spidersan 0.20.1 → 0.20.2

package/dist/lib/security.d.ts

@@ -0,0 +1,72 @@
+/**
+ * Validate agent ID (e.g., "sherlock", "watsan-1", "agent_01")
+ * @throws Error if invalid
+ */
+export declare function validateAgentId(agentId: string): string;
+/**
+ * Validate git branch name
+ * @throws Error if invalid
+ */
+export declare function validateBranchName(branch: string): string;
+/**
+ * Validate PR number
+ * @throws Error if invalid
+ */
+export declare function validatePRNumber(prNumber: number | string): number;
+/**
+ * Validate task ID (for torrent/task commands)
+ * @throws Error if invalid
+ */
+export declare function validateTaskId(taskId: string): string;
+/**
+ * Validate file path (basic safety check)
+ * @throws Error if invalid
+ */
+export declare function validateFilePath(filePath: string): string;
+/**
+ * Sanitize free-form text by removing shell metacharacters
+ * Use for message bodies, subjects, etc.
+ */
+export declare function sanitizeText(text: string): string;
+/**
+ * Sanitize an array of file paths
+ */
+export declare function sanitizeFilePaths(files: string[]): string[];
+/**
+ * Escape a string for safe use in git commands (minimal escaping)
+ */
+export declare function escapeGitArg(arg: string): string;
+/**
+ * Escapes a string so it can be safely used in a shell script.
+ * Replaces single quotes with '\'' and wraps the result in single quotes.
+ * Prevents command injection when generating bash scripts.
+ */
+export declare function escapeShellString(str: string): string;
+export declare const patterns: {
+    VALID_AGENT_ID: RegExp;
+    VALID_BRANCH_NAME: RegExp;
+    VALID_TASK_ID: RegExp;
+    VALID_FILE_PATH: RegExp;
+    SHELL_METACHARACTERS: RegExp;
+};
+export declare const sanitizeAgentId: typeof validateAgentId;
+export declare const sanitizeBranchName: typeof validateBranchName;
+export declare const sanitizeFilePath: typeof validateFilePath;
+export declare const sanitizePRNumber: typeof validatePRNumber;
+export declare function isValidMessageId(messageId: string): boolean;
+/**
+ * Validate that a file path resolves to a location inside the current repository.
+ * Prevents arbitrary file read/write vulnerabilities via path traversal or absolute paths.
+ *
+ * @param filePath The path to validate
+ * @param rootDir The root directory (defaults to CWD)
+ * @returns The resolved absolute path if valid
+ * @throws Error if path is outside rootDir
+ */
+export declare function validateRepoPath(filePath: string, rootDir?: string): string;
+/**
+ * Safely resolves the CLI entry point path.
+ * Replaces insecure usage of process.argv[1] which can be manipulated.
+ */
+export declare function getCLIPath(): string;
+//# sourceMappingURL=security.d.ts.map

package/dist/lib/security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../src/lib/security.ts"],"names":[],"mappings":"AAsBA;;;GAGG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAQvD;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAQzD;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAMlE;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAQrD;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAYzD;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAKjD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAU3D;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAIhD;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAGrD;AAGD,eAAO,MAAM,QAAQ;;;;;;CAMpB,CAAA;AAGD,eAAO,MAAM,eAAe,wBAAkB,CAAC;AAC/C,eAAO,MAAM,kBAAkB,2BAAqB,CAAC;AACrD,eAAO,MAAM,gBAAgB,yBAAmB,CAAC;AACjD,eAAO,MAAM,gBAAgB,yBAAmB,CAAC;AAIjD,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAE3D;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAE,MAAsB,GAAG,MAAM,CAgB1F;AAED;;;GAGG;AACH,wBAAgB,UAAU,IAAI,MAAM,CAKnC"}

