tribunal-kit 9.2.5 → 9.2.6

package/src/commands/minimal.js

@@ -1,71 +1,85 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
+'use strict';
+const __importDefault =
+  (this && this.__importDefault) ||
+  function (mod) {
+    return mod && mod.__esModule ? mod : { default: mod };
+  };
+Object.defineProperty(exports, '__esModule', { value: true });
 exports.cmdMinimal = cmdMinimal;
-const fs_1 = __importDefault(require("fs"));
-const path_1 = __importDefault(require("path"));
-const logger_1 = require("../utils/logger");
-const helpers_1 = require("../utils/helpers");
+const fs_1 = __importDefault(require('fs'));
+const path_1 = __importDefault(require('path'));
+const logger_1 = require('../utils/logger');
+const helpers_1 = require('../utils/helpers');
 
 function cmdMinimal(flags, quiet = false) {
-    const targetDir = flags.path ? path_1.default.resolve(flags.path) : process.cwd();
-    const agentDest = path_1.default.join(targetDir, '.agent');
-    (0, helpers_1.banner)(quiet);
+  const targetDir = flags.path ? path_1.default.resolve(flags.path) : process.cwd();
+  const agentDest = path_1.default.join(targetDir, '.agent');
+  (0, helpers_1.banner)(quiet);
 
-    if (!fs_1.default.existsSync(agentDest)) {
-        (0, logger_1.log)(`  ${(0, logger_1.c)('red', '✖')} ${(0, logger_1.bold)('Not installed')} in this project`);
-        return;
-    }
+  if (!fs_1.default.existsSync(agentDest)) {
+    (0, logger_1.log)(
+      `  ${(0, logger_1.c)('red', '✖')} ${(0, logger_1.bold)('Not installed')} in this project`,
+    );
+    return;
+  }
 
-    const enginePath = path_1.default.join(agentDest, 'scripts', 'minimal_change_engine.js');
-    if (!fs_1.default.existsSync(enginePath)) {
-        (0, logger_1.log)(`  ${(0, logger_1.c)('red', '✖')} minimal_change_engine.js not found`);
-        return;
-    }
+  const enginePath = path_1.default.join(agentDest, 'scripts', 'minimal_change_engine.js');
+  if (!fs_1.default.existsSync(enginePath)) {
+    (0, logger_1.log)(`  ${(0, logger_1.c)('red', '✖')} minimal_change_engine.js not found`);
+    return;
+  }
 
-    try {
-        const engine = require(enginePath);
-        const task = flags.task || flags._?.slice(1).join(' ') || 'Default task evaluation';
-        const mode = flags.mode || 'balanced';
-        const result = engine.evaluateMinimalChange(task, {
-            files_added: flags.filesAdded ? parseInt(flags.filesAdded, 10) : 0,
-            files_modified: flags.filesModified ? parseInt(flags.filesModified, 10) : 1,
-            estimated_lines_added: flags.linesAdded ? parseInt(flags.linesAdded, 10) : 20,
-        }, { mode, cwd: targetDir });
+  try {
+    const engine = require(enginePath);
+    const task = flags.task || flags._?.slice(1).join(' ') || 'Default task evaluation';
+    const mode = flags.mode || 'balanced';
+    const result = engine.evaluateMinimalChange(
+      task,
+      {
+        files_added: flags.filesAdded ? parseInt(flags.filesAdded, 10) : 0,
+        files_modified: flags.filesModified ? parseInt(flags.filesModified, 10) : 1,
+        estimated_lines_added: flags.linesAdded ? parseInt(flags.linesAdded, 10) : 20,
+      },
+      { mode, cwd: targetDir },
+    );
 
-        if (flags.json) {
-            console.log(JSON.stringify(result, null, 2));
-            return;
-        }
+    if (flags.json) {
+      console.log(JSON.stringify(result, null, 2));
+      return;
+    }
 
