srclawyer 0.6.3 → 0.8.0

package/README.md

@@ -23,10 +23,44 @@ srclawyer init
 srclawyer scan                  # analyze the codebase and write PRIVACY_POLICY.md
 srclawyer scan --json           # findings as JSON (still writes the policy file)
 srclawyer scan --out docs/privacy.md
+srclawyer scan --force          # overwrite the policy even if it was edited (see below)
 ```
 
 If `srclawyer` isn't found right after a global install, see [Troubleshooting: command not found](#troubleshooting-command-not-found) below.
 
+## Editing the generated policy
+
+`scan` regenerates `PRIVACY_POLICY.md` freely **until you edit it**. After that the file is yours, and `scan` will not overwrite it.
+
+The generated policy has `[TO COMPLETE: …]` placeholders for facts only you know (company name, contact email, retention period, and so on). Fill them in by answering the `init` questions or by setting the same fields in `.srclawyer.config.yml`, then re-run `scan`: the placeholders are replaced. Once you have changed the file by hand (filled a placeholder in the text, reworded a section, anything), it is no longer the generated version, so complete the rest by hand too.
+
+How it works: every generated policy ends with a marker line, `<!-- srclawyer:policy-sha256=… -->`, holding a hash of the rest of the file. Before writing, `scan` recomputes the hash.
+
+| The existing file | What `scan` does |
+|---|---|
+| doesn't exist, or still matches its marker | writes the new policy |
+| edited since it was generated | refuses (see below) |
+| has no marker | refuses (see below) |
+| any of the above, with `--force` | overwrites it |
+
+When it refuses, a plain `scan` exits 2 before scanning anything, and prints one of these:
+
+```text
+Not overwriting PRIVACY_POLICY.md: it has been edited since SrcLawyer generated it. Write the new policy to a separate file with --out PRIVACY_POLICY.generated.md and compare, or pass --force to replace it.
+```
+
+```text
+Not overwriting PRIVACY_POLICY.md: it was not generated by this version of SrcLawyer (it may be hand-written, or generated before overwrite protection was added in 0.8.0). Write the new policy to a separate file with --out PRIVACY_POLICY.generated.md and compare, or pass --force to replace it.
+```
+
+- **`--out` is guarded the same way.** `srclawyer scan --out PRIVACY_POLICY.generated.md` writes a draft you can compare with your edited policy; running it again overwrites that draft cleanly as long as you haven't edited the draft.
+- **`scan --write-inventory`** still writes the drift baseline when your policy is protected. It leaves the policy untouched, says so, and exits 0. So "update the policy by hand, then refresh the baseline" works without `--force`.
+- **`init`** never overwrites a policy. If `PRIVACY_POLICY.md` is already there and would be refused, it skips its "run a scan now?" question and prints the `--out` command instead.
+- **The marker is an HTML comment.** It is invisible when the Markdown is rendered, but it is in the file's raw text and in the page source if you publish the Markdown as is. You can delete the line, and nothing breaks, but the file then counts as not generated by SrcLawyer and is protected from then on.
+- **Formatters count as edits.** If a formatter (Prettier, a Markdown auto-fix hook) rewrites the file, it no longer matches its marker. `scan` fails safe: it refuses, and you use `--out` or `--force`.
+
+**Upgrading from 0.7.0 or earlier.** Policies generated before 0.8.0 have no marker, so the first `scan` after upgrading refuses to overwrite one, even if you never edited it. If you never touched it, run `srclawyer scan --force` once; from then on it carries a marker. If you did edit it, run `srclawyer scan --out PRIVACY_POLICY.generated.md` and compare the two files.
+
 ## Development
 
 Working on SrcLawyer itself (not just using it):
@@ -117,6 +151,51 @@ llm:
 
 Only the variable's *name* is stored in the config — the key itself is never written to disk. When it's enabled, `scan` prints a notice that redacted snippets are being sent to Anthropic; `scan --no-llm` skips it for a single run. A hosted tier, where SrcLawyer supplies the model access and no key is needed, is planned but not yet available: a config with `tier: managed` gets a clear "not available yet" error rather than silently doing nothing.
 
+## Drift check (GitHub Action)
+
+**Free during the beta.** Flags when your code starts collecting a new kind of data, or using a new third-party processor, that your privacy policy was never updated for. It compares the code against a committed baseline, `.srclawyer.inventory.json` — just the sorted data categories and processors, no file names or line numbers — not against policy text, which people edit by hand.
+
+```bash
+npx srclawyer scan --write-inventory     # once: writes the policy (if safe to) and the baseline; commit the baseline
+npx srclawyer check                      # exit 0 no drift, 1 drift, 2 error, 3 inconclusive
+```
+
+```yaml
+- uses: actions/checkout@v7
+- uses: SrcLawyer/srclawyer@v0.8.0
+  with:
+    srclawyer-version: 0.8.0             # required and pinned
+```
+
+Drift fails the check, and the step summary lists what was added and removed with a one-line fix. If no verdict can be reached — the confidence service is unreachable, files were skipped, or the baseline and the run used different file discovery — the result is **inconclusive**, a warning by default, and is never reported as drift. The Action needs no secrets and `contents: read`; an optional pull-request comment needs `pull-requests: write`. Inside a git repository, `check` and `--write-inventory` look only at tracked and untracked-but-not-ignored files, so a gitignored build directory can't cause phantom drift; plain `scan` is unchanged. `check` makes the same network calls as `scan` (below) and never calls an AI provider.
+
+| Exit code | `srclawyer check` | `srclawyer scan` |
+|---|---|---|
+| 0 | no drift | clean |
+| 1 | drift | completed with warnings |
+| 2 | crash, bad usage, or a missing or invalid baseline | crash or bad usage |
+| 3 | inconclusive | — |
+
+`scan`'s "completed with warnings" (1) and `check`'s "inconclusive" (3) are the same condition under different numbers; `scan`'s was left alone so existing scripts keep working. Example workflows (pull requests, a weekly schedule, manual dispatch, writing the baseline on the runner) are in [docs/github-action.md](docs/github-action.md).
+
+## Removing SrcLawyer
+
+SrcLawyer writes at most three files into your project, and only when you ask it to:
+
+- `.srclawyer.config.yml`, written by `srclawyer init`.
+- `PRIVACY_POLICY.md`, written by `srclawyer scan` (or the path you give `--out`) unless that file has been edited, in which case [it is left alone](#editing-the-generated-policy).
+- `.srclawyer.inventory.json`, written only when you pass `--write-inventory` to `scan` (or the path you give it).
