scip-query 0.19.6 → 0.19.8

package/docs/CLI_JSON_OUTPUT.md

@@ -13,7 +13,7 @@ The current envelope is schema version 1:
 {
   "kind": "scip-query-result",
   "schemaVersion": 1,
-  "producer": { "name": "scip-query", "version": "0.19.6" },
+  "producer": { "name": "scip-query", "version": "0.19.8" },
   "command": "refs",
   "resultSchemaVersion": 1,
   "evidence": "graph-fact",
@@ -37,6 +37,91 @@ The public `scip-query/runtime` export provides
 consumers that want the repository's compatibility policy rather than a
 hand-written field check.
 
+## Complete output for agents
+
+An output page is one consecutive, bounded part of the characters a command
+rendered. Its real-world units are the `scip-query-output-page` objects and
+human page blocks returned after a result exceeds an agent transport's safe
+size. It differs from a query limit because it divides already-produced
+output without discarding any character: following each emitted continuation
+command reconstructs the complete rendered stream.
+
+Every command accepts these global options:
+
+```text
+--output-page-size <characters>
+--output-cursor <cursor>
+```
+
+Human output larger than 12,000 characters is paged automatically. The page
+prints its exact continuation command both before and after its content.
+Agents must run that command unchanged and continue until the page reports
+completion. Do not pipe scip-query through `head`, `tail`, or a line-range
+`sed`; those programs discard output without creating a resumable position.
+
+Default `--json` output remains the ordinary `scip-query-result` envelope
+byte-for-byte so existing scripts are not broken. When that envelope exceeds
+12,000 characters, scip-query writes an early stderr warning containing the
+exact command that opts into output pages. The paged command returns:
+
+```json
+{
+  "kind": "scip-query-output-page",
+  "schemaVersion": 1,
+  "producer": { "name": "scip-query", "version": "0.19.8" },
+  "command": "architecture",
+  "contentType": "application/json",
+  "agentInstruction": "INCOMPLETE EVIDENCE: do not draw conclusions or report completion from this partial page. Run page.continuation.command exactly, then repeat until page.complete is true.",
+  "page": {
+    "offset": 0,
+    "returnedCharacters": 12000,
+    "totalCharacters": 48152,
+    "omittedCharacters": 36152,
+    "remainingCharacters": 36152,
+    "complete": false,
+    "outputHash": "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
+    "continuation": {
+      "cursor": "<opaque cursor>",
+      "command": "scip-query architecture --json --output-page-size 12000 --output-cursor <opaque cursor>"
+    }
+  },
+  "content": "{\n  \"kind\": \"scip-query-result\",\n  ..."
+}
+```
+
+The cursor is bound to the command, working directory, complete
+non-pagination argument list, next character offset, private output snapshot,
+and SHA-256 of the complete rendered output. SHA-256 is a fixed-size content
+fingerprint: the same bytes produce the same identity with overwhelming
+reliability. A continuation reads the immutable snapshot rather than re-running
+the command, so timestamps, durations, edits, or reindexes cannot mix
+different result generations between pages. Missing, expired, or changed
+snapshot data is rejected with the exact command that restarts at page one.
+Every incomplete machine-readable page also carries a direct
+`agentInstruction`. A partial page is not sufficient evidence for a conclusion
+or completion claim; consumers must follow `page.continuation.command` until
+`page.complete` is `true`.
+
+Output pages and result coverage answer different questions:
+
+- output pagination says whether every rendered character is retrievable;
+- the result envelope's `coverage` says whether the command examined every
+  logical result unit.
+
+A completely retrieved page can therefore still contain a bounded or sampled
+analysis. Use the result envelope's stated `--full` remediation when present,
+then follow output continuation commands until complete.
+
+The machine-readable page schema is
+[`schemas/cli-output-page.schema.json`](schemas/cli-output-page.schema.json).
+Page sizes range from 256 through 100,000 characters and cursors are limited
+to 4,096 characters. The first paged invocation streams the complete output
+to a mode-`0600` snapshot beneath a current-user mode-`0700` temporary
+directory while retaining only the requested page in memory. Snapshots expire
+after one hour and are removed after the final page. Pagination imposes no
+arbitrary total-output ceiling and does not silently discard later pages;
+command-level result budgets still apply and report their own completeness.
+
 ## Compatibility policy
 
 The decoder accepts:

package/docs/COMMAND_REFERENCE.md

@@ -6,11 +6,13 @@ This syntax summary is generated from the CLI command descriptors. Keep workflow
 
 Commands with `--json` emit the versioned public envelope documented in [CLI JSON output contract](CLI_JSON_OUTPUT.md).
 
+Every command accepts `--output-page-size <characters>` and `--output-cursor <cursor>`. Oversized human output prints an exact continuation command; oversized JSON prints the exact command that opts into versioned output pages.
+
 ### Indexing
 
 | Command | Description | Options |
 |---|---|---|
-| `reindex` | Index the codebase and convert to SQLite | `-l, --language <lang>`<br>`--pnpm-workspaces`<br>`--force`<br>`--allow-partial`<br>`--indexer-concurrency <n>`<br>`--json` |
+| `reindex` | Index the codebase and convert to SQLite | `-l, --language <lang>`<br>`--pnpm-workspaces`<br>`--force`<br>`--allow-partial`<br>`--trust-project-tools`<br>`--install-missing`<br>`--indexer-concurrency <n>`<br>`--json` |
 | `augment-sources` | Add source files skipped by upstream SCIP indexers to the SQLite documents table | - |
 | `augment-vue` | Add compiler-resolved Vue SFC references to the SQLite index using Volar | `--project <tsconfig>` |
 
@@ -102,7 +104,7 @@ Commands with `--json` emit the versioned public envelope documented in [CLI JSO
 | `affected <symbol>` | Transitive closure of symbols that could break if this symbol changes | `--max-depth <n>`<br>`-s, --scope <path>`<br>`--json` |
 | `change-surface <file>` | Pre-change briefing: exports, consumers, and blast-radius risk | `--full`<br>`--json` |
 | `co-change [file]` | Files that change together in git history without a dependency edge — hidden coupling candidates | `--min-together <n>`<br>`-n, --limit <n>`<br>`--all`<br>`--full`<br>`--json` |
-| `diff-gate` | Gate the current diff: architecture regressions plus echo, migration, coordination, doc-drift, unused-param, and new-dead candidates; exit 1 on blocking findings | `--base <ref>`<br>`--min-together <n>`<br>`--max-echo-checks <n>`<br>`--max-helpers <n>`<br>`--baseline`<br>`--full`<br>`--skip <check>`<br>`--hook`<br>`--json`<br>`--compact` |
+| `diff-gate` | Runtime-bounded, single-flight gate for the current diff: architecture regressions plus echo, migration, coordination, doc-drift, unused-param, and new-dead candidates; exit 1 on blocking findings | `--base <ref>`<br>`--min-together <n>`<br>`--max-echo-checks <n>`<br>`--max-helpers <n>`<br>`--baseline`<br>`--full`<br>`--skip <check>`<br>`--hook`<br>`--json`<br>`--compact` |
 | `incomplete-migration` | Partially-completed extraction candidates: new helpers in the diff wired into some sites while similar un-migrated sites remain | `--base <ref>`<br>`--min-containment <n>`<br>`--max-helpers <n>`<br>`-n, --limit <n>`<br>`--full`<br>`--json` |
 | `diff-impact` | Compute changed symbols and downstream consumers from current git diff | `--base <ref>`<br>`--json` |
 
