tldr-experts 0.9.2 → 0.10.0

package/dist/hooks/{chunk-y3cxqvnx.js → chunk-f6d6cp4h.js}

@@ -7051,9 +7051,9 @@ var bunRuntime = {
         clearTimeout(timer);
       opts.signal?.removeEventListener("abort", onAbort);
       const [stdout, stderr] = await withinGrace(collected);
-      return { exitCode, stdout, stderr, timedOut };
+      return { exitCode, stdout, stderr, timedOut, spawnFailed: false };
     } catch (error) {
-      return { exitCode: 127, stdout: "", stderr: messageOf(error), timedOut };
+      return { exitCode: 127, stdout: "", stderr: messageOf(error), timedOut, spawnFailed: true };
     }
   },
   async readText(path) {
@@ -7186,6 +7186,7 @@ var nodeRuntime = {
   spawn(cmd, args, opts = {}) {
     return new Promise((resolve) => {
       let timedOut = false;
+      let spawnFailed = false;
       let settled = false;
       let stdout = "";
       let stderr = "";
@@ -7224,7 +7225,7 @@ var nodeRuntime = {
           clearTimeout(timer);
         if (graceTimer !== null)
           clearTimeout(graceTimer);
-        resolve({ exitCode, stdout, stderr, timedOut });
+        resolve({ exitCode, stdout, stderr, timedOut, spawnFailed });
       };
       child.stdout?.on("data", (chunk) => {
         const text = chunk.toString("utf8");
@@ -7240,6 +7241,7 @@ var nodeRuntime = {
       child.stderr?.on("end", () => errSplitter?.end());
       child.on("error", (error) => {
         stderr += error.message;
+        spawnFailed = true;
         finish(127);
       });
       child.on("exit", (code, signal) => {
@@ -7412,9 +7414,375 @@ function isEpicWorktreeOf(name, runId) {
   return name.startsWith(`${EPIC_WORKTREE_PREFIX}${runId}-`);
 }
 
