK_DRIFT_LOCK_PATH, message, null, null));
+        issues.push(message);
+    }
+    else {
+        try {
+            ensureInside(root, lockPath);
+            ensureInsideWithoutSymlinks(root, lockPath);
+            lock = parseManifestLock(readUtf8FileInsideWithoutSymlinks(root, lockPath, { maxBytes: 1024 * 1024 }));
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            findings.push(makeFinding('manifest_lock_invalid', 'high', REPO_MANIFEST_LOCK_DRIFT_LOCK_PATH, message, null, null));
+            issues.push(`Invalid manifest lock: ${message}`);
+        }
+    }
+    const entries = [];
+    if (lock) {
+        let maxEntriesFindingReported = false;
+        for (const lockedFile of lock.files) {
+            if (!shouldCheckEntry(lockedFile.relativePath, normalizedRequestedPaths)) {
+                entries.push({
+                    path: lockedFile.relativePath,
+                    source: lockedFile.source,
+                    last_action: lockedFile.lastAction,
+                    lock_hash: lockedFile.contentHash,
+                    actual_hash: null,
+                    exists: safeEntryExists(root, lockedFile.relativePath),
+                    status: 'skipped',
+                });
+                continue;
+            }
+            if (entries.filter((entry) => entry.status !== 'skipped').length >= policy.max_entries) {
+                if (!maxEntriesFindingReported) {
+                    const message = `Manifest lock drift check reached max_entries ${policy.max_entries}; remaining entries were skipped.`;
+                    findings.push(makeFinding('manifest_lock_max_entries_exceeded', 'high', lockedFile.relativePath, message, lockedFile.contentHash, null));
+                    maxEntriesFindingReported = true;
+                }
+                entries.push({
+                    path: lockedFile.relativePath,
+                    source: lockedFile.source,
+                    last_action: lockedFile.lastAction,
+                    lock_hash: lockedFile.contentHash,
+                    actual_hash: null,
+                    exists: safeEntryExists(root, lockedFile.relativePath),
+                    status: 'skipped',
+                });
+                continue;
+            }
+            entries.push(inspectEntry(root, lockedFile, findings));
+        }
+    }
+    const lockMetadata = createLockMetadata(lock, existsSync(lockPath));
+    const summary = summarize(entries, lockMetadata.entries_total, findings);
+    const hasHighFinding = findings.some((finding) => finding.severity === 'high' || finding.severity === 'critical');
+    const status = issues.length > 0 || hasHighFinding ? 'error' : findings.length > 0 ? 'failed' : 'passed';
+    return {
+        schema_version: '1',
+        command: 'script-pack',
+        pack_id: REPO_MANIFEST_LOCK_DRIFT_PACK_ID,
+        script_id: REPO_MANIFEST_LOCK_DRIFT_SCRIPT_ID,
+        script_ref: REPO_MANIFEST_LOCK_DRIFT_SCRIPT_REF,
+        action: 'check',
+        status,
+        ok: status === 'passed',
+        mustflow_root: root,
+        input: {
+            paths: requestedPaths,
+        },
+        policy,
+        input_hash: createInputHash({ inputPaths: requestedPaths, policy, lock: lockMetadata, summary, entries, findings, issues }),
+        lock: lockMetadata,
+        summary,
+        entries,
+        findings,
+        issues,
+    };
+}

package/dist/core/repo-merge-conflict-scan.js

@@ -0,0 +1,335 @@
+import { createHash } from 'node:crypto';
+import { spawnSync } from 'node:child_process';
+import { existsSync, lstatSync, readdirSync } from 'node:fs';
+import path from 'node:path';
+import { ensureInsideWithoutSymlinks, readUtf8FileInsideWithoutSymlinks } from './safe-filesystem.js';
+export const REPO_MERGE_CONFLICT_SCAN_PACK_ID = 'repo';
+export const REPO_MERGE_CONFLICT_SCAN_SCRIPT_ID = 'merge-conflict-scan';
+export const REPO_MERGE_CONFLICT_SCAN_SCRIPT_REF = `${REPO_MERGE_CONFLICT_SCAN_PACK_ID}/${REPO_MERGE_CONFLICT_SCAN_SCRIPT_ID}`;