@@ -142,7 +144,7 @@ Commands with `--json` emit the versioned public envelope documented in [CLI JSO
 | `suppress <id>` | Record an accepted finding as a file under .scipquery/suppressions/ with a required reason | `--reason <text>`<br>`--check <check>`<br>`--file <path>`<br>`--expires-at <iso>`<br>`--replace <revision>`<br>`--json` |
 | `effectiveness` | Per-check effectiveness from the committed outcome ledger: caught, comparison-verified fixes, suppressed, unverified disappearances, and precision | `--since <window>`<br>`--check <check>`<br>`--json` |
 | `doctor` | Diagnose config, index freshness, dependency readiness, and project capabilities | `--json` |
-| `setup` | Bootstrap this project: enable automatic indexing, install agent skills, refresh the index, verify capabilities, and report health | `--guided`<br>`--yes`<br>`--git-hook`<br>`--no-hooks`<br>`--no-skills`<br>`--no-parsers`<br>`--no-health`<br>`--dossier-dir <path>`<br>`--json` |
+| `setup` | Bootstrap this project: enable automatic indexing, install agent skills, refresh the index, verify capabilities, and report health | `--guided`<br>`--yes`<br>`--git-hook`<br>`--no-hooks`<br>`--no-skills`<br>`--no-parsers`<br>`--install-missing`<br>`--no-health`<br>`--dossier-dir <path>`<br>`--json` |
 | `setup-agent` | Seed agent guidance for this project: AGENTS.md/CLAUDE.md block pointing agents at the scip-query skills and diff gate, plus an optional git pre-commit backstop | `--git-hook` |
 | `setup-ci` | Write a GitHub Actions workflow that runs scip-query reindex and diff-gate on pull requests | `--force`<br>`--dry-run` |
 | `uninstall` | Remove scip-query-owned skill links, project hooks, and managed agent setup blocks | `--global`<br>`--project`<br>`--dry-run`<br>`--json` |

package/docs/SECURITY_MODEL.md

@@ -0,0 +1,129 @@
+# Security model
+
+`scip-query` treats a checked-out repository and every index or cache artifact
+derived from it as untrusted input. An untrusted checkout is a directory of
+files supplied by a project rather than by the operator, distinguished from
+ordinary input by being able to name source paths, tools, configuration, and
+persisted records that the CLI may otherwise be tempted to trust.
+
+The default analysis boundary may read repository files and managed,
+rebuildable cache artifacts. It may not execute a repository-selected program,
+adopt an arbitrary cache directory, escape the canonical project root through
+an indexed path, or install a mutable tool identity merely because the
+checkout requests it.
+
+## Explicit authority
+
+An authority grant is an operator action that permits one otherwise-forbidden
+effect, distinguished from project configuration by coming from the current
+CLI invocation:
+
+- `--trust-project-tools` permits reviewed repository-local indexer
+  executables for that invocation.
+- `--tla-tools <jar>` selects a reviewed TLA jar explicitly. The default
+  downloaded TLA artifact remains version- and SHA-256-pinned.
+- `--install-missing` permits installation of the exact immutable tool
+  identities listed by the command. Without it, missing tools produce setup
+  instructions instead of a mutation.
+- environment overrides such as `SCIP_QUERY_CACHE_DIR` are operator-owned
+  storage choices. Tracked `.scipquery.json` cannot grant destructive authority
+  over an arbitrary external cache.
+
+A managed cache is rebuildable local state rooted under a scip-query-owned
+directory, distinguished from a caller-selected directory by an ownership
+record and canonical containment checks. Destructive cache operations require
+both properties.
+
+## Input budgets
+
+An input budget is a maximum amount of untrusted data one operation will
+materialize or ask a parser to compile, distinguished from silent truncation by
+failing explicitly with the input kind, observed amount, and accepted limit.
+
+| Input class                                            |                    Limit | Representative users                                                     |
+| ------------------------------------------------------ | -----------------------: | ------------------------------------------------------------------------ |
+| Config, manifest, lock, lease, and other small records |                    8 MiB | `.scipquery.json`, package manifests, generation metadata, hook settings |
+| One source or per-document fragment                    |                   64 MiB | indexed source reads, TypeScript/Vue snapshots, mailbox result payloads  |
+| One SCIP index artifact                                |                  512 MiB | merge, sanitize, Rust occurrence fallback, shared-generation hydration   |
+| Profile or retained JSONL artifact                     |                  256 MiB | profiling audits, legacy event ledgers, rotating diagnostic segments     |
+| Generated TLA trace                                    | 16 MiB and 100,000 steps | `tla instrument` recorder                                                |
+| Repository-supplied regular-expression pattern         |         4,096 characters | entry-root patterns and TLA statement bindings                           |
+| Agent hook standard input                              |                    8 MiB | stop-hook request payload                                                |
+
+Regular files are opened first, checked through that descriptor, read, and
+checked again so replacement or growth cannot bypass the pre-read limit.
+Streams and pseudo-files are counted while reading. Large file fingerprints
+are computed in fixed-size chunks rather than by retaining the complete file.
+
+An oversized artifact is not partially interpreted. Operations that require
+the complete artifact fail and name the limit; query-level detectors that
+intentionally sample or cap logical rows retain their existing machine-readable
+coverage metadata and `--full` remediation.
+
+## Complete command output
+
+Output pagination is a resumable transport for one rendered command result,
+distinguished from a result limit by preserving every rendered character.
+Human output above 12,000 characters automatically includes the exact command
+for the next page. Large default JSON remains byte-compatible and writes the
+exact opt-in paging command to stderr before and after the JSON stream.
+
+Every command accepts:
+
+```text
+--output-page-size <characters>
+--output-cursor <cursor>
+```
+
+The opaque cursor binds the command, working directory, non-pagination
+arguments, next character offset, private output snapshot, and complete output
+hash. The first invocation streams the output to current-user temporary
+storage with private permissions while retaining only one page in memory.
+Continuations read that immutable snapshot instead of re-running a command
+whose timestamps or durations may change. Snapshots expire after one hour and
+are removed after the final page; an unavailable snapshot produces the exact
+page-one restart command.
+
+Continue until `page.complete` is `true`. Do not pipe output through `head`,
+`tail`, or a line-range `sed`; those programs discard data without creating a
+resumable position. Every incomplete JSON page repeats this obligation in
+`agentInstruction`; an incomplete page must not support a conclusion or
+completion claim. See [CLI JSON output](CLI_JSON_OUTPUT.md) and the
+[output-page schema](schemas/cli-output-page.schema.json).
+
+## Diff-gate process containment
+
+A diff-gate lease is one live process identity permitted to evaluate a
+project's current diff, distinguished from an ordinary lock file by recording
+and validating the owner's PID, process start, and project identity. CLI and
+Stop-hook gates share this lease, so an overlapping request reports the live
+owner instead of multiplying detector work.
+
+The public gate owns an isolated child process. Its default deadline is 60
+seconds, or 180 seconds with `--full`. On timeout, failure, or interruption the
+parent terminates and reaps that child before releasing the lease. An operator
+may set `SCIP_QUERY_DIFF_GATE_TIMEOUT_MS` to a positive millisecond value; the
+runtime caps it at 10 minutes.
+
+Outcome reconciliation rechecks at most one historical comparison base per
+gate. Deferred bases remain open and the result reports their exact base and
+finding counts, so accumulated event history cannot silently multiply one
+foreground gate into an unbounded replay batch.
+
+## Terminal and JSON output
+
+Human terminal output is presentation text written to an interactive terminal,
+distinguished from JSON by being able to activate terminal control sequences.
+Repository-controlled human fields therefore have control bytes rendered
+inert. JSON values retain their printable data and are protected by JSON
+encoding rather than human-output rewriting.
+
+Registry and release diagnostics redact URL user information and
+credential-bearing query fields before rendering nested errors.
+
+## Reporting a security issue
+
+Do not include a live credential, private repository, or destructive
+proof-of-concept target in a public report. Describe the affected command,
+platform, trust flags, and smallest disposable reproduction needed to
+distinguish the boundary failure.

package/docs/TELEMETRY_RETENTION.md

@@ -27,6 +27,11 @@ segments. That bounded-history deletion is different from concurrency loss:
 which segment is pruned is decided while the append/rotation lock excludes
 other writers.
 
