waterplane 0.1.6 → 0.1.14

package/packages/host/dist/extensions/scorecard/shared/logic.mjs

@@ -0,0 +1,170 @@
+/**
+ * The scorecard's pure logic, shared by the host half and (for the remedy prompt) the phone:
+ * GitHub remote → slug, the API reply → checks, failing / accepted, the words of the setup row and
+ * the remedy prompt. No node imports.
+ */
+import { BUILT_IN_ACCEPTS, SLUG_RE } from "./wire.mjs";
+const DETAIL_LINES = 20;
+const DETAIL_CHARS = 300;
+/** GitHub `owner/name` of a remote URL (https, scp-style, ssh://, git://), or null for any other host. */
+export function githubSlug(url) {
+    const m = /^(?:(?:https?|ssh|git|git\+ssh):\/\/)?(?:[^@/\s]+@)?(?:www\.)?github\.com(?::\d+)?[:/]+([^/\s]+)\/([^/\s]+?)(?:\.git)?\/?$/i.exec(url.trim());
+    if (!m)
+        return null;
+    const slug = `${m[1]}/${m[2]}`;
+    return isUsableSlug(slug) ? slug : null;
+}
+/** SLUG_RE plus the two names GitHub's regex shape admits but no repo can have ("." and ".."). */
+export function isUsableSlug(s) {
+    if (!SLUG_RE.test(s))
+        return false;
+    const name = s.slice(s.indexOf("/") + 1);
+    return name !== "." && name !== "..";
+}
+/** Check names come off the network: only OWN keys count, so `constructor` / `__proto__` are ordinary names. */
+export const own = (o, k) => (o && Object.hasOwn(o, k) ? o[k] : undefined);
+export const builtInAccept = (name) => own(BUILT_IN_ACCEPTS, name);
+/** The slug a git `config` text names: remote `origin` if it is GitHub, else the first GitHub remote. */
+export function slugFromConfig(text) {
+    const remotes = [];
+    let cur = null;
+    for (const raw of text.split(/\r?\n/)) {
+        const line = raw.trim();
+        const sec = /^\[\s*remote\s+"([^"]+)"\s*\]$/i.exec(line);
+        if (sec) {
+            cur = sec[1];
+            continue;
+        }
+        if (line.startsWith("[")) {
+            cur = null;
+            continue;
+        }
+        const kv = /^url\s*=\s*(.+)$/i.exec(line);
+        if (kv && cur !== null)
+            remotes.push({ name: cur, url: kv[1].trim() });
+    }
+    const gh = remotes.map((r) => ({ name: r.name, slug: githubSlug(r.url) })).filter((r) => r.slug);
+    return (gh.find((r) => r.name === "origin") ?? gh[0])?.slug ?? null;
+}
+/** Failing = it loses points: 0 <= score < 10. -1 (inconclusive) never fails. */
+export const isFailing = (score) => score >= 0 && score < 10;
+export const viewerUrl = (slug) => `https://scorecard.dev/viewer/?uri=github.com/${slug}`;
+const MAX_CHECKS = 40;
+const NAME_MAX = 100;
+const REASON_CAP = 500;
+const SHORT_CAP = 300;
+const URL_CAP = 300;
+const clip = (v, n) => (v.length > n ? v.slice(0, n - 1) + "…" : v);
+const str = (v) => (typeof v === "string" ? v : null);
+/** The API reply, defensively. A wrong shape is `{ ok:false, reason }` — never an invented number. */
+export function parseReply(d) {
+    const o = d;
+    if (!o || typeof o !== "object" || Array.isArray(o))
+        return { ok: false, reason: "the Scorecard reply was not a JSON object" };
+    const score = o.score;
+    if (typeof score !== "number" || !Number.isFinite(score))
+        return { ok: false, reason: "the Scorecard reply has no aggregate score" };
+    if (score < 0 || score > 10)
+        return { ok: false, reason: `the Scorecard reply's score (${score}) is outside 0–10` };
+    if (!Array.isArray(o.checks))
+        return { ok: false, reason: "the Scorecard reply has no list of checks" };
+    const checks = [];
+    for (const c of o.checks) {
+        if (checks.length >= MAX_CHECKS)
+            break;
+        const r = c;
+        if (!r || typeof r !== "object" || typeof r.name !== "string" || !r.name || typeof r.score !== "number" || !Number.isFinite(r.score))
+            continue;
+        const doc = r.documentation;
+        const details = Array.isArray(r.details)
+            ? r.details.filter((x) => typeof x === "string").slice(0, DETAIL_LINES).map((x) => (x.length > DETAIL_CHARS ? x.slice(0, DETAIL_CHARS - 1) + "…" : x))