-        (0, logger_1.log)(`  ${(0, logger_1.bold)('Minimal Change Governance Audit')}`);
-        (0, logger_1.log)(`  Minimality Score:          ${result.passed ? (0, logger_1.c)('green', result.minimality_score + '/100') : (0, logger_1.c)('red', result.minimality_score + '/100')}`);
-        (0, logger_1.log)(`  Decision Classification:   ${(0, logger_1.c)('cyan', result.minimality_classification)}`);
-        (0, logger_1.log)(`  Strictness Mode:           ${(0, logger_1.c)('yellow', mode)}`);
-        console.log();
+    (0, logger_1.log)(`  ${(0, logger_1.bold)('Minimal Change Governance Audit')}`);
+    (0, logger_1.log)(
+      `  Minimality Score:          ${result.passed ? (0, logger_1.c)('green', result.minimality_score + '/100') : (0, logger_1.c)('red', result.minimality_score + '/100')}`,
+    );
+    (0, logger_1.log)(
+      `  Decision Classification:   ${(0, logger_1.c)('cyan', result.minimality_classification)}`,
+    );
+    (0, logger_1.log)(`  Strictness Mode:           ${(0, logger_1.c)('yellow', mode)}`);
+    console.log();
 
-        if (result.change_budget) {
-            (0, logger_1.log)(`  ${(0, logger_1.bold)('Change Budget:')}`);
-            (0, logger_1.log)(`    files_added:           ${result.change_budget.files_added}`);
-            (0, logger_1.log)(`    files_modified:        ${result.change_budget.files_modified}`);
-            (0, logger_1.log)(`    dependencies_added:    ${result.change_budget.dependencies_added}`);
-            (0, logger_1.log)(`    new_abstractions:      ${result.change_budget.new_abstractions}`);
-            console.log();
-        }
+    if (result.change_budget) {
+      (0, logger_1.log)(`  ${(0, logger_1.bold)('Change Budget:')}`);
+      (0, logger_1.log)(`    files_added:           ${result.change_budget.files_added}`);
+      (0, logger_1.log)(`    files_modified:        ${result.change_budget.files_modified}`);
+      (0, logger_1.log)(`    dependencies_added:    ${result.change_budget.dependencies_added}`);
+      (0, logger_1.log)(`    new_abstractions:      ${result.change_budget.new_abstractions}`);
+      console.log();
+    }
 
-        if (result.complexity_flags.length > 0) {
-            (0, logger_1.log)(`  ${(0, logger_1.c)('yellow', 'Complexity Flags Detected:')}`);
-            result.complexity_flags.forEach(f => {
-                (0, logger_1.log)(`    • [${f.severity.toUpperCase()}] ${f.type}: ${f.evidence}`);
-            });
-            console.log();
-        } else {
-            (0, logger_1.log)(`  ${(0, logger_1.c)('green', '✔ Zero Complexity Flags Detected')}`);
-            console.log();
-        }
-    } catch (err) {
-        (0, logger_1.log)(`  ${(0, logger_1.c)('red', '✖ Error executing Minimal Change Engine:')} ${err.message}`);
+    if (result.complexity_flags.length > 0) {
+      (0, logger_1.log)(`  ${(0, logger_1.c)('yellow', 'Complexity Flags Detected:')}`);
+      result.complexity_flags.forEach(f => {
+        (0, logger_1.log)(`    • [${f.severity.toUpperCase()}] ${f.type}: ${f.evidence}`);
+      });
+      console.log();
+    } else {
+      (0, logger_1.log)(`  ${(0, logger_1.c)('green', '✔ Zero Complexity Flags Detected')}`);
+      console.log();
     }
+  } catch (err) {
+    (0, logger_1.log)(
+      `  ${(0, logger_1.c)('red', '✖ Error executing Minimal Change Engine:')} ${err.message}`,
+    );
+  }
 }