package/dist/lib/security.js

@@ -0,0 +1,180 @@
+import { resolve, relative, isAbsolute, dirname } from 'path';
+import { fileURLToPath } from 'url';
+/**
+ * Spidersan Security Utilities
+ *
+ * Input validation and sanitization for shell command safety.
+ * Prevents command injection attacks via agent IDs, branch names, etc.
+ *
+ * @module security
+ */
+// Validation patterns
+const VALID_AGENT_ID = /^[a-z0-9][a-z0-9_-]{0,30}$/i;
+const VALID_BRANCH_NAME = /^[a-zA-Z0-9][a-zA-Z0-9/_.-]{0,99}$/;
+const VALID_TASK_ID = /^[a-z0-9][a-z0-9_-]{0,50}$/i;
+// Allow spaces in file paths
+const VALID_FILE_PATH = /^[./a-zA-Z0-9][a-zA-Z0-9/_.@\- ]{0,200}$/;
+// Shell metacharacters to remove from text
+const SHELL_METACHARACTERS = /[`$(){}[\]|;&<>\\]/g;
+/**
+ * Validate agent ID (e.g., "sherlock", "watsan-1", "agent_01")
+ * @throws Error if invalid
+ */
+export function validateAgentId(agentId) {
+    if (!agentId || typeof agentId !== 'string') {
+        throw new Error('Agent ID is required');
+    }
+    if (!VALID_AGENT_ID.test(agentId)) {
+        throw new Error(`Invalid agent ID: "${agentId.slice(0, 20)}..." (must be alphanumeric with - or _)`);
+    }
+    return agentId;
+}
+/**
+ * Validate git branch name
+ * @throws Error if invalid
+ */
+export function validateBranchName(branch) {
+    if (!branch || typeof branch !== 'string') {
+        throw new Error('Branch name is required');
+    }
+    if (!VALID_BRANCH_NAME.test(branch)) {
+        throw new Error(`Invalid branch name: "${branch.slice(0, 20)}..."`);
+    }
+    return branch;
+}
+/**
+ * Validate PR number
+ * @throws Error if invalid
+ */
+export function validatePRNumber(prNumber) {
+    const num = typeof prNumber === 'string' ? parseInt(prNumber, 10) : prNumber;
+    if (!Number.isInteger(num) || num <= 0) {
+        throw new Error(`Invalid PR number: ${prNumber}`);
+    }
+    return num;
+}
+/**
+ * Validate task ID (for torrent/task commands)
+ * @throws Error if invalid
+ */
+export function validateTaskId(taskId) {
+    if (!taskId || typeof taskId !== 'string') {
+        throw new Error('Task ID is required');
+    }
+    if (!VALID_TASK_ID.test(taskId)) {
+        throw new Error(`Invalid task ID: "${taskId.slice(0, 20)}..." (must be alphanumeric with - or _)`);
+    }
+    return taskId;
+}
+/**
+ * Validate file path (basic safety check)
+ * @throws Error if invalid
+ */
+export function validateFilePath(filePath) {
+    if (!filePath || typeof filePath !== 'string') {
+        throw new Error('File path is required');
+    }
+    // Block path traversal
+    if (filePath.includes('..')) {
+        throw new Error('Path traversal not allowed');
+    }
+    if (!VALID_FILE_PATH.test(filePath)) {
+        throw new Error(`Invalid file path: "${filePath.slice(0, 20)}..."`);
+    }
+    return filePath;
+}
+/**
+ * Sanitize free-form text by removing shell metacharacters
+ * Use for message bodies, subjects, etc.
+ */
+export function sanitizeText(text) {
+    if (!text || typeof text !== 'string') {
+        return '';
+    }
+    return text.replace(SHELL_METACHARACTERS, '');
+}
+/**
+ * Sanitize an array of file paths
+ */
+export function sanitizeFilePaths(files) {
+    return files.filter(f => {
+        try {
+            validateFilePath(f);
+            return true;
+        }
+        catch {
+            console.warn(`⚠️ Skipping invalid file path: ${f.slice(0, 30)}...`);
+            return false;
+        }
+    });
+}
+/**
+ * Escape a string for safe use in git commands (minimal escaping)
+ */
+export function escapeGitArg(arg) {
+    // For use with execFileSync where no shell is invoked
+    // Just basic validation, no escaping needed
+    return arg;
+}
+/**
+ * Escapes a string so it can be safely used in a shell script.
+ * Replaces single quotes with '\'' and wraps the result in single quotes.
+ * Prevents command injection when generating bash scripts.
+ */
+export function escapeShellString(str) {
+    if (str === null || str === undefined)
+        return "''";
+    return `'${String(str).replace(/'/g, "'\\''")}'`;
+}
+// Export validation patterns for testing
+export const patterns = {
+    VALID_AGENT_ID,
+    VALID_BRANCH_NAME,
+    VALID_TASK_ID,
+    VALID_FILE_PATH,
+    SHELL_METACHARACTERS,
+};
+// Test-compatible aliases for vitest security tests
+export const sanitizeAgentId = validateAgentId;
+export const sanitizeBranchName = validateBranchName;
+export const sanitizeFilePath = validateFilePath;
+export const sanitizePRNumber = validatePRNumber;
+// Message ID validation (for mycmail commands)
+const VALID_MESSAGE_ID = /^[a-z0-9][a-z0-9_-]{0,64}$/i;
+export function isValidMessageId(messageId) {
+    return typeof messageId === 'string' && VALID_MESSAGE_ID.test(messageId);
+}
+/**
+ * Validate that a file path resolves to a location inside the current repository.
+ * Prevents arbitrary file read/write vulnerabilities via path traversal or absolute paths.
+ *
+ * @param filePath The path to validate
+ * @param rootDir The root directory (defaults to CWD)
+ * @returns The resolved absolute path if valid
+ * @throws Error if path is outside rootDir
+ */
+export function validateRepoPath(filePath, rootDir = process.cwd()) {
+    if (!filePath || typeof filePath !== 'string') {
+        throw new Error('File path is required');
+    }
+    const resolved = resolve(rootDir, filePath);
+    const rel = relative(rootDir, resolved);
+    // Check if path is outside root (starts with ..) or is absolute (on different drive on Windows)
+    // Note: on Linux/Mac relative() returns relative path, on Windows it might be absolute if different drive.
+    // Checking isAbsolute(rel) handles the different drive case.
+    if (rel.startsWith('..') || isAbsolute(rel)) {
+        throw new Error(`Security Error: Path "${filePath}" resolves outside the repository.`);
+    }
+    return resolved;
+}
+/**
+ * Safely resolves the CLI entry point path.
+ * Replaces insecure usage of process.argv[1] which can be manipulated.
+ */
+export function getCLIPath() {
+    const __filename = fileURLToPath(import.meta.url);
+    const __dirname = dirname(__filename);
+    const ext = __filename.endsWith('.ts') ? '.ts' : '.js';
+    return resolve(__dirname, '..', 'bin', `spidersan${ext}`);
+}
+//# sourceMappingURL=security.js.map