+// src/core/schemas/validation.ts
+function result(issues, deprecations = []) {
+  return { ok: issues.length === 0, issues, deprecations };
+}
+var VERSION_KEY = "version";
+var LEGACY_VERSION_KEY = "schema_version";
+var SCHEMA_VERSION = 1;
+var LEGACY_VERSION_NOTE = `${LEGACY_VERSION_KEY} is deprecated — say ${VERSION_KEY}: ${String(SCHEMA_VERSION)}`;
+function requireVersion(doc, issues, deprecations) {
+  const declared = doc[VERSION_KEY];
+  if (declared !== undefined) {
+    if (declared !== SCHEMA_VERSION) {
+      issues.push({
+        path: VERSION_KEY,
+        message: `unknown schema version ${describeValue(declared)} (expected ${String(SCHEMA_VERSION)})`
+      });
+    }
+    return;
+  }
+  if (!(LEGACY_VERSION_KEY in doc) || doc[LEGACY_VERSION_KEY] === undefined) {
+    issues.push({ path: VERSION_KEY, message: `missing required key \`${VERSION_KEY}\`` });
+    return;
+  }
+  requireNumber(doc[LEGACY_VERSION_KEY], LEGACY_VERSION_KEY, issues);
+  deprecations.push(LEGACY_VERSION_NOTE);
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function joinPath(base, key) {
+  return base === "" ? key : `${base}.${key}`;
+}
+function requireKeys(value, keys, base, issues) {
+  for (const key of keys) {
+    if (!(key in value) || value[key] === undefined) {
+      issues.push({ path: joinPath(base, key), message: `missing required key \`${key}\`` });
+    }
+  }
+}
+function requireEnum(value, allowed, path, issues) {
+  if (value === undefined)
+    return;
+  if (typeof value !== "string" || !allowed.includes(value)) {
+    issues.push({ path, message: `expected one of ${allowed.join(" | ")}, got ${describe(value)}` });
+  }
+}
+function requireArray(value, path, issues) {
+  if (value === undefined)
+    return false;
+  if (!Array.isArray(value)) {
+    issues.push({ path, message: `expected an array, got ${describe(value)}` });
+    return false;
+  }
+  return true;
+}
+function requireNumber(value, path, issues) {
+  if (value === undefined)
+    return;
+  if (typeof value !== "number" || Number.isNaN(value)) {
+    issues.push({ path, message: `expected a number, got ${describe(value)}` });
+  }
+}
+function requireString(value, path, issues) {
+  if (value === undefined)
+    return;
+  if (typeof value !== "string") {
+    issues.push({ path, message: `expected a string, got ${describe(value)}` });
+  }
+}
+function requireRecord(value, path, issues) {
+  if (value === undefined)
+    return false;
+  if (!isRecord(value)) {
+    issues.push({ path, message: `expected a mapping, got ${describe(value)}` });
+    return false;
+  }
+  return true;
+}
+function asDocument(input, issues) {
+  if (!isRecord(input)) {
+    issues.push({ path: "", message: `expected a mapping at the document root, got ${describe(input)}` });
+    return null;
+  }
+  return input;
+}
+function describe(value) {
+  if (value === null)
+    return "null";
+  if (Array.isArray(value))
+    return "an array";
+  return typeof value;
+}
+function describeValue(value) {
+  return typeof value === "number" || typeof value === "boolean" ? String(value) : describe(value);
+}
+
+// src/core/schemas/planCommon.ts
+var STORY_ID_RE = /^S\d{1,4}$/;
+var WAVE_ID_RE = /^W\d{1,3}$/;
+var MAX_LIST_ITEMS = 64;
+var MAX_ITEM_CHARS = 512;
+var MAX_WAVES = 32;
+var MAX_STORIES_PER_WAVE = 32;
+var MAX_PLAN_STORIES = 200;
+function requireStringList(value, path, issues, rules = {}) {
+  if (value === undefined)
+    return [];
+  if (!Array.isArray(value)) {
+    issues.push({ path, message: `expected a list, got ${describe2(value)}` });
+    return [];
+  }
+  const max = rules.max ?? MAX_LIST_ITEMS;
+  if (value.length > max) {
+    issues.push({ path, message: `${value.length} items exceeds the ${max}-item cap` });
+  }
+  if (rules.nonEmpty === true && value.length === 0) {
+    issues.push({ path, message: "must not be empty" });
+  }
+  const seen = new Set;
+  const out = [];
+  value.forEach((item, i) => {
+    const at = `${path}[${i}]`;
+    if (typeof item !== "string") {
+      issues.push({ path: at, message: `expected a string, got ${describe2(item)}` });
+      return;
+    }
+    if (item.trim() === "") {
+      issues.push({ path: at, message: "must not be blank" });
+      return;
+    }
+    if (item.length > MAX_ITEM_CHARS) {
+      issues.push({
+        path: at,
+        message: `${item.length} characters exceeds the ${MAX_ITEM_CHARS}-character cap on one list item ` + "— split it into several items"
+      });
+    }
+    if (rules.pattern !== undefined && !rules.pattern.test(item)) {
+      issues.push({ path: at, message: `expected ${rules.patternName ?? String(rules.pattern)}, got \`${item}\`` });
+      return;
+    }
+    if (rules.unique === true && seen.has(item)) {
+      issues.push({ path: at, message: `\`${item}\` is listed twice` });
+      return;
+    }
+    seen.add(item);
+    out.push(item);
+  });
+  return out;
+}
+function requirePattern(value, pattern, patternName, path, issues) {
+  if (value === undefined)
+    return;