+The retained-set reader also has a 256 MiB byte budget across the files it
+opens. It validates each segment as the same regular file before and after the
+read. Exceeding that operational budget is an explicit read failure; it does
+not silently return a prefix and present it as complete telemetry.
+
 ## Serialization and crash recovery
 
 The rotation lock is `<history>.rotation.lock`. It is a process-instance lock:

package/docs/schemas/cli-output-page.schema.json

@@ -0,0 +1,104 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/ainsleyclark/scip-query/blob/main/docs/schemas/cli-output-page.schema.json",
+  "title": "scip-query CLI output page v1",
+  "description": "A bounded, resumable page of rendered scip-query output.",
+  "type": "object",
+  "required": ["kind", "schemaVersion", "producer", "command", "contentType", "page", "content"],
+  "properties": {
+    "kind": {
+      "const": "scip-query-output-page"
+    },
+    "schemaVersion": {
+      "const": 1
+    },
+    "producer": {
+      "type": "object",
+      "required": ["name", "version"],
+      "properties": {
+        "name": {
+          "const": "scip-query"
+        },
+        "version": {
+          "type": "string",
+          "minLength": 1
+        }
+      },
+      "additionalProperties": false
+    },
+    "command": {
+      "type": "string",
+      "minLength": 1
+    },
+    "contentType": {
+      "enum": ["text/plain", "application/json"]
+    },
+    "agentInstruction": {
+      "type": "string",
+      "minLength": 1,
+      "description": "A direct evidence-completeness obligation for an AI agent consuming this page."
+    },
+    "page": {
+      "type": "object",
+      "required": [
+        "offset",
+        "returnedCharacters",
+        "totalCharacters",
+        "omittedCharacters",
+        "remainingCharacters",
+        "complete",
+        "outputHash"
+      ],
+      "properties": {
+        "offset": {
+          "type": "integer",
+          "minimum": 0
+        },
+        "returnedCharacters": {
+          "type": "integer",
+          "minimum": 0
+        },
+        "totalCharacters": {
+          "type": "integer",
+          "minimum": 0
+        },
+        "omittedCharacters": {
+          "type": "integer",
+          "minimum": 0
+        },
+        "remainingCharacters": {
+          "type": "integer",
+          "minimum": 0
+        },
+        "complete": {
+          "type": "boolean"
+        },
+        "outputHash": {
+          "type": "string",
+          "pattern": "^[a-f0-9]{64}$"
+        },
+        "continuation": {
+          "type": "object",
+          "required": ["cursor", "command"],
+          "properties": {
+            "cursor": {
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 4096
+            },
+            "command": {
+              "type": "string",
+              "minLength": 1
+            }
+          },
+          "additionalProperties": false
+        }
+      },
+      "additionalProperties": false
+    },
+    "content": {
+      "type": "string"
+    }
+  },
+  "additionalProperties": false
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "scip-query",
-  "version": "0.19.6",
+  "version": "0.19.8",
   "description": "Evidence and verification for AI coding agents: map code, reuse concepts, finish migrations, and gate diffs.",
   "type": "module",
   "main": "dist/index.js",
@@ -321,10 +321,11 @@
     "test": "vitest run",
     "test:watch": "vitest",
     "typecheck": "tsc --noEmit",
+    "audit:prod": "node scripts/audit-production-dependencies.mjs",
     "api:report": "node scripts/api-surface-contract.mjs report",
     "api:check": "npm run build && node scripts/api-surface-contract.mjs check && tsc -p tests/fixtures/public-api-consumer/tsconfig.json",
     "api:update": "npm run build && node scripts/api-surface-contract.mjs update",
-    "lint": "npm run format:check && eslint src tests tsup.config.ts scripts/api-surface-contract.mjs scripts/build-scip-windows.mjs scripts/npm-release-state.ts scripts/npm-release.ts scripts/publish-scip-windows.ts scripts/release-npm-guard.ts scripts/release-npm.ts scripts/scip-windows-package-identity.ts scripts/scip-windows-provenance.mjs scripts/scip-windows-release.ts scripts/verify-scip-windows.mjs scripts/verify-scip-windows-registry.ts && npm run api:check && node scripts/check-skill-links.mjs",
+    "lint": "npm run format:check && eslint src tests tsup.config.ts scripts/api-surface-contract.mjs scripts/audit-production-dependencies.mjs scripts/build-scip-windows.mjs scripts/npm-release-state.ts scripts/npm-release.ts scripts/publish-scip-windows.ts scripts/release-npm-guard.ts scripts/release-npm.ts scripts/scip-windows-package-identity.ts scripts/scip-windows-provenance.mjs scripts/scip-windows-release.ts scripts/verify-scip-windows.mjs scripts/verify-scip-windows-registry.ts && npm run api:check && node scripts/check-skill-links.mjs",
     "build:scip-windows": "node scripts/build-scip-windows.mjs",
     "verify:scip-windows": "node scripts/verify-scip-windows.mjs",
     "verify:scip-windows-registry": "vite-node scripts/verify-scip-windows-registry.ts",
@@ -362,8 +363,8 @@
   "dependencies": {
     "@bufbuild/protobuf": "^2.11.0",
     "@c4312/scip": "^0.1.0",
-    "@vue/compiler-dom": "^3.5.38",
-    "@vue/compiler-sfc": "^3.5.38",
+    "@vue/compiler-dom": "^3.5.40",
+    "@vue/compiler-sfc": "^3.5.40",
     "better-sqlite3": "^12.9.0",
     "chokidar": "^4.0.3",
     "commander": "^13.1.0",
@@ -372,8 +373,8 @@
   },
   "//optionalDependencies": "Native parsers and bundled SCIP indexers go in optionalDependencies so a failed install (missing build tools, restricted registry, incompatible platform) downgrades scip-query gracefully — the affected language falls back to regex parsing or asks the user to install its indexer manually — instead of blocking npm install.",
   "optionalDependencies": {
-    "@sourcegraph/scip-typescript": "^0.4.0",
-    "scip-python-plus": "^0.7.4",
+    "@sourcegraph/scip-typescript": "0.4.0",
+    "scip-python-plus": "0.7.5",
     "scip-query-scip-windows": "0.13.1",
     "tree-sitter": "0.21.1",
     "tree-sitter-c": "0.23.2",
@@ -399,7 +400,7 @@
     "tsup": "^8.3.0",
     "typescript": "^5.7.0",
     "typescript-eslint": "^8.58.1",
-    "vitest": "^3.0.0"
+    "vitest": "^3.2.7"
   },
   "allowScripts": {
     "better-sqlite3@12.9.0": true,

package/skills/_shared/SKILL.md

@@ -24,7 +24,9 @@ A SCIP index is the compiler-derived map of a repository: source files, symbols,
 
 ## Freshness gate
 
-Before trusting any graph fact: run `scip-query status --capabilities`. If freshness reports `fresh`, continue. If it reports `stale`, `missing`, or `unknown`, run `scip-query reindex` first — it indexes the codebase and converts it to SQLite — then re-check status before proceeding.
+Before the first SCIP graph fact in a work session, run `scip-query status --capabilities` once. If the reported generation is fresh, reuse it until source changes; do not repeat capability checks between commands against that same generation.
+
+After source changes, let an active watcher refresh the index. If status says the watcher is indexing, debouncing, cooling down, or already has a pending/claimed refresh request, wait for that work to finish and check once more instead of starting a competing refresh. Run `scip-query reindex` only when freshness is `stale`, `missing`, or `unknown` and the watcher is disabled, unavailable, or has failed to refresh. Re-check status once after that fallback completes.
 