package/dist/lib/security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.js","sourceRoot":"","sources":["../../src/lib/security.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AAEpC;;;;;;;GAOG;AAEH,sBAAsB;AACtB,MAAM,cAAc,GAAG,6BAA6B,CAAC;AACrD,MAAM,iBAAiB,GAAG,oCAAoC,CAAC;AAC/D,MAAM,aAAa,GAAG,6BAA6B,CAAC;AACpD,6BAA6B;AAC7B,MAAM,eAAe,GAAG,0CAA0C,CAAC;AAEnE,2CAA2C;AAC3C,MAAM,oBAAoB,GAAG,qBAAqB,CAAC;AAEnD;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe;IAC3C,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,sBAAsB,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,yCAAyC,CAAC,CAAC;IACzG,CAAC;IACD,OAAO,OAAO,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAc;IAC7C,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,yBAAyB,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAyB;IACtD,MAAM,GAAG,GAAG,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC7E,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,sBAAsB,QAAQ,EAAE,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,GAAG,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,MAAc;IACzC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,qBAAqB,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,yCAAyC,CAAC,CAAC;IACvG,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC7C,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC7C,CAAC;IACD,uBAAuB;IACvB,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,uBAAuB,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,QAAQ,CAAC;AACpB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY;IACrC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACpC,OAAO,EAAE,CAAC;IACd,CAAC;IACD,OAAO,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC;AAClD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAe;IAC7C,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;QACpB,IAAI,CAAC;YACD,gBAAgB,CAAC,CAAC,CAAC,CAAC;YACpB,OAAO,IAAI,CAAC;QAChB,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;YACpE,OAAO,KAAK,CAAC;QACjB,CAAC;IACL,CAAC,CAAC,CAAC;AACP,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,GAAW;IACpC,sDAAsD;IACtD,4CAA4C;IAC5C,OAAO,GAAG,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAW;IACzC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACnD,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AACrD,CAAC;AAED,yCAAyC;AACzC,MAAM,CAAC,MAAM,QAAQ,GAAG;IACpB,cAAc;IACd,iBAAiB;IACjB,aAAa;IACb,eAAe;IACf,oBAAoB;CACvB,CAAA;AAED,oDAAoD;AACpD,MAAM,CAAC,MAAM,eAAe,GAAG,eAAe,CAAC;AAC/C,MAAM,CAAC,MAAM,kBAAkB,GAAG,kBAAkB,CAAC;AACrD,MAAM,CAAC,MAAM,gBAAgB,GAAG,gBAAgB,CAAC;AACjD,MAAM,CAAC,MAAM,gBAAgB,GAAG,gBAAgB,CAAC;AAEjD,+CAA+C;AAC/C,MAAM,gBAAgB,GAAG,6BAA6B,CAAC;AACvD,MAAM,UAAU,gBAAgB,CAAC,SAAiB;IAC9C,OAAO,OAAO,SAAS,KAAK,QAAQ,IAAI,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAgB,EAAE,UAAkB,OAAO,CAAC,GAAG,EAAE;IAC9E,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC7C,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAExC,gGAAgG;IAChG,2GAA2G;IAC3G,6DAA6D;IAC7D,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,yBAAyB,QAAQ,oCAAoC,CAAC,CAAC;IAC3F,CAAC;IAED,OAAO,QAAQ,CAAC;AACpB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU;IACtB,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IACvD,OAAO,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,GAAG,EAAE,CAAC,CAAC;AAC9D,CAAC"}