+
+Delete whichever of them you no longer want. No other SrcLawyer command writes files: `srclawyer check` is read-only, and installing the package writes nothing to your project.
+
+SrcLawyer never creates a workflow file. To stop the [GitHub Action](#drift-check-github-action), delete or edit the workflow you added yourself (for example `.github/workflows/srclawyer.yml`).
+
+To remove the command-line tool:
+
+```bash
+npm uninstall -g srclawyer
+```
+
 ## Network calls
 
 Detection itself is fully local and offline — no code leaves your machine for pattern matching. Once detection completes, every `scan` makes these calls to a SrcLawyer-run service:

package/dist/cli.js

@@ -1,15 +1,18 @@
 #!/usr/bin/env node
-import { readFileSync } from "node:fs";
-import { dirname, join } from "node:path";
-import { fileURLToPath } from "node:url";
-import { Command } from "commander";
+import { Command, CommanderError } from "commander";
 import { isValidEnvVarName, runInit } from "./commands/init.js";
 import { runScan } from "./commands/scan.js";
+import { runCheck } from "./commands/check.js";
+import { DEFAULT_INVENTORY_PATH } from "./inventory/inventory.js";
+import { EXIT_CRASH } from "./exitCodes.js";
+import { readPackageVersion } from "./version.js";
 // Read from package.json rather than hardcoding, so --version can't silently drift out of sync with
 // the published version the way a literal string did through every prior release.
-const HERE = dirname(fileURLToPath(import.meta.url));
-const { version } = JSON.parse(readFileSync(join(HERE, "../package.json"), "utf8"));
+const version = readPackageVersion();
 const program = new Command();
+// Commander normally calls process.exit(1) itself on a usage error; exit codes are this CLI's contract
+// (see exitCodes.ts), so it throws instead and the handler at the bottom decides the code.
+program.exitOverride();
 program
     .name("srclawyer")
     .description("Static analysis engine that derives privacy policy documentation directly from source code")
@@ -78,7 +81,43 @@ program
     .option("--json", "output findings as JSON", false)
     .option("--out <path>", "path to write the generated privacy policy", "PRIVACY_POLICY.md")
     .option("--no-llm", "skip AI-assisted resolution of ambiguous findings for this run")
+    .option("--write-inventory [path]", `also write the drift baseline (data categories and processors only) to <path> (default ${DEFAULT_INVENTORY_PATH}); uses git-aware file discovery in a git repository`)
+    .option("--allow-incomplete-inventory", "with --write-inventory: write the baseline even if the scan completed with warnings")
+    .option("--force", "overwrite the policy file even if it was edited since SrcLawyer generated it, or was not generated by SrcLawyer", false)
     .action(async (opts) => {
-    await runScan(process.cwd(), { json: opts.json, out: opts.out, llm: opts.llm });
+    await runScan(process.cwd(), {
+        json: opts.json,
+        out: opts.out,
+        llm: opts.llm,
+        writeInventory: opts.writeInventory === true ? DEFAULT_INVENTORY_PATH : opts.writeInventory,
+        allowIncompleteInventory: opts.allowIncompleteInventory,
+        force: opts.force,
+    });
+});
+program
+    .command("check")
+    .description("Check for drift: compare the code's data categories and processors with the committed baseline (exit 0 no drift, 1 drift, 2 error, 3 inconclusive)")
+    .option("--inventory <path>", "the baseline file", DEFAULT_INVENTORY_PATH)
+    .option("--format <format>", "text or json", "text")
+    .action(async (opts) => {
+    const format = opts.format;
+    if (format !== "text" && format !== "json")
+        return program.error(`error: --format must be "text" or "json" (got "${format}")`);
+    process.exitCode = await runCheck(process.cwd(), { inventoryPath: opts.inventory, format });
+});
+// Exit 1 is reserved for "completed with warnings" (scan) and "drift" (check), so anything that ends
+// the run abnormally -- an uncaught error, an unhandled rejection, a usage error -- exits 2.
+function crash(error) {
+    console.error(error instanceof Error ? (error.stack ?? error.message) : String(error));
+    process.exit(EXIT_CRASH);
+}
+process.on("uncaughtException", crash);
+process.on("unhandledRejection", crash);
+program.parseAsync(process.argv).catch((error) => {
+    if (error instanceof CommanderError) {
+        // Help and --version also arrive here, with exitCode 0; commander has already printed its message.
+        process.exitCode = error.exitCode === 0 ? 0 : EXIT_CRASH;
+        return;
+    }
+    crash(error);
 });
-program.parseAsync(process.argv);

package/dist/commands/check.d.ts

@@ -0,0 +1,28 @@
+import { type DiscoveryMode, type InventoryDiff } from "../inventory/inventory.js";
+export type CheckFormat = "text" | "json";
+export interface CheckOptions {
+    inventoryPath: string;
+    format: CheckFormat;
+}
+export interface CheckReport {
+    result: "no-drift" | "drift" | "inconclusive" | "error";
+    exitCode: number;
+    srclawyerVersion: string;
+    baseline: {
+        path: string;
+        srclawyerVersion: string;
+        discovery: DiscoveryMode;
+    } | null;
+    currentDiscovery: DiscoveryMode | null;
+    /** Present only for a conclusive result -- an inconclusive run never reports a diff. */
+    diff: InventoryDiff | null;
+    inconclusiveReasons: string[];
+    error: string | null;
+}
+/**
+ * Re-derives the inventory and compares it with the committed baseline. Never writes a policy, never
+ * calls an LLM provider, and never reports an incomplete scan as drift: anything that makes the scan
+ * untrustworthy (the same warnings that make `scan` exit 1, or a discovery-mode mismatch) is
+ * inconclusive and carries no diff.