 ## Symbol lookup fallback ladder
 
@@ -87,7 +89,7 @@ Standalone detector commands (outside diff-gate) are not outcome-tracked in this
 
 ## Postcheck
 
-Every implemented change ends with `scip-query status --capabilities` and `scip-query diff-gate --json`. Fix each finding, or record a specific acceptance reason for each one left unresolved (findings marked `(advisory)` never block — treat them as context, not obligations). Do not report success while a diff-gate finding is unexplained. The authoritative table of *which* postcheck to run for *which* kind of edit lives in `scip-verify`; invoke that skill rather than re-deriving it here.
+At final verification for a coherent diff, run `scip-query status --capabilities` once and `scip-query diff-gate --json`. Repeat them only if the diff changes afterward. Fix each finding, or record a specific acceptance reason for each one left unresolved (findings marked `(advisory)` never block — treat them as context, not obligations). Do not report success while a diff-gate finding is unexplained. The authoritative table of *which* postcheck to run for *which* kind of edit lives in `scip-verify`; invoke that skill rather than re-deriving it here.
 
 ## Subagent evidence boundary
 

package/skills/scip-audit/SKILL.md

@@ -32,8 +32,9 @@ Use this shortlist first. Open [`../_shared/SKILL.md`](../_shared/SKILL.md) only
 <!-- END GENERATED SKILL COMMANDS -->
 catalogue) from `../_shared/SKILL.md` — each reference file below carries its
 own shortlist first and only defers to `_shared` when that shortlist runs
-out. Before trusting any graph fact, confirm the index is fresh with
-`scip-query status --capabilities` (reindex if `stale`/`missing`/`unknown`).
+out. Apply `_shared`'s freshness gate once before the first graph fact; let
+an active watcher refresh after source changes, and use manual reindex only
+as its documented fallback.
 
 ## Triage
 

package/skills/scip-explore/SKILL.md

@@ -28,7 +28,7 @@ Use this shortlist first. Open [`../_shared/SKILL.md`](../_shared/SKILL.md) only
 
 ## Evidence rules (apply to every step below)
 
-- Use a current index before trusting graph facts: check `scip-query status --capabilities` freshness (`_shared` has the exact command); reindex if it reports `stale`, `missing`, or `unknown`.
+- Use a current index before trusting graph facts: apply `_shared`'s freshness gate once before the first graph claim. After source changes, let an active watcher refresh and use manual reindex only as the documented fallback.
 - Relationship, consumer, and completeness claims must cite a `scip-query` command. Literal local-source claims may cite a native file read instead.
 - Resolve ambiguous symbols before describing behavior — `scip-query code` is the usual tool, but it isn't mandatory when you already have an exact native range.
 - Follow the graph before trusting folder structure. Start wide, then narrow.

package/skills/scip-improve/SKILL.md

@@ -50,7 +50,7 @@ with its evidence and disposition.
 | --- | --- | --- | --- | --- |
 | `scip-query cleanup-plan --verify --json` | Ordered, batched deletion plan: graph-fact dead code plus the cascade candidates it unlocks | ordered cleanup batches, evidence, and optional verification outcomes | `bounded` | Build compiler-checked deletion batches from confirmed dead-code findings. |
 | `scip-query cleanup-apply --verified --batch <n>` | Apply a compiler-verified cleanup-plan batch to the working tree | applied files, deletions, verification, and refusal reasons | `bounded` | Apply one already verified cleanup batch. |
-| `scip-query diff-gate --json --compact` | Gate the current diff: architecture regressions plus echo, migration, coordination, doc-drift, unused-param, and new-dead candidates; exit 1 on blocking findings | blocking findings with check id, message, and remediation; advisory findings; root-cause groups; changed file and symbol counts; process exit status (1 when blocking findings exist) | `bounded` | Gate each implemented improvement slice before declaring it complete. |
+| `scip-query diff-gate --json --compact` | Runtime-bounded, single-flight gate for the current diff: architecture regressions plus echo, migration, coordination, doc-drift, unused-param, and new-dead candidates; exit 1 on blocking findings | blocking findings with check id, message, and remediation; advisory findings; root-cause groups; changed file and symbol counts; process exit status (1 when blocking findings exist) | `bounded` | Gate each implemented improvement slice before declaring it complete. |
 
 Use this shortlist first. Open [`../_shared/SKILL.md`](../_shared/SKILL.md) only when it is insufficient.
 <!-- END GENERATED SKILL COMMANDS -->

package/skills/scip-plan/SKILL.md

@@ -45,7 +45,7 @@ Picking the mode matters: running the high-assurance certificate on routine work
 
 ## Scenario: plan a single non-trivial change (ordinary mode, the default)
 
-Start with `scip-query status --capabilities` to confirm the index is fresh before citing graph facts — reindex only if the index is stale, missing, or unknown. Then run `scip-query plan-context <target>` — the single anchoring call for planning. Its composite return already includes definitions, references, callers, callees, dataflow producers/consumers, forward and backward slices, affected symbols, change-surface risk, dependencies and reverse dependencies, module exports, external surface use, complexity, churn, co-change partners, and active suppressions, so the job is to interpret this composite rather than rebuild a proof system on top of it.
+Apply `_shared`'s freshness gate once before citing the first graph fact; let an active watcher handle refreshes and use manual reindex only as the documented fallback. Then run `scip-query plan-context <target>` — the single anchoring call for planning. Its composite return already includes definitions, references, callers, callees, dataflow producers/consumers, forward and backward slices, affected symbols, change-surface risk, dependencies and reverse dependencies, module exports, external surface use, complexity, churn, co-change partners, and active suppressions, so the job is to interpret this composite rather than rebuild a proof system on top of it.
 