+const DEFAULT_MAX_FILES = 1000;
+const DEFAULT_MAX_FILE_BYTES = 512 * 1024;
+const MARKER_PATTERNS = [
+    { prefix: '<<<<<<<', marker: 'start' },
+    { prefix: '|||||||', marker: 'base' },
+    { prefix: '=======', marker: 'separator' },
+    { prefix: '>>>>>>>', marker: 'end' },
+];
+const SKIPPED_DIRECTORY_NAMES = new Set([
+    '.git',
+    'node_modules',
+    'vendor',
+    'third_party',
+    'dist',
+    'build',
+    'coverage',
+    '.mustflow/cache',
+    '.mustflow/state',
+]);
+function normalizeRelativePath(value) {
+    return value.replace(/\\/gu, '/').replace(/^\.\/+/u, '').replace(/\/+$/u, '') || '.';
+}
+function sha256(value) {
+    return `sha256:${createHash('sha256').update(value).digest('hex')}`;
+}
+function positiveInteger(value, fallback) {
+    return typeof value === 'number' && Number.isInteger(value) && value > 0 ? value : fallback;
+}
+function runGit(root, args) {
+    const result = spawnSync('git', [...args], {
+        cwd: root,
+        encoding: 'utf8',
+        stdio: ['ignore', 'pipe', 'pipe'],
+        windowsHide: true,
+        maxBuffer: 16 * 1024 * 1024,
+    });
+    return {
+        ok: result.status === 0,
+        stdout: result.stdout ?? '',
+        stderr: result.stderr ?? '',
+    };
+}
+function isInsideGitWorktree(root) {
+    const result = runGit(root, ['rev-parse', '--is-inside-work-tree']);
+    return result.ok && result.stdout.trim() === 'true';
+}
+function parseGitPaths(stdout) {
+    const paths = [];
+    const seen = new Set();
+    for (const line of stdout.split(/\r?\n/u)) {
+        const relativePath = normalizeRelativePath(line.trim());
+        if (!relativePath || relativePath === '.' || seen.has(relativePath)) {
+            continue;
+        }
+        seen.add(relativePath);
+        paths.push(relativePath);
+    }
+    return paths.sort((left, right) => left.localeCompare(right));
+}
+function collectGitChangedFiles(root, issues, findings) {
+    if (!isInsideGitWorktree(root)) {
+        const message = 'Git worktree is unavailable; provide explicit paths to scan.';
+        issues.push(message);
+        findings.push(makeFinding('merge_conflict_scan_git_unavailable', 'low', '.', message, null, null));
+        return [];
+    }
+    const tracked = runGit(root, ['diff', '--name-only', '--diff-filter=ACMRTUXB', 'HEAD', '--']);
+    const untracked = runGit(root, ['ls-files', '--others', '--exclude-standard', '--']);
+    const paths = new Set();
+    if (tracked.ok) {
+        for (const entry of parseGitPaths(tracked.stdout)) {
+            paths.add(entry);
+        }
+    }
+    else {
+        issues.push(`Could not inspect changed tracked files: ${tracked.stderr.trim() || 'git diff failed'}`);
+    }
+    if (untracked.ok) {
+        for (const entry of parseGitPaths(untracked.stdout)) {
+            paths.add(entry);
+        }
+    }
+    else {
+        issues.push(`Could not inspect untracked files: ${untracked.stderr.trim() || 'git ls-files failed'}`);
+    }
+    return [...paths].sort((left, right) => left.localeCompare(right));
+}
+function shouldSkipDirectory(relativePath) {
+    const normalized = normalizeRelativePath(relativePath);
+    const firstSegment = normalized.split('/')[0] ?? normalized;
+    return SKIPPED_DIRECTORY_NAMES.has(normalized) || SKIPPED_DIRECTORY_NAMES.has(firstSegment);
+}
+function isLikelyTextFile(relativePath) {
+    const extension = path.posix.extname(relativePath).toLowerCase();
+    if (!extension) {
+        return true;
+    }
+    return ![
+        '.png',
+        '.jpg',
+        '.jpeg',
+        '.gif',
+        '.webp',
+        '.ico',
+        '.pdf',
+        '.zip',
+        '.gz',
+        '.tgz',
+        '.wasm',
+        '.sqlite',
+        '.db',
+        '.lockb',
+    ].includes(extension);
+}
+function listFilesUnder(root, relativePath, findings, issues) {
+    const absolutePath = path.join(root, ...relativePath.split('/'));
+    let entries;
+    try {
+        ensureInsideWithoutSymlinks(root, absolutePath);