+ */
+export declare function runCheck(root: string, options: CheckOptions): Promise<number>;

package/dist/commands/check.js

@@ -0,0 +1,93 @@
+import { existsSync, readFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { scan } from "../engine/scanEngine.js";
+import { selectDiscovery } from "../engine/gitDiscovery.js";
+import { resolveScanProtectedLogic } from "./protectedLogicStep.js";
+import { computeInventory, diffInventories, hasDrift, inventoryBlockers, parseInventory, } from "../inventory/inventory.js";
+import { EXIT_CRASH, EXIT_DRIFT, EXIT_INCONCLUSIVE, EXIT_OK } from "../exitCodes.js";
+import { readPackageVersion } from "../version.js";
+const FIX_INSTRUCTION = 'If this change is intended, update your privacy policy, then refresh the baseline with "srclawyer scan --write-inventory" and commit it.';
+function listLine(label, values) {
+    return values.length > 0 ? [`  ${label} ${values.join(", ")}`] : [];
+}
+function renderText(report, inventoryPath) {
+    const lines = [];
+    switch (report.result) {
+        case "no-drift":
+            lines.push("Drift check: no drift.");
+            lines.push(`  Baseline ${inventoryPath} (srclawyer ${report.baseline?.srclawyerVersion}, ${report.baseline?.discovery} discovery) matches the code.`);
+            break;
+        case "drift": {
+            lines.push("Drift check: DRIFT DETECTED.");
+            const d = report.diff;
+            lines.push(...listLine("Added categories:  ", d.added.categories), ...listLine("Removed categories:", d.removed.categories));
+            lines.push(...listLine("Added processors:  ", d.added.processors), ...listLine("Removed processors:", d.removed.processors));
+            if (report.baseline && report.baseline.srclawyerVersion !== report.srclawyerVersion) {
+                lines.push(`  (The baseline was written by srclawyer ${report.baseline.srclawyerVersion}; this is ${report.srclawyerVersion}. Detection rules can change between versions.)`);
+            }
+            lines.push("", FIX_INSTRUCTION);
+            break;
+        }
+        case "inconclusive":
+            lines.push("Drift check: INCONCLUSIVE — no drift verdict, because the scan was not complete or comparable:");
+            for (const reason of report.inconclusiveReasons)
+                lines.push(`  - ${reason}`);
+            break;
+        case "error":
+            lines.push(`error: ${report.error}`);
+            break;
+    }
+    return lines.join("\n");
+}
+function finish(report, options) {
+    if (options.format === "json")
+        console.log(JSON.stringify(report, null, 2));
+    else
+        (report.result === "error" ? console.error : console.log)(renderText(report, options.inventoryPath));
+    return report.exitCode;
+}
+const baseReport = () => ({
+    result: "error",
+    exitCode: EXIT_CRASH,
+    srclawyerVersion: readPackageVersion(),
+    baseline: null,
+    currentDiscovery: null,
+    diff: null,
+    inconclusiveReasons: [],
+    error: null,
+});
+/**
+ * Re-derives the inventory and compares it with the committed baseline. Never writes a policy, never
+ * calls an LLM provider, and never reports an incomplete scan as drift: anything that makes the scan
+ * untrustworthy (the same warnings that make `scan` exit 1, or a discovery-mode mismatch) is
+ * inconclusive and carries no diff.
+ */
+export async function runCheck(root, options) {
+    const path = resolve(root, options.inventoryPath);
+    if (!existsSync(path)) {
+        return finish({ ...baseReport(), error: `no baseline found at ${options.inventoryPath}. Create one with "srclawyer scan --write-inventory" and commit it.` }, options);
+    }
+    const parsed = parseInventory(readFileSync(path, "utf8"));
+    if (!parsed.ok) {
+        return finish({ ...baseReport(), error: `the baseline at ${options.inventoryPath} is invalid: ${parsed.reason}. Re-create it with "srclawyer scan --write-inventory".` }, options);
+    }
+    const baseline = parsed.inventory;
+    const discovery = selectDiscovery(root);
+    const result = await scan(root, { onlyFiles: discovery.files });
+    const protectedLogic = await resolveScanProtectedLogic(result);
+    const reasons = inventoryBlockers(result, protectedLogic.warning);
+    if (baseline.discovery !== discovery.mode) {
+        reasons.push(`Discovery mode mismatch: the baseline was written with ${baseline.discovery} discovery, but this run used ${discovery.mode} discovery${discovery.mode === "glob" ? ` (${discovery.reason})` : ""}. The two see different files, so they can't be compared.`);
+    }
+    const report = {
+        ...baseReport(),
+        baseline: { path: options.inventoryPath, srclawyerVersion: baseline.srclawyerVersion, discovery: baseline.discovery },
+        currentDiscovery: discovery.mode,
+    };
+    if (reasons.length > 0) {
+        return finish({ ...report, result: "inconclusive", exitCode: EXIT_INCONCLUSIVE, inconclusiveReasons: reasons }, options);
+    }
+    const current = computeInventory(protectedLogic.findings, { srclawyerVersion: readPackageVersion(), discovery: discovery.mode });
+    const diff = diffInventories(baseline, current);
+    return finish(hasDrift(diff) ? { ...report, result: "drift", exitCode: EXIT_DRIFT, diff } : { ...report, result: "no-drift", exitCode: EXIT_OK, diff }, options);
+}

package/dist/commands/init.js

@@ -1,8 +1,9 @@
 import { existsSync, readFileSync } from "node:fs";
-import { join } from "node:path";
+import { join, resolve } from "node:path";
 import { createInterface } from "node:readline/promises";
 import { CONFIG_FILENAME, DEFAULT_CONFIG, configPath, hasUnmigratedLegacyConfig, legacyConfigMessage, writeConfig, } from "../config/config.js";
 import { NETWORK_CALLS_NOTICE, byokNetworkNotice } from "../policy/legalNotices.js";
+import { DEFAULT_POLICY_PATH, SUGGESTED_DRAFT_PATH, checkPolicyWrite } from "../policy/policyGuard.js";
 import { runScan } from "./scan.js";
 export const DEFAULT_API_KEY_ENV_VAR = "ANTHROPIC_API_KEY";
 const ENV_VAR_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
@@ -177,12 +178,20 @@ export async function runInit(root, flags = {}) {
     console.log(`\nWrote ${CONFIG_FILENAME}. Run "srclawyer scan" to analyze this codebase.`);
     let runScanNow = false;
     if (isInteractive) {
-        const raw = await ask(lines, "Run a scan now and generate your policy?", "y");
-        runScanNow = /^y(es)?$/i.test(raw.trim());
+        // init never overwrites an existing policy. If one is there and scan would refuse to replace it,
+        // don't offer the scan at all; show how to generate a draft next to it instead.