 Reach for a second command only when a section `plan-context` returned came back bounded (not complete) or the target wasn't indexed: `scip-query refs <symbol>` to enumerate consumers in full, `scip-query affected <symbol>` for the transitive blast radius when the change isn't consumer-local, `scip-query code <symbol>` to read the source behind a behavior claim before writing it into the plan.
 

package/skills/scip-verify/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: scip-verify
-description: Use after finishing a change and before committing: reindex, run the postchecks matching what you edited, diff-gate, and try to refute your own PASS — including verifying that a React or Vue refactor actually achieved the reuse it claimed. Also use to calibrate detector precision once a repo is already set up and its findings look too noisy or too clean. For an existing status claim with no just-finished diff, use scip-audit instead. Distinct from the `review` skill: that one reviews a branch against coding standards and the originating spec; this one runs reindex, routed postchecks and diff-gate on a change you just made.
+description: Use after finishing a change and before committing: ensure the watcher has produced a fresh index generation, run the postchecks matching what you edited, diff-gate, and try to refute your own PASS — including verifying that a React or Vue refactor actually achieved the reuse it claimed. Also use to calibrate detector precision once a repo is already set up and its findings look too noisy or too clean. For an existing status claim with no just-finished diff, use scip-audit instead. Distinct from the `review` skill: that one reviews a branch against coding standards and the originating spec; this one runs freshness, routed postchecks and diff-gate checks on a change you just made.
 commands:
   - template: "scip-query doctor"
     when: "Prove the workspace and configuration are usable before trusting evidence."
@@ -33,7 +33,7 @@ Load shared mechanics — command syntax, the evidence contract, diff-gate's
 | --- | --- | --- | --- | --- |
 | `scip-query doctor` | Diagnose config, index freshness, dependency readiness, and project capabilities | config, freshness, dependency, and capability diagnostics | `complete` | Prove the workspace and configuration are usable before trusting evidence. |
 | `scip-query diff-impact --json` | Compute changed symbols and downstream consumers from current git diff | changed symbols, downstream consumer identities, and impact paths | `bounded` | Compare changed files, symbols, and affected consumers with the intended diff. |
-| `scip-query diff-gate --json --compact` | Gate the current diff: architecture regressions plus echo, migration, coordination, doc-drift, unused-param, and new-dead candidates; exit 1 on blocking findings | blocking findings with check id, message, and remediation; advisory findings; root-cause groups; changed file and symbol counts; process exit status (1 when blocking findings exist) | `bounded` | Run the complete finished-diff gate without blind line truncation. |
+| `scip-query diff-gate --json --compact` | Runtime-bounded, single-flight gate for the current diff: architecture regressions plus echo, migration, coordination, doc-drift, unused-param, and new-dead candidates; exit 1 on blocking findings | blocking findings with check id, message, and remediation; advisory findings; root-cause groups; changed file and symbol counts; process exit status (1 when blocking findings exist) | `bounded` | Run the complete finished-diff gate without blind line truncation. |
 