+  if (typeof value !== "string") {
+    issues.push({ path, message: `expected a string, got ${describe2(value)}` });
+    return;
+  }
+  if (!pattern.test(value)) {
+    issues.push({ path, message: `expected ${patternName}, got \`${value}\`` });
+  }
+}
+function requireVersion1(doc, issues) {
+  if (doc.version !== undefined && doc.version !== 1) {
+    issues.push({ path: "version", message: `unknown schema version ${String(doc.version)} (expected 1)` });
+  }
+}
+function describe2(value) {
+  if (value === null)
+    return "null";
+  if (Array.isArray(value))
+    return "a list";
+  if (isRecord(value))
+    return "a mapping";
+  return typeof value;
+}
+
+// src/core/schemas/frontMatter.ts
+var FENCE = "---";
+function splitFrontMatter(text) {
+  const lines = text.split(`
+`);
+  if ((lines[0] ?? "").trimEnd() !== FENCE) {
+    return { present: false, raw: "", body: text, bodyLine: 1 };
+  }
+  for (let i = 1;i < lines.length; i++) {
+    if ((lines[i] ?? "").trimEnd() !== FENCE)
+      continue;
+    return {
+      present: true,
+      raw: lines.slice(1, i).join(`
+`),
+      body: lines.slice(i + 1).join(`
+`),
+      bodyLine: i + 2
+    };
+  }
+  return { present: false, raw: "", body: text, bodyLine: 1 };
+}
+function parseFrontMatter(text) {
+  const frontMatter = splitFrontMatter(text);
+  if (!frontMatter.present) {
+    return {
+      frontMatter,
+      doc: null,
+      issue: {
+        path: "",
+        message: "no YAML front matter — the file must open with `---` and close the block with `---`"
+      }
+    };
+  }
+  try {
+    return { frontMatter, doc: parseYaml(frontMatter.raw), issue: null };
+  } catch (error) {
+    return {
+      frontMatter,
+      doc: null,
+      issue: { path: "", message: `front matter is not valid YAML: ${message(error)}` }
+    };
+  }
+}
+function message(error) {
+  return error instanceof Error ? error.message.split(`
+`)[0] ?? "parse error" : String(error);
+}
+// src/core/schemas/story.ts
+var DOD_FENCE_OPEN_RE = /^\s*```+\s*dod\s*$/i;
+var DOD_FENCE_CLOSE_RE = /^\s*```+\s*$/;
+var FENCE_OPEN_RE = DOD_FENCE_OPEN_RE;
+var FENCE_CLOSE_RE = DOD_FENCE_CLOSE_RE;
+function parseDodBlock(text) {
+  const commands = [];
+  let present = false;
+  let inside = false;
+  for (const line of text.split(`
+`)) {
+    if (inside) {
+      if (FENCE_CLOSE_RE.test(line)) {
+        inside = false;
+        continue;
+      }
+      const command = line.trim();
+      if (command !== "" && !command.startsWith("#"))
+        commands.push(command);
+      continue;
+    }
+    if (FENCE_OPEN_RE.test(line)) {
+      present = true;
+      inside = true;
+    }
+  }
+  return { present, commands };
+}
+
+// src/hooks/lib/story.ts
+var DONE_RE = /^\s*(?:[-*]\s*)?(?:\*\*)?status(?:\*\*)?\s*:\s*["'`]?done["'`]?\.?\s*$/i;
+var REPO_RE = /^\s*(?:[-*]\s*)?(?:\*\*)?repo(?:\*\*)?\s*:\s*["'`]?([A-Za-z0-9._-]{1,64})["'`]?\s*$/i;
+var TIMEOUT_RE = /^\s*(?:[-*]\s*)?(?:\*\*)?timeout_s(?:\*\*)?\s*:\s*(\d{1,6})\s*$/i;
+var FENCE_OPEN_RE2 = /^\s*```+\s*dod\s*$/i;
+var FENCE_CLOSE_RE2 = /^\s*```+\s*$/;
+function readStory(text) {
+  const lines = text.split(`
+`);
+  const dod = parseDodBlock(text);
+  let setsDone = false;
+  let repo = null;
+  let timeoutS = null;
+  let inDod = false;
+  for (const line of lines) {
+    if (inDod) {
+      if (FENCE_CLOSE_RE2.test(line))
+        inDod = false;
+      continue;
+    }
+    if (FENCE_OPEN_RE2.test(line)) {
+      inDod = true;
+      continue;
+    }
+    if (!setsDone && DONE_RE.test(line))
+      setsDone = true;
+    if (repo === null) {
+      const m = REPO_RE.exec(line);
+      if (m?.[1] !== undefined)
+        repo = m[1];
+    }
+    if (timeoutS === null) {
+      const m = TIMEOUT_RE.exec(line);
+      if (m?.[1] !== undefined)
+        timeoutS = Number(m[1]);
+    }
+  }
+  return { setsDone, repo, dodCommands: dod.commands, hasDodBlock: dod.present, timeoutS };
+}
+function isAllowedDodCommand(command, allowed) {
+  return allowed.has(command);
+}
+var META_RE = /[|&;<>$`(){}*?~\\]/;
+function splitArgv(command) {
+  if (/[\n\r]/.test(command))
+    return null;
+  const argv = [];
+  const pattern = /"([^"]*)"|'([^']*)'|([^\s"']+)/g;
+  for (const match of command.matchAll(pattern)) {
+    if (match[1] !== undefined || match[2] !== undefined) {
+      argv.push(match[1] ?? match[2] ?? "");
+      continue;
+    }
+    const bare = match[3] ?? "";
+    if (META_RE.test(bare))
+      return null;
+    argv.push(bare);
+  }
+  return argv.length === 0 ? null : argv;
+}
+
+class DodCommandRefused extends Error {
+}
+async function runDodCommand(command, cwd, timeoutMs, allowed) {
+  if (!isAllowedDodCommand(command, allowed)) {
+    throw new DodCommandRefused(allowed.size === 0 ? `\`${command}\` cannot be run: .tldrx/workspace.yml declares no commands, so there is nothing ` + "to check it against. An empty allowlist is not a permit." : `\`${command}\` is not one of .tldrx/workspace.yml's commands. Declared: ` + `${[...allowed].map((c) => `\`${c}\``).join(", ")}.`);