+        const existing = checkPolicyWrite(resolve(root, DEFAULT_POLICY_PATH), DEFAULT_POLICY_PATH, false);
+        if (existing.allowed) {
+            const raw = await ask(lines, "Run a scan now and generate your policy?", "y");
+            runScanNow = /^y(es)?$/i.test(raw.trim());
+        }
+        else {
+            console.log(`\n${DEFAULT_POLICY_PATH} already exists and SrcLawyer will not overwrite it, so no scan was run. To generate a policy to compare against it, run:\n\n  srclawyer scan --out ${SUGGESTED_DRAFT_PATH}`);
+        }
     }
     rl.close();
     if (runScanNow) {
         console.log("");
-        await runScan(root, { json: false, out: "PRIVACY_POLICY.md", llm: true });
+        await runScan(root, { json: false, out: DEFAULT_POLICY_PATH, llm: true });
     }
 }

package/dist/commands/protectedLogicStep.d.ts

@@ -0,0 +1,12 @@
+import type { Finding, ScanResult } from "../engine/types.js";
+/**
+ * The one place a scan result is handed to the protected-logic service. Not tier-gated, not behind
+ * --no-llm: confidence scoring and Zod-schema detection are Layer 1 capabilities, needed on every real
+ * scan. A failure degrades honestly (findings keep their safe local fallback and a warning is
+ * returned) rather than blocking the scan. Shared by `scan` and `check` so both make exactly the same
+ * calls under exactly the same conditions.
+ */
+export declare function resolveScanProtectedLogic(result: ScanResult): Promise<{
+    findings: Finding[];
+    warning: string | null;
+}>;

package/dist/commands/protectedLogicStep.js

@@ -0,0 +1,16 @@
+import { resolveProtectedLogic } from "../cloud/resolveProtectedLogic.js";
+import { resolveProtectedLogicEndpoint } from "../cloud/config.js";
+/**
+ * The one place a scan result is handed to the protected-logic service. Not tier-gated, not behind
+ * --no-llm: confidence scoring and Zod-schema detection are Layer 1 capabilities, needed on every real
+ * scan. A failure degrades honestly (findings keep their safe local fallback and a warning is
+ * returned) rather than blocking the scan. Shared by `scan` and `check` so both make exactly the same
+ * calls under exactly the same conditions.
+ */
+export async function resolveScanProtectedLogic(result) {
+    const hasScorableFindings = result.findings.some((f) => f.confidenceFactors) || result.pendingZodCandidates.length > 0 || result.oversizedZodFiles.length > 0;
+    if (!hasScorableFindings)
+        return { findings: result.findings, warning: null };
+    const resolved = await resolveProtectedLogic(result.findings, result.pendingZodCandidates, resolveProtectedLogicEndpoint(), result.oversizedZodFiles);
+    return { findings: resolved.findings, warning: resolved.warning };
+}

package/dist/commands/scan.d.ts

@@ -2,5 +2,12 @@ export interface ScanOptions {
     json: boolean;
     out: string;
     llm: boolean;
+    /** Write the drift baseline to this path (relative to root). With this set the scan uses the shared
+     *  git-aware discovery mode (see gitDiscovery.ts) for the policy as well, so the two always agree. */
+    writeInventory?: string;
+    /** Write the baseline even if the scan completed with warnings that make it untrustworthy. */
+    allowIncompleteInventory?: boolean;
+    /** Overwrite the policy file even if it was edited since SrcLawyer generated it, or was not generated by SrcLawyer. */
+    force?: boolean;
 }
 export declare function runScan(root: string, options: ScanOptions): Promise<void>;

package/dist/commands/scan.js

@@ -4,13 +4,27 @@ import { CONFIG_FILENAME, hasUnmigratedLegacyConfig, legacyConfigMessage, loadCo
 import { scan } from "../engine/scanEngine.js";
 import { formatText } from "../report/formatText.js";
 import { generatePolicyMarkdown } from "../policy/generatePolicy.js";
+import { checkPolicyWrite, withPolicyMarker } from "../policy/policyGuard.js";
 import { resolveProviderForTier } from "../llm/resolveProviderForTier.js";
 import { resolveAmbiguousFindings } from "../llm/resolveAmbiguousFindings.js";
-import { resolveProtectedLogic } from "../cloud/resolveProtectedLogic.js";
-import { resolveProtectedLogicEndpoint } from "../cloud/config.js";
+import { resolveScanProtectedLogic } from "./protectedLogicStep.js";
+import { selectDiscovery } from "../engine/gitDiscovery.js";
+import { computeInventory, inventoryBlockers, serializeInventory } from "../inventory/inventory.js";
+import { EXIT_CRASH } from "../exitCodes.js";
+import { readPackageVersion } from "../version.js";
 import { MAX_FRAGMENT_BYTES } from "../rules/zodPreFilter.js";
 import { SCAN_DISCLAIMER_REMINDER, byokNetworkNotice } from "../policy/legalNotices.js";
 export async function runScan(root, options) {
+    // Refuse before any scanning or network call: a plain scan exists to write this file, so if it is
+    // protected there is nothing useful to do. With --write-inventory the scan still runs, because the
+    // baseline refresh is independent of the policy -- only the policy write is skipped.
+    const policyPath = resolve(root, options.out);
+    let policyDecision = checkPolicyWrite(policyPath, options.out, options.force ?? false);
+    if (!policyDecision.allowed && !options.writeInventory) {
+        console.error(policyDecision.message);
+        process.exitCode = EXIT_CRASH;
+        return;
+    }
     const config = loadConfig(root);
     let legacyConfigWarning = null;
     if (!config) {
@@ -22,7 +36,8 @@ export async function runScan(root, options) {
             console.error(`No ${CONFIG_FILENAME} found. Run "srclawyer init" first.\n`);
         }
     }
-    const result = await scan(root);
+    const discovery = options.writeInventory ? selectDiscovery(root) : null;
+    const result = await scan(root, { onlyFiles: discovery?.files ?? null });
     let findings = result.findings;
     if (result.workspaceWarning)
         console.error(result.workspaceWarning);
@@ -33,20 +48,11 @@ export async function runScan(root, options) {
     if (result.maxZodFragmentBytes > 0) {
         console.error(`Largest Zod-schema fragment this scan: ${result.maxZodFragmentBytes} bytes (hard ceiling: ${MAX_FRAGMENT_BYTES} bytes).`);
     }
-    // Not tier-gated, not behind --no-llm: confidence scoring and Zod-schema detection are Layer 1
-    // capabilities now, needed on every real scan regardless of which LLM tier (if any) is configured.
-    // A failure here degrades honestly (findings keep their safe local fallback) rather than blocking
-    // the scan — see resolveProtectedLogic's own per-call error handling.