+            : [];
+        checks.push({
+            name: clip(r.name, NAME_MAX),
+            score: r.score,
+            reason: clip(str(r.reason) ?? "", REASON_CAP),
+            details,
+            docUrl: doc && typeof doc === "object" ? clip(str(doc.url) ?? "", URL_CAP) || null : null,
+            short: doc && typeof doc === "object" ? clip(str(doc.short) ?? "", SHORT_CAP) : "",
+        });
+    }
+    if (!checks.length)
+        return { ok: false, reason: "the Scorecard reply lists no readable check" };
+    const repo = o.repo;
+    const sc = o.scorecard;
+    const value = { score, checks };
+    const date = str(o.date);
+    if (date)
+        value.date = date;
+    const commit = repo && typeof repo === "object" ? str(repo.commit) : null;
+    if (commit)
+        value.commit = commit;
+    const ver = sc && typeof sc === "object" ? str(sc.version) : null;
+    if (ver)
+        value.scorecardVersion = ver;
+    return { ok: true, value };
+}
+/** A person's accept holds while the check's score has not fallen below the score it was accepted at. */
+export const acceptHolds = (a, score) => a.builtIn === true || a.score === undefined || score >= a.score;
+/** The sheet's checks: each with `failing` and its accept (built-in first, else the person's, unless lapsed). */
+export function checkViews(checks, person = {}) {
+    return checks.map((c) => {
+        const v = { ...c, failing: isFailing(c.score) };
+        if (!v.failing)
+            return v;
+        const built = builtInAccept(c.name);
+        if (built)
+            v.accepted = { reason: built, builtIn: true };
+        else {
+            const p = own(person, c.name);
+            if (p && acceptHolds(p, c.score))
+                v.accepted = p;
+        }
+        return v;
+    });
+}
+export const openCount = (checks) => checks.filter((c) => c.failing && !c.accepted).length;
+const plural = (n, w) => `${n} ${w}${n === 1 ? "" : "s"}`;
+/** The setup row's detail for a scored repo, e.g. "6/10 — 3 failing checks (A, B, C); 3 accepted". */
+export function scoredDetail(score, checks) {
+    const open = checks.filter((c) => c.failing && !c.accepted);
+    const accepted = checks.filter((c) => c.failing && c.accepted).length;
+    if (!open.length)
+        return `${score}/10 — no failing check left${accepted ? ` (${accepted} accepted)` : ""}`;
+    const names = open.length > 6 ? `${open.slice(0, 6).map((c) => c.name).join(", ")}, …` : open.map((c) => c.name).join(", ");
+    return `${score}/10 — ${plural(open.length, "failing check")} (${names})${accepted ? `; ${accepted} accepted` : ""}`;
+}
+const HINTS = {
+    "Pinned-Dependencies": "Pin every GitHub Action by its full commit SHA, with the version as a trailing comment (`uses: actions/checkout@<40-hex-sha> # v4.2.2`); pin Docker base images by digest and install steps by hash or lockfile. Add Dependabot (`.github/dependabot.yml`, ecosystem `github-actions`) so the pins keep getting updated.",
+    "Token-Permissions": "Give every workflow a top-level `permissions: read-all` (or `contents: read`) and grant write scopes only on the single job that needs them.",
+    "Branch-Protection": "Needs a minimal ruleset on the default branch that blocks force-push and deletion. That takes repo admin in GitHub settings: do NOT run it yourself. Give the person the `gh api` command (a repository ruleset, or `PUT /repos/{owner}/{repo}/branches/{branch}/protection`) to run, and explain what it changes.",
+    "Signed-Releases": "Sign or attest the release assets (build-provenance attestation with `actions/attest-build-provenance`, or sigstore/cosign signatures uploaded next to each release asset).",
+    "SAST": "Add a CodeQL workflow (`github/codeql-action`) that runs on pull requests and pushes to the default branch.",
+    "Security-Policy": "Add a SECURITY.md saying how to report a vulnerability privately and what to expect in reply.",