package/dist/lib/semantic-analysis.d.ts

@@ -0,0 +1,31 @@
+import { type SymbolConflict } from './ast.js';
+export interface SemanticTarget {
+    label: string;
+    files: string[];
+    /** Resolvable git ref for this target's head, or null when it isn't available locally. */
+    ref: string | null;
+}
+export interface SemanticResult {
+    conflicts: SymbolConflict[];
+    /** One human-readable line per file/target that could not be analyzed. */
+    skipped: string[];
+    /**
+     * Overlapping files of a type semantic analysis doesn't cover (.sql, .yaml, .md …). "No symbol
+     * conflicts" says nothing about them, so callers must not turn it into "safe to merge".
+     */
+    unsupported: string[];
+}
+/**
+ * A branch's tip for analysis: the LOCAL branch first (unpushed commits are the point), then
+ * origin's. resolveBranchRef alone prefers the remote and would read a stale tip.
+ */
+export declare function resolveBranchTip(name: string): string | null;
+/**
+ * A cross-machine label "<machine>/<branch>" names ANOTHER machine's branch, so it resolves only
+ * against origin — a same-named local branch would be the wrong tip. The caller must know the
+ * label is cross-machine (from where the entry came from); guessing from the label's shape is
+ * ambiguous for local branches like "feat/x".
+ */
+export declare function resolveCrossMachineRef(label: string): string | null;
+export declare function analyzeSemantic(currentLabel: string, currentRef: string | null, targets: SemanticTarget[], cwd?: string): SemanticResult;
+//# sourceMappingURL=semantic-analysis.d.ts.map