-    const hasScorableFindings = findings.some((f) => f.confidenceFactors) || result.pendingZodCandidates.length > 0 || result.oversizedZodFiles.length > 0;
-    let protectedLogicWarning = null;
-    if (hasScorableFindings) {
-        const endpoint = resolveProtectedLogicEndpoint();
-        const resolved = await resolveProtectedLogic(findings, result.pendingZodCandidates, endpoint, result.oversizedZodFiles);
-        findings = resolved.findings;
-        protectedLogicWarning = resolved.warning;
-        if (protectedLogicWarning)
-            console.error(protectedLogicWarning);
-    }
+    const protectedLogic = await resolveScanProtectedLogic(result);
+    findings = protectedLogic.findings;
+    const protectedLogicWarning = protectedLogic.warning;
+    if (protectedLogicWarning)
+        console.error(protectedLogicWarning);
     let llmError = null;
     if (options.llm && config) {
         const { provider, error } = resolveProviderForTier(config);
@@ -75,13 +81,41 @@ export async function runScan(root, options) {
     }
     const ambiguousCount = findings.filter((f) => f.requiresReview).length;
     const finalResult = { ...result, findings, ambiguousCount };
-    const policyPath = resolve(root, options.out);
-    writeFileSync(policyPath, generatePolicyMarkdown(finalResult, config, llmError, protectedLogicWarning));
+    // Checked again now: a long scan leaves time for the file to be edited since the check above.
+    policyDecision = checkPolicyWrite(policyPath, options.out, options.force ?? false);
+    let policyNote = null;
+    if (policyDecision.allowed) {
+        writeFileSync(policyPath, withPolicyMarker(generatePolicyMarkdown(finalResult, config, llmError, protectedLogicWarning)));
+    }
+    else {
+        policyNote = `Privacy policy not written. ${policyDecision.message}`;
+        console.error(policyNote);
+    }
+    let inventoryNote = null;
+    if (options.writeInventory && discovery) {
+        const blockers = inventoryBlockers(result, protectedLogicWarning);
+        if (blockers.length > 0 && !options.allowIncompleteInventory) {
+            inventoryNote = `Inventory not written: this scan completed with warnings (see above), so its categories may be incomplete and would read as drift later. Fix them and re-run, or pass --allow-incomplete-inventory to write it anyway.`;
+            console.error(inventoryNote);
+        }
+        else {
+            const inventory = computeInventory(finalResult.findings, { srclawyerVersion: readPackageVersion(), discovery: discovery.mode });
+            writeFileSync(resolve(root, options.writeInventory), serializeInventory(inventory));
+            inventoryNote = `Wrote the drift baseline to ${options.writeInventory} (${inventory.categories.length} categories, ${inventory.processors.length} processors; ${discovery.mode} discovery). Commit it, then run "srclawyer check" in CI.`;
+            if (discovery.mode === "glob")
+                inventoryNote += ` (${discovery.reason}; the baseline records the ordinary filesystem walk.)`;
+            console.error(inventoryNote);
+        }
+    }
     if (result.unsupportedStackWarning || result.workspaceWarning || result.skippedFilesWarning || llmError || protectedLogicWarning || legacyConfigWarning) {
         process.exitCode = 1;
     }
+    // A refusal is a failure of what a plain scan was asked to do; with --write-inventory the policy
+    // was a side output and skipping it (with the note above) is not.
+    if (policyNote && !options.writeInventory)
+        process.exitCode = EXIT_CRASH;
     if (options.json) {
-        console.log(JSON.stringify({ ...finalResult, policyPath, llmError, protectedLogicWarning, legacyConfigWarning }, null, 2));
+        console.log(JSON.stringify({ ...finalResult, policyPath, policyWritten: policyNote === null, policySkippedReason: policyNote, llmError, protectedLogicWarning, legacyConfigWarning, inventoryNote }, null, 2));
         return;
     }
     console.log(formatText(finalResult, { aiReviewEnabled: config?.tier === "byok" }));
@@ -89,6 +123,6 @@ export async function runScan(root, options) {
         console.log(`\n${protectedLogicWarning}`);
     if (legacyConfigWarning)
         console.log(`\n${legacyConfigWarning}`);
-    console.log(`\nPrivacy policy written to ${join(options.out)}`);
+    console.log(policyNote ? "\nPrivacy policy not written (see above)." : `\nPrivacy policy written to ${join(options.out)}`);
     console.log(`\n${SCAN_DISCLAIMER_REMINDER}`);
 }

package/dist/engine/gitDiscovery.d.ts

@@ -0,0 +1,20 @@
+import type { DiscoveryMode } from "../inventory/inventory.js";
+/**
+ * The shared discovery mode for the drift baseline (`scan --write-inventory`) and `check`. A baseline
+ * written on a laptop and checked on a CI runner must see the same files, but the ordinary walk also
+ * sees whatever untracked, gitignored output happens to be on disk (generated code, local scratch
+ * dirs) that a clean checkout never has -- which would show up as phantom drift. So inside a git
+ * repository both sides use `git ls-files --cached --others --exclude-standard` (tracked, plus
+ * untracked-but-not-ignored); anywhere else, the ordinary walk. `scan`'s own default discovery is not
+ * changed. The mode is recorded in the baseline, and a mismatch is reported as inconclusive.
+ */
+export type DiscoverySelection = {
+    mode: "git";
+    files: Set<string>;
+} | {
+    mode: "glob";
+    files: null;
+    reason: string;
+};
+export declare function selectDiscovery(root: string): DiscoverySelection;
+export declare function discoveryMode(selection: DiscoverySelection): DiscoveryMode;

package/dist/engine/gitDiscovery.js

@@ -0,0 +1,31 @@
+import { execFileSync } from "node:child_process";
+import { resolve } from "node:path";
+function firstLine(text) {
+    return text.trim().split("\n")[0] ?? "";
+}
+export function selectDiscovery(root) {
+    const git = (args) => execFileSync("git", ["-C", root, ...args], { encoding: "buffer", stdio: ["ignore", "pipe", "pipe"], maxBuffer: 512 * 1024 * 1024 });
+    try {
+        git(["rev-parse", "--is-inside-work-tree"]);
+    }
+    catch (error) {
+        const stderr = error.stderr?.toString() ?? "";
+        const reason = error.code === "ENOENT" ? "git is not installed" : stderr.includes("not a git repository") ? "not a git repository" : `git is not usable here (${firstLine(stderr) || "unknown error"})`;
+        return { mode: "glob", files: null, reason };
+    }
+    try {
+        const listing = git(["ls-files", "-z", "--cached", "--others", "--exclude-standard"]).toString("utf8");
+        const files = new Set();
+        for (const relative of listing.split("\0"))
+            if (relative)
+                files.add(resolve(root, relative));
+        return { mode: "git", files };
+    }
+    catch (error) {
+        const stderr = error.stderr?.toString() ?? "";
+        return { mode: "glob", files: null, reason: `git ls-files failed (${firstLine(stderr) || "unknown error"})` };
+    }
+}
+export function discoveryMode(selection) {
+    return selection.mode;
+}

package/dist/engine/globFiles.js

@@ -1,4 +1,5 @@
 import { glob } from "tinyglobby";
+import { resolve } from "node:path";
 // expandDirectories: false keeps tinyglobby's matching identical to the fast-glob behavior this
 // replaced (a pattern matches only what it names, never everything under a matched directory).