+    "Binary-Artifacts": "Remove committed binaries (jars, executables, archives) or, where one must stay, say why it is there and where it comes from.",
+    "Dependency-Update-Tool": "Add `.github/dependabot.yml` (or a Renovate config) covering every ecosystem the repo uses, including `github-actions`.",
+    "Vulnerabilities": "Fix or upgrade the dependencies the details list; where an advisory cannot apply, document it in an osv-scanner config (`osv-scanner.toml` ignore with a reason).",
+    "Maintained": "Scored from recent commit and issue activity on the repo's age; usually only time fixes it. Say so rather than inventing activity.",
+    "CII-Best-Practices": "Needs a project page at bestpractices.dev, which only the maintainer can create and fill in; tell the person what it asks for.",
+    "License": "Add a recognised license file (LICENSE or COPYING) at the repo root with an OSI-approved license text.",
+    "Packaging": "Publish through a recognised packaging workflow (e.g. a GitHub Actions workflow that runs the registry's publish step); say which registry fits this repo.",
+    "CI-Tests": "Make sure pull requests run the test suite in CI and that the run is visible as a check.",
+    "Webhooks": "Webhooks must carry a secret; that is set in GitHub settings by a repo admin, so tell the person which webhook lacks one.",
+};
+/** The prompt a person taps to send the agent after one failing check. Pure; the phone may quote it. */
+export function remedyPrompt(slug, c) {
+    const lines = [
+        `The public OpenSSF Scorecard for github.com/${slug} gives the check "${c.name}" ${c.score}/10.`,
+        `Reason: ${c.reason || "(none given)"}`,
+    ];
+    if (c.details.length)
+        lines.push("Details:", ...c.details.map((d) => `- ${d}`));
+    if (c.docUrl)
+        lines.push(`Documentation: ${c.docUrl}`);
+    const hint = own(HINTS, c.name);
+    if (hint)
+        lines.push("", `What usually fixes it: ${hint}`);
+    lines.push("", `Raise this one check in this repo. Change only what "${c.name}" needs, commit, and say plainly what you could not fix (and why, for example that it needs a repo admin or a person's account).`);
+    return lines.join("\n");
+}
+//# sourceMappingURL=logic.mjs.map

package/packages/host/dist/extensions/scorecard/shared/logic.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"logic.mjs","sourceRoot":"","sources":["../../../../../extensions/scorecard/shared/logic.mts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAqD,MAAM,YAAY,CAAC;AAE1G,MAAM,YAAY,GAAG,EAAE,CAAC;AACxB,MAAM,YAAY,GAAG,GAAG,CAAC;AAEzB,0GAA0G;AAC1G,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,MAAM,CAAC,GAAG,6HAA6H,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACzJ,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/B,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1C,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,YAAY,CAAC,CAAS;IACpC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,OAAO,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC;AACvC,CAAC;AAED,gHAAgH;AAChH,MAAM,CAAC,MAAM,GAAG,GAAG,CAAK,CAAiD,EAAE,CAAS,EAAiB,EAAE,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AACtJ,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,IAAY,EAAsB,EAAE,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;AAE/F,yGAAyG;AACzG,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,OAAO,GAAoC,EAAE,CAAC;IACpD,IAAI,GAAG,GAAkB,IAAI,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,iCAAiC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzD,IAAI,GAAG,EAAE,CAAC;YAAC,GAAG,GAAG,GAAG,CAAC,CAAC,CAAE,CAAC;YAAC,SAAS;QAAC,CAAC;QACrC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAAC,GAAG,GAAG,IAAI,CAAC;YAAC,SAAS;QAAC,CAAC;QACnD,MAAM,EAAE,GAAG,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,EAAE,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACjG,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