package/dist/lib/semantic-analysis.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"semantic-analysis.d.ts","sourceRoot":"","sources":["../../src/lib/semantic-analysis.ts"],"names":[],"mappings":"AAQA,OAAO,EAAa,KAAK,cAAc,EAAE,MAAM,UAAU,CAAC;AAI1D,MAAM,WAAW,cAAc;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,0FAA0F;IAC1F,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC3B,SAAS,EAAE,cAAc,EAAE,CAAC;IAC5B,0EAA0E;IAC1E,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB;;;OAGG;IACH,WAAW,EAAE,MAAM,EAAE,CAAC;CACzB;AAqBD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAE5D;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAGnE;AAED,wBAAgB,eAAe,CAC3B,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,GAAG,IAAI,EACzB,OAAO,EAAE,cAAc,EAAE,EACzB,GAAG,CAAC,EAAE,MAAM,GACb,cAAc,CAyEhB"}

package/dist/lib/semantic-analysis.js

@@ -0,0 +1,120 @@
+/**
+ * semantic-analysis.ts — the `conflicts --semantic` engine.
+ *
+ * Takes targets that carry a REAL git ref (never a display label like
+ * "PR #303 (branch)") and returns symbol conflicts plus every file it could not
+ * analyze. Callers must not print "safe to merge" while `skipped` is non-empty.
+ */
+import { execFileSync } from 'child_process';
+import { ASTParser } from './ast.js';
+import { findOutlineConflicts } from './outline.js';
+import { resolveBranchRef, resolveLocalBranchRef } from './git.js';
+const TS_FILE = /\.(ts|js|tsx|jsx)$/;
+const PY_FILE = /\.py$/;
+const git = (args, cwd) => execFileSync('git', args, { encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'], cwd, timeout: 30_000 }); // a hung object store must not hang the command
+/**
+ * File content at ref; null ONLY when the path genuinely doesn't exist there (a legitimate
+ * non-conflict). Any other git failure throws, so the caller records it as skipped instead of
+ * reading it as "absent".
+ *
+ * `ls-tree`, not `cat-file -e`: cat-file exits 128 for a missing path AND for a bad ref/repo, so it
+ * can't tell them apart. ls-tree exits 0 with empty output for an absent path and non-zero otherwise.
+ */
+function show(ref, file, cwd) {
+    if (!git(['ls-tree', '--name-only', ref, '--', file], cwd).trim())
+        return null;
+    return git(['show', `${ref}:${file}`], cwd);
+}
+/**
+ * A branch's tip for analysis: the LOCAL branch first (unpushed commits are the point), then
+ * origin's. resolveBranchRef alone prefers the remote and would read a stale tip.
+ */
+export function resolveBranchTip(name) {
+    return resolveLocalBranchRef(name) ?? resolveBranchRef(name);
+}
+/**
+ * A cross-machine label "<machine>/<branch>" names ANOTHER machine's branch, so it resolves only
+ * against origin — a same-named local branch would be the wrong tip. The caller must know the
+ * label is cross-machine (from where the entry came from); guessing from the label's shape is
+ * ambiguous for local branches like "feat/x".
+ */
+export function resolveCrossMachineRef(label) {
+    const remote = resolveBranchRef(label.slice(label.indexOf('/') + 1));
+    return remote?.startsWith('refs/remotes/') ? remote : null;
+}
+export function analyzeSemantic(currentLabel, currentRef, targets, cwd) {
+    const parser = new ASTParser();
+    const result = { conflicts: [], skipped: [], unsupported: [] };
+    for (const target of targets) {
+        for (const file of target.files) {
+            const isPython = PY_FILE.test(file);
+            if (!isPython && !TS_FILE.test(file)) {
+                if (!result.unsupported.includes(file))
+                    result.unsupported.push(file);
+                continue;
+            }
+            // An unresolvable ref is UNKNOWN, not "no conflict" — never swallow it.
+            if (!currentRef) {
+                result.skipped.push(`${file}: no local ref for ${currentLabel}`);
+                continue;
+            }
+            if (!target.ref) {
+                result.skipped.push(`${file}: no local ref for ${target.label} (not fetched?)`);
+                continue;
+            }
+            let current;
+            let other;
+            try {
+                current = show(currentRef, file, cwd);
+                other = show(target.ref, file, cwd);
+            }
+            catch {
+                result.skipped.push(`${file}: could not read from ${target.label}`);
+                continue;
+            }
+            // Absent on one side = added/deleted there. A delete/modify overlap is a real git conflict, and
+            // symbol comparison can't judge it, so it is unanalyzed (incomplete), never "nothing to conflict".
+            if (current === null || other === null) {
+                result.skipped.push(`${file}: absent on ${current === null ? currentLabel : target.label} (added or deleted) — not analyzed`);
+                continue;
+            }
+            // Three-way against the merge-base. Two-way ONLY when the histories are genuinely unrelated
+            // (merge-base exit 1); any other failure is unknown, not a reason to change comparison mode.
+            let base;
+            try {
+                let mb = null;
+                try {
+                    mb = git(['merge-base', currentRef, target.ref], cwd).trim();
+                }
+                catch (err) {
+                    if (err.status !== 1)
+                        throw err; // 1 = no common ancestor
+                }
+                base = mb ? show(mb, file, cwd) ?? undefined : undefined;
+            }
+            catch {
+                result.skipped.push(`${file}: could not compute merge-base with ${target.label}`);
+                continue;
+            }
+            let found;
+            try {
+                found = isPython
+                    ? findOutlineConflicts('.py', current, `${currentLabel}:${file}`, other, `${target.label}:${file}`, base)
+                    : parser.findSymbolConflicts(current, `${currentLabel}:${file}`, other, `${target.label}:${file}`, base);
+            }
+            catch {
+                // A parser failure is unknown, not "no conflicts". No caught message: it can carry
+                // internals and this line is printed.
+                result.skipped.push(`${file}: parse failed`);
+                continue;
+            }
+            if (!found) {
+                result.skipped.push(`${file}: semantic analysis unavailable (install ast-grep)`);
+                continue;
+            }
+            result.conflicts.push(...found);
+        }
+    }
+    return result;
+}
+//# sourceMappingURL=semantic-analysis.js.map