 Use this shortlist first. Open [`../_shared/SKILL.md`](../_shared/SKILL.md) only when it is insufficient.
 <!-- END GENERATED SKILL COMMANDS -->
@@ -55,6 +55,11 @@ scip-query doctor
 scip-query status --capabilities
 ```
 
+Apply `_shared`'s freshness gate here: if the watcher is already refreshing or
+has accepted a refresh request, wait and check once more rather than launching
+a parallel reindex. Use manual `scip-query reindex` only when the index is
+stale, missing, or unknown and the watcher is disabled, unavailable, or failed.
+
 Complete only when missing indexers, invalid config, stale indexes, or
 unavailable relevant capabilities are fixed or reported as blockers. Verify
 environment and index freshness before trusting any graph fact that follows.

package/dist/chunk-24QNP7MN.js

@@ -1,2 +0,0 @@
-import{a as f,b as m}from"./chunk-QZ4JVECJ.js";import{a as u}from"./chunk-7LABSJSR.js";import{B as g,E as d}from"./chunk-DGMCFMPG.js";import{H as l}from"./chunk-B5MHCHP3.js";import{readFileSync as E,readdirSync as h}from"fs";import{basename as k,join as c}from"path";function S(t,e,r={}){let a=new Set(t),n=new Set(e),o=[...n].filter(i=>!a.has(i)).sort(),s=r.allowExtra?[]:[...a].filter(i=>!n.has(i)).sort();return{missing:o,extra:s}}function b(t,e){let r=N(t,e.file,e.keys);if(!r.ok)return{name:e.name,file:e.file,status:"unavailable",missing:[],extra:[],unavailableReason:r.reason};let a=L(t.config.projectRoot,e.mustEqual),n=S(r.keys,a,{allowExtra:e.allowExtra??!1}),o=n.missing.length>0||n.extra.length>0?"violated":"ok";return{name:e.name,file:e.file,status:o,missing:n.missing,extra:n.extra}}function O(t,e){return e.map(r=>b(t,r))}function G(t,e){if(e.has(t.file))return!0;let r=t.mustEqual;switch(r.type){case"top-level-dirs":return[...e].some(a=>a===r.path||a.startsWith(`${r.path}/`));case"file-glob":return[...e].some(a=>f(r.pattern,a));case"registered-commands":return e.has("docs/COMMAND_REFERENCE.md");case"builtin-skills":return[...e].some(a=>a.startsWith("skills/"))}}function I(t){if(t.status==="unavailable")return`[coverage-contract] ${t.name}: DISCLOSED \u2014 could not evaluate (${t.unavailableReason})`;let e=[];return t.missing.length>0&&e.push(`missing ${t.missing.join(", ")}`),t.extra.length>0&&e.push(`extra ${t.extra.join(", ")}`),`[coverage-contract] ${t.name}: ${e.join("; ")}`}function N(t,e,r){return r.type==="markdown-list"?T(t,e,r.marker):R(t,e,r)}function R(t,e,r){if(!l(t,e))return{ok:!1,reason:`file not found: ${e}`};let n=g(e);if(!n)return{ok:!1,reason:`unsupported file type for ${r.type} extraction: ${e}`};let o=d(t,e);if(!o)return{ok:!1,reason:`tree-sitter parser unavailable for ${n} (${e}) \u2014 contract skipped, not silently passed`,disclosedUnavailable:{language:n,reason:"parser-unavailable"}};let s=r.type==="object-literal-keys"?D(o,r.identifier):w(o,r.identifier);return s===null?{ok:!1,reason:`no ${r.type==="object-literal-keys"?"object literal":"string array"} named "${r.identifier}" found in ${e}`}:{ok:!0,keys:s}}function y(t){let e=t.childForFieldName("value");return e?e.type==="as_expression"||e.type==="satisfies_expression"?e.namedChild(0):e:null}function D(t,e){for(let r of t.rootNode.descendantsOfType("variable_declarator")){if(r.childForFieldName("name")?.text!==e)continue;let n=y(r);if(n?.type==="object")return $(n)}return null}function $(t){let e=new Set;for(let r of t.namedChildren)if(r.type==="pair"){let a=r.childForFieldName("key");a&&e.add(C(a.text))}else r.type==="shorthand_property_identifier"&&e.add(r.text);return[...e].sort()}function w(t,e){for(let r of t.rootNode.descendantsOfType("variable_declarator")){if(r.childForFieldName("name")?.text!==e)continue;let n=y(r);if(n?.type!=="array")continue;let o=new Set;for(let s of n.namedChildren)s.type==="string"&&o.add(C(s.text));return[...o].sort()}return null}function C(t){return t.length>=2&&(t[0]==="'"&&t.endsWith("'")||t[0]==='"'&&t.endsWith('"'))?t.slice(1,-1):t}function T(t,e,r){let a=l(t,e);if(!a)return{ok:!1,reason:`file not found: ${e}`};let n=v(a,r);return n===null?{ok:!1,reason:`no <!-- BEGIN GENERATED ${r} --> ... <!-- END GENERATED ${r} --> block in ${e}`}:{ok:!0,keys:x(n)}}function v(t,e){let r=u(e),n=new RegExp(`<!--\\s*BEGIN GENERATED ${r}\\s*-->([\\s\\S]*?)<!--\\s*END GENERATED ${r}\\s*-->`).exec(t);return n?n[1]:null}function x(t){let e=new Set;for(let r of t.matchAll(/`([a-z][a-z0-9-]*)`/g))e.add(r[1]);for(let r of t.matchAll(/\[([a-z][a-z0-9-]*)\]\([^)]*\)/g))e.add(r[1]);return[...e].sort()}function L(t,e){switch(e.type){case"top-level-dirs":return p(c(t,e.path));case"file-glob":return[...new Set(m(t,e.pattern).map(r=>k(r)))].sort();case"registered-commands":return A(t);case"builtin-skills":return p(c(t,"skills"))}}function p(t){let e;try{e=h(t,{withFileTypes:!0})}catch{return[]}return e.filter(r=>r.isDirectory()&&!r.name.startsWith(".")).map(r=>r.name).sort()}function A(t){let e;try{e=E(c(t,"docs/COMMAND_REFERENCE.md"),"utf-8")}catch{return[]}let r=v(e,"COMMAND REFERENCE");return r?x(r):[]}var z={dead:{minLoc:3,skipBarrels:!0,deadCodeOnly:!0},isolated:{minLoc:3},similar:{minSimilarity:.6,limit:50,minCallees:4},duplicateBodies:{maxLoc:15,limit:50},extract:{minLoc:15,minCallees:5,limit:50},wrappers:{maxLoc:15,limit:50},passthroughs:{maxLoc:15,limit:50},stale:{minLoc:3,limit:50},drift:{},twinDrift:{minSimilarity:.3}};export{b as a,O as b,G as c,I as d,z as e};
-//# sourceMappingURL=chunk-24QNP7MN.js.map

package/dist/chunk-2ZOCHAL2.js

@@ -1,8 +0,0 @@
-import{a as x,d as z,e as K,f as k,g as S,h as j,i as H,j as F}from"./chunk-A63U2W3P.js";import{execFileSync as T}from"child_process";import{createRequire as me}from"module";import{existsSync as pe}from"fs";import{platform as v,arch as V}from"os";var X="v0.8.1",B="https://github.com/sourcegraph/scip",Y="SCIP_QUERY_SCIP_BIN";function ge(e){if(e.isOnPath("scip"))return{source:"path",path:"scip"};let t=e.env[Y];if(t&&e.fileExists(t))return{source:"env",path:t};if(e.platform==="win32"){let r=e.resolveSidecar(e.arch);if(r&&e.fileExists(r))return{source:"sidecar",path:r}}return null}function ye(e){let t=me(import.meta.url);for(let r of e==="arm64"?["arm64","x64"]:[e])try{return t.resolve(`scip-query-scip-windows/scip-win32-${r}.exe`)}catch{}return null}function W(e=process.env){return ge({platform:v(),arch:V(),env:e,isOnPath:x,fileExists:pe,resolveSidecar:ye})?.path??null}function pt(){return W()!==null}function gt(){let e=W();if(!e)return null;try{return T(e,["--version"],{stdio:"pipe",timeout:1e4,killSignal:"SIGKILL"}).toString().trim()}catch{return null}}function Re(){let e=v(),t=V(),r,n,o;switch(e){case"darwin":r="darwin",o="tar.gz";break;case"linux":r="linux",o="tar.gz";break;default:return null}switch(t){case"arm64":n="arm64";break;case"x64":n="amd64";break;default:return null}let i=`scip-${r}-${n}.${o}`;return{url:`${B}/releases/download/${X}/${i}`,filename:i}}function yt(){let e=Re();console.log("\nThe `scip` CLI is required but not found on PATH.\n"),v()==="darwin"?(console.log("Install via Homebrew:"),console.log(`  brew install sourcegraph/scip/scip