package/src/commands/mutate.js

@@ -1,30 +1,34 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
+'use strict';
+const __importDefault =
+  (this && this.__importDefault) ||
+  function (mod) {
+    return mod && mod.__esModule ? mod : { default: mod };
+  };
+Object.defineProperty(exports, '__esModule', { value: true });
 exports.cmdMutate = cmdMutate;
-const fs_1 = __importDefault(require("fs"));
-const path_1 = __importDefault(require("path"));
-const logger_1 = require("../utils/logger");
-const helpers_1 = require("../utils/helpers");
+const fs_1 = __importDefault(require('fs'));
+const path_1 = __importDefault(require('path'));
+const logger_1 = require('../utils/logger');
+const helpers_1 = require('../utils/helpers');
 async function cmdMutate(flags, processArgs) {
-    const targetDir = flags.path ? path_1.default.resolve(flags.path) : process.cwd();
-    const agentDest = path_1.default.join(targetDir, '.agent');
-    if (!fs_1.default.existsSync(agentDest)) {
-        (0, logger_1.err)('.agent/ not found. Run: npx tribunal-kit init');
-        process.exit(1);
-    }
-    const args = processArgs.slice(3);
-    if (args.length < 2) {
-        (0, logger_1.err)('Usage: npx tribunal-kit mutate <target_file> <test_command>');
-        process.exit(1);
-    }
-    const mutateScript = path_1.default.join(agentDest, 'scripts', 'mutation_runner.js');
-    try {
-        await (0, helpers_1.runShellAsync)('node', [mutateScript, ...args], { stdio: 'inherit', cwd: targetDir });
-    }
-    catch {
-        process.exit(1);
-    }
+  const targetDir = flags.path ? path_1.default.resolve(flags.path) : process.cwd();
+  const agentDest = path_1.default.join(targetDir, '.agent');
+  if (!fs_1.default.existsSync(agentDest)) {
+    (0, logger_1.err)('.agent/ not found. Run: npx tribunal-kit init');
+    process.exit(1);
+  }
+  const args = processArgs.slice(3);
+  if (args.length < 2) {
+    (0, logger_1.err)('Usage: npx tribunal-kit mutate <target_file> <test_command>');
+    process.exit(1);
+  }
+  const mutateScript = path_1.default.join(agentDest, 'scripts', 'mutation_runner.js');
+  try {
+    await (0, helpers_1.runShellAsync)('node', [mutateScript, ...args], {
+      stdio: 'inherit',
+      cwd: targetDir,
+    });
+  } catch {
+    process.exit(1);
+  }
 }

package/src/commands/native.js

@@ -1,6 +1,6 @@
-"use strict";
+'use strict';
 
-const fs = require("fs");
+const fs = require('fs');
 
 function getOption(args, names) {
   for (let index = 0; index < args.length; index += 1) {
@@ -27,27 +27,30 @@ function parseMaxLines(value) {
 
 function cmdMinContext(processArgs, quiet = false) {
   const args = processArgs.slice(3);
-  const file = getOption(args, ["--file", "-f"]);
-  const maxLines = parseMaxLines(getOption(args, ["--max-lines"]));
-  if (!file) return fail("Usage: tk min-context --file <path> [--max-lines <count>]");
-  if (maxLines === undefined) return fail("--max-lines must be a non-negative integer.");
+  const file = getOption(args, ['--file', '-f']);
+  const maxLines = parseMaxLines(getOption(args, ['--max-lines']));
+  if (!file) return fail('Usage: tk min-context --file <path> [--max-lines <count>]');
+  if (maxLines === undefined) return fail('--max-lines must be a non-negative integer.');
 
   let content;
   try {
-    content = fs.readFileSync(file, "utf8");
+    content = fs.readFileSync(file, 'utf8');
   } catch (error) {
     return fail(`Failed to read file: ${error.message}`);
   }
 
   const originalLines = content.split(/\r?\n/).length;
-  let lines = content.split(/\r?\n/).map((line) => line.trimEnd()).filter((line) => line.trim());
+  let lines = content
+    .split(/\r?\n/)
+    .map(line => line.trimEnd())
+    .filter(line => line.trim());
   if (maxLines !== null) lines = lines.slice(0, maxLines);
   const result = {
     file,
     original_lines: originalLines,
     minified_lines: lines.length,
     lines_reduced: Math.max(0, originalLines - lines.length),
-    minified: lines.join("\n"),
+    minified: lines.join('\n'),
   };
   if (!quiet) console.error(`✓ Minified ${file}`);
   console.log(JSON.stringify(result));
@@ -56,7 +59,7 @@ function cmdMinContext(processArgs, quiet = false) {
 