package/dist/lib/semantic-analysis.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"semantic-analysis.js","sourceRoot":"","sources":["../../src/lib/semantic-analysis.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAuB,MAAM,UAAU,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAoBnE,MAAM,OAAO,GAAG,oBAAoB,CAAC;AACrC,MAAM,OAAO,GAAG,OAAO,CAAC;AAExB,MAAM,GAAG,GAAG,CAAC,IAAc,EAAE,GAAY,EAAU,EAAE,CACjD,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,gDAAgD;AAEjK;;;;;;;GAOG;AACH,SAAS,IAAI,CAAC,GAAW,EAAE,IAAY,EAAE,GAAY;IACjD,IAAI,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,aAAa,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC;IAC/E,OAAO,GAAG,CAAC,CAAC,MAAM,EAAE,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;AAChD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IACzC,OAAO,qBAAqB,CAAC,IAAI,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC;AACjE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAa;IAChD,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACrE,OAAO,MAAM,EAAE,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,eAAe,CAC3B,YAAoB,EACpB,UAAyB,EACzB,OAAyB,EACzB,GAAY;IAEZ,MAAM,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;IAC/B,MAAM,MAAM,GAAmB,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;IAE/E,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC3B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YAC9B,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACpC,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC;oBAAE,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACtE,SAAS;YACb,CAAC;YAED,wEAAwE;YACxE,IAAI,CAAC,UAAU,EAAE,CAAC;gBACd,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,sBAAsB,YAAY,EAAE,CAAC,CAAC;gBACjE,SAAS;YACb,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;gBACd,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,sBAAsB,MAAM,CAAC,KAAK,iBAAiB,CAAC,CAAC;gBAChF,SAAS;YACb,CAAC;YAED,IAAI,OAAsB,CAAC;YAC3B,IAAI,KAAoB,CAAC;YACzB,IAAI,CAAC;gBACD,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;gBACtC,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YACxC,CAAC;YAAC,MAAM,CAAC;gBACL,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,yBAAyB,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;gBACpE,SAAS;YACb,CAAC;YACD,gGAAgG;YAChG,mGAAmG;YACnG,IAAI,OAAO,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACrC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,eAAe,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,oCAAoC,CAAC,CAAC;gBAC9H,SAAS;YACb,CAAC;YAED,4FAA4F;YAC5F,6FAA6F;YAC7F,IAAI,IAAwB,CAAC;YAC7B,IAAI,CAAC;gBACD,IAAI,EAAE,GAAkB,IAAI,CAAC;gBAC7B,IAAI,CAAC;oBACD,EAAE,GAAG,GAAG,CAAC,CAAC,YAAY,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;gBACjE,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACX,IAAK,GAA2B,CAAC,MAAM,KAAK,CAAC;wBAAE,MAAM,GAAG,CAAC,CAAC,yBAAyB;gBACvF,CAAC;gBACD,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;YAC7D,CAAC;YAAC,MAAM,CAAC;gBACL,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,uCAAuC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;gBAClF,SAAS;YACb,CAAC;YAED,IAAI,KAA8B,CAAC;YACnC,IAAI,CAAC;gBACD,KAAK,GAAG,QAAQ;oBACZ,CAAC,CAAC,oBAAoB,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,YAAY,IAAI,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC,KAAK,IAAI,IAAI,EAAE,EAAE,IAAI,CAAC;oBACzG,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,GAAG,YAAY,IAAI,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC,KAAK,IAAI,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;YACjH,CAAC;YAAC,MAAM,CAAC;gBACL,mFAAmF;gBACnF,sCAAsC;gBACtC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,gBAAgB,CAAC,CAAC;gBAC7C,SAAS;YACb,CAAC;YACD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACT,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,oDAAoD,CAAC,CAAC;gBACjF,SAAS;YACb,CAAC;YACD,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;QACpC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC"}