-`),console.log("Or download manually:")):v()==="win32"?(console.log("On Windows the scip binary ships via the npm sidecar package scip-query-scip-windows,"),console.log("installed automatically with scip-query. If it is missing:"),console.log("  npm install -g scip-query-scip-windows"),console.log(`Or set ${Y} to a local scip.exe path.
-`),console.log("Upstream release page:")):console.log("Download from:"),console.log(e?`  ${e.url}
-`:`  ${B}/releases/tag/${X}
-`),console.log("After installing, ensure `scip` is on your PATH and run `scip-query reindex`.")}function Rt(e){if(v()==="darwin"&&x("brew")){e("Installing scip CLI via Homebrew...");try{if(T("brew",["install","sourcegraph/scip/scip"],{stdio:"inherit",timeout:3e5,env:process.env}),x("scip"))return e("Successfully installed scip CLI via Homebrew"),!0}catch(t){let r=t instanceof Error?t.message:String(t);e(`Homebrew install failed: ${r}`)}}if(x("go")){e("Installing scip CLI via go install...");try{if(T("go",["install","github.com/sourcegraph/scip/cmd/scip@latest"],{stdio:"inherit",timeout:3e5,env:process.env}),x("scip"))return e("Successfully installed scip CLI via go install"),!0}catch(t){let r=t instanceof Error?t.message:String(t);e(`go install failed: ${r}`)}}return e("Could not auto-install scip CLI."),e(`Install manually from: ${B}/releases`),!1}import{randomUUID as xe}from"crypto";import{closeSync as he,fsyncSync as be,linkSync as ke,mkdirSync as Se,openSync as ve,readFileSync as Pe,statSync as Le,unlinkSync as we,writeSync as Ie}from"fs";import{dirname as C}from"path";var E="scip-query-process-lock",_=1;var w=Object.freeze({wallNow:()=>Date.now(),isProcessAlive:z,readProcessIdentity:S,randomToken:()=>xe(),makeDirectory:e=>Se(e,{recursive:!0}),openFile:(e,t,r)=>ve(e,t,r),writeFile:(e,t,r,n)=>Ie(e,t,r,n),syncFile:e=>be(e),closeFile:e=>he(e),linkFile:(e,t)=>ke(e,t),readFile:e=>Pe(e,"utf8"),statFile:e=>{let t=Le(e);return{dev:t.dev,ino:t.ino,size:t.size,mtimeMs:t.mtimeMs}},removeFile:e=>we(e)});function Z(e,t){let r=t.runtime??w;r.makeDirectory(C(e));let n;for(let o=0;o<2;o+=1)try{return{kind:"acquired",lock:ee(e,t,r),...n?{reclaimed:n}:{}}}catch(i){if(i.code!=="EEXIST")throw i;let s=h(e,{parseLegacy:t.parseLegacy,runtime:r});if(o===0&&Fe(e,s,{creationGraceMs:t.creationGraceMs,parseLegacy:t.parseLegacy,runtime:r})){n=s;continue}return{kind:"contended",observation:s}}return{kind:"contended",observation:h(e,{parseLegacy:t.parseLegacy,runtime:r})}}function h(e,t={}){let r=t.runtime??w,n,o;try{n=r.statFile(e),o=r.readFile(e)}catch(c){return c.code==="ENOENT"?{state:"missing"}:{state:"malformed"}}let i;try{i=JSON.parse(o)}catch{return{state:"malformed",raw:o,identity:n}}let s=Oe(i);if(s)return{state:"valid",raw:o,identity:n,record:s,owner:Be(s),parsed:i};let a=t.parseLegacy?.(i)??null;return a?{state:"legacy",raw:o,identity:n,owner:a,parsed:i}:{state:"malformed",raw:o,identity:n,parsed:i}}function Oe(e){if(!e||typeof e!="object"||Array.isArray(e))return null;let t=e;if(t.protocol!==E||t.version!==_||typeof t.kind!="string"||t.kind.trim()===""||typeof t.pid!="number"||!Number.isSafeInteger(t.pid)||t.pid<=0||typeof t.token!="string"||t.token.trim()===""||typeof t.startedAt!="string"||!Number.isFinite(Date.parse(t.startedAt))||t.detail!==void 0&&(typeof t.detail!="object"||t.detail===null||Array.isArray(t.detail)))return null;let r=t.processIdentity===void 0?null:K(t.processIdentity);return t.processIdentity!==void 0&&(!r||r.pid!==t.pid)?null:{protocol:E,version:_,kind:t.kind,pid:t.pid,token:t.token,...r?{processIdentity:r}:{},startedAt:t.startedAt,...t.detail?{detail:t.detail}:{}}}function Fe(e,t,r={}){let n=r.runtime??w;if(!N(t,n))return!1;let o=Te(`${e}.reclaim`,n);if(!o)return!1;try{let i=h(e,{parseLegacy:r.parseLegacy,runtime:n});return!te(t,i)||!N(i,n)?!1:M(e,n)}finally{o.release()}}function ee(e,t,r){let n=t.pid??process.pid,o=r.randomToken(),i=t.processIdentity===void 0?r.readProcessIdentity(n):t.processIdentity,s={protocol:E,version:_,kind:t.kind,pid:n,token:o,...i?{processIdentity:i}:{},startedAt:new Date(r.wallNow()).toISOString(),...t.detail?{detail:t.detail}:{}},a=`${e}.${o}.candidate`,c=r.openFile(a,"wx",384),d;try{H(c,Buffer.from(`${JSON.stringify(s)}
-`),r,"process lock"),r.syncFile(c)}catch(u){d=u}try{r.closeFile(c)}catch(u){d??=u}if(d!==void 0)throw A(a,r),d;try{r.linkFile(a,e)}catch(u){throw A(a,r),u}A(a,r);try{re(C(e),r)}catch(u){throw Q(e,s,r),u}let m=!1;return{path:e,record:s,release:()=>m?!1:(m=!0,Q(e,s,r))}}function Q(e,t,r=w){let n=h(e,{runtime:r});return n.state!=="valid"||!n.record||n.record.pid!==t.pid||n.record.token!==t.token||t.processIdentity&&(!n.record.processIdentity||!k(t.processIdentity,n.record.processIdentity))?!1:M(e,r)}function Te(e,t){for(let r=0;r<2;r+=1)try{return ee(e,{kind:"reclaim-guard",runtime:t},t)}catch(n){if(n.code!=="EEXIST")return null;let o=h(e,{runtime:t});if(r>0||!N(o,t))return null;let i=h(e,{runtime:t});if(!te(o,i)||!M(e,t))return null}return null}function N(e,t){if(e.state==="missing")return!1;if(e.owner){if(!t.isProcessAlive(e.owner.pid))return!0;if(!e.owner.processIdentity)return!1;let r=t.readProcessIdentity(e.owner.pid);return r!==null&&!k(e.owner.processIdentity,r)}return!1}function te(e,t){return e.state===t.state&&e.raw===t.raw&&e.identity!==void 0&&t.identity!==void 0&&e.identity.dev===t.identity.dev&&e.identity.ino===t.identity.ino&&e.identity.size===t.identity.size&&e.identity.mtimeMs===t.identity.mtimeMs}function Be(e){return{pid:e.pid,...e.processIdentity?{processIdentity:e.processIdentity}:{}}}function re(e,t){let r;try{r=t.openFile(e,"r")}catch(n){if(F(n,process.platform))return;throw n}try{t.syncFile(r)}catch(n){if(!F(n,process.platform))throw n}finally{t.closeFile(r)}}function M(e,t){try{return t.removeFile(e),re(C(e),t),!0}catch{return!1}}function A(e,t){try{t.removeFile(e)}catch{}}import{readFileSync as Et,statSync as He}from"fs";import{dirname as Ve,join as Xe}from"path";import{appendFileSync as Ae,existsSync as Ee,mkdirSync as _e,readFileSync as Ne,renameSync as Ce,rmSync as Me,statSync as Je,truncateSync as De}from"fs";import{basename as $e,dirname as qe}from"path";var $=".previous",Ue=".rotation.lock",Ge=2e3,J=class extends Error{constructor(r,n){super(`Timed out after ${n}ms waiting for rotating JSONL lock: ${r}`);this.lockPath=r;this.timeoutMs=n;this.name="RotatingJsonlLockTimeoutError"}lockPath;timeoutMs;code="ROTATING_JSONL_LOCK_TIMEOUT"},D=class extends Error{constructor(r){super(`Rotating JSONL lock ownership changed before release: ${r}`);this.lockPath=r;this.name="RotatingJsonlLockReleaseError"}lockPath;code="ROTATING_JSONL_LOCK_RELEASE_FAILED"},ze=Object.freeze({monotonicNow:j,wait(e){Atomics.wait(new Int32Array(new SharedArrayBuffer(4)),0,0,e)},tryAcquireLock(e,t){let r=Z(e,{kind:"rotating-jsonl",detail:{target:$e(t)}});return r.kind==="acquired"?{kind:"acquired",lock:r.lock}:{kind:"contended"}},makeDirectory(e){_e(e,{recursive:!0})},exists:Ee,readBytes(e){return Ne(e)},size(e){return Je(e).size},truncate:De,remove(e){Me(e,{force:!0})},rename:Ce,append:Ae});function ne(e,t,r){let n=r.runtime??ze,o=JSON.stringify(t);if(o===void 0)throw new TypeError("Rotating JSONL records must be JSON-serializable values.");let i=Buffer.from(`${o}