+        entries = readdirSync(absolutePath, { withFileTypes: true });
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        issues.push(`${relativePath}: ${message}`);
+        findings.push(makeFinding('merge_conflict_scan_unreadable_path', 'high', relativePath, message, null, null));
+        return [];
+    }
+    const files = [];
+    for (const entry of entries.sort((left, right) => left.name.localeCompare(right.name))) {
+        const child = normalizeRelativePath(relativePath === '.' ? entry.name : `${relativePath}/${entry.name}`);
+        if (entry.isDirectory()) {
+            if (!shouldSkipDirectory(child)) {
+                files.push(...listFilesUnder(root, child, findings, issues));
+            }
+            continue;
+        }
+        if (entry.isFile() && isLikelyTextFile(child)) {
+            files.push(child);
+        }
+    }
+    return files;
+}
+function resolveInputFiles(root, inputPaths, policy, findings, issues) {
+    const files = [];
+    const seen = new Set();
+    for (const inputPath of inputPaths) {
+        const absolutePath = path.resolve(root, inputPath);
+        let relativePath;
+        try {
+            ensureInsideWithoutSymlinks(root, absolutePath);
+            relativePath = normalizeRelativePath(path.relative(root, absolutePath));
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            issues.push(`${inputPath}: ${message}`);
+            findings.push(makeFinding('merge_conflict_scan_path_outside_root', 'high', inputPath, message, null, null));
+            continue;
+        }
+        if (!existsSync(absolutePath)) {
+            continue;
+        }
+        let stats;
+        try {
+            stats = lstatSync(absolutePath);
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            issues.push(`${relativePath}: ${message}`);
+            findings.push(makeFinding('merge_conflict_scan_unreadable_path', 'high', relativePath, message, null, null));
+            continue;
+        }
+        const candidates = stats.isDirectory()
+            ? listFilesUnder(root, relativePath, findings, issues)
+            : stats.isFile() && isLikelyTextFile(relativePath)
+                ? [relativePath]
+                : [];
+        for (const candidate of candidates) {
+            if (seen.has(candidate)) {
+                continue;
+            }
+            if (files.length >= policy.max_files) {
+                const message = `Merge-conflict scan reached max_files ${policy.max_files}; remaining files were skipped.`;
+                issues.push(message);
+                findings.push(makeFinding('merge_conflict_scan_max_files_exceeded', 'high', candidate, message, null, null));
+                return files;
+            }
+            seen.add(candidate);
+            files.push(candidate);
+        }
+    }
+    return files.sort((left, right) => left.localeCompare(right));
+}
+function markerForLine(line) {
+    const trimmedStart = line.trimStart();
+    for (const pattern of MARKER_PATTERNS) {
+        if (trimmedStart.startsWith(pattern.prefix)) {
+            return { marker: pattern.marker, markerLength: pattern.prefix.length };
+        }
+    }
+    return null;
+}
+function makeFinding(code, severity, pathValue, message, line, marker) {
+    return {
+        code,
+        severity,
+        path: pathValue,
+        line,
+        marker,
+        message,
+        json_pointer: null,
+        metric: null,
+        actual: null,
+        expected: null,
+    };
+}
+function scanFile(root, relativePath, policy, findings, issues) {
+    let content;
+    try {
+        content = readUtf8FileInsideWithoutSymlinks(root, path.join(root, ...relativePath.split('/')), {
+            maxBytes: policy.max_file_bytes,
+        });
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        const code = message.includes('exceeds maximum size')
+            ? 'merge_conflict_scan_file_too_large'
+            : 'merge_conflict_scan_unreadable_path';
+        const severity = code === 'merge_conflict_scan_file_too_large' ? 'medium' : 'high';