 function cmdDagSchedule(processArgs, quiet = false) {
   const args = processArgs.slice(3);
-  const rawTasks = getOption(args, ["--tasks", "-t"]);
+  const rawTasks = getOption(args, ['--tasks', '-t']);
   if (!rawTasks) return fail("Usage: tk dag-schedule --tasks '<json-array>'");
 
   let tasks;
@@ -65,13 +68,16 @@ function cmdDagSchedule(processArgs, quiet = false) {
   } catch (error) {
     return fail(`Failed to parse task JSON: ${error.message}`);
   }
-  if (!Array.isArray(tasks) || tasks.some((task) => !task || typeof task.id !== "string" || !task.id)) {
-    return fail("Each task must be an object with a non-empty id.");
+  if (
+    !Array.isArray(tasks) ||
+    tasks.some(task => !task || typeof task.id !== 'string' || !task.id)
+  ) {
+    return fail('Each task must be an object with a non-empty id.');
   }
 
-  const ids = new Set(tasks.map((task) => task.id));
-  const inDegree = new Map(tasks.map((task) => [task.id, 0]));
-  const dependents = new Map(tasks.map((task) => [task.id, []]));
+  const ids = new Set(tasks.map(task => task.id));
+  const inDegree = new Map(tasks.map(task => [task.id, 0]));
+  const dependents = new Map(tasks.map(task => [task.id, []]));
   for (const task of tasks) {
     const dependencies = Array.isArray(task.dependencies) ? task.dependencies : [];
     for (const dependency of dependencies) {
@@ -83,7 +89,10 @@ function cmdDagSchedule(processArgs, quiet = false) {
   }
 
   const waves = [];
-  let wave = [...inDegree.entries()].filter(([, degree]) => degree === 0).map(([id]) => id).sort();
+  let wave = [...inDegree.entries()]
+    .filter(([, degree]) => degree === 0)
+    .map(([id]) => id)
+    .sort();
   let processed = 0;
   while (wave.length > 0) {
     waves.push(wave);
@@ -106,36 +115,36 @@ function cmdDagSchedule(processArgs, quiet = false) {
     waves,
     is_cyclic: processed < tasks.length,
   };
-  if (!quiet && result.is_cyclic) console.error("⚠ Dependency cycle detected.");
+  if (!quiet && result.is_cyclic) console.error('⚠ Dependency cycle detected.');
   console.log(JSON.stringify(result));
   return result.success;
 }
 
 function cmdContextCompress(processArgs, quiet = false) {
   const args = processArgs.slice(3);
-  const file = getOption(args, ["--file", "-f"]);
-  const maxLines = parseMaxLines(getOption(args, ["--max-lines"]));
-  if (!file) return fail("Usage: tk context-compress --file <path> [--max-lines <count>]");
-  if (maxLines === undefined) return fail("--max-lines must be a non-negative integer.");
+  const file = getOption(args, ['--file', '-f']);
+  const maxLines = parseMaxLines(getOption(args, ['--max-lines']));
+  if (!file) return fail('Usage: tk context-compress --file <path> [--max-lines <count>]');
+  if (maxLines === undefined) return fail('--max-lines must be a non-negative integer.');
 
   let content;
   try {
-    content = fs.readFileSync(file, "utf8");
+    content = fs.readFileSync(file, 'utf8');
   } catch (error) {
     return fail(`Failed to read file: ${error.message}`);
   }
 
