plumbbob 0.9.5 → 0.10.0

package/node_modules/checkride/dist/agent-setup/scripts.js

@@ -15,8 +15,8 @@
  * still takes all three. The gate is the one both need, because it alone has a
  * branch neither config can carry (see {@link gateTail}).
  */
-import { DIRTY_MARKER } from '../gate.js';
-import { execCommand } from '../pm/index.js';
+import { DIRTY_MARKER, GATE_RETRY_ENV } from '../gate.js';
+import { execCommand, runScript } from '../pm/index.js';
 /**
  * The repo root, however the calling harness spells it. Cursor sets
  * `CURSOR_PROJECT_DIR` (and `CLAUDE_PROJECT_DIR` as an alias); Claude Code sets
@@ -32,100 +32,283 @@ function checkrideCommand(pm, args) {
     return execCommand(pm, ['checkride', ...args], { quiet: true });
 }
 /**
- * What a harness is told when `checkride gate` itself could not run.
+ * Every message this script can emit is passed to `printf` as an *argument*,
+ * never inlined into a double-quoted format string, so its backticks survive:
+ * `sh` runs a backtick span inside double quotes as a command, but it does not
+ * re-scan the result of a variable expansion. An early draft used `echo "…"`
+ * with the text inline and the shell silently ate two quoted command names.
  *
- * Emitted through `printf '%s\n' '…'` — single-quoted, never double — because
- * the text carries backticks and `sh` runs a backtick span inside double quotes
- * as a command. The first draft of this message used `echo "…"` and the shell
- * silently ate the two quoted command names, substituting their output. Keep it
- * free of single quotes for the same reason.
+ * Two characters are therefore banned from every message here, and a test
+ * enforces both. A single quote would end the `'…'` the call site wraps it in. A
+ * double quote (or a backslash) would break {@link standDown}, which builds its
+ * JSON body with `printf '{"systemMessage":"%s"}'` rather than carrying a
+ * second, pre-encoded copy of the same sentence out of step with the first.
  */
-const UNRUNNABLE = 'checkride: the gate could not run — `checkride gate` is not resolvable in this repo. ' +
-    'Install checkride (or re-run `checkride agent-setup`) before finishing.';
+const NOTHING_RAN = 'Nothing ran: no check executed and no artifact was written, so `.check/` holds nothing from this turn.';
+/** `<pm> install`, which is how all four package managers spell it. */
+const installFix = (pm) => `Run \`${pm} install\` (checkride is a devDependency of this repo), then run \`${runScript(pm, 'check')}\`.`;
 /**
- * The one line that hands `harness` the {@link UNRUNNABLE} verdict, and the exit
- * status that goes with it.
+ * The repo has no checkride to run, because its dependencies were never
+ * installed — someone pulled a branch that added checkride, or cloned fresh, and
+ * started a session before installing.
  *
- * The statuses differ because the harnesses do: Claude Code blocks on 2, while
- * Cursor reads any non-zero stop hook as a *broken* hook and ends the turn —
- * there, blocking has to ride in the body with an exit of 0. Kept as a pair so
- * no branch can pick one without the other.
+ * This stands the gate down instead of blocking, and it is the one case where
+ * that is clearly right. Blocking exists to make an agent fix what it broke; an
+ * absent toolchain is not something the turn broke, and the remedy is an install
+ * rather than an edit. Blocking on it re-asks the same agent every turn, forever,
+ * for a change that cannot clear it — the loop that ends with a contributor
+ * removing the gate. See `../gate.ts` {@link reportStandDown} for the same
+ * judgement one layer down.
  */
-function unrunnable(harness) {
-    return harness === 'cursor'
-        ? { emit: `printf '%s\\n' '${JSON.stringify({ followup_message: UNRUNNABLE })}'`, exit: 0 }
-        : { emit: `printf '%s\\n' '${UNRUNNABLE}' >&2`, exit: 2 };
+const notInstalled = (pm) => [
+    'checkride: the gate could not run — checkride is not installed in this repo.',
+    NOTHING_RAN,
+    installFix(pm),
+    'Not blocking: the fix is an install rather than an edit, so blocking would only repeat this ' +
+        'message. Nothing was verified this turn.',
+].join(' ');
+/**
+ * checkride *is* installed and still did not answer with one of its own two gate
+ * codes — a broken launcher, a corrupt install, a crash. This one blocks: it is
+ * rare, it is not self-explanatory, and unlike a missing install there is no
+ * known remedy to name, so the honest move is to stop and be looked at. The
+ * retry guard in {@link gatePreamble} still bounds it.
+ */
+const notAnswering = (pm, harness) => [
+    'checkride: the gate could not run — checkride is installed here but `checkride gate` did not answer.',
+    NOTHING_RAN,
+    `Run \`${execCommand(pm, ['checkride', 'gate', '--harness', harness])}\` in a terminal to see the failure directly.`,
+].join(' ');
+/** The harness pointed the hook at a directory that is not there. */
+const noRepo = 'checkride: the gate could not run — the project directory the harness named does not exist or ' +
+    'cannot be entered, so there is no repo to check.';
+/**
+ * The shell functions every branch below answers through: one for a verdict that
+ * blocks, one for a verdict that gives up on blocking.
+ *
+ * `block` consults `retry` first, which is what bounds *every* could-not-run
+ * cause rather than only the ones enumerated here. Claude Code sends
+ * `stop_hook_active` on the Stop payload and Cursor sends `loop_count`; either
+ * one says the harness has already auto-submitted a turn on this hook, and a
+ * second identical block has been demonstrated not to help. A red pipeline never
+ * reaches this — that loop is the gate working, and is deliberately unbounded.
+ *
+ * Under Cursor `stand_down` consults it too, for a different reason. Blocking
+ * there is a `followup_message`, and so is the only way to reach a *user*, so
+ * the same guard has to serve both: it stops `block` repeating itself, and it
+ * rations `stand_down` to the single message that names the fix. `retry` is
+ * conservative in exactly the direction that keeps that safe — Cursor's
+ * `loop_count` counts every follow-up in the conversation rather than the
+ * consecutive ones, so an over-count costs a quiet stand-down, never a loop.