+  }
+  const argv = splitArgv(command);
+  if (argv === null) {
+    throw new DodCommandRefused(`\`${command}\` needs a shell to run (it contains a metacharacter), and this gate does not open one. ` + "Put it in a script, declare the script under the repo's `commands:`, and cite that.");
+  }
+  const head = argv[0] ?? "";
+  const { exitCode, stdout, stderr, timedOut } = await runtime.spawn(head, argv.slice(1), {
+    cwd,
+    timeoutMs
+  });
+  return { command, exitCode, timedOut, tail: lastMeaningfulLine(`${stdout}
+${stderr}`) };
+}
+function lastMeaningfulLine(output, max = 200) {
+  const lines = output.split(`
+`).map((l) => l.trimEnd()).filter((l) => l.trim() !== "");
+  const last = lines[lines.length - 1] ?? "";
+  return last.length > max ? `${last.slice(0, max - 1)}…` : last;
+}
+
 // src/hooks/lib/workspace.ts
 import { existsSync as existsSync2, readdirSync, readFileSync, statSync as statSync2 } from "node:fs";
 import { basename, dirname as dirname3, isAbsolute, join as join2, resolve, sep } from "node:path";
+
+// src/core/detect/probeCommands.ts
+var PROBE_STATUSES = ["ok", "failed", "timed-out", "unspawnable", "not-probed", "skipped"];
+
+// src/core/schemas/workspace.ts
+function commandProbeIssues(probe, path) {
+  if (!isRecord(probe))
+    return [{ path, message: "expected a mapping" }];
+  const issues = [];
+  if (!PROBE_STATUSES.includes(probe.status)) {
+    issues.push({ path: `${path}.status`, message: `expected one of ${PROBE_STATUSES.join(" | ")}` });
+  }
+  if (typeof probe.verified !== "boolean") {
+    issues.push({ path: `${path}.verified`, message: "expected a boolean" });
+  }
+  if (probe.exit_code !== null && typeof probe.exit_code !== "number") {
+    issues.push({ path: `${path}.exit_code`, message: "expected a number or null" });
+  }
+  if (typeof probe.at !== "string" || probe.at === "") {
+    issues.push({ path: `${path}.at`, message: "expected a non-empty RFC3339 string" });
+  }
+  if (typeof probe.reason !== "string" || probe.reason === "") {
+    issues.push({ path: `${path}.reason`, message: "expected a non-empty sentence saying why" });
+  }
+  return issues;
+}
+
+// src/hooks/lib/workspace.ts
 var RUN_YML = "run.yml";
 function locateWork(filePath) {
   if (filePath === "")
@@ -7468,11 +7836,33 @@ function commandRolesOf(doc) {
   }
   return out;
 }
+function commandProbesOf(doc) {
+  const out = new Map;
+  const list = doc?.repos;
+  if (!Array.isArray(list))
+    return out;
+  for (const entry of list) {
+    if (typeof entry?.name !== "string")
+      continue;
+    const probes = new Map;
+    const raw = entry.command_probes;
+    if (raw !== null && typeof raw === "object" && !Array.isArray(raw)) {
+      for (const [slot, value] of Object.entries(raw)) {
+        if (commandProbeIssues(value, slot).length > 0)
+          continue;
+        probes.set(slot, value);
+      }
+    }
+    out.set(entry.name, probes);
+  }
+  return out;
+}
 function loadWorkspace(root) {
   const repos = new Map;
   const commands = new Set;
   const repoCommands = new Map;
   const commandRoles = new Map;
+  const commandProbes = new Map;
   const defaultBranches = new Map;
   let seedTriageThresholdTokens = null;
   const empty = () => ({
@@ -7481,6 +7871,7 @@ function loadWorkspace(root) {
     commands,
     repoCommands,
     commandRoles,
+    commandProbes,
     defaultBranches,
     seedTriageThresholdTokens
   });
@@ -7504,6 +7895,7 @@ function loadWorkspace(root) {
   if (!Array.isArray(list))
     return empty();
   const declared = commandRolesOf(doc);
+  const measured = commandProbesOf(doc);
   for (const entry of list) {
     if (typeof entry?.name !== "string")
       continue;
@@ -7518,6 +7910,7 @@ function loadWorkspace(root) {
     }
     repoCommands.set(entry.name, own);
     commandRoles.set(entry.name, roles);
+    commandProbes.set(entry.name, measured.get(entry.name) ?? new Map);
   }
   return empty();
 }
@@ -7933,14 +8326,14 @@ function parseFileSrc(raw, repos) {
 }
 var lineCountCache = new Map;
 var OK = { ok: true, outcome: "ok" };
-function refused(message, resolved) {
-  return resolved === undefined ? { ok: false, outcome: "refused", message } : { ok: false, outcome: "refused", message, resolved };
+function refused(message2, resolved) {
+  return resolved === undefined ? { ok: false, outcome: "refused", message: message2 } : { ok: false, outcome: "refused", message: message2, resolved };
 }
-function unverified(message) {
-  return { ok: true, outcome: "unverified", message };
+function unverified(message2) {
+  return { ok: true, outcome: "unverified", message: message2 };
 }
-function noted(message) {
-  return { ok: true, outcome: "noted", message };
+function noted(message2) {
+  return { ok: true, outcome: "noted", message: message2 };
 }
 function resolveSrc(ref, ctx, section, claim = "") {
   switch (ref.kind) {
@@ -8721,4 +9114,4 @@ function noneBullet(lookedAt) {
   return `- none [src: absent:${lookedAt}]`;
 }
 