   const codeFile = /\.(?:js|ts|rs|json)$/i.test(file);
-  let lines = content.split(/\r?\n/).filter((line) => {
+  let lines = content.split(/\r?\n/).filter(line => {
     const trimmed = line.trim();
-    return trimmed && (!codeFile || !trimmed.startsWith("//") || trimmed.includes("// VERIFY"));
+    return trimmed && (!codeFile || !trimmed.startsWith('//') || trimmed.includes('// VERIFY'));
   });
   if (maxLines !== null && lines.length > maxLines) {
     const omitted = lines.length - maxLines;
     lines = lines.slice(0, maxLines);
     lines.push(`// ... [Truncated ${omitted} lines for agent context optimization]`);
   }
-  const compressedContent = lines.join("\n");
+  const compressedContent = lines.join('\n');
   const originalBytes = Buffer.byteLength(content);
   const compressedBytes = Buffer.byteLength(compressedContent);
   const result = {
@@ -152,12 +161,15 @@ function cmdContextCompress(processArgs, quiet = false) {
 
 function cmdOptimizeStep(processArgs, quiet = false) {
   const args = processArgs.slice(3);
-  const skillPath = getOption(args, ["--skill-path"]);
-  const rawEdits = getOption(args, ["--edits-json"]);
-  const parsedBudget = parseMaxLines(getOption(args, ["--budget"]));
+  const skillPath = getOption(args, ['--skill-path']);
+  const rawEdits = getOption(args, ['--edits-json']);
+  const parsedBudget = parseMaxLines(getOption(args, ['--budget']));
   const budget = parsedBudget ?? 4;
-  if (!skillPath || !rawEdits) return fail("Usage: tk optimize-step --skill-path <path> --edits-json '<json-array>' [--budget <count>]");
-  if (parsedBudget === undefined) return fail("--budget must be a non-negative integer.");
+  if (!skillPath || !rawEdits)
+    return fail(
+      "Usage: tk optimize-step --skill-path <path> --edits-json '<json-array>' [--budget <count>]",
+    );
+  if (parsedBudget === undefined) return fail('--budget must be a non-negative integer.');
 
   let edits;
   try {
@@ -165,92 +177,222 @@ function cmdOptimizeStep(processArgs, quiet = false) {
   } catch (error) {
     return fail(`Failed to parse edits JSON: ${error.message}`);
   }
-  if (!Array.isArray(edits)) return fail("--edits-json must be a JSON array.");
+  if (!Array.isArray(edits)) return fail('--edits-json must be a JSON array.');
 
-  let text = fs.existsSync(skillPath) ? fs.readFileSync(skillPath, "utf8") : "";
-  const protectedStart = text.indexOf("<!-- SLOW_UPDATE_START -->");
-  const protectedEnd = text.indexOf("<!-- SLOW_UPDATE_END -->");
-  const isProtected = (position) => protectedStart !== -1 && protectedEnd !== -1 && position >= protectedStart && position < protectedEnd;
+  let text = fs.existsSync(skillPath) ? fs.readFileSync(skillPath, 'utf8') : '';
+  const protectedStart = text.indexOf('<!-- SLOW_UPDATE_START -->');
+  const protectedEnd = text.indexOf('<!-- SLOW_UPDATE_END -->');
+  const isProtected = position =>
+    protectedStart !== -1 &&
+    protectedEnd !== -1 &&
+    position >= protectedStart &&
+    position < protectedEnd;
   const reports = [];
   let appliedCount = 0;
-  const ranked = [...edits].sort((left, right) => {
-    const leftFailure = left.source_type === "failure" ? 1 : 0;
-    const rightFailure = right.source_type === "failure" ? 1 : 0;
-    return rightFailure - leftFailure || (right.support_count || 1) - (left.support_count || 1);
-  }).slice(0, budget);
+  const ranked = [...edits]
+    .sort((left, right) => {
+      const leftFailure = left.source_type === 'failure' ? 1 : 0;
+      const rightFailure = right.source_type === 'failure' ? 1 : 0;
+      return rightFailure - leftFailure || (right.support_count || 1) - (left.support_count || 1);
+    })
+    .slice(0, budget);
 
