tickmarkr 2.7.6 → 2.7.7

package/dist/compile/native.js

@@ -179,12 +179,14 @@ export const COLLECTABLE_TESTS = "tests/**/*.test.ts";
 export const LEGACY_PREFIX = ["dro", "vr"].join("");
 export const TICKMARKR_NATIVE_MARKER = /^<!--\s*tickmarkr:spec(?:\s+v1)?\s*-->\s*$/m;
 export const NATIVE_MARKER = new RegExp(`^<!--\\s*(?:tickmarkr|${LEGACY_PREFIX}):spec(?:\\s+v1)?\\s*-->\\s*$`, "m");
-const HEAD_RE = /^## (T\d+):\s*(.+)$/;
-const FIELD_RE = /^- (\w+):\s*(.*)$/;
-const NESTED_RE = /^\s+- (.+)$/;
+// Queue row 130: the rest of a spec line is [^\r\n], never `.` — `.` misses U+2028/U+2029, and an acceptance item holding
+// one was glued onto its neighbour as a plain judge string, losing its own test: oracle (PRD and Spec Kit dropped it).
+const HEAD_RE = /^## (T\d+):\s*([^\r\n]+)$/;
+const FIELD_RE = /^- (\w+):\s*([^\r\n]*)$/;
+const NESTED_RE = /^\s+- ([^\r\n]+)$/;
 // v1.19: a typed acceptance oracle line — "command: ...", "test: ...", or "judge: ...". Anything
 // without one of these prefixes is a plain-string judge criterion (compat path, emits a warning).
-const ORACLE_RE = new RegExp(`^(${ORACLES.join("|")}):\\s*(.*)$`);
+const ORACLE_RE = new RegExp(`^(${ORACLES.join("|")}):\\s*([^\\r\\n]*)$`);
 const FIELDS = new Set(["goal", "shape", "deps", "files", "context", "complexity", "humangate", "pin", "floor", "gates", "acceptance", "timeout", "pins", "outofscope"]);
 const listItems = (draft) => draft.list === "acceptance" ? draft.acceptanceRaw
     : draft.list === "pins" ? draft.pinsRaw
@@ -199,7 +201,7 @@ const PIN_GLOB_SEP = "| glob:";
 const LANDING_SEP = "| suite:";
 function parsePin(task, raw, index, pathSet) {
     const bad = (detail) => invalid(task, "pins", `item ${index + 1} (${JSON.stringify(raw)}) ${detail}`);
-    const typed = raw.match(/^(\w+):\s*(.*)$/);
+    const typed = raw.match(/^(\w+):\s*([^\r\n]*)$/);
     if (typed?.[1] === "fixture") {
         const paths = pathSet(typed[2]);
         if (!paths.length)
@@ -275,7 +277,7 @@ function testsAtHead(root) {
     }
     const bodies = new Map();
     for (const line of grep.stdout.split("\n")) {
-        const match = line.match(/^HEAD:(tests\/.*\.test\.ts):\d+:(.*)$/);
+        const match = line.match(/^HEAD:(tests\/[^\r\n]*\.test\.ts):\d+:([^\r\n]*)$/);
         if (!match)
             continue;
         const lines = bodies.get(match[1]) ?? [];
@@ -544,7 +546,7 @@ export function compileNative(file, options = {}) {
         }
         const draft = drafts.at(-1);
         if (!draft) {
-            const base = line.match(/^base:\s*(.*)$/);
+            const base = line.match(/^base:\s*([^\r\n]*)$/);
             if (base) {
                 const value = base[1].trim();
                 if (!value) {

package/dist/compile/prd.js

@@ -1,9 +1,10 @@
 import { existsSync, readFileSync } from "node:fs";
 import { validateGraph } from "../graph/schema.js";
 import { CompileError, inferShape, sha256 } from "./common.js";
-const HEAD_RE = /^## (T\d+):\s*(.+)$/;
-const FIELD_RE = /^- (\w+):\s*(.*)$/;
-const NESTED_RE = /^\s+- (.+)$/;
+// Queue row 130: [^\r\n], never `.` (U+2028/U+2029 inside a line).
+const HEAD_RE = /^## (T\d+):\s*([^\r\n]+)$/;
+const FIELD_RE = /^- (\w+):\s*([^\r\n]*)$/;
+const NESTED_RE = /^\s+- ([^\r\n]+)$/;
 export function compilePrd(file) {
     if (!existsSync(file))
         throw new CompileError(`no such PRD file: ${file}`);