-`),s=Math.max(1,Math.floor(r.maxSegmentBytes),i.length);return Ke(e,r.lockTimeoutMs,n,()=>{n.makeDirectory(qe(e));let a=je(e,n);r.onPhase?.("tail-repaired");let c=`${e}${r.previousSuffix??$}`,d=!1,m=!1;return n.exists(e)&&n.size(e)+i.length>s&&(n.exists(c)&&(n.remove(c),m=!0),r.onPhase?.("previous-pruned"),n.rename(e,c),d=!0,r.onPhase?.("current-rotated")),n.append(e,i),r.onPhase?.("record-appended"),{lineBytes:i.length,segmentLimitBytes:s,repairedTailBytes:a,rotated:d,prunedPrevious:m}})}function Ke(e,t,r,n){let o=`${e}${Ue}`,i=Math.max(0,t??Ge),s=r.monotonicNow()+i,a;for(;;){let f=r.tryAcquireLock(o,e);if(f.kind==="acquired"){a=f.lock;break}let p=s-r.monotonicNow();if(p<=0)throw new J(o,i);r.wait(Math.min(5,p))}let c=!1,d,m;try{m=n()}catch(f){c=!0,d=f}let u=!1;try{u=a.release()}catch(f){if(!c)throw f}if(c)throw d;if(!u)throw new D(o);return m}function je(e,t){if(!t.exists(e))return 0;let r=t.readBytes(e);if(r.length===0||r[r.length-1]===10)return 0;let n=r.lastIndexOf(10),o=n<0?0:n+1;return t.truncate(e,o),r.length-o}var Ye="reindex-activity.jsonl",We=$,Qe=1024*1024,Ct=1440*60*1e3;function oe(e){return Xe(Ve(e),Ye)}function Ze(e){if(e.reused)return 0;let t=ie(e.indexPath)+ie(e.dbPath);for(let r of e.shards??[])!r.reused&&r.outputBytes!==null&&(t+=r.outputBytes);return t}function Mt(e,t){let r=t.lastRefresh;r&&se(oe(e),{version:1,event:"run",recordedAt:r.completedAt,trigger:r.trigger,result:r.result,durationMs:r.durationMs,estimatedLogicalOutputBytes:Ze(t)})}function Jt(e,t){se(oe(e),{version:1,event:"run",recordedAt:t.completedAt,trigger:t.trigger,result:"failed",durationMs:t.durationMs,estimatedLogicalOutputBytes:0})}function et(e,t,r=Qe,n){ne(e,t,{maxSegmentBytes:r,previousSuffix:We,...n?{runtime:n}:{}})}function se(e,t){try{et(e,t)}catch{}}function ie(e){try{return He(e).size}catch{return 0}}import{createHash as tt}from"crypto";import{mkdirSync as rt,realpathSync as nt}from"fs";import{homedir as it}from"os";import{join as y,resolve as ae}from"path";function ot(e,t){let r=process.env.SCIP_QUERY_CACHE_DIR;if(r)return q(r);if(t?.dbPath)return q(ae(e,t.dbPath));let n=st(e);return q(n)}function ce(){let e=process.env.XDG_CACHE_HOME;return y(e||y(it(),".cache"),"scip-query")}function st(e){let t=ae(e);try{t=nt(t)}catch{}let r=tt("sha256").update(t).digest("hex").slice(0,12);return y(ce(),"projects",r)}function zt(e){if(!/^[a-f0-9]{24}$/.test(e))throw new Error(`invalid repository cache identity: ${e}`);return y(ce(),"repositories",e)}function Kt(e){return process.env.SCIP_QUERY_SHARED_CACHE!=="0"&&!process.env.SCIP_QUERY_CACHE_DIR&&!process.env.SCIP_QUERY_INDEX_DB&&!e?.dbPath}function jt(e,t){let r=ot(e,t);return{cacheDir:r,dbPath:y(r,"index.db"),indexPath:y(r,"index.scip"),metaPath:y(r,"meta.json")}}function q(e){return rt(e,{recursive:!0}),e}import{spawn as at}from"child_process";import{performance as le}from"perf_hooks";var Wt={probe:1e4,git:3e4,analysis:18e4,install:3e5,indexer:6e5},P=class extends Error{constructor(r,n,o,i={}){super(o,i.cause===void 0?void 0:{cause:i.cause});this.kind=r;this.label=n;this.name="BoundedProcessError",this.timedOut=i.timedOut??!1,this.reaped=i.reaped??!1,this.stdout=i.stdout??"",this.stderr=i.stderr??"",this.stdoutTruncated=i.stdoutTruncated??!1,this.stderrTruncated=i.stderrTruncated??!1}kind;label;timedOut;reaped;stdout;stderr;stdoutTruncated;stderrTruncated};function I(e,t){if(!Number.isFinite(e)||e<=0)throw new TypeError(`${t} must be a positive finite number.`)}function de(e,t,r,n){let o=Math.max(0,n-r);o>0&&e.push(t.subarray(0,o))}function ue(e,t,r){let n=Buffer.concat([...e,t]);e.length=0,e.push(n.subarray(Math.max(0,n.length-r)))}function ct(e,t){if(e.exitCode!==null||e.signalCode!==null||e.pid===void 0)return!1;if(!t)return!0;let r=S(e.pid);return r!==null&&k(t,r)}function Qt(e){I(e.timeoutMs,"timeoutMs"),I(e.maxStdoutBytes,"maxStdoutBytes"),I(e.maxStderrBytes,"maxStderrBytes");let t=e.terminationGraceMs??1e3;return I(t,"terminationGraceMs"),new Promise((r,n)=>{let o=le.now(),i;try{i=at(e.command,[...e.args??[]],{cwd:e.cwd,env:e.env,detached:e.detached,stdio:["pipe","pipe","pipe"]})}catch(l){n(new P("spawn",e.label,`${e.label} could not start.`,{cause:l,reaped:!0}));return}let s=[],a=[],c=0,d=0,m=!1,u=!1,f=null,p=!1,R=null,fe=i.pid===void 0?null:S(i.pid),b=l=>{f||p||(f=l,i.kill("SIGTERM"),R=setTimeout(()=>{!p&&ct(i,fe)&&i.kill("SIGKILL")},t),R.unref())},O=setTimeout(()=>{b({kind:"timeout",timedOut:!0,message:`${e.label} timed out after ${e.timeoutMs}ms.`})},e.timeoutMs);O.unref();let L=()=>{b({kind:"aborted",timedOut:!1,message:`${e.label} was cancelled.`})};e.signal?.addEventListener("abort",L,{once:!0}),e.signal?.aborted&&L(),i.stdout.on("data",l=>{let g=Buffer.isBuffer(l)?l:Buffer.from(l);e.outputLimitBehavior==="truncate-tail"?ue(s,g,e.maxStdoutBytes):de(s,g,c,e.maxStdoutBytes),c+=g.length,c>e.maxStdoutBytes&&(m=!0,e.outputLimitBehavior!=="truncate-tail"&&b({kind:"stdout-limit",timedOut:!1,message:`${e.label} exceeded stdout limit (${e.maxStdoutBytes} bytes).`}))}),i.stderr.on("data",l=>{let g=Buffer.isBuffer(l)?l:Buffer.from(l);e.outputLimitBehavior==="truncate-tail"?ue(a,g,e.maxStderrBytes):de(a,g,d,e.maxStderrBytes),d+=g.length,d>e.maxStderrBytes&&(u=!0,e.outputLimitBehavior!=="truncate-tail"&&b({kind:"stderr-limit",timedOut:!1,message:`${e.label} exceeded stderr limit (${e.maxStderrBytes} bytes).`}))}),i.on("error",l=>{if(!p&&!f){if(i.pid===void 0){clearTimeout(O),R&&clearTimeout(R),e.signal?.removeEventListener("abort",L),p=!0,n(new P("spawn",e.label,`${e.label} could not start: ${l.message}`,{cause:l,reaped:!0}));return}b({kind:"spawn",timedOut:!1,message:`${e.label} failed after start: ${l.message}`})}}),i.on("close",(l,g)=>{if(p)return;p=!0,clearTimeout(O),R&&clearTimeout(R),e.signal?.removeEventListener("abort",L);let U=Buffer.concat(s).toString("utf8"),G=Buffer.concat(a).toString("utf8");if(f){n(new P(f.kind,e.label,f.message,{timedOut:f.timedOut,reaped:!0,stdout:U,stderr:G,stdoutTruncated:m,stderrTruncated:u}));return}r({status:l,signal:g,stdout:U,stderr:G,timedOut:!1,durationMs:le.now()-o,stdoutTruncated:m,stderrTruncated:u})}),e.input===void 0?i.stdin.end():i.stdin.end(e.input)})}export{W as a,pt as b,gt as c,yt as d,Rt as e,Z as f,h as g,Fe as h,$ as i,ne as j,Ye as k,Mt as l,Jt as m,st as n,zt as o,Kt as p,jt as q,Wt as r,P as s,Qt as t};
-//# sourceMappingURL=chunk-2ZOCHAL2.js.map

package/dist/chunk-35SQLYCQ.js

@@ -1,2 +0,0 @@
-function r(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function t(e){return typeof e=="string"&&Number.isFinite(Date.parse(e))}function n(e){return typeof e=="number"&&Number.isSafeInteger(e)&&e>=0}var o=["typescript","javascript","java","scala","kotlin","rust","python","ruby","go","cpp","c","csharp","vb","dart","php","clojure"];export{r as a,t as b,n as c,o as d};
-//# sourceMappingURL=chunk-35SQLYCQ.js.map