package/dist/lib/supabase-credentials.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Single source of truth for resolving spidersan's Supabase credentials.
+ *
+ * Precedence: SPIDERSAN_SUPABASE_* → SUPABASE_* → config.storage.*
+ *
+ * SPIDERSAN_SUPABASE_* MUST come first. envoak's vault-inject guard drops any
+ * secret whose name carries a bare SUPABASE_ prefix, so vault-injected creds
+ * only ever arrive under the scoped names. Resolvers checking just the bare
+ * names silently no-op under `envoak vault inject` — the production hook path —
+ * and report "Supabase not configured" while a valid grant is present (fc8cf22,
+ * 29aa575, tb-efmm; tb-ly0b found 7 more copies with the same defect).
+ *
+ * This module exists so that stays fixed in ONE place. Do not re-derive these
+ * env names inline; call resolveSupabaseCredentials()/resolveSupabaseEnv().
+ *
+ * COLONY_SUPABASE_* is deliberately absent from the chain: colony points at a
+ * different Supabase project, so falling back to it would silently write
+ * spider_registries into the wrong database (tb-ly0b).
+ */
+export interface SupabaseCredentials {
+    url: string;
+    key: string;
+}
+/**
+ * Env-only resolution. For callers with no config file in scope (subscribers,
+ * activity logging) that need a synchronous answer.
+ */
+export declare function resolveSupabaseEnv(): {
+    url?: string;
+    key?: string;
+};
+/**
+ * Env → config.storage. The default for commands; null when unconfigured.
+ */
+export declare function resolveSupabaseCredentials(basePath?: string): Promise<SupabaseCredentials | null>;
+//# sourceMappingURL=supabase-credentials.d.ts.map

package/dist/lib/supabase-credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"supabase-credentials.d.ts","sourceRoot":"","sources":["../../src/lib/supabase-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,MAAM,WAAW,mBAAmB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACf;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,IAAI;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,CAKnE;AAED;;GAEG;AACH,wBAAsB,0BAA0B,CAC5C,QAAQ,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAQrC"}