package/dist/compile/speckit.js

@@ -2,8 +2,9 @@ import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { validateGraph } from "../graph/schema.js";
 import { CompileError, inferShape, sha256 } from "./common.js";
-const TASK_RE = /^- \[( |x)\] (T\d+)\s*(\[P\])?\s*(.+)$/;
-const SUB_RE = /^\s+- (\w+):\s*(.+)$/;
+// Queue row 130: [^\r\n], never `.` (U+2028/U+2029 inside a line).
+const TASK_RE = /^- \[( |x)\] (T\d+)\s*(\[P\])?\s*([^\r\n]+)$/;
+const SUB_RE = /^\s+- (\w+):\s*([^\r\n]+)$/;
 export function compileSpecKit(dir) {
     const path = join(dir, "tasks.md");
     if (!existsSync(path)) {

package/dist/gates/acceptance.js

@@ -307,13 +307,14 @@ function compressLines(lines) {
     }
     return parts.join(", ");
 }
-const DIFF_SECTIONS = /(?=^diff --git )/m;
+// Queue rows 128/129: "\n"-only line semantics — the m flag would also split a line at U+2028/U+2029.
+const DIFF_SECTIONS = /(?<=^|\n)(?=diff --git )/;
 // the a-side path of a whole-file deletion section, or null if this section is not one.
 function deletedPath(section) {
-    if (!/^deleted file mode /m.test(section))
+    if (!/(?<=^|\n)deleted file mode /.test(section))
         return null;
-    const oldPath = /^--- (.+)$/m.exec(section)?.[1]
-        ?? /^Binary files (.+) and \/dev\/null differ$/m.exec(section)?.[1];
+    const oldPath = /(?<=^|\n)--- ([^\r\n]+)/.exec(section)?.[1]
+        ?? /(?<=^|\n)Binary files ([^\r\n]+) and \/dev\/null differ(?=[\r\n]|$)/.exec(section)?.[1];
     if (!oldPath || oldPath === "/dev/null")
         return null;
     const unquoted = oldPath.startsWith('"') && oldPath.endsWith('"') ? oldPath.slice(1, -1) : oldPath;