+ */
+function gatePreamble(harness) {
+    const cursor = harness === 'cursor';
+    return [
+        '# The Stop payload arrives as JSON on stdin and says whether the harness has',
+        '# already been round this loop once. Read it before anything else can consume',
+        '# it, and only from a pipe: `cat` on a terminal would hang a hand-run forever.',
+        "payload=''",
+        '[ -t 0 ] || payload=$(cat)',
+        '',
+        '# True once the harness has already auto-submitted a turn on this hook.',
+        'retry() {',
+        '  printf %s "$payload" |',
+        `    grep -Eq '"stop_hook_active"[[:space:]]*:[[:space:]]*true|"loop_count"[[:space:]]*:[[:space:]]*[1-9]'`,
+        '}',
+        '',
+        '# Give up on blocking, and say so. Nothing here is silent: a turn that ended',
+        '# unverified must never look like one that passed.',
+        'stand_down() {',
+        ...(cursor
+            ? [
+                '  # Cursor names no channel that shows hook stderr to a user — only a Hooks',
+                '  # output panel under Customize — so stderr alone would hide this from the',
+                '  # one party who can fix an environment. `followup_message` does reach the',
+                '  # chat, and it also *submits a new turn*, so it goes out exactly once:',
+                '  # `loop_count` says a follow-up already went, and a second is the loop.',
+                '  retry || printf \'{"followup_message":"%s"}\\n\' "$1"',
+                '  printf \'%s\\n\' "$1" >&2',
+            ]
+            : [
+                '  # `systemMessage` reaches the user — the one party who can fix an',
+                '  # environment. With no `decision` in the body, Claude Code does not block.',
+                '  printf \'{"systemMessage":"%s"}\\n\' "$1"',
+                '  printf \'%s\\n\' "$1" >&2',
+            ]),
+        '  exit 0',
+        '}',
+        '',
+        '# Block the turn — unless this is the second consecutive attempt, in which',
+        '# case blocking is the thing already shown not to work.',
+        'block() {',
+        '  retry && stand_down "$1 Standing down rather than blocking a second time on the same verdict."',
+        ...(cursor
+            ? [
+                '  # Cursor reads any non-zero stop hook as a *broken* hook and ends the turn,',
+                '  # so the block has to ride in the body with an exit of 0.',
+                '  printf \'{"followup_message":"%s"}\\n\' "$1"',
+                '  exit 0',
+            ]
+            : ['  printf \'%s\\n\' "$1" >&2', '  exit 2']),
+        '}',
+        ...(cursor
+            ? [
+                '',
+                '# checkride also stands *itself* down, for a refusal it detects from inside',
+                '# (an `engines` pin the hook Node fails, a corepack it cannot verify) — and',
+                '# it never sees the stop payload, so hand it the one fact that bounds that',
+                '# message to a single turn the same way. It sends a followup only on a 0.',
+                `if retry; then ${GATE_RETRY_ENV}=1; else ${GATE_RETRY_ENV}=0; fi`,
+                `export ${GATE_RETRY_ENV}`,
+            ]
+            : []),
+    ];
 }
 /**
  * Translate the gate's exit status into `harness`'s protocol.
  *
- * The interesting branch is the last one. `checkride gate` exits 0 or 2 by
- * design; anything else means it never ran — an uninstalled checkride, a broken
- * launcher — and that must **block**, not pass. Claude Code reads a plain exit 1
- * as "hook failed, carry on", which would leave a repo whose gate had silently
- * stopped gating: precisely the vacuous green checkride exists to prevent. So
- * the gate alone fails closed. (`protect` fails open, deliberately: the cost of
- * a broken protect hook is a repo where nothing can be written at all.)
+ * `checkride gate` exits 0 or 2 by design, and only on those two is its stdout a
+ * hook body worth forwarding. Anything else means checkride never ran, and
+ * whatever is on stdout then is the *launcher's* error — pnpm writes
+ * `ERR_PNPM_RECURSIVE_EXEC_FIRST_FAIL` there, ahead of a stray `undefined` on
+ * pnpm 11. Forwarding that puts unparseable text on the one channel a harness
+ * reads as protocol, so the status is checked first and the body is forwarded
+ * only when checkride is the one that wrote it. That is why {@link invokeGate}
+ * captures under both harnesses: output already streamed past the script cannot
+ * be withheld by it.
  */
-function gateTail(harness) {
-    const { emit, exit } = unrunnable(harness);
-    if (harness === 'cursor') {
-        return [
-            '# On success checkride has already written its JSON to stdout, which is what',
-            '# Cursor reads. Only the never-ran case is left to answer for.',
-            '[ "$status" -eq 0 ] && exit 0',
-            emit,
-            `exit ${exit}`,
+function gateTail(harness, pm) {
+    const answered = harness === 'cursor'
+        ? [
+            '# On 0 checkride has already written its JSON body, and on 2 the followup',
+            '# body. Either way it answered, so hand back what it wrote, unchanged.',
+            '# A green that had nothing to do writes nothing, and that is a body too.',
+            'case "$status" in',
+            '  0|2)',
+            '    [ -n "$body" ] && printf \'%s\\n\' "$body"',
+            '    exit 0',
+            '    ;;',
+            'esac',
+        ]
+        : [
+            '# Claude Code parses a hook body only on exit 0, and only a body can carry a',
+            '# user-visible message alongside the block. So when checkride produced one,',
+            '# forward it and exit 0: the verdict rides in `decision`, not in the status.',
+            'case "$status" in',
+            '  0|2)',
+            '    if [ -n "$body" ]; then',
+            "      printf '%s\\n' \"$body\"",
+            '      exit 0',
+            '    fi',
+            '    # No body — an older checkride that reports only through the exit code.',
+            '    exit "$status"',
+            '    ;;',
+            'esac',
         ];
+    return [
+        ...answered,
+        '',
+        "# Neither of checkride's two gate codes: checkride itself never ran. Which of",
+        '# the two reasons it was decides whether blocking could accomplish anything.',
+        'if [ -e node_modules/.bin/checkride ] || [ -e .pnp.cjs ] || [ -e .pnp.js ]; then',
+        `  block '${notAnswering(pm, harness)}'`,
+        'fi',
+        `stand_down '${notInstalled(pm)}'`,
+    ];
+}
+/**
+ * Characters a `gate.preflight` path may not contain, because the generated
+ * script embeds it inside `'…'` and inside a message that later becomes a JSON
+ * string field.