,IAAI,CAAC;AACtE,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,KAAa,EAAW,EAAE,CAAC,KAAK,IAAI,CAAC,IAAI,KAAK,GAAG,EAAE,CAAC;AAE9E,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,gDAAgD,IAAI,EAAE,CAAC;AAU1G,MAAM,UAAU,GAAG,EAAE,CAAC;AACtB,MAAM,QAAQ,GAAG,GAAG,CAAC;AACrB,MAAM,UAAU,GAAG,GAAG,CAAC;AACvB,MAAM,SAAS,GAAG,GAAG,CAAC;AACtB,MAAM,OAAO,GAAG,GAAG,CAAC;AACpB,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,CAAS,EAAU,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAE5F,MAAM,GAAG,GAAG,CAAC,CAAU,EAAiB,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AAE9E,sGAAsG;AACtG,MAAM,UAAU,UAAU,CAAC,CAAU;IACnC,MAAM,CAAC,GAAG,CAAmC,CAAC;IAC9C,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,2CAA2C,EAAE,CAAC;IAC/H,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;IACtB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,4CAA4C,EAAE,CAAC;IACrI,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gCAAgC,KAAK,mBAAmB,EAAE,CAAC;IACpH,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,2CAA2C,EAAE,CAAC;IACxG,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;QACzB,IAAI,MAAM,CAAC,MAAM,IAAI,UAAU;YAAE,MAAM;QACvC,MAAM,CAAC,GAAG,CAAmC,CAAC;QAC9C,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,SAAS;QAC/I,MAAM,GAAG,GAAG,CAAC,CAAC,aAA2D,CAAC;QAC1E,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;YACtC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACnK,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC;YAC5B,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,UAAU,CAAC;YAC7C,OAAO;YACP,MAAM,EAAE,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI;YACzF,KAAK,EAAE,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE;SACnF,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,6CAA6C,EAAE,CAAC;IAChG,MAAM,IAAI,GAAG,CAAC,CAAC,IAAkD,CAAC;IAClE,MAAM,EAAE,GAAG,CAAC,CAAC,SAAuD,CAAC;IACrE,MAAM,KAAK,GAAW,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACxC,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAAC,IAAI,IAAI;QAAE,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC;IACtD,MAAM,MAAM,GAAG,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAAC,IAAI,MAAM;QAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC;IAC7G,MAAM,GAAG,GAAG,EAAE,IAAI,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAAC,IAAI,GAAG;QAAE,KAAK,CAAC,gBAAgB,GAAG,GAAG,CAAC;IACzG,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAC7B,CAAC;AAED,yGAAyG;AACzG,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAc,EAAE,KAAa,EAAW,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,IAAI,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC;AAEvI,iHAAiH;AACjH,MAAM,UAAU,UAAU,CAAC,MAA6B,EAAE,SAAgD,EAAE;IAC1G,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACtB,MAAM,CAAC,GAAc,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3D,IAAI,CAAC,CAAC,CAAC,OAAO;YAAE,OAAO,CAAC,CAAC;QACzB,MAAM,KAAK,GAAG,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,KAAK;YAAE,CAAC,CAAC,QAAQ,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;aACpD,CAAC;YACJ,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;YAC9B,IAAI,CAAC,IAAI,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC;gBAAE,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC;QACnD,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,MAA4B,EAAU,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC;AAEzH,MAAM,MAAM,GAAG,CAAC,CAAS,EAAE,CAAS,EAAU,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;AAElF,sGAAsG;AACtG,MAAM,UAAU,YAAY,CAAC,KAAa,EAAE,MAA4B;IACtE,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC;IACtE,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,OAAO,GAAG,KAAK,8BAA8B,QAAQ,CAAC,CAAC,CAAC,KAAK,QAAQ,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC3G,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5H,OAAO,GAAG,KAAK,SAAS,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,eAAe,CAAC,KAAK,KAAK,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,QAAQ,WAAW,