 // tinyglobby/picomatch compiles braces to regex alternation rather than expanding them, so it has no
@@ -8,5 +9,8 @@ import { glob } from "tinyglobby";
 // traversal order, which neither fast-glob nor tinyglobby guarantees.
 export async function globFiles(patterns, options) {
     const { boundary, ...globOptions } = options;
-    return (await glob(patterns, { expandDirectories: false, ...globOptions, ...(boundary ? { fs: boundary.globFs() } : {}) })).sort();
+    const found = (await glob(patterns, { expandDirectories: false, ...globOptions, ...(boundary ? { fs: boundary.globFs() } : {}) })).sort();
+    // An optional discovery restriction (git mode) is an intersection with the normal glob, so every
+    // ignore pattern and the symlink boundary above still apply unchanged.
+    return boundary ? found.filter((p) => boundary.keepsInDiscovery(resolve(options.cwd, p))) : found;
 }

package/dist/engine/rootBoundary.d.ts

@@ -10,7 +10,10 @@ export declare class RootBoundary {
     readonly realRoot: string;
     private readonly blocked;
     private readonly resolved;
+    private discoveryFilter;
     constructor(root: string);
+    restrictDiscoveryTo(files: Set<string> | null): void;
+    keepsInDiscovery(absolutePath: string): boolean;
     isInsideRealPath(resolved: string): boolean;
     /** Records a blocked link by its in-repo (lexical) path only -- never its target. */
     private recordBlocked;

package/dist/engine/rootBoundary.js

@@ -17,6 +17,9 @@ export class RootBoundary {
     // through an in-root directory loop is the same link, counted once.
     blocked = new Map();
     resolved = new Map();
+    // When set, discovery only keeps files in this set (absolute paths) -- see gitDiscovery.ts. It lives
+    // here only because this object is already threaded through every glob call.
+    discoveryFilter = null;
     constructor(root) {
         this.root = root;
         try {
@@ -26,6 +29,12 @@ export class RootBoundary {
             this.realRoot = resolve(root);
         }
     }
+    restrictDiscoveryTo(files) {
+        this.discoveryFilter = files;
+    }
+    keepsInDiscovery(absolutePath) {
+        return this.discoveryFilter === null || this.discoveryFilter.has(absolutePath);
+    }
     isInsideRealPath(resolved) {
         return resolved === this.realRoot || resolved.startsWith(this.realRoot + sep);
     }

package/dist/engine/scanEngine.d.ts

@@ -8,4 +8,8 @@ import type { ScanResult } from "./types.js";
  * rather than folded into it. Anyone auditing "does this touch the network" can still answer that by
  * reading this file alone.
  */
-export declare function scan(root: string): Promise<ScanResult>;
+export interface ScanEngineOptions {
+    /** Absolute paths discovery is restricted to (git mode, for the drift baseline); unset = ordinary discovery. */
+    onlyFiles?: Set<string> | null;
+}
+export declare function scan(root: string, options?: ScanEngineOptions): Promise<ScanResult>;

package/dist/engine/scanEngine.js

@@ -103,17 +103,9 @@ async function runPythonCodeRules(filePath, source, root) {
     }
     return { findings, failure };
 }
-/**
- * Pure, local, offline — no network access anywhere in this function or anything it calls. Zod
- * schemas and confidence scoring can no longer be fully resolved here (see pendingZodCandidates and
- * every Finding.confidenceFactors) — resolving those against the protected-logic service is a
- * separate, explicit step in src/cloud/resolveProtectedLogic.ts, called from commands/scan.ts, the
- * same way Layer 2's resolveAmbiguousFindings.ts is a separate step layered on top of this function
- * rather than folded into it. Anyone auditing "does this touch the network" can still answer that by
- * reading this file alone.
- */
-export async function scan(root) {
+export async function scan(root, options = {}) {
     const boundary = new RootBoundary(root);
+    boundary.restrictDiscoveryTo(options.onlyFiles ?? null);
     const [{ projects, workspaceWarning }, unsupportedStackWarning] = await Promise.all([
         discoverProjects(root, boundary),
         detectUnsupportedStack(root, boundary),

package/dist/exitCodes.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Process exit codes -- one table for both commands so they can't drift apart. Documented in the README.
+ *
+ *   code | srclawyer scan                  | srclawyer check
+ *   -----+---------------------------------+----------------------------------------------------------
+ *    0   | clean                           | no drift
+ *    1   | completed with warnings         | drift
+ *    2   | crash or bad usage              | crash, bad usage, or a missing / invalid baseline
+ *    3   | (not used)                      | inconclusive: a warning that makes `scan` exit 1, or a
+ *        |                                 | discovery-mode mismatch -- never reported as drift
+ *
+ * `scan`'s "warnings" (1) and `check`'s "inconclusive" (3) are the same condition under different
+ * numbers; `scan`'s was left alone so existing scripts keep working.
+ */
+export declare const EXIT_OK = 0;
+export declare const EXIT_SCAN_WARNINGS = 1;
+export declare const EXIT_DRIFT = 1;
+export declare const EXIT_CRASH = 2;
+export declare const EXIT_INCONCLUSIVE = 3;

package/dist/exitCodes.js

@@ -0,0 +1,19 @@
+/**
+ * Process exit codes -- one table for both commands so they can't drift apart. Documented in the README.
+ *
+ *   code | srclawyer scan                  | srclawyer check
+ *   -----+---------------------------------+----------------------------------------------------------
+ *    0   | clean                           | no drift
+ *    1   | completed with warnings         | drift
+ *    2   | crash or bad usage              | crash, bad usage, or a missing / invalid baseline
+ *    3   | (not used)                      | inconclusive: a warning that makes `scan` exit 1, or a
+ *        |                                 | discovery-mode mismatch -- never reported as drift
+ *
+ * `scan`'s "warnings" (1) and `check`'s "inconclusive" (3) are the same condition under different
+ * numbers; `scan`'s was left alone so existing scripts keep working.