+ *
+ * Rejected loudly rather than escaped or stripped. Every one of these in a
+ * repo-relative script path is a mistake, and a mangled path would fail later as
+ * "preflight not found", pointing at the wrong thing.
+ */
+const PREFLIGHT_HOSTILE = /['"\\`\n]/;
+/**
+ * The repo-owned preflight, run from the repo root before checkride is started.
+ *
+ * Its exit code is read in the gate's own vocabulary — 0 runs the gate, 2 blocks
+ * the turn, anything else stands it down — so there is one meaning per code
+ * across the whole system rather than a second convention to learn. Both
+ * non-zero branches use the script's own output as the message and never start
+ * checkride, which is what lets a preflight answer for a repo where checkride
+ * *cannot* start.
+ *
+ * A configured path that is not there **blocks**, and deliberately: treating it
+ * as a stand-down would mean a typo in one config key silently disarms the gate
+ * forever. A missing file is repo-fixable, so blocking is the consistent answer.
+ */
+function preflight(path) {
+    if (PREFLIGHT_HOSTILE.test(path)) {
+        throw new Error(`checkride.config.json: gate.preflight '${path}' contains a quote, backslash, backtick or newline. ` +
+            'Use a plain repo-relative path.');
     }
+    // `sh` resolves a command with no `/` against PATH, which is never what a
+    // repo-relative config value means.
+    const target = path.includes('/') ? path : `./${path}`;
     return [
-        '# Claude Code parses a hook body only on exit 0, and only a body can carry a',
-        '# user-visible message alongside the block. So when checkride produced one,',
-        '# forward it and exit 0: the verdict rides in `decision`, not in the status.',
-        'if [ -n "$body" ]; then',
-        "  printf '%s\\n' \"$body\"",
-        '  case "$status" in',
-        '    0|2) exit 0 ;;',
-        '  esac',
+        '# The repo-owned preflight, from `gate.preflight` in checkride.config.json.',
+        '# checkride owns this script and overwrites it; the preflight is where a repo',
+        '# says something before the gate and keeps it across every refresh.',
+        `if [ ! -e '${target}' ]; then`,
+        `  block 'checkride: the gate could not run — checkride.config.json names a gate.preflight (${target}) that is not there. Add the script, or drop the key.'`,
         'fi',
         '',
-        '# No body — an older checkride that reports only through the exit code.',
-        '[ "$status" -eq 0 ] && exit 0',
-        '[ "$status" -eq 2 ] && exit 2',
+        '# A preflight prints for humans; this has to survive a JSON string field. The',
+        '# two characters that would break one are dropped and newlines folded.',
+        'say() {',
+        `  printf %s "$1" | tr -d '"\\\\' | tr '\\n' ' '`,
+        '}',
+        '',
+        '# Honour the shebang when the file is executable, and fall back to `sh` when it',
+        '# is not — a checked-in script routinely arrives without its exec bit.',
+        `if [ -x '${target}' ]; then`,
+        `  said=$('${target}' 2>&1)`,
+        'else',
+        `  said=$(sh '${target}' 2>&1)`,
+        'fi',
+        'code=$?',
+        `[ "$code" -eq 0 ] || [ -n "$said" ] ||`,
+        `  said='checkride: the gate could not run — the preflight ${target} exited non-zero and printed nothing.'`,
         '',
-        "# Neither of checkride's two gate codes: it never ran. Block anyway.",
-        emit,
-        `exit ${exit}`,
+        '# 0 runs the gate; 2 blocks; anything else stands down. checkride is never',
+        '# started on a non-zero branch.',
+        'case "$code" in',
+        '  0) ;;',
+        '  2) block "$(say "$said")" ;;',
+        '  *) stand_down "$(say "$said")" ;;',
+        'esac',
     ];
 }
 /**
- * Enter the repo, or report the same "could not run" verdict as any other way
- * the gate can fail to start.
+ * Enter the repo, or report a verdict rather than a bare status.
  *
  * Spelled as a block rather than `cd … || exit 2` for two reasons: a bare status
  * tells the agent nothing, and under Cursor a non-zero stop hook is a *broken*
  * hook, so the one branch that used to exit 2 there was the one branch that
  * silently let a turn end.
  */
-function enterRepo(harness) {
-    const { emit, exit } = unrunnable(harness);
-    return [`if ! cd ${PROJECT_DIR}; then`, `  ${emit}`, `  exit ${exit}`, 'fi'];
+function enterRepo() {
+    return [`if ! cd ${PROJECT_DIR}; then`, `  block '${noRepo}'`, 'fi'];
 }
 /**
- * How the gate's stdout is taken.
+ * How the gate's stdout is taken: captured, under both harnesses.
  *
- * Cursor's script lets it stream straight through: Cursor reads the hook's own
- * stdout, and there is nothing for the script to decide. Claude Code's captures
- * it, because the script has to *choose an exit code based on whether a body
- * came back* — see {@link gateTail}. Capturing costs nothing that is visible:
- * the pipeline's human-readable progress is on stderr and streams live either
- * way; stdout carries only the one-line JSON verdict, written at the very end.
+ * Letting it stream through is tempting under Cursor, which reads the hook's own
+ * stdout and would need no forwarding — but a *failed launch* writes there too,
+ * and a script that never held that output cannot keep it off a channel with
+ * defined semantics. Capturing is what gives {@link gateTail} the choice, and
+ * `block`/`stand_down` sole ownership of stdout on the paths where checkride
+ * never answered.
+ *
+ * It costs nothing visible: the pipeline's human-readable progress is on stderr
+ * and streams live either way, and stdout carries only the one-line JSON
+ * verdict, written at the very end.
  */
-function invokeGate(pm, harness, args) {
-    const command = checkrideCommand(pm, args);
-    return harness === 'cursor'
-        ? [command, 'status=$?']
-        : [`body=$(${command})`, 'status=$?'];
+function invokeGate(pm, args) {
+    return [`body=$(${checkrideCommand(pm, args)})`, 'status=$?'];
 }
 /**
  * The gate script: `cd` to the repo, hand off to `checkride gate`, and translate
@@ -135,6 +318,12 @@ function invokeGate(pm, harness, args) {
  * makes the gate conditional on the edit marker, so pure-conversation turns
  * don't pay for a full pipeline run. Without the marker hook the guard would
  * disarm the gate entirely, so a `--hook gate` selection writes it unguarded.