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AACvH,CAAC;AAED,MAAM,KAAK,GAA2B;IACpC,qBAAqB,EAAE,0TAA0T;IACjV,mBAAmB,EAAE,8IAA8I;IACnK,mBAAmB,EAAE,oTAAoT;IACzU,iBAAiB,EAAE,6KAA6K;IAChM,MAAM,EAAE,6GAA6G;IACrH,iBAAiB,EAAE,+FAA+F;IAClH,kBAAkB,EAAE,+HAA+H;IACnJ,wBAAwB,EAAE,yHAAyH;IACnJ,iBAAiB,EAAE,mKAAmK;IACtL,YAAY,EAAE,oIAAoI;IAClJ,oBAAoB,EAAE,gIAAgI;IACtJ,SAAS,EAAE,wGAAwG;IACnH,WAAW,EAAE,4JAA4J;IACzK,UAAU,EAAE,0FAA0F;IACtG,UAAU,EAAE,2HAA2H;CACxI,CAAC;AAEF,wGAAwG;AACxG,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,CAAa;IACtD,MAAM,KAAK,GAAG;QACZ,+CAA+C,IAAI,qBAAqB,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,MAAM;QAChG,WAAW,CAAC,CAAC,MAAM,IAAI,cAAc,EAAE;KACxC,CAAC;IACF,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IAChF,IAAI,CAAC,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,0BAA0B,IAAI,EAAE,CAAC,CAAC;IAC3D,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,wDAAwD,CAAC,CAAC,IAAI,kIAAkI,CAAC,CAAC;IACjN,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/packages/host/dist/extensions/scorecard/shared/wire.d.mts

@@ -0,0 +1,140 @@
+/**
+ * The scorecard extension's wire: what the phone may ask the host half, typed once for both ends.
+ * Pure, no node imports — the host compiles it (`tsconfig.extensions.json`), the phone bundles it.
+ *
+ * The reading is the public OpenSSF Scorecard API (`api.securityscorecards.dev`) for the repo's
+ * GitHub remote: no credential, no model call. A repo with no GitHub remote, a private one, or one
+ * the API has not scored gets NO score — `absent` says why in a sentence, never a 0.
+ *
+ * Transport: the generic plugin channel on the one socket. Phone → host is `plugin.call`; host →
+ * phone is ONE tiny push, `changed` (`{ at, slug }`), after which the phone reads that repo again.
+ */
+/** One Scorecard check as the API scored it. */
+export interface ScoreCheck {
+    /** The API's check name, verbatim ("Pinned-Dependencies"). */
+    name: string;
+    /** 0–10; -1 = inconclusive / not applicable (the API's own value) — never failing. */
+    score: number;
+    /** The API's one-line reason ("dependency not pinned by hash detected -- score normalized to 6"). */
+    reason: string;
+    /** The API's details lines, capped by the host (≤ 20 lines, each ≤ 300 chars). */
+    details: string[];
+    /** The check's documentation page (the API's `documentation.url`), or null. */
+    docUrl: string | null;
+    /** The API's short description (`documentation.short`), or "". */
+    short: string;
+}
+/** Why a check that loses points is not counted: a person's reason, or one shipped built in. */
+export interface ScoreAccept {
+    reason: string;
+    /** ISO time the accept was made (built-in: absent). */
+    at?: string;
+    /** The check's score when accepted. The accept lapses when the score later falls BELOW it. */
+    score?: number;
+    /** Shipped with waterplane (solo-unfixable), not typed by anyone; cannot be withdrawn. */
+    builtIn?: true;
+}
+/** A check as the sheet draws it: the reading plus whether it counts. */
+export interface CheckView extends ScoreCheck {
+    /** 0 <= score < 10. */
+    failing: boolean;
+    /** Present when a failing check is accepted (and the accept has not lapsed). */
+    accepted?: ScoreAccept;
+}
+export interface ScoreView {
+    /** Repo id (the phone's `RepoTarget.id`) this answers for. */
+    repo: string;
+    /** `owner/name` on github.com that is scored, or null when the repo has no GitHub remote and none is set. */
+    slug: string | null;
+    /** Where `slug` came from: the `origin` remote (else the first GitHub remote), or a person's
+     *  "scored as" (a private repo published through a public mirror — this repo's own case). */
+    slugFrom: "remote" | "set" | null;
+    /** The aggregate 0–10 as the API gives it, or null with `absent`. */
+    score: number | null;
+    /** Why there is no score, in a sentence ("private repo — Scorecard scores public repos only"). */