+ */
+export const EXIT_OK = 0;
+export const EXIT_SCAN_WARNINGS = 1;
+export const EXIT_DRIFT = 1;
+export const EXIT_CRASH = 2;
+export const EXIT_INCONCLUSIVE = 3;

package/dist/inventory/inventory.d.ts

@@ -0,0 +1,54 @@
+import type { Finding, ScanResult } from "../engine/types.js";
+/**
+ * The drift baseline: WHICH data categories and third-party processors the code touches, and nothing
+ * else -- no file names, line numbers, field names or timestamps. Users hand-edit their generated
+ * policy, so drift is judged against this, never against policy text.
+ *
+ * Built from Layer 1 only (finding.dataCategories / finding.processor) over ALL findings: AI-assisted
+ * review never changes it (so it's identical on every tier), and a finding moving between "confident"
+ * and "needs review" is not drift.
+ */
+export declare const INVENTORY_SCHEMA = 1;
+export declare const DEFAULT_INVENTORY_PATH = ".srclawyer.inventory.json";
+/** "git": git ls-files --cached --others --exclude-standard; "glob": the ordinary filesystem walk. */
+export type DiscoveryMode = "git" | "glob";
+export interface Inventory {
+    schema: number;
+    /** Informational only -- never compared. Lets a drift report say "the baseline was written by an older version". */
+    srclawyerVersion: string;
+    discovery: DiscoveryMode;
+    categories: string[];
+    processors: string[];
+}
+export declare function computeInventory(findings: Finding[], meta: {
+    srclawyerVersion: string;
+    discovery: DiscoveryMode;
+}): Inventory;
+/** Fixed key order, two-space indent, trailing newline: the same inventory is always the same bytes. */
+export declare function serializeInventory(inventory: Inventory): string;
+export type ParsedInventory = {
+    ok: true;
+    inventory: Inventory;
+} | {
+    ok: false;
+    reason: string;
+};
+export declare function parseInventory(text: string): ParsedInventory;
+export interface InventoryDiff {
+    added: {
+        categories: string[];
+        processors: string[];
+    };
+    removed: {
+        categories: string[];
+        processors: string[];
+    };
+}
+export declare function diffInventories(baseline: Inventory, current: Inventory): InventoryDiff;
+export declare function hasDrift(diff: InventoryDiff): boolean;
+/**
+ * The warnings that make a drift verdict untrustworthy -- exactly the ones that make `scan` exit 1,
+ * minus the two that can't affect Layer 1 categories (an AI-review misconfiguration, and the legacy
+ * config filename). A degraded scan is missing findings, which would read as "removed" categories.
+ */
+export declare function inventoryBlockers(result: ScanResult, protectedLogicWarning: string | null): string[];

package/dist/inventory/inventory.js

@@ -0,0 +1,94 @@
+/**
+ * The drift baseline: WHICH data categories and third-party processors the code touches, and nothing
+ * else -- no file names, line numbers, field names or timestamps. Users hand-edit their generated
+ * policy, so drift is judged against this, never against policy text.
+ *
+ * Built from Layer 1 only (finding.dataCategories / finding.processor) over ALL findings: AI-assisted
+ * review never changes it (so it's identical on every tier), and a finding moving between "confident"
+ * and "needs review" is not drift.
+ */
+export const INVENTORY_SCHEMA = 1;
+export const DEFAULT_INVENTORY_PATH = ".srclawyer.inventory.json";
+// Default code-point sort, deliberately not localeCompare: locale-aware ordering differs between
+// machines (ICU data, LANG), which would make the committed file differ byte-for-byte between a laptop and CI.
+function sortedUnique(values) {
+    return [...new Set(values)].sort();
+}
+export function computeInventory(findings, meta) {
+    return {
+        schema: INVENTORY_SCHEMA,
+        srclawyerVersion: meta.srclawyerVersion,
+        discovery: meta.discovery,
+        categories: sortedUnique(findings.flatMap((f) => f.dataCategories)),
+        processors: sortedUnique(findings.flatMap((f) => (f.processor ? [f.processor] : []))),
+    };
+}
+/** Fixed key order, two-space indent, trailing newline: the same inventory is always the same bytes. */
+export function serializeInventory(inventory) {
+    const ordered = {
+        schema: inventory.schema,
+        srclawyerVersion: inventory.srclawyerVersion,
+        discovery: inventory.discovery,
+        categories: sortedUnique(inventory.categories),
+        processors: sortedUnique(inventory.processors),
+    };
+    return JSON.stringify(ordered, null, 2) + "\n";
+}
+export function parseInventory(text) {
+    let raw;
+    try {
+        raw = JSON.parse(text.replace(/^/, ""));
+    }
+    catch {
+        return { ok: false, reason: "it is not valid JSON" };
+    }
+    if (typeof raw !== "object" || raw === null || Array.isArray(raw))
+        return { ok: false, reason: "it is not a JSON object" };
+    const o = raw;
+    if (o.schema !== INVENTORY_SCHEMA)
+        return { ok: false, reason: `unsupported schema ${JSON.stringify(o.schema)} (this version reads schema ${INVENTORY_SCHEMA})` };
+    if (o.discovery !== "git" && o.discovery !== "glob")
+        return { ok: false, reason: '"discovery" must be "git" or "glob"' };
+    const stringArray = (v) => Array.isArray(v) && v.every((x) => typeof x === "string");
+    if (!stringArray(o.categories))
+        return { ok: false, reason: '"categories" must be an array of strings' };
+    if (!stringArray(o.processors))
+        return { ok: false, reason: '"processors" must be an array of strings' };
+    return {
+        ok: true,
+        inventory: {
+            schema: INVENTORY_SCHEMA,
+            srclawyerVersion: typeof o.srclawyerVersion === "string" ? o.srclawyerVersion : "unknown",
+            discovery: o.discovery,
+            categories: sortedUnique(o.categories),
+            processors: sortedUnique(o.processors),
+        },
+    };
+}
+function difference(from, minus) {
+    const exclude = new Set(minus);
+    return from.filter((v) => !exclude.has(v));
+}
+export function diffInventories(baseline, current) {
+    return {
+        added: {
+            categories: difference(current.categories, baseline.categories),
+            processors: difference(current.processors, baseline.processors),
+        },
+        removed: {
+            categories: difference(baseline.categories, current.categories),
+            processors: difference(baseline.processors, current.processors),
+        },
+    };
+}
+export function hasDrift(diff) {
+    return Object.values(diff.added).some((v) => v.length > 0) || Object.values(diff.removed).some((v) => v.length > 0);
+}
+/**
+ * The warnings that make a drift verdict untrustworthy -- exactly the ones that make `scan` exit 1,
+ * minus the two that can't affect Layer 1 categories (an AI-review misconfiguration, and the legacy
+ * config filename). A degraded scan is missing findings, which would read as "removed" categories.