+        issues.push(`${relativePath}: ${message}`);
+        findings.push(makeFinding(code, severity, relativePath, message, null, null));
+        return { file: null, markers: [] };
+    }
+    const fileMarkers = [];
+    const lines = content.split(/\r\n|\n|\r/u);
+    for (const [index, line] of lines.entries()) {
+        const marker = markerForLine(line);
+        if (!marker) {
+            continue;
+        }
+        const column = line.length - line.trimStart().length + 1;
+        const lineNumber = index + 1;
+        fileMarkers.push({
+            path: relativePath,
+            line: lineNumber,
+            column,
+            marker: marker.marker,
+            marker_length: marker.markerLength,
+        });
+        findings.push(makeFinding('merge_conflict_marker_detected', 'high', relativePath, `Merge conflict marker "${marker.marker}" detected at ${relativePath}:${lineNumber}.`, lineNumber, marker.marker));
+    }
+    return {
+        file: {
+            path: relativePath,
+            sha256: sha256(content),
+            bytes: Buffer.byteLength(content, 'utf8'),
+            markers: fileMarkers.length,
+        },
+        markers: fileMarkers,
+    };
+}
+function summarize(files, markers, issues) {
+    return {
+        files_checked: files.length,
+        markers_found: markers.length,
+        files_with_markers: files.filter((file) => file.markers > 0).length,
+        issues: issues.length,
+    };
+}
+function createInputHash(reportInput) {
+    return sha256(JSON.stringify(reportInput));
+}
+export function checkRepoMergeConflictScan(projectRoot, options) {
+    const root = path.resolve(projectRoot);
+    const inputPaths = options.paths.length > 0 ? [...options.paths] : [];
+    const findings = [];
+    const issues = [];
+    const policy = {
+        input_mode: inputPaths.length > 0 ? 'explicit_paths' : 'git_changed_files',
+        marker_prefixes: MARKER_PATTERNS.map((pattern) => pattern.prefix),
+        max_files: positiveInteger(options.maxFiles, DEFAULT_MAX_FILES),
+        max_file_bytes: positiveInteger(options.maxFileBytes, DEFAULT_MAX_FILE_BYTES),
+        skipped_directories: [...SKIPPED_DIRECTORY_NAMES].sort((left, right) => left.localeCompare(right)),
+    };
+    const effectivePaths = inputPaths.length > 0 ? inputPaths : collectGitChangedFiles(root, issues, findings);
+    const scanTargets = resolveInputFiles(root, effectivePaths, policy, findings, issues);
+    const files = [];
+    const markers = [];
+    for (const target of scanTargets) {
+        const result = scanFile(root, target, policy, findings, issues);
+        if (result.file) {
+            files.push(result.file);
+        }
+        markers.push(...result.markers);
+    }
+    if (effectivePaths.length === 0 && issues.length === 0) {
+        const message = 'No input files were available for merge-conflict scanning.';
+        findings.push(makeFinding('merge_conflict_scan_no_input_files', 'low', '.', message, null, null));
+    }
+    const summary = summarize(files, markers, issues);
+    const hasHighFinding = findings.some((finding) => finding.severity === 'high' || finding.severity === 'critical');
+    const status = findings.some((finding) => finding.code === 'merge_conflict_scan_path_outside_root')
+        ? 'error'
+        : hasHighFinding
+            ? 'failed'
+            : 'passed';
+    return {
+        schema_version: '1',
+        command: 'script-pack',
+        pack_id: REPO_MERGE_CONFLICT_SCAN_PACK_ID,
+        script_id: REPO_MERGE_CONFLICT_SCAN_SCRIPT_ID,
+        script_ref: REPO_MERGE_CONFLICT_SCAN_SCRIPT_REF,
+        action: 'check',
+        status,
+        ok: status === 'passed',
+        mustflow_root: root,
+        input: {
+            paths: inputPaths,
+        },
+        policy,
+        input_hash: createInputHash({ inputPaths, policy, files, markers, findings, issues }),
+        summary,
+        files,
+        markers,
+        findings,
+        issues,
+    };
+}