   for (const edit of ranked) {
     const operation = edit && edit.op;
     const target = edit && edit.target;
     const replacement = edit && edit.content;
-    if (operation === "append" && typeof replacement === "string") {
-      if (text.includes(replacement.trim())) reports.push("skip: append duplicate content");
+    if (operation === 'append' && typeof replacement === 'string') {
+      if (text.includes(replacement.trim())) reports.push('skip: append duplicate content');
       else {
-        text = `${text}${text && !text.endsWith("\n") ? "\n" : ""}${replacement}\n`;
+        text = `${text}${text && !text.endsWith('\n') ? '\n' : ''}${replacement}\n`;
         appliedCount += 1;
-        reports.push("applied: append content");
+        reports.push('applied: append content');
       }
-    } else if (["delete", "replace", "insert_after"].includes(operation) && typeof target === "string") {
+    } else if (
+      ['delete', 'replace', 'insert_after'].includes(operation) &&
+      typeof target === 'string'
+    ) {
       const position = text.indexOf(target);
       if (position === -1) reports.push(`skip: ${operation} target not found`);
-      else if (isProtected(position)) reports.push(`skip: ${operation} target is inside protected region`);
-      else if (operation === "delete") {
-        text = text.replace(target, "");
+      else if (isProtected(position))
+        reports.push(`skip: ${operation} target is inside protected region`);
+      else if (operation === 'delete') {
+        text = text.replace(target, '');
         appliedCount += 1;
-        reports.push("applied: deleted target");
-      } else if (typeof replacement !== "string") reports.push(`skip: ${operation} content missing`);
-      else if (operation === "replace") {
+        reports.push('applied: deleted target');
+      } else if (typeof replacement !== 'string')
+        reports.push(`skip: ${operation} content missing`);
+      else if (operation === 'replace') {
         text = text.replace(target, replacement);
         appliedCount += 1;
-        reports.push("applied: replaced target");
+        reports.push('applied: replaced target');
       } else {
         const before = text.slice(0, position + target.length);
         const after = text.slice(position + target.length);
-        text = `${before}${replacement.startsWith("\n") ? "" : "\n"}${replacement}${replacement.endsWith("\n") ? "" : "\n"}${after}`;
+        text = `${before}${replacement.startsWith('\n') ? '' : '\n'}${replacement}${replacement.endsWith('\n') ? '' : '\n'}${after}`;
         appliedCount += 1;
-        reports.push("applied: inserted content after target");
+        reports.push('applied: inserted content after target');
       }
     } else reports.push(`skip: unknown or invalid operation ${String(operation)}`);
   }
 