+ */
+export function inventoryBlockers(result, protectedLogicWarning) {
+    return [result.unsupportedStackWarning, result.workspaceWarning, result.skippedFilesWarning, protectedLogicWarning].filter((w) => !!w);
+}

package/dist/policy/policyGuard.d.ts

@@ -0,0 +1,20 @@
+/** Where `scan` writes the policy unless told otherwise. */
+export declare const DEFAULT_POLICY_PATH = "PRIVACY_POLICY.md";
+/** The path suggested for a side-by-side draft when the real policy is protected. */
+export declare const SUGGESTED_DRAFT_PATH = "PRIVACY_POLICY.generated.md";
+/** Appends the marker line to a freshly generated policy. */
+export declare function withPolicyMarker(body: string): string;
+export type PolicyFileState = "missing" | "unchanged" | "edited" | "unmarked";
+/** What an existing file at `path` is, relative to what SrcLawyer last generated. */
+export declare function classifyPolicyFile(path: string): PolicyFileState;
+export type PolicyWriteDecision = {
+    allowed: true;
+} | {
+    allowed: false;
+    kind: "edited" | "unmarked";
+    message: string;
+};
+export declare function editedMessage(path: string): string;
+export declare function unmarkedMessage(path: string): string;
+/** Whether `scan` may write its policy to `path`. `displayPath` is the path as the user gave it. */
+export declare function checkPolicyWrite(path: string, displayPath: string, force: boolean): PolicyWriteDecision;

package/dist/policy/policyGuard.js

@@ -0,0 +1,70 @@
+import { createHash } from "node:crypto";
+import { existsSync, readFileSync, statSync } from "node:fs";
+// Overwrite protection for the generated privacy policy. Every policy SrcLawyer writes ends with a
+// marker line holding a SHA-256 of the rest of the file. Before writing over an existing file we
+// recompute that hash: a match means nobody has touched it since we generated it (safe to
+// regenerate); anything else means it is someone's work and is left alone unless --force is passed.
+// This detects changes, it is not a security feature -- anyone can recompute the hash.
+const MARKER_PREFIX = "<!-- srclawyer:policy-sha256=";
+const MARKER_LINE = /^<!-- srclawyer:policy-sha256=([0-9a-f]{64}) -->$/;
+/** Where `scan` writes the policy unless told otherwise. */
+export const DEFAULT_POLICY_PATH = "PRIVACY_POLICY.md";
+/** The path suggested for a side-by-side draft when the real policy is protected. */
+export const SUGGESTED_DRAFT_PATH = "PRIVACY_POLICY.generated.md";
+// CRLF/CR become LF and trailing whitespace is dropped, so a Windows checkout (autocrlf) or an editor
+// that adds or strips the final newline is not mistaken for a hand edit.
+function normalize(text) {
+    return text.replace(/\r\n?/g, "\n").trimEnd();
+}
+function sha256(text) {
+    return createHash("sha256").update(text, "utf8").digest("hex");
+}
+/** Appends the marker line to a freshly generated policy. */
+export function withPolicyMarker(body) {
+    const terminated = body.endsWith("\n") ? body : `${body}\n`;
+    return `${terminated}${MARKER_PREFIX}${sha256(normalize(body))} -->\n`;
+}
+/** What an existing file at `path` is, relative to what SrcLawyer last generated. */
+export function classifyPolicyFile(path) {
+    if (!existsSync(path))
+        return "missing";
+    const lines = readFileSync(path, "utf8").replace(/\r\n?/g, "\n").split("\n");
+    let markerIndex = -1;
+    let recorded = "";
+    for (let i = lines.length - 1; i >= 0; i--) {
+        const match = MARKER_LINE.exec(lines[i].trim());
+        if (match) {
+            markerIndex = i;
+            recorded = match[1];
+            break;
+        }
+    }
+    if (markerIndex === -1)
+        return "unmarked";
+    // Everything except the marker line counts, including text added after it.
+    const rest = lines.filter((_, i) => i !== markerIndex).join("\n");
+    return sha256(normalize(rest)) === recorded ? "unchanged" : "edited";
+}
+function alternativeOut(path) {
+    return path === SUGGESTED_DRAFT_PATH ? "a different path" : SUGGESTED_DRAFT_PATH;
+}
+export function editedMessage(path) {
+    return `Not overwriting ${path}: it has been edited since SrcLawyer generated it. Write the new policy to a separate file with --out ${alternativeOut(path)} and compare, or pass --force to replace it.`;
+}
+export function unmarkedMessage(path) {
+    return `Not overwriting ${path}: it was not generated by this version of SrcLawyer (it may be hand-written, or generated before overwrite protection was added in 0.8.0). Write the new policy to a separate file with --out ${alternativeOut(path)} and compare, or pass --force to replace it.`;
+}
+/** Whether `scan` may write its policy to `path`. `displayPath` is the path as the user gave it. */
+export function checkPolicyWrite(path, displayPath, force) {
+    if (force)
+        return { allowed: true };
+    // A directory is not a policy file; let the write fail the way it always has.
+    if (existsSync(path) && statSync(path).isDirectory())
+        return { allowed: true };
+    const state = classifyPolicyFile(path);
+    if (state === "edited")
+        return { allowed: false, kind: "edited", message: editedMessage(displayPath) };
+    if (state === "unmarked")
+        return { allowed: false, kind: "unmarked", message: unmarkedMessage(displayPath) };
+    return { allowed: true };
+}

package/dist/version.d.ts

@@ -0,0 +1 @@
+export declare function readPackageVersion(): string;

package/dist/version.js

@@ -0,0 +1,9 @@
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+// Read from package.json rather than hardcoded, so no reported version can drift from the published
+// one. Works from both src/ (tsx, tests) and dist/: this file sits one level below package.json either way.
+export function readPackageVersion() {
+    const here = dirname(fileURLToPath(import.meta.url));
+    return JSON.parse(readFileSync(join(here, "../package.json"), "utf8")).version;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "srclawyer",
-  "version": "0.6.3",
+  "version": "0.8.0",
   "description": "Static analysis engine that derives privacy policy documentation directly from source code",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",