+ *
+ * `preflight` is the repo's own script, from `gate.preflight` in
+ * checkride.config.json, baked in here rather than looked up at run time — see
+ * {@link preflight} and `../gate.ts` `gatePreflight`. It runs *before* the edit
+ * marker is consulted, because a repo that cannot run the gate at all wants to
+ * say so on every turn, not only on the ones that edited a file.
  */
 export function gateScript(pm, opts) {
     const args = ['gate', '--harness', opts.harness, ...((opts.dirtyGuard ?? true) ? ['--if-dirty'] : [])];
@@ -143,16 +332,20 @@ export function gateScript(pm, opts) {
         `# checkride-gate.sh — the ${opts.harness} stop-hook gate.`,
         '#',
         '# checkride owns this file: `checkride agent-setup` (and `checkride init`)',
-        '# overwrite it on every run. Customize via a sibling script or the',
-        '# environment, not by editing here — edits are lost on the next refresh.',
+        '# overwrite it on every run. Customize through checkride.config.json (a `gate`',
+        '# key narrows what runs) or the environment (CHECKRIDE_NODE_BIN), not by',
+        '# editing here — edits are lost on the next refresh.',
         '#',
         "# Runs the repo's `check` script as a hard gate, and reports the verdict in",
         `# ${opts.harness}'s hook protocol. See \`checkride gate --help\`.`,
         '',
-        ...enterRepo(opts.harness),
+        ...gatePreamble(opts.harness),
         '',
-        ...invokeGate(pm, opts.harness, args),
-        ...gateTail(opts.harness),
+        ...enterRepo(),
+        '',
+        ...(opts.preflight === undefined ? [] : [...preflight(opts.preflight), '']),
+        ...invokeGate(pm, args),
+        ...gateTail(opts.harness, pm),
         '',
     ].join('\n');
 }
@@ -202,6 +395,19 @@ export function dirtyScript() {
  * is older and accepted.)
  */
 const PATH_KEYS = ['file_path', 'notebook_path', 'path', 'target_file', 'filePath', 'relative_workspace_path'];
+/**
+ * Shell verbs that can destroy *any* path they are handed, so every positional
+ * argument is a write target. `mv` belongs here rather than with the
+ * destination-only verbs because moving an accounting file away removes it just
+ * as effectively as overwriting it.
+ */
+const ALL_ARGS_VERBS = ['rm', 'unlink', 'shred', 'mv', 'truncate', 'tee', 'rmdir'];
+/**
+ * Shell verbs whose sources are *read* and whose last positional argument is the
+ * only thing written. `cp .check/summary.json /tmp/x` has to stay allowed — it
+ * is a backup, not an edit — and treating its source as a target would deny it.
+ */
+const DEST_ONLY_VERBS = ['cp', 'install', 'ln', 'rsync'];
 /** The deny message, shared by both harnesses. */
 const DENY_MESSAGE = "'checkride: ' + rel + ' is checkride-owned accounting. Never edit the baseline or .check ' +\n" +
     "    'artifacts to make a check pass — fix the finding instead (the ratchet prunes the baseline on its own).'";
@@ -229,11 +435,27 @@ function denyTail() {
  * matched — reads are never denied, because triage depends on reading `.check/`
  * artifacts.
  *
+ * Two Cursor events land here. `preToolUse` carries a file-tool call, whose
+ * target is read from {@link PATH_KEYS}. `beforeShellExecution` carries a
+ * command line, which is scanned for a write *to* an accounting path — the gap
+ * a tool-name matcher cannot close, since `echo … > checkride.baseline.json` is
+ * a shell call and not a `Write`.
+ *
+ * The command scan is deliberately timid, because a guard that fires on a wrong
+ * parse is worse than a known hole. It denies only on demonstrated write intent
+ * — a `>`/`>>` redirect target, or a positional argument of a known mutating
+ * verb — and anything it cannot read that way is allowed. `cat`, `grep`, `jq`
+ * and `cp … /tmp/x` over `.check/` all pass, which they must: triage reads those
+ * artifacts. The hook's own `matcher` narrows the input further, so a command
+ * that never names an accounting path is not parsed at all.
+ *
  * **Cursor only.** Claude Code enforces the same paths through
  * `permissions.deny`, which is checked below the hook layer and costs nothing
  * per tool call, so it needs no script. Cursor has no documented equivalent —
  * its config is hooks — so the script survives for the harness that still
  * requires one. If Cursor grows a file-path deny list, this file goes away.
+ * (Claude Code's deny rules have the same shell-redirect hole and no script to
+ * close it with; that half of the gap is still open. See docs/cursor.md.)