-export { runtime, parseYaml, parseYamlRepairing, STAGES_DIR, TEMPLATES_DIR, PROJECT_FRAMEWORK_DIR, PROJECT_WORK_DIR, readableSource, SRC_PATTERNS, srcRule, parseSrcToken, classifySrc, locateWork, findWorkspaceRoot, loadWorkspace, toSrcContext, repoPath, factsPath, stageYamlPath, listRunDirs, parseHandoff, isHandoff, BULLET_RULE, EMPTY_SECTION_RULE, validateHandoff, validateCitations, noneBullet };
+export { runtime, parseYaml, parseYamlRepairing, STAGES_DIR, TEMPLATES_DIR, PROJECT_FRAMEWORK_DIR, PROJECT_WORK_DIR, result, requireVersion, isRecord, requireKeys, requireEnum, requireArray, requireNumber, requireString, requireRecord, asDocument, STORY_ID_RE, WAVE_ID_RE, MAX_WAVES, MAX_STORIES_PER_WAVE, MAX_PLAN_STORIES, requireStringList, requirePattern, requireVersion1, parseFrontMatter, readStory, DodCommandRefused, runDodCommand, readableSource, SRC_PATTERNS, srcRule, parseSrcToken, classifySrc, locateWork, findWorkspaceRoot, loadWorkspace, toSrcContext, repoPath, factsPath, stageYamlPath, listRunDirs, parseHandoff, isHandoff, BULLET_RULE, EMPTY_SECTION_RULE, validateHandoff, validateCitations, noneBullet };

