tickmarkr 2.7.3 → 2.7.4

package/dist/cli/commands/verify.js

@@ -7,7 +7,7 @@ import { allAdapters, probeAll, readDoctor, rolePools, writeDoctor } from "../..
 import { channelKey } from "../../adapters/types.js";
 import { loadConfig } from "../../config/config.js";
 import { captureBaseline, detectGateCommands, staleFileCountCommands } from "../../gates/baseline.js";
-import { getVerdictStore, runnerInputsHash } from "../../gates/cache.js";
+import { getVerdictStore, lockfileKeyBytes, runnerInputsHash } from "../../gates/cache.js";
 import { modelProvider } from "../../gates/review.js";
 import { runGates } from "../../gates/run-gates.js";
 import { getTask, loadGraph } from "../../graph/graph.js";
@@ -92,7 +92,7 @@ export function baselineCachePath(cwd, baseSha, commands) {
     const lockParts = [];
     for (const file of LOCKFILES) {
         const path = join(cwd, file);
-        lockParts.push(file, existsSync(path) ? readFileSync(path) : "<absent>");
+        lockParts.push(file, existsSync(path) ? lockfileKeyBytes(file, readFileSync(path)) : "<absent>");
     }
     const commandParts = Object.entries(commands).sort(([a], [b]) => a.localeCompare(b)).map(([name, command]) => `${name}\0${command}\0`);
     return join(realpathSync(tmpdir()), "tickmarkr-verify", "cache", `baseline-${baseSha.slice(0, 12)}-${hashParts(lockParts)}-${hashParts(commandParts)}-${runnerInputsHash()}.json`);

package/dist/gates/cache.d.ts

@@ -5,6 +5,7 @@ export declare const DEFAULT_VERDICT_CACHE_BOUND = 128;
 export declare function setVerdictCacheBoundForTests(bound: number | undefined): void;
 export declare function resetVerdictCacheBoundForTests(): void;
 export declare const LOCKFILES: readonly ["package-lock.json", "npm-shrinkwrap.json", "pnpm-lock.yaml", "yarn.lock", "bun.lock", "bun.lockb"];
+export declare function lockfileKeyBytes(file: string, bytes: Buffer): Buffer | string;
 export declare function lockfileHash(worktree: string): string;
 export declare function canonicalJson(obj: unknown): string;
 export declare function baselineIdentity(baseline?: Baseline): string;

package/dist/gates/cache.js

@@ -23,6 +23,32 @@ export const LOCKFILES = [
     "bun.lock",
     "bun.lockb",
 ];
+// Queue row 122: a version-only bump rewrites an npm v2/v3 lockfile's root `version` and `packages[""].version` and nothing
+// a dependency resolves from, so those two fields leave the key; every other byte keys as written. Other lockfile kinds, a
+// v1 or unversioned npm lockfile, and an unparseable one key on their raw bytes, which can only miss, never falsely hit.
+export function lockfileKeyBytes(file, bytes) {
+    if (file !== "package-lock.json" && file !== "npm-shrinkwrap.json")
+        return bytes;
+    let lock;
+    try {
+        lock = JSON.parse(bytes.toString("utf8"));
+    }
+    catch {
+        return bytes;
+    }
+    if (!lock || typeof lock !== "object" || Array.isArray(lock))
+        return bytes;
+    const { version: _version, ...rest } = lock;
+    if (rest.lockfileVersion !== 2 && rest.lockfileVersion !== 3)
+        return bytes;
+    const packages = rest.packages;
+    const own = packages?.[""];
+    if (own && typeof own === "object" && !Array.isArray(own)) {
+        const { version: _ownVersion, ...ownRest } = own;
+        rest.packages = { ...packages, "": ownRest };
+    }
+    return canonicalJson(rest);
+}
 export function lockfileHash(worktree) {
     const hash = createHash("sha256");
     let found = false;
@@ -31,7 +57,7 @@ export function lockfileHash(worktree) {
         if (existsSync(p)) {
             found = true;
             try {
-                hash.update(file).update("\0").update(readFileSync(p)).update("\0");
+                hash.update(file).update("\0").update(lockfileKeyBytes(file, readFileSync(p))).update("\0");
             }
             catch {
                 hash.update(file).update("\0unreadable\0");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tickmarkr",
-  "version": "2.7.3",
+  "version": "2.7.4",
   "description": "Spec in, verified work out.",
   "type": "module",
   "license": "MIT",