  */
 export function protectScript() {
     return [
@@ -242,14 +464,16 @@ export function protectScript() {
         '// checkride owns this file: `checkride agent-setup` (and `checkride init`)',
         '// overwrite it on every run.',
         '//',
-        '// Pre-tool hook for Cursor. Reads the tool call as JSON on stdin and',
-        '// denies the write when it targets the baseline or .check/. Reads are never',
-        '// matched — triage depends on reading .check artifacts.',
+        '// Guard hook for Cursor. Reads the hook payload as JSON on stdin and denies',
+        '// the call when it *writes* to the baseline or .check/. Reads are never',
+        '// denied — triage depends on reading .check artifacts.',
         "'use strict';",
         "const { realpathSync } = require('node:fs');",
         "const { basename, dirname, isAbsolute, relative, resolve, sep } = require('node:path');",
         '',
         `const PATH_KEYS = ${JSON.stringify(PATH_KEYS)};`,
+        `const ALL_ARGS_VERBS = ${JSON.stringify(ALL_ARGS_VERBS)};`,
+        `const DEST_ONLY_VERBS = ${JSON.stringify(DEST_ONLY_VERBS)};`,
         '',
         '// Resolve symlinks in `p`, so a symlinked prefix cannot make an in-repo path',
         '// look external. On macOS the repo root routinely arrives in two spellings —',
@@ -274,6 +498,84 @@ export function protectScript() {
         '  }',
         '}',
         '',
+        '// Split a command line into tokens, keeping quoted spans whole and emitting',
+        '// each unquoted operator as a token of its own — so `echo x>f` and `echo x > f`',
+        '// tokenize alike, and a `>` inside quotes is never mistaken for a redirect.',
+        'function tokenize(command) {',
+        '  const tokens = [];',
+        "  let cur = '';",
+        '  let quote = null;',
+        "  const flush = () => { if (cur !== '') { tokens.push(cur); cur = ''; } };",
+        '  for (let i = 0; i < command.length; i += 1) {',
+        '    const c = command[i];',
+        '    if (quote !== null) {',
+        '      if (c === quote) quote = null;',
+        '      else cur += c;',
+        '    } else if (/["\']/.test(c)) {',
+        '      quote = c;',
+        "    } else if (c === '\\\\') {",
+        "      i += 1; cur += command[i] || '';",
+        '    } else if (/\\s/.test(c)) {',
+        '      flush();',
+        '    } else if (/[<>|&;]/.test(c)) {',
+        '      flush();',
+        '      let op = c;',
+        '      while (command[i + 1] === c) { op += c; i += 1; }',
+        '      tokens.push(op);',
+        '    } else {',
+        '      cur += c;',
+        '    }',
+        '  }',
+        '  flush();',
+        '  return tokens;',
+        '}',
+        '',
+        'const isOperator = (t) => /^[<>|&;]+$/.test(t);',
+        '',
+        '// Break a token stream at the operators that start a new command, so the verb',
+        '// of `cat x | tee .check/f` is read as `tee` and not as `cat`.',
+        'function segments(tokens) {',
+        '  const out = [[]];',
+        '  for (const t of tokens) {',
+        '    if (/^[|&;]+$/.test(t)) out.push([]);',
+        '    else out[out.length - 1].push(t);',
+        '  }',
+        '  return out;',
+        '}',
+        '',
+        '// Every path a command line demonstrably writes to. Anything this cannot read',
+        '// as a write yields nothing, and the caller then allows the command.',
+        'function commandTargets(command) {',
+        '  const targets = [];',
+        '  for (const segment of segments(tokenize(command))) {',
+        '    for (let i = 0; i < segment.length; i += 1) {',
+        "      if (segment[i] !== '>' && segment[i] !== '>>') continue;",
+        '      const next = segment[i + 1];',
+        '      if (next !== undefined && !isOperator(next)) targets.push(next);',
+        '    }',
+        '    const words = segment.filter((t) => !isOperator(t));',
+        '    // Step over any leading `VAR=value` assignments to reach the verb itself.',
+        '    let i = 0;',
+        '    while (i < words.length && /^[A-Za-z_][A-Za-z0-9_]*=/.test(words[i])) i += 1;',
+        "    const verb = (words[i] || '').split('/').pop();",
+        '    const rest = words.slice(i + 1);',
+        "    const args = rest.filter((a) => !a.startsWith('-'));",
+        '    if (ALL_ARGS_VERBS.indexOf(verb) >= 0) targets.push(...args);',
+        '    else if (DEST_ONLY_VERBS.indexOf(verb) >= 0 && args.length > 0) targets.push(args[args.length - 1]);',
+        "    else if ((verb === 'sed' || verb === 'perl') && rest.some((a) => /^-[a-zA-Z]*i/.test(a))) targets.push(...args);",
+        "    else if (verb === 'dd') targets.push(...rest.filter((a) => a.startsWith('of=')).map((a) => a.slice(3)));",