-  if (appliedCount > 0) fs.writeFileSync(skillPath, text, "utf8");
+  if (appliedCount > 0) fs.writeFileSync(skillPath, text, 'utf8');
   const result = { success: true, applied_count: appliedCount, reports };
   if (!quiet) console.error(`✓ Applied ${appliedCount} bounded SkillOpt edit(s)`);
   console.log(JSON.stringify(result));
   return true;
 }
-function cmdImpactTier(processArgs, quiet = false) {
+const HIGH_RISK_PATTERNS =
+  /\b(auth(?:entication|orization)?|login|sign-in|sso|oauth|identity|roles?|access-control|permissions?|ownership|admin|secrets?|credentials?|api keys?|signing-keys?|postgres|sql|schema|migration|transaction|pools?|database|db|containers?|privileges?|deployment|network polic(?:y|ies)|tls|certificates?|ci|redis|docker|passwords?|tokens?|jwt|rbac|infrastructure|provisioning|sessions?)\b/i;
+const HIGH_RISK_EXTENSIONS = /\.(sql|prisma|tf|tofu)$/i;
+
+function resolveMonotonicImpactTier(options = {}) {
+  const opts = options && typeof options === 'object' ? options : {};
+  const rawFiles = opts.files;
+  const files = Array.isArray(rawFiles)
+    ? rawFiles.filter(Boolean)
+    : typeof rawFiles === 'string' && rawFiles.length > 0
+      ? rawFiles.split(',').map(f => f.trim()).filter(Boolean)
+      : [];
+  const lines = typeof opts.lines === 'number' && !isNaN(opts.lines) ? opts.lines : parseInt(opts.lines, 10) || 0;
+  const task = typeof opts.task === 'string' ? opts.task : '';
+  const diff = typeof opts.diff === 'string' ? opts.diff : '';
+  const layaTier = opts.layaTier;
+
+  const fileCount = files.length;
+
+  // 1. Base tier from change volume
+  const isFastPass =
+    fileCount <= 2 &&
+    lines <= 10 &&
+    files.length > 0 &&
+    files.every(f => /\.(css|scss|less|md|txt|svg|png|jpg)$/i.test(f));
+
+  let baseTier = 0;
+  if (isFastPass || (fileCount === 0 && lines <= 5)) baseTier = 0;
+  else if (fileCount <= 1 && lines <= 50) baseTier = 1;
+  else if (fileCount <= 5 && lines <= 200) baseTier = 2;
+  else baseTier = 3;
+
+  // 2. Concrete risk evidence analysis
+  const isPureDocFiles =
+    fileCount > 0 &&
+    files.every(f => /\.(md|txt|markdown|rst|adoc)$/i.test(f) || f.includes('docs/'));
+
+  // Concrete secret or code patterns that make even documentation dangerous
+  const secretOrExecPatterns =
+    /(?:-----BEGIN [A-Z ]+KEY-----|eyJ[A-Za-z0-9-_=]+\.[A-Za-z0-9-_=]+|(?:api[_-]?key|secret|password|bearer|auth[_-]?token)\s*[:=]\s*['"][^'"]{6,}['"])/i;
+
+  const diffHasCode = /^\+[ \t]*(?:const|let|var|function|def|import|require|class|export|db\.|SELECT|UPDATE|DELETE|INSERT|jwt\.|auth\.)/mi.test(diff);
+  const diffMatchesHighRiskCode = diffHasCode && HIGH_RISK_PATTERNS.test(diff);
+
+  const diffHasHighRisk =
+    HIGH_RISK_EXTENSIONS.test(diff) ||
+    diffMatchesHighRiskCode ||
+    (!isPureDocFiles && HIGH_RISK_PATTERNS.test(diff)) ||
+    secretOrExecPatterns.test(diff);
+
+  const fileHasHighRisk = files.some(
+    f =>
+      HIGH_RISK_EXTENSIONS.test(f) ||
+      (!isPureDocFiles && HIGH_RISK_PATTERNS.test(f)) ||
+      f.includes('docker') ||
+      f.includes('.github/'),
+  );
+
+  let riskEvidenceTier = 0;
+  if (diffHasHighRisk || fileHasHighRisk) {
+    riskEvidenceTier = 3;
+  } else if (!isPureDocFiles && HIGH_RISK_PATTERNS.test(task + ' ' + files.join(' '))) {
+    riskEvidenceTier = 3;
+  }
+
+  // 3. Negative controls (Documentation changes)
+  // A doc change remains low risk (Tier 0) UNLESS concrete high-risk implementation evidence exists in files or diff
+  if (isPureDocFiles && !diffHasHighRisk && !fileHasHighRisk) {
+    return 0;
+  }
+
+  // 4. Ambiguity tier: short vague tasks (<= 2 words) touching non-doc code files
+  let ambiguityTier = 0;
+  const wordCount = task.trim().length > 0 ? task.trim().split(/\s+/).length : 0;
+  if (wordCount > 0 && wordCount <= 2 && fileCount > 0 && !isPureDocFiles) {
+    ambiguityTier = 2;
+  }
+
+  // 5. Monotonic aggregation: finalTier = max(baseTier, layaTier, riskEvidenceTier, ambiguityTier)
+  const candidateTiers = [baseTier, riskEvidenceTier, ambiguityTier];
+  if (typeof layaTier === 'number' && !isNaN(layaTier) && layaTier >= 0 && layaTier <= 3) {
+    candidateTiers.push(layaTier);
+  }
+
+  return Math.max(...candidateTiers);
+}
+
+async function cmdImpactTier(processArgs, quiet = false) {
   const args = processArgs.slice(3);
-  const files = getOption(args, ["--files"]) || "";
-  const lines = parseInt(getOption(args, ["--lines"]) || "0", 10);
-  const task = getOption(args, ["--task"]) || "";
-
-  const fileList = files ? files.split(",").map(f => f.trim()).filter(Boolean) : [];
-  const fileCount = fileList.length;
-
-  // Tier classification heuristics (mirrors Rust ImpactTier logic)
-  let tier = 0;
-  if (fileCount === 0 && lines <= 5) tier = 0;
-  else if (fileCount <= 1 && lines <= 50) tier = 1;
-  else if (fileCount <= 5 && lines <= 200) tier = 2;
-  else tier = 3;
-
-  // Check for high-risk patterns that force Tier 3
-  const highRiskPatterns = /\b(auth|migration|schema|security|password|token|jwt|rbac|permissions)\b/i;
-  const highRiskExtensions = /\.(sql|prisma|tf|tofu)$/i;
-  if (highRiskPatterns.test(task) || fileList.some(f => highRiskExtensions.test(f))) {
-    tier = Math.max(tier, 3);
+  const files = getOption(args, ['--files']) || '';
+  const lines = parseInt(getOption(args, ['--lines']) || '0', 10);
+  const task = getOption(args, ['--task']) || '';
+  const diff = getOption(args, ['--diff']) || '';
+
+  const fileList = files
+    ? files
+        .split(',')
+        .map(f => f.trim())
+        .filter(Boolean)
+    : [];
+
+  let layaTier = null;
+  let providerUsed = null;
+
+  // -- LAYA SYSTEM-1 INTERCEPTION --
+  try {
+    const { System1Provider } = require('../system1/provider');
+    const provider = new System1Provider();
+    if (provider.isAvailable()) {
+      if (process.env.TK_VERBOSE || process.env.VERBOSE) {
+        console.error(
+          `\x1b[90m⚡ System-1 Laya active. Routing impact classification to local ONNX model...\x1b[0m`,
+        );
+      }
+      layaTier = await provider.classifyImpact(fileList, task);
+      providerUsed = 'laya';
+    }
+  } catch (err) {
+    if (process.env.TK_VERBOSE || process.env.VERBOSE) {
+      console.error(
+        `\x1b[93m⚠ Laya System-1 failure: ${err.message}. Falling back to deterministic heuristic.\x1b[0m`,
+      );
+    }
   }
+  // -- END LAYA INTERCEPTION --
+
+  const finalTier = resolveMonotonicImpactTier({
+    files: fileList,
+    lines,
+    task,
+    diff,
+    layaTier,
+  });
 