+    absent?: string;
+    /** The API's run date (ISO) and scored commit, when scored. */
+    date?: string;
+    commit?: string;
+    scorecardVersion?: string;
+    /** Every check, API order. Empty when absent. */
+    checks: CheckView[];
+    /** How many checks are failing and not accepted — the chip's number, and exactly what its tap opens. */
+    open: number;
+    /** When the host read the API (ms epoch), or null when it never has. */
+    readAt: number | null;
+    /** True when the repo is private and this reading was scored on the desktop with the scorecard CLI
+     *  (not the public score); `date` is when. No `viewerUrl` then. */
+    local?: true;
+    /** The badge / public viewer page for the slug, when scored. */
+    viewerUrl?: string;
+    /** A sentence about something the host could not use (the accepts file does not parse, so no
+     *  person's accept counts and none can be written). Shown on the sheet; absent when all is well. */
+    problem?: string;
+}
+/** Built-in accepts: checks a solo maintainer cannot pass. Keyed by the API's check name. */
+export declare const BUILT_IN_ACCEPTS: Readonly<Record<string, string>>;
+/** A read is reused this long before the host asks the API again. */
+export declare const SCORE_FRESH_MS: number;
+/** Whether a slug is public (unauthenticated GitHub API) is reused this long — 60 requests/hour per IP. */
+export declare const VISIBILITY_FRESH_MS: number;
+export declare const PUSH_CHANGED = "changed";
+/** The setup row's check id. */
+export declare const CHECK_ID = "scorecard";
+/** A GitHub `owner/name`, as GitHub allows them. */
+export declare const SLUG_RE: RegExp;
+/** Longest accept reason the host keeps. */
+export declare const REASON_MAX = 500;
+export type ScorecardMethods = {
+    /** The cached view; starts a read in the background when stale (a `changed` push follows). */
+    read: {
+        args: {
+            repo: string;
+        };
+        result: ScoreView;
+    };
+    /** Read the API now, past the cache. */
+    refresh: {
+        args: {
+            repo: string;
+        };
+        result: ScoreView;
+    };
+    /** Accept a failing check with a reason (non-empty, ≤ REASON_MAX). */
+    accept: {
+        args: {
+            repo: string;
+            check: string;
+            reason: string;
+        };
+        result: ScoreView;
+    };
+    /** Withdraw a person's accept (a built-in one is refused in words). */
+    unaccept: {
+        args: {
+            repo: string;
+            check: string;
+        };
+        result: ScoreView;
+    };
+    /** Score this repo as another public `owner/name` (a mirror), or null to go back to the remote. */
+    scoredAs: {
+        args: {
+            repo: string;
+            slug: string | null;
+        };
+        result: ScoreView;
+    };
+    /** Put the check's remedy prompt in the repo's backlog — waits for a tap, never fires. */
+    remedy: {
+        args: {
+            repo: string;
+            check: string;
+        };
+        result: {
+            intentId: string;
+            existing: boolean;
+            state?: string;
+        };
+    };
+};

package/packages/host/dist/extensions/scorecard/shared/wire.mjs

@@ -0,0 +1,29 @@
+/**
+ * The scorecard extension's wire: what the phone may ask the host half, typed once for both ends.
+ * Pure, no node imports — the host compiles it (`tsconfig.extensions.json`), the phone bundles it.
+ *
+ * The reading is the public OpenSSF Scorecard API (`api.securityscorecards.dev`) for the repo's
+ * GitHub remote: no credential, no model call. A repo with no GitHub remote, a private one, or one
+ * the API has not scored gets NO score — `absent` says why in a sentence, never a 0.
+ *
+ * Transport: the generic plugin channel on the one socket. Phone → host is `plugin.call`; host →
+ * phone is ONE tiny push, `changed` (`{ at, slug }`), after which the phone reads that repo again.