package/dist/lib/supabase-credentials.js

@@ -0,0 +1,43 @@
+/**
+ * Single source of truth for resolving spidersan's Supabase credentials.
+ *
+ * Precedence: SPIDERSAN_SUPABASE_* → SUPABASE_* → config.storage.*
+ *
+ * SPIDERSAN_SUPABASE_* MUST come first. envoak's vault-inject guard drops any
+ * secret whose name carries a bare SUPABASE_ prefix, so vault-injected creds
+ * only ever arrive under the scoped names. Resolvers checking just the bare
+ * names silently no-op under `envoak vault inject` — the production hook path —
+ * and report "Supabase not configured" while a valid grant is present (fc8cf22,
+ * 29aa575, tb-efmm; tb-ly0b found 7 more copies with the same defect).
+ *
+ * This module exists so that stays fixed in ONE place. Do not re-derive these
+ * env names inline; call resolveSupabaseCredentials()/resolveSupabaseEnv().
+ *
+ * COLONY_SUPABASE_* is deliberately absent from the chain: colony points at a
+ * different Supabase project, so falling back to it would silently write
+ * spider_registries into the wrong database (tb-ly0b).
+ */
+import { loadConfig } from './config.js';
+/**
+ * Env-only resolution. For callers with no config file in scope (subscribers,
+ * activity logging) that need a synchronous answer.
+ */
+export function resolveSupabaseEnv() {
+    return {
+        url: process.env.SPIDERSAN_SUPABASE_URL || process.env.SUPABASE_URL,
+        key: process.env.SPIDERSAN_SUPABASE_KEY || process.env.SUPABASE_KEY,
+    };
+}
+/**
+ * Env → config.storage. The default for commands; null when unconfigured.
+ */
+export async function resolveSupabaseCredentials(basePath) {
+    const env = resolveSupabaseEnv();
+    const config = await loadConfig(basePath);
+    const url = env.url || config.storage.supabaseUrl;
+    const key = env.key || config.storage.supabaseKey;
+    if (!url || !key)
+        return null;
+    return { url, key };
+}
+//# sourceMappingURL=supabase-credentials.js.map

package/dist/lib/supabase-credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"supabase-credentials.js","sourceRoot":"","sources":["../../src/lib/supabase-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAOzC;;;GAGG;AACH,MAAM,UAAU,kBAAkB;IAC9B,OAAO;QACH,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY;QACnE,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY;KACtE,CAAC;AACN,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC5C,QAAiB;IAEjB,MAAM,GAAG,GAAG,kBAAkB,EAAE,CAAC;IACjC,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC;IAClD,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC;IAElD,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAC9B,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AACxB,CAAC"}

package/dist/lib/trunk.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Trunk branch detection.
+ *
+ * Centralizes the "which branch is trunk?" question that was previously
+ * hardcoded as `main`/`master` in several places.
+ *
+ * Resolution order (first hit wins):
+ *   1. `git symbolic-ref refs/remotes/origin/HEAD` (strip the `origin/` prefix)
+ *   2. `.spidersanrc` `trunk` key
+ *   3. `main`   — if that branch exists
+ *   4. `master` — if that branch exists
+ *   5. `'main'` — default fallback
+ *
+ * Pure + cached per `cwd` within a process. Tolerates a missing
+ * `origin/HEAD` (fresh clones throw — we catch and fall through).
+ */
+/**
+ * Resolve the repo's trunk branch name.
+ *
+ * @param opts.cwd - Repo directory (defaults to `process.cwd()`).
+ * @returns The trunk branch name (e.g. `'main'`, `'master'`, `'develop'`).
+ */
+export declare function getTrunkBranch(opts?: {
+    cwd?: string;
+}): string;
+/**
+ * True if `branch` is the repo's trunk.
+ *
+ * @param branch - Branch name to test.
+ * @param opts.cwd - Repo directory (defaults to `process.cwd()`).
+ */
+export declare function isTrunk(branch: string, opts?: {
+    cwd?: string;
+}): boolean;
+/**
+ * Clear the per-cwd trunk cache. Intended for tests; harmless in production.
+ */
+export declare function _clearTrunkCache(): void;
+//# sourceMappingURL=trunk.d.ts.map

package/dist/lib/trunk.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trunk.d.ts","sourceRoot":"","sources":["../../src/lib/trunk.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AA0EH;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAQ9D;AAED;;;;;GAKG;AACH,wBAAgB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAExE;AAED;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,IAAI,CAEvC"}