-  const tierNames = ["Fast-Pass", "Express Pass", "Targeted Audit", "Full Gauntlet"];
+  const tierNames = ['Fast-Pass', 'Express Pass', 'Targeted Audit', 'Full Gauntlet'];
   const result = {
-    tier,
-    tier_name: tierNames[tier],
-    file_count: fileCount,
+    tier: finalTier,
+    tier_name: tierNames[finalTier],
+    file_count: fileList.length,
     line_count: lines,
-    socratic_gate: tier >= 3 ? "required" : tier >= 2 ? "conditional" : "bypass",
+    socratic_gate: finalTier >= 3 ? 'required' : finalTier >= 2 ? 'conditional' : 'bypass',
   };
-  if (!quiet) console.error(`✓ Impact Tier: ${tier} (${tierNames[tier]})`);
+
+  if (providerUsed === 'laya') {
+    result._provider = 'laya';
+  }
+
+  if (!quiet) {
+    const providerTag = providerUsed ? ` [${providerUsed}]` : '';
+    console.error(`✓ Impact Tier: ${finalTier} (${tierNames[finalTier]})${providerTag}`);
+  }
   console.log(JSON.stringify(result));
   return true;
 }
@@ -261,4 +403,7 @@ module.exports = {
   cmdContextCompress,
   cmdOptimizeStep,
   cmdImpactTier,
+  resolveMonotonicImpactTier,
+  HIGH_RISK_PATTERNS,
+  HIGH_RISK_EXTENSIONS,
 };