package/dist/hooks/{chunk-8awygmqw.js → chunk-gvs5fvve.js}

@@ -1,7 +1,7 @@
 import {
   PROJECT_FRAMEWORK_DIR,
   PROJECT_WORK_DIR
-} from "./chunk-y3cxqvnx.js";
+} from "./chunk-f6d6cp4h.js";
 
 // src/core/lock/workspaceLock.ts
 import { existsSync as existsSync2, mkdirSync as mkdirSync2, openSync, readFileSync as readFileSync2, rmSync as rmSync2, writeSync, closeSync } from "node:fs";

package/dist/hooks/{chunk-rk1nm39z.js → chunk-w3jssmwe.js}

@@ -1,6 +1,6 @@
 import {
   toolInput
-} from "./chunk-2y3kwfrx.js";
+} from "./chunk-dzm2bzqp.js";
 
 // src/hooks/lib/wouldBe.ts
 import { existsSync, readFileSync } from "node:fs";

package/dist/hooks/claim-sources.js

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 import {
   wouldBeContent
-} from "./chunk-rk1nm39z.js";
+} from "./chunk-w3jssmwe.js";
 import {
   claimSourcesDeny,
   claimSourcesEmptySectionDeny,
   claimSourcesMalformedDeny,
   claimSourcesUnresolvedDeny
-} from "./chunk-cf4az0j5.js";
+} from "./chunk-7ye9jde9.js";
 import {
   allow,
   deny,
@@ -16,8 +16,8 @@ import {
   postContext,
   readPayload,
   runHook
-} from "./chunk-2y3kwfrx.js";
-import"./chunk-x3zy7zrn.js";
+} from "./chunk-dzm2bzqp.js";
+import"./chunk-3rwbyema.js";
 import {
   isHandoff,
   loadWorkspace,
@@ -25,7 +25,7 @@ import {
   toSrcContext,
   validateCitations,
   validateHandoff
-} from "./chunk-y3cxqvnx.js";
+} from "./chunk-f6d6cp4h.js";
 
 // src/hooks/claim-sources.ts
 await runHook("claim-sources", async () => {

package/dist/hooks/dod-gate.js

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 import {
   wouldBeContent
-} from "./chunk-rk1nm39z.js";
+} from "./chunk-w3jssmwe.js";
 import {
   dodGateDeny,
   dodGateInternalErrorDeny,
   dodGateMissingBlockDeny,
   dodGateRefusedCommandDeny
-} from "./chunk-cf4az0j5.js";
+} from "./chunk-7ye9jde9.js";
 import {
   allow,
   deny,
@@ -15,111 +15,20 @@ import {
   filePathOf,
   isWriteOrEdit,
   readPayload
-} from "./chunk-2y3kwfrx.js";
-import"./chunk-x3zy7zrn.js";
-import {
-  parseDodBlock
-} from "./chunk-rrkdfk7s.js";
-import"./chunk-5w5eg00k.js";
-import"./chunk-39zh2e44.js";
+} from "./chunk-dzm2bzqp.js";
+import"./chunk-3rwbyema.js";
 import {
+  DodCommandRefused,
   loadWorkspace,
   locateWork,
+  readStory,
   repoPath,
-  runtime
-} from "./chunk-y3cxqvnx.js";
+  runDodCommand
+} from "./chunk-f6d6cp4h.js";
 