package/dist/gates/artifact-manifest.js

@@ -3,7 +3,7 @@
  * path receives capture accounting only when its manifest row names a
  * registered producer and repeats that producer's current provenance exactly.
  */
-import { diffSidePath, gitHeaderPaths, unquoteGitPath } from "./git-paths.js";
+import { diffSidePath, gitHeaderPaths, quoteGitPath, unquoteGitPath } from "./git-paths.js";
 const GOLDEN_PROVENANCE = {
     source: "src/tui/cockpit/capture.ts",
     entrypoint: "regenerateGoldenFrames",
@@ -191,17 +191,21 @@ export function classifyArtifactPath(path, manifest = CAPTURE_ARTIFACT_MANIFEST)
         provenance: producer.provenance,
     };
 }
-const SET_ASIDE_RECEIPT = /^set aside: regenerable capture (.+?) — \d+ bytes withheld\b/m;
+// Queue rows 128/129: patch text is split into lines at "\n" only. Under the m flag JS `^` and `$` also break at
+// U+2028/U+2029 (and `.` never matches them), so an added line holding one could forge a header line; these patterns
+// anchor on "\n" instead, and a name written back into the text is quoted (quoteGitPath) so it cannot end a line.
+const SET_ASIDE_RECEIPT = /(?<=^|\n)set aside: regenerable capture ([^\r\n]+?) — \d+ bytes withheld\b/;
 /** The path named by a citable capture receipt, or null when there is none. */
 export function setAsideReceiptPath(section) {
-    return SET_ASIDE_RECEIPT.exec(section)?.[1] ?? null;
+    const path = SET_ASIDE_RECEIPT.exec(section)?.[1];
+    return path === undefined ? null : unquoteGitPath(path);
 }
-const DIFF_SECTIONS = /(?=^diff --git )/m;
+const DIFF_SECTIONS = /(?<=^|\n)(?=diff --git )/;
 function deletedPath(section) {
-    if (!/^deleted file mode /m.test(section))
+    if (!/(?<=^|\n)deleted file mode /.test(section))
         return null;
-    const oldPath = /^--- (.+)$/m.exec(section)?.[1]
-        ?? /^Binary files (.+) and \/dev\/null differ$/m.exec(section)?.[1];
+    const oldPath = /(?<=^|\n)--- ([^\r\n]+)/.exec(section)?.[1]
+        ?? /(?<=^|\n)Binary files ([^\r\n]+) and \/dev\/null differ(?=[\r\n]|$)/.exec(section)?.[1];
     return oldPath ? diffSidePath(oldPath) : null;
 }
 /**
@@ -216,7 +220,7 @@ export function reviewableLogicDiff(diff) {
         const path = deletedPath(section);
         if (!path || isProtectedEvidence(path))
             return section;
-        return `deleted file: ${path}\n`;
+        return `deleted file: ${quoteGitPath(path)}\n`;
     }).join("");
 }
 function parseContentSection(section) {
@@ -240,12 +244,12 @@ function parseContentSection(section) {
 function sectionPaths(section, parsed) {
     if (parsed)
         return [...new Set(parsed.sides.filter((path) => path !== null))];
-    const renamedFrom = /^rename from (.+)$/m.exec(section)?.[1];
-    const renamedTo = /^rename to (.+)$/m.exec(section)?.[1];
+    const renamedFrom = /(?<=^|\n)rename from ([^\r\n]+)/.exec(section)?.[1];
+    const renamedTo = /(?<=^|\n)rename to ([^\r\n]+)/.exec(section)?.[1];
     if (renamedFrom || renamedTo) {
         return [...new Set([renamedFrom, renamedTo].filter((path) => path !== undefined).map(unquoteGitPath))];
     }
-    const header = /^diff --git (.+)$/m.exec(section)?.[1];
+    const header = /(?<=^|\n)diff --git ([^\r\n]+)/.exec(section)?.[1];
     return header ? gitHeaderPaths(header) : [];
 }
 function hunkPayload(body, sign) {
@@ -293,7 +297,7 @@ export function measureArtifactDiff(diff, manifest = CAPTURE_ARTIFACT_MANIFEST)
             sections: [],
         };
     }
-    const rawSections = diff.split(/(?=^diff --git )/m);
+    const rawSections = diff.split(DIFF_SECTIONS);
     const kindOnly = kindOnlyPaths(rawSections);
     const rendered = [];
     const measurements = [];
@@ -321,7 +325,7 @@ export function measureArtifactDiff(diff, manifest = CAPTURE_ARTIFACT_MANIFEST)
         const withheld = parsed.lines.slice(parsed.minus).join("\n");
         const captureBytes = Buffer.byteLength(withheld, "utf8");
         const receiptPath = paths.at(-1);
-        const receipt = `set aside: regenerable capture ${receiptPath} — ${captureBytes} bytes withheld (producer ${producer.producer}; provenance ${producer.provenance.source}#${producer.provenance.entrypoint}@${producer.provenance.revision})`;
+        const receipt = `set aside: regenerable capture ${quoteGitPath(receiptPath)} — ${captureBytes} bytes withheld (producer ${producer.producer}; provenance ${producer.provenance.source}#${producer.provenance.entrypoint}@${producer.provenance.revision})`;
         const compact = `${parsed.lines.slice(0, parsed.minus).join("\n")}\n${receipt}\n`;
         rendered.push(compact);
         measurements.push({

package/dist/gates/git-paths.d.ts

@@ -1,5 +1,11 @@
 /** A path exactly as git printed it, quoted or not, decoded to the name on disk. Unquoted input is returned as is. */
 export declare function unquoteGitPath(raw: string): string;
+/**
+ * Queue rows 128/129: the inverse of unquoteGitPath, for a name tickmarkr writes back into patch text it parses again.
+ * A name holding a control character, U+2028/U+2029, a double quote or a backslash is C-quoted (those characters
+ * escaped, every other character kept), so no name can end a line; any other name is returned as is.
+ */
+export declare function quoteGitPath(path: string): string;
 /**
  * One side of a `--- ` / `+++ ` line, after its four-character marker: null for /dev/null, else the path without its
  * a/ or b/ prefix. git ends a side holding a space with ONE tab (quoted or not, measured on git 2.54) — exactly that tab