+        '  }',
+        '  return targets;',
+        '}',
+        '',
+        "// `target`'s repo-relative path when it is checkride accounting, else undefined.",
+        'function accounting(target, root, base) {',
+        '  const abs = canon(isAbsolute(target) ? target : resolve(base, target));',
+        "  const rel = relative(root, abs).split(sep).join('/');",
+        "  if (rel === 'checkride.baseline.json' || rel === '.check' || rel.startsWith('.check/')) return rel;",
+        '  return undefined;',
+        '}',
+        '',
         "let raw = '';",
         "process.stdin.on('data', (chunk) => { raw += chunk; });",
         "process.stdin.on('end', () => {",
@@ -283,14 +585,17 @@ export function protectScript() {
         '  } catch {',
         '    process.exit(0); // fail open: a broken hook must not brick every edit',
         '  }',
-        '  const tool = (input && input.tool_input) || {};',
-        "  const target = PATH_KEYS.map((k) => tool[k]).find((v) => typeof v === 'string' && v.length > 0);",
-        '  if (target === undefined) process.exit(0);',
+        "  if (input === null || typeof input !== 'object') process.exit(0);",
         '  const root = canon(process.env.CURSOR_PROJECT_DIR || process.env.CLAUDE_PROJECT_DIR || process.cwd());',
-        '  const abs = canon(isAbsolute(target) ? target : resolve(root, target));',
-        "  const rel = relative(root, abs).split(sep).join('/');",
-        "  const denied = rel === 'checkride.baseline.json' || rel === '.check' || rel.startsWith('.check/');",
-        '  if (!denied) process.exit(0);',
+        "  // A shell command resolves against the shell's own cwd, which Cursor sends;",
+        '  // a file-tool path has always been resolved against the repo root.',
+        "  const base = typeof input.cwd === 'string' && input.cwd.length > 0 ? canon(input.cwd) : root;",
+        '  const tool = input.tool_input || {};',
+        "  const targets = input.hook_event_name === 'beforeShellExecution'",
+        "    ? commandTargets(typeof input.command === 'string' ? input.command : '')",
+        "    : PATH_KEYS.map((k) => tool[k]).filter((v) => typeof v === 'string' && v.length > 0);",
+        '  const rel = targets.map((t) => accounting(t, root, base)).find((r) => r !== undefined);',
+        '  if (rel === undefined) process.exit(0);',
         ...denyTail(),
         '});',
         '',

package/node_modules/checkride/dist/agent-setup/scripts.js.map

@@ -1 +1 @@
-{"version":3,"file":"scripts.js","sourceRoot":"","sources":["../../src/agent-setup/scripts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,YAAY,EAAoB,MAAM,YAAY,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAuB,MAAM,gBAAgB,CAAC;AAElE;;;;;GAKG;AACH,MAAM,WAAW,GAAG,mDAAmD,CAAC;AAExE;;;GAGG;AACH,SAAS,gBAAgB,CAAC,EAAkB,EAAE,IAAuB;IACnE,OAAO,WAAW,CAAC,EAAE,EAAE,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,GACd,uFAAuF;IACvF,yEAAyE,CAAC;AAE5E;;;;;;;;GAQG;AACH,SAAS,UAAU,CAAC,OAAoB;IACtC,OAAO,OAAO,KAAK,QAAQ;QACzB,CAAC,CAAC,EAAE,IAAI,EAAE,mBAAmB,IAAI,CAAC,SAAS,CAAC,EAAE,gBAAgB,EAAE,UAAU,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE;QAC3F,CAAC,CAAC,EAAE,IAAI,EAAE,mBAAmB,UAAU,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AAC9D,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,QAAQ,CAAC,OAAoB;IACpC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzB,OAAO;YACL,8EAA8E;YAC9E,gEAAgE;YAChE,+BAA+B;YAC/B,IAAI;YACJ,QAAQ,IAAI,EAAE;SACf,CAAC;IACJ,CAAC;IACD,OAAO;QACL,8EAA8E;QAC9E,6EAA6E;QAC7E,8EAA8E;QAC9E,yBAAyB;QACzB,4BAA4B;QAC5B,qBAAqB;QACrB,oBAAoB;QACpB,QAAQ;QACR,IAAI;QACJ,EAAE;QACF,yEAAyE;QACzE,+BAA+B;QAC/B,+BAA+B;QAC/B,EAAE;QACF,sEAAsE;QACtE,IAAI;QACJ,QAAQ,IAAI,EAAE;KACf,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,SAAS,CAAC,OAAoB;IACrC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IAC3C,OAAO,CAAC,WAAW,WAAW,QAAQ,EAAE,KAAK,IAAI,EAAE,EAAE,UAAU,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;AAC/E,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,UAAU,CAAC,EAAkB,EAAE,OAAoB,EAAE,IAAuB;IACnF,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IAC3C,OAAO,OAAO,KAAK,QAAQ;QACzB,CAAC,CAAC,CAAC,OAAO,EAAE,WAAW,CAAC;QACxB,CAAC,CAAC,CAAC,UAAU,OAAO,GAAG,EAAE,WAAW,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,UAAU,CACxB,EAAkB,EAClB,IAAoD;IAEpD,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACvG,OAAO;QACL,WAAW;QACX,6BAA6B,IAAI,CAAC,OAAO,kBAAkB;QAC3D,GAAG;QACH,4EAA4E;QAC5E,oEAAoE;QACpE,0EAA0E;QAC1E,GAAG;QACH,6EAA6E;QAC7E,KAAK,IAAI,CAAC,OAAO,kDAAkD;QACnE,EAAE;QACF,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC;QAC1B,EAAE;QACF,GAAG,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC;QACrC,