 // src/hooks/dod-gate.ts
 import { basename, join } from "node:path";
 import { existsSync } from "node:fs";
-
-// src/hooks/lib/story.ts
-var DONE_RE = /^\s*(?:[-*]\s*)?(?:\*\*)?status(?:\*\*)?\s*:\s*["'`]?done["'`]?\.?\s*$/i;
-var REPO_RE = /^\s*(?:[-*]\s*)?(?:\*\*)?repo(?:\*\*)?\s*:\s*["'`]?([A-Za-z0-9._-]{1,64})["'`]?\s*$/i;
-var TIMEOUT_RE = /^\s*(?:[-*]\s*)?(?:\*\*)?timeout_s(?:\*\*)?\s*:\s*(\d{1,6})\s*$/i;
-var FENCE_OPEN_RE = /^\s*```+\s*dod\s*$/i;
-var FENCE_CLOSE_RE = /^\s*```+\s*$/;
-function readStory(text) {
-  const lines = text.split(`
-`);
-  const dod = parseDodBlock(text);
-  let setsDone = false;
-  let repo = null;
-  let timeoutS = null;
-  let inDod = false;
-  for (const line of lines) {
-    if (inDod) {
-      if (FENCE_CLOSE_RE.test(line))
-        inDod = false;
-      continue;
-    }
-    if (FENCE_OPEN_RE.test(line)) {
-      inDod = true;
-      continue;
-    }
-    if (!setsDone && DONE_RE.test(line))
-      setsDone = true;
-    if (repo === null) {
-      const m = REPO_RE.exec(line);
-      if (m?.[1] !== undefined)
-        repo = m[1];
-    }
-    if (timeoutS === null) {
-      const m = TIMEOUT_RE.exec(line);
-      if (m?.[1] !== undefined)
-        timeoutS = Number(m[1]);
-    }
-  }
-  return { setsDone, repo, dodCommands: dod.commands, hasDodBlock: dod.present, timeoutS };
-}
-function isAllowedDodCommand(command, allowed) {
-  return allowed.has(command);
-}
-var META_RE = /[|&;<>$`(){}*?~\\]/;
-function splitArgv(command) {
-  if (/[\n\r]/.test(command))
-    return null;
-  const argv = [];
-  const pattern = /"([^"]*)"|'([^']*)'|([^\s"']+)/g;
-  for (const match of command.matchAll(pattern)) {
-    if (match[1] !== undefined || match[2] !== undefined) {
-      argv.push(match[1] ?? match[2] ?? "");
-      continue;
-    }
-    const bare = match[3] ?? "";
-    if (META_RE.test(bare))
-      return null;
-    argv.push(bare);
-  }
-  return argv.length === 0 ? null : argv;
-}
-
-class DodCommandRefused extends Error {
-}
-async function runDodCommand(command, cwd, timeoutMs, allowed) {
-  if (!isAllowedDodCommand(command, allowed)) {
-    throw new DodCommandRefused(allowed.size === 0 ? `\`${command}\` cannot be run: .tldrx/workspace.yml declares no commands, so there is nothing ` + "to check it against. An empty allowlist is not a permit." : `\`${command}\` is not one of .tldrx/workspace.yml's commands. Declared: ` + `${[...allowed].map((c) => `\`${c}\``).join(", ")}.`);
-  }
-  const argv = splitArgv(command);
-  if (argv === null) {
-    throw new DodCommandRefused(`\`${command}\` needs a shell to run (it contains a metacharacter), and this gate does not open one. ` + "Put it in a script, declare the script under the repo's `commands:`, and cite that.");
-  }
-  const head = argv[0] ?? "";
-  const { exitCode, stdout, stderr, timedOut } = await runtime.spawn(head, argv.slice(1), {
-    cwd,
-    timeoutMs
-  });
-  return { command, exitCode, timedOut, tail: lastMeaningfulLine(`${stdout}
-${stderr}`) };
-}
-function lastMeaningfulLine(output, max = 200) {
-  const lines = output.split(`
-`).map((l) => l.trimEnd()).filter((l) => l.trim() !== "");
-  const last = lines[lines.length - 1] ?? "";
-  return last.length > max ? `${last.slice(0, max - 1)}…` : last;
-}
-
-// src/hooks/dod-gate.ts
 var DEFAULT_TIMEOUT_S = 900;
 var storyId = "?";
 try {