package/dist/gates/git-paths.js

@@ -34,6 +34,28 @@ export function unquoteGitPath(raw) {
     }
     return Buffer.from(bytes).toString("utf8");
 }
+const NAMED = Object.fromEntries(Object.entries(ESCAPES).map(([name, code]) => [code, name]));
+/**
+ * Queue rows 128/129: the inverse of unquoteGitPath, for a name tickmarkr writes back into patch text it parses again.
+ * A name holding a control character, U+2028/U+2029, a double quote or a backslash is C-quoted (those characters
+ * escaped, every other character kept), so no name can end a line; any other name is returned as is.
+ */
+export function quoteGitPath(path) {
+    if (!/[\x00-\x1f\x7f"\\\u2028\u2029]/.test(path))
+        return path;
+    let quoted = "";
+    for (const ch of path) {
+        const code = ch.codePointAt(0);
+        if (NAMED[code] !== undefined)
+            quoted += `\\${NAMED[code]}`;
+        else if (code < 0x20 || code === 0x7f || code === 0x2028 || code === 0x2029) {
+            quoted += [...Buffer.from(ch, "utf8")].map((byte) => `\\${byte.toString(8).padStart(3, "0")}`).join("");
+        }
+        else
+            quoted += ch;
+    }
+    return `"${quoted}"`;
+}
 /**
  * One side of a `--- ` / `+++ ` line, after its four-character marker: null for /dev/null, else the path without its
  * a/ or b/ prefix. git ends a side holding a space with ONE tab (quoted or not, measured on git 2.54) — exactly that tab

package/dist/run/beat-lifecycle.js

@@ -104,7 +104,7 @@ export function readProcessIdentity(pid, host = {}) {
     const ps = spawnSync("ps", ["-ww", "-o", "pgid=", "-o", "stat=", "-o", "lstart=", "-o", "command=", "-p", String(pid)], {
         encoding: "utf8", env: { ...process.env, LC_ALL: "C" },
     });
-    const row = /^\s*(\d+)\s+(\S+)\s+(\w{3} \w{3} [ \d]\d \d\d:\d\d:\d\d \d{4})\s+(.*\S)\s*$/.exec(ps.stdout ?? "");
+    const row = /^\s*(\d+)\s+(\S+)\s+(\w{3} \w{3} [ \d]\d \d\d:\d\d:\d\d \d{4})\s+(.*\S)\s*$/s.exec(ps.stdout ?? "");
     if (ps.status !== 0 || !row)
         return confirmedDead(pid) ? "DEAD" : "UNKNOWN";
     if (row[2].startsWith("Z"))

package/dist/run/daemon.js

@@ -1244,7 +1244,7 @@ export async function observeWorkerProcessTree(marker, cwd) {
         return "unmeasurable";
     const rows = [];
     for (const line of snapshot.stdout.split("\n")) {
-        const match = /^\s*(\d+)\s+(\d+)\s+(.*)$/.exec(line);
+        const match = /^\s*(\d+)\s+(\d+)\s+(.*)$/s.exec(line);
         if (match)
             rows.push({ pid: match[1], ppid: match[2], command: match[3] });
     }
@@ -1272,7 +1272,7 @@ const pathAtOrBelow = (root, candidate) => {
 export function countLiveSuites(snapshot, repoRoot, daemonPid, cwdForPid, suiteParentForPid) {
     const rows = [];
     for (const line of snapshot.split("\n")) {
-        const match = /^\s*(\d+)\s+(\d+)\s+(\S+)\s+(.*)$/.exec(line);
+        const match = /^\s*(\d+)\s+(\d+)\s+(\S+)\s+(.*)$/s.exec(line);
         if (match && !match[3].startsWith("Z")) {
             rows.push({ pid: Number(match[1]), ppid: Number(match[2]), command: match[4] });
         }

package/dist/run/launchservices-check.js

@@ -14,7 +14,7 @@ import { basename } from "node:path";
 export const LAUNCHSERVICES_PROBE_CEILING_MS = 5_000;
 // lstart in the C locale: "Wed Sep 30 21:54:33 2026"; comm is the executable path on Darwin.
 const PS_ARGS = ["-A", "-o", "pid=,lstart=,comm="];
-const PS_LINE = /^\s*(\d+)\s+(\w{3}\s+\w{3}\s+\d{1,2}\s+\d{2}:\d{2}:\d{2}\s+\d{4})\s+(.+?)\s*$/;
+const PS_LINE = /^\s*(\d+)\s+(\w{3}\s+\w{3}\s+\d{1,2}\s+\d{2}:\d{2}:\d{2}\s+\d{4})\s+(.+?)\s*$/s;
 const MAX_PS_BYTES = 4 * 1024 * 1024;
 /** Exactly one launchservicesd row, or null (absent, ambiguous or malformed output is unknown). */
 export function parsePsIdentity(stdout) {