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC;QACzB,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW;IACzB,OAAO;QACL,WAAW;QACX,6DAA6D;QAC7D,GAAG;QACH,4EAA4E;QAC5E,8BAA8B;QAC9B,GAAG;QACH,yEAAyE;QACzE,EAAE;QACF,MAAM,WAAW,YAAY;QAC7B,uBAAuB,YAAY,eAAe,YAAY,EAAE;QAChE,QAAQ;QACR,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,SAAS,GAAG,CAAC,WAAW,EAAE,eAAe,EAAE,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,yBAAyB,CAAC,CAAC;AAE/G,kDAAkD;AAClD,MAAM,YAAY,GAChB,gGAAgG;IAChG,8GAA8G,CAAC;AAEjH;;;;GAIG;AACH,SAAS,QAAQ;IACf,OAAO;QACL,oBAAoB,GAAG,YAAY,GAAG,GAAG;QACzC,yCAAyC;QACzC,yBAAyB;QACzB,4BAA4B;QAC5B,6BAA6B;QAC7B,QAAQ;QACR,oBAAoB;KACrB,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,aAAa;IAC3B,OAAO;QACL,qBAAqB;QACrB,8EAA8E;QAC9E,6EAA6E;QAC7E,+BAA+B;QAC/B,IAAI;QACJ,uEAAuE;QACvE,8EAA8E;QAC9E,0DAA0D;QAC1D,eAAe;QACf,8CAA8C;QAC9C,yFAAyF;QACzF,EAAE;QACF,qBAAqB,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG;QACjD,EAAE;QACF,+EAA+E;QAC/E,+EAA+E;QAC/E,8EAA8E;QAC9E,yEAAyE;QACzE,IAAI;QACJ,6EAA6E;QAC7E,gFAAgF;QAChF,iFAAiF;QACjF,qBAAqB;QACrB,yBAAyB;QACzB,oBAAoB;QACpB,cAAc;QACd,WAAW;QACX,mDAAmD;QACnD,eAAe;QACf,gCAAgC;QAChC,0CAA0C;QAC1C,oCAAoC;QACpC,iBAAiB;QACjB,OAAO;QACP,KAAK;QACL,GAAG;QACH,EAAE;QACF,eAAe;QACf,yDAAyD;QACzD,iCAAiC;QACjC,cAAc;QACd,SAAS;QACT,8BAA8B;QAC9B,aAAa;QACb,4EAA4E;QAC5E,KAAK;QACL,mDAAmD;QACnD,oGAAoG;QACpG,8CAA8C;QAC9C,0GAA0G;QAC1G,2EAA2E;QAC3E,yDAAyD;QACzD,sGAAsG;QACtG,iCAAiC;QACjC,GAAG,QAAQ,EAAE;QACb,KAAK;QACL,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}
+{"version":3,"file":"scripts.js","sourceRoot":"","sources":["../../src/agent-setup/scripts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,YAAY,EAAE,cAAc,EAAoB,MAAM,YAAY,CAAC;AAC5E,OAAO,EAAE,WAAW,EAAuB,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAE7E;;;;;GAKG;AACH,MAAM,WAAW,GAAG,mDAAmD,CAAC;AAExE;;;GAGG;AACH,SAAS,gBAAgB,CAAC,EAAkB,EAAE,IAAuB;IACnE,OAAO,WAAW,CAAC,EAAE,EAAE,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,GACf,wGAAwG,CAAC;AAE3G,uEAAuE;AACvE,MAAM,UAAU,GAAG,CAAC,EAAkB,EAAU,EAAE,CAChD,SAAS,EAAE,sEAAsE,SAAS,CAAC,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC;AAE/G;;;;;;;;;;;;GAYG;AACH,MAAM,YAAY,GAAG,CAAC,EAAkB,EAAU,EAAE,CAClD;IACE,8EAA8E;IAC9E,WAAW;IACX,UAAU,CAAC,EAAE,CAAC;IACd,8FAA8F;QAC5F,0CAA0C;CAC7C,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAEd;;;;;;GAMG;AACH,MAAM,YAAY,GAAG,CAAC,EAAkB,EAAE,OAAoB,EAAU,EAAE,CACxE;IACE,sGAAsG;IACtG,WAAW;IACX,SAAS,WAAW,CAAC,EAAE,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,+CAA+C;CACrH,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAEd,qEAAqE;AACrE,MAAM,MAAM,GACV,gGAAgG;IAChG,kDAAkD,CAAC;AAErD;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAS,YAAY,CAAC,OAAoB;IACxC,MAAM,MAAM,GAAG,OAAO,KAAK,QAAQ,CAAC;IACpC,OAAO;QACL,8EAA8E;QAC9E,+EAA+E;QAC/E,gFAAgF;QAChF,YAAY;QACZ,4BAA4B;QAC5B,EAAE;QACF,yEAAyE;QACzE,WAAW;QACX,0BAA0B;QAC1B,2GAA2G;QAC3G,GAAG;QACH,EAAE;QACF,8EAA8E;QAC9E,oDAAoD;QACpD,gBAAgB;QAChB,GAAG,CAAC,MAAM;YACR,CAAC,CAAC;gBACE,6EAA6E;gBAC7E,6EAA6E;gBAC7E,6EAA6E;gBAC7E,0EAA0E;gBAC1E,2EAA2E;gBAC3E,yDAAyD;gBACzD,6BAA6B;aAC9B;YACH,CAAC,CAAC;gBACE,qEAAqE;gBACrE,8EAA8E;gBAC9E,6CAA6C;gBAC7C,6BAA6B;aAC9B,CAAC;QACN,UAAU;QACV,GAAG;QACH,EAAE;QACF,4EAA4E;QAC5E,yDAAyD;QACzD,WAAW;QACX,kGAAkG;QAClG,GAAG,CAAC,MAAM;YACR,CAAC,CAAC;gBACE,+EAA+E;gBAC/E,6DAA6D;gBAC7D,gDAAgD;gBAChD,UAAU;aACX;YACH,CAAC,CAAC,CAAC,6BAA6B,EAAE,UAAU,CAAC,CAAC;QAChD,GAAG;QACH,GAAG,CAAC,MAAM;YACR,CAAC,CAAC;gBACE,EAAE;gBACF,6EAA6E;gBAC7E,6EAA6E;gBAC7E,4EAA4E;gBAC5E,2EAA2E;gBAC3E,kBAAkB,cAAc,YAAY,cAAc,QAAQ;gBAClE,UAAU,cAAc,EAAE;aAC3B;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,QAAQ,CAAC,OAAoB,EAAE,EAAkB;IACxD,MAAM,QAAQ,GACZ,OAAO,KAAK,QAAQ;QAClB,CAAC,CAAC;YACE,2EAA2E;YAC3E,wEAAwE;YACxE,0EAA0E;YAC1E,mBAAmB;YACnB,QAAQ;YACR,gDAAgD;YAChD,YAAY;YACZ,QAAQ;YACR,MAAM;SACP;QACH,CAAC,CAAC;YACE,8EAA8E;YAC9E,6EAA6E;YAC7E,8EAA8E;YAC9E,mBAAmB;YACnB,QAAQ;YACR,6BAA6B;YAC7B,gCAAgC;YAChC,cAAc;YACd,QAAQ;YACR,6EAA6E;YAC7E,oBAAoB;YACpB,QAAQ;YACR,MAAM;SACP,CAAC;IACR,OAAO;QACL,GAAG,QAAQ;QACX,EAAE;QACF,+EAA+E;QAC/E,8EAA8E;QAC9E,kFAAkF;QAClF,YAAY,YAAY,CAAC,EAAE,EAAE,OAAO,CAAC,GAAG;QACxC,IAAI;QACJ,eAAe,YAAY,CAAC,EAAE,CAAC,GAAG;KACnC,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,iBAAiB,GAAG,WAAW,CAAC;AAEtC;;;;;;;;;;;;;GAaG;AACH,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,0CAA0C,IAAI,sDAAsD;YAClG,iCAAiC,CACpC,CAAC;IACJ,CAAC;IACD,0EAA0E;IAC1E,oCAAoC;IACpC,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;IACvD,OAAO;QACL,6EAA6E;QAC7E,+EAA+E;QAC/E,qEAAqE;QACrE,cAAc,MAAM,WAAW;QAC/B,8FAA8F,MAAM,wDAAwD;QAC5J,IAAI;QACJ,EAAE;QACF,+EAA+E;QAC/E,wEAAwE;QACxE,SAAS;QACT,iDAAiD;QACjD,GAAG;QACH,EAAE;QACF,iFAAiF;QACjF,wEAAwE;QACxE,YAAY,MAAM,WAAW;QAC7B,aAAa,MAAM,SAAS;QAC5B,MAAM;QACN,gBAAgB,MAAM,SAAS;QAC/B,IAAI;QACJ,SAAS;QACT,wCAAwC;QACxC,6DAA6D,MAAM,wCAAwC;QAC3G,EAAE;QACF,4EAA4E;QAC5E,iCAAiC;QACjC,iBAAiB;QACjB,SAAS;QACT,gCAAgC;QAChC,qCAAqC;QACrC,MAAM;KACP,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,SAAS;IAChB,OAAO,CAAC,WAAW,WAAW,QAAQ,EAAE,YAAY,MAAM,GAAG,EAAE,IAAI,CAAC,CAAC;AACvE,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,UAAU,CAAC,EAAkB,EAAE,IAAuB;IAC7D,OAAO,CAAC,UAAU,gBAAgB,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,UAAU,CACxB,EAAkB,EAClB,IAAwE;IAExE,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACvG,OAAO;QACL,WAAW;QACX,6BAA6B,IAAI,CAAC,OAAO,kBAAkB;QAC3D,GAAG;QACH,4EAA4E;QAC5E,gFAAgF;QAChF,0EAA0E;QAC1E,sDAAsD;QACtD,GAAG;QACH,6EAA6E;QAC7E,KAAK,IAAI,CAAC,OAAO,kDAAkD;QACnE,EAAE;QACF,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC;QAC7B,EAAE;QACF,GAAG,SAAS,EAAE;QACd,EAAE;QACF,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3E,GAAG,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC;QACvB,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;QAC7B,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW;IACzB,OAAO;QACL,WAAW;QACX,6DAA6D;QAC7D,GAAG;QACH,4EAA4E;QAC5E,8BAA8B;QAC9B,GAAG;QACH,yEAAyE;QACzE,EAAE;QACF,MAAM,WAAW,YAAY;QAC7B,uBAAuB,YAAY,eAAe,YAAY,EAAE;QAChE,QAAQ;QACR,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,SAAS,GAAG,CAAC,WAAW,EAAE,eAAe,EAAE,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,yBAAyB,CAAC,CAAC;AAE/G;;;;;GAKG;AACH,MAAM,cAAc,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;AAEnF;;;;GAIG;AACH,MAAM,eAAe,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;AAEzD,kDAAkD;AAClD,MAAM,YAAY,GAChB,gGAAgG;IAChG,8GAA8G,CAAC;AAEjH;;;;GAIG;AACH,SAAS,QAAQ;IACf,OAAO;QACL,oBAAoB,GAAG,YAAY,GAAG,GAAG;QACzC,yCAAyC;QACzC,yBAAyB;QACzB,4BAA4B;QAC5B,6BAA6B;QAC7B,QAAQ;QACR,oBAAoB;KACrB,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,UAAU,aAAa;IAC3B,OAAO;QACL,qBAAqB;QACrB,8EAA8E;QAC9E,6EAA6E;QAC7E,+BAA+B;QAC/B,IAAI;QACJ,8EAA8E;QAC9E,0EAA0E;QAC1E,yDAAyD;QACzD,eAAe;QACf,8CAA8C;QAC9C,yFAAyF;QACzF,EAAE;QACF,qBAAqB,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG;QACjD,0BAA0B,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,GAAG;QAC3D,2BAA2B,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,GAAG;QAC7D,EAAE;QACF,+EAA+E;QAC/E,+EAA+E;QAC/E,8EAA8E;QAC9E,yEAAyE;QACzE,IAAI;QACJ,6EAA6E;QAC7E,gFAAgF;QAChF,iFAAiF;QACjF,qBAAqB;QACrB,yBAAyB;QACzB,oBAAoB;QACpB,cAAc;QACd,WAAW;QACX,mDAAmD;QACnD,eAAe;QACf,gCAAgC;QAChC,0CAA0C;QAC1C,oCAAoC;QACpC,iBAAiB;QACjB,OAAO;QACP,KAAK;QACL,GAAG;QACH,EAAE;QACF,8EAA8E;QAC9E,kFAAkF;QAClF,8EAA8E;QAC9E,8BAA8B;QAC9B,sBAAsB;QACtB,iBAAiB;QACjB,qBAAqB;QACrB,4EAA4E;QAC5E,iDAAiD;QACjD,2BAA2B;QAC3B,2BAA2B;QAC3B,sCAAsC;QACtC,sBAAsB;QACtB,mCAAmC;QACnC,kBAAkB;QAClB,gCAAgC;QAChC,wCAAwC;QACxC,iCAAiC;QACjC,gBAAgB;QAChB,qCAAqC;QACrC,gBAAgB;QAChB,mBAAmB;QACnB,yDAAyD;QACzD,wBAAwB;QACxB,cAAc;QACd,iBAAiB;QACjB,OAAO;QACP,KAAK;QACL,YAAY;QACZ,kBAAkB;QAClB,GAAG;QACH,EAAE;QACF,iDAAiD;QACjD,EAAE;QACF,gFAAgF;QAChF,iEAAiE;QACjE,6BAA6B;QAC7B,qBAAqB;QACrB,6BAA6B;QAC7B,2CAA2C;QAC3C,uCAAuC;QACvC,KAAK;QACL,eAAe;QACf,GAAG;QACH,EAAE;QACF,gFAAgF;QAChF,uEAAuE;QACvE,oCAAoC;QACpC,uBAAuB;QACvB,wDAAwD;QACxD,mDAAmD;QACnD,gEAAgE;QAChE,oCAAoC;QACpC,wEAAwE;QACxE,OAAO;QACP,0DAA0D;QAC1D,gFAAgF;QAChF,gBAAgB;QAChB,mFAAmF;QACnF,qDAAqD;QACrD,sCAAsC;QACtC,0DAA0D;QAC1D,mEAAmE;QACnE,0GAA0G;QAC1G,sHAAsH;QACtH,8GAA8G;QAC9G,KAAK;QACL,mBAAmB;QACnB,GAAG;QACH,EAAE;QACF,mFAAmF;QACnF,2CAA2C;QAC3C,2EAA2E;QAC3E,yDAAyD;QACzD,uGAAuG;QACvG,qBAAqB;QACrB,GAAG;QACH,EAAE;QACF,eAAe;QACf,yDAAyD;QACzD,iCAAiC;QACjC,cAAc;QACd,SAAS;QACT,8BAA8B;QAC9B,aAAa;QACb,4EAA4E;QAC5E,KAAK;QACL,qEAAqE;QACrE,0GAA0G;QAC1G,gFAAgF;QAChF,uEAAuE;QACvE,iGAAiG;QACjG,wCAAwC;QACxC,oEAAoE;QACpE,8EAA8E;QAC9E,2FAA2F;QAC3F,2FAA2F;QAC3F,2CAA2C;QAC3C,GAAG,QAAQ,EAAE;QACb,KAAK;QACL,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}

package/node_modules/checkride/dist/baseline/fallow.js

@@ -191,9 +191,9 @@ function collectDeadKeys(j) {
  * Extract dead-code findings and the authoritative issue count (`total_issues`).
  * Findings come from the top-level detail arrays (`unused_exports`,
  * `unused_dev_dependencies`, `circular_dependencies`, …) rather than the summary
- * keys: the summary aggregates a few categories under one name (e.g. dev and
+ * keys: the summary aggregates a few categories under one name (for example dev and
  * optional deps both count as `unused_dependencies`) whose items live in
- * separately-named arrays, so keying off the summary would miss them. Iterating
+ * separately named arrays, so keying off the summary would miss them. Iterating
  * every array except the {@link UNCOUNTED_ARRAYS} covers whatever categories
  * fallow reports — including ones added in a future minor — without a
  * hand-maintained list of the ones that do count. A category whose items carry