package/dist/run/lease.js

@@ -330,7 +330,7 @@ export async function describeLeaseBlockers(pids) {
             done("");
         }
     });
-    const executables = new Map(rows.split("\n").flatMap((line) => { const row = /^\s*(\d+)\s+(.*)$/.exec(line); return row ? [[Number(row[1]), row[2].trim()]] : []; }));
+    const executables = new Map(rows.split("\n").flatMap((line) => { const row = /^\s*(\d+)\s+(.*)$/s.exec(line); return row ? [[Number(row[1]), row[2].trim()]] : []; }));
     const cwds = await import("./suite-census.js").then(({ batchedProcessCwds }) => batchedProcessCwds(pids)).catch(() => undefined);
     return pids.map((pid) => {
         const cwd = cwds?.get(pid);
@@ -363,7 +363,7 @@ export async function protectedProcesses(holder, tokenEnv = REPOSITORY_LEASE_TOK
         return !leader || sameProcessBirth(processBirth(pid), holder.rootBirths?.[pid]);
     }));
     const parsed = lines.flatMap(line => {
-        const match = /^\s*(\d+)\s+(\d+)\s+(\d+)\s+(\S+)\s+(.*)$/.exec(line);
+        const match = /^\s*(\d+)\s+(\d+)\s+(\d+)\s+(\S+)\s+(.*)$/s.exec(line);
         return match ? [{ pid: Number(match[1]), parent: Number(match[2]), group: Number(match[3]), stat: match[4], command: match[5] }] : [];
     });
     const parents = new Map(parsed.map(row => [row.pid, row.parent]));

package/dist/run/stall.js

@@ -118,7 +118,8 @@ export const workerReapHost = {
             if (!lines.length || lines.length > 20_000)
                 return undefined;
             for (const line of lines) {
-                const m = /^\s*(\d+)\s+(\d+)\s+(\d+)\s+(\S+)\s+(\S+)\s+(\S+\s+\S+\s+\d+\s+\S+\s+\d+)\s+(.*)$/.exec(line);
+                // Queue row 127: the s flag — ps prints an argv's U+2028/U+2029 raw, and `.` alone never matches them.
+                const m = /^\s*(\d+)\s+(\d+)\s+(\d+)\s+(\S+)\s+(\S+)\s+(\S+\s+\S+\s+\d+\s+\S+\s+\d+)\s+(.*)$/s.exec(line);
                 if (!m)
                     return undefined;
                 if (m[5].startsWith("Z"))
@@ -418,7 +419,7 @@ async function workerTreeCpuSnapshot(marker, cwd, group, identities) {
             continue;
         if (group !== undefined && Number(ids[3]) === group)
             grouped.push(ids[1]);
-        const m = /^\s*(\d+)\s+(\d+)\s+\d+\s+(\S+)\s+(.*)$/.exec(line);
+        const m = /^\s*(\d+)\s+(\d+)\s+\d+\s+(\S+)\s+(.*)$/s.exec(line);
         if (!m)
             continue;
         const cpu = parsePsCpu(m[3]);

package/dist/run/suite-census.js

@@ -56,7 +56,7 @@ export async function batchedProcessCwds(pids, exec = probeExec, proc = procRead
 export function runnerPids(snapshot) {
     const pids = [];
     for (const line of snapshot.split("\n")) {
-        const match = /^\s*(\d+)\s+(\d+)\s+(\S+)\s+(.*)$/.exec(line);
+        const match = /^\s*(\d+)\s+(\d+)\s+(\S+)\s+(.*)$/s.exec(line);
         if (match && !match[3].startsWith("Z") && isRunnerCommand(match[4]))
             pids.push(Number(match[1]));
     }
@@ -95,7 +95,7 @@ export async function batchedProcessProbes(pids, exec = probeExec, proc = procRe
         if (rest.length === 0)
             return;
         for (const line of (await ask("ps", ["eww", "-p", rest.join(","), "-o", "pid=,command="])).split("\n")) {
-            const row = /^\s*(\d+)\s+(.*)$/.exec(line);
+            const row = /^\s*(\d+)\s+(.*)$/s.exec(line);
             const value = row ? parentIn(row[2]) : undefined;
             if (row && value)
                 parents.set(Number(row[1]), Number(value));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tickmarkr",
-  "version": "2.7.6",
+  "version": "2.7.7",
   "description": "Spec in, verified work out.",
   "type": "module",
   "license": "MIT",