+ */
+/** Built-in accepts: checks a solo maintainer cannot pass. Keyed by the API's check name. */
+export const BUILT_IN_ACCEPTS = {
+    "Code-Review": "Solo maintainer: needs a second person approving changes; self-merged pull requests do not count.",
+    "Contributors": "Solo maintainer: needs contributors from several organisations.",
+    "Fuzzing": "No fuzzing integration (OSS-Fuzz, ClusterFuzzLite) for this project; accepted for a solo project.",
+};
+/** A read is reused this long before the host asks the API again. */
+export const SCORE_FRESH_MS = 6 * 60 * 60_000;
+/** Whether a slug is public (unauthenticated GitHub API) is reused this long — 60 requests/hour per IP. */
+export const VISIBILITY_FRESH_MS = 24 * 60 * 60_000;
+export const PUSH_CHANGED = "changed";
+/** The setup row's check id. */
+export const CHECK_ID = "scorecard";
+/** A GitHub `owner/name`, as GitHub allows them. */
+export const SLUG_RE = /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})\/[A-Za-z0-9._-]{1,100}$/;
+/** Longest accept reason the host keeps. */
+export const REASON_MAX = 500;
+//# sourceMappingURL=wire.mjs.map

package/packages/host/dist/extensions/scorecard/shared/wire.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"wire.mjs","sourceRoot":"","sources":["../../../../../extensions/scorecard/shared/wire.mts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAqEH,6FAA6F;AAC7F,MAAM,CAAC,MAAM,gBAAgB,GAAqC;IAChE,aAAa,EAAE,mGAAmG;IAClH,cAAc,EAAE,iEAAiE;IACjF,SAAS,EAAE,mGAAmG;CAC/G,CAAC;AAEF,qEAAqE;AACrE,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;AAC9C,2GAA2G;AAC3G,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;AACpD,MAAM,CAAC,MAAM,YAAY,GAAG,SAAS,CAAC;AACtC,gCAAgC;AAChC,MAAM,CAAC,MAAM,QAAQ,GAAG,WAAW,CAAC;AACpC,oDAAoD;AACpD,MAAM,CAAC,MAAM,OAAO,GAAG,4DAA4D,CAAC;AACpF,4CAA4C;AAC5C,MAAM,CAAC,MAAM,UAAU,GAAG,GAAG,CAAC"}

package/packages/host/dist/files.d.ts

@@ -133,12 +133,8 @@ export declare function statInTree(worktree: string, relPath: string, opts?: Tre
     mtime: number;
 } | null;
 export declare function readInTree(worktree: string, relPath: string, opts?: TreeReadOpts): Buffer | null;
-/**
- * Walk a worktree (or just the outbox) for viewable artifacts, newest first.
- * `scope`: "outbox" = the outbox dirs in OUTBOX_SUBDIRS (.claude/outbox + .outbox),
- * else the whole tree minus SKIP_DIRS and the inbox.
- */
-export declare function discoverArtifacts(worktree: string, opts?: {
+/** Options both artifact walks take. */
+export interface ArtifactWalkOpts {
     scope?: "repo" | "outbox";
     sinceSeconds?: number;
     limit?: number;
@@ -148,19 +144,25 @@ export declare function discoverArtifacts(worktree: string, opts?: {
     kind?: ArtifactKind;
     /** Include the .claude/inbox dir in a "repo" scope walk (search wants it). */
     includeInbox?: boolean;
-}): {
+}
+/**
+ * Walk a worktree (or just the outbox) for viewable artifacts, newest first.
+ * `scope`: "outbox" = the outbox dirs in OUTBOX_SUBDIRS (.claude/outbox + .outbox),
+ * else the whole tree minus SKIP_DIRS and the inbox. Blocks the loop for the
+ * whole walk — its callers are outbox-scope; a repo-scope caller wants
+ * `discoverArtifactsAsync`.
+ */
+export declare function discoverArtifacts(worktree: string, opts?: ArtifactWalkOpts): {
     files: FileEntry[];
     truncated: boolean;
 };
 /**
  * `discoverArtifacts` without holding the event loop: the same walk, the same filters, the same
  * answer — for every REPO-scope caller (the cross-repo search, a session's image and auto-pull
- * baselines). The sync walk `stat`s every entry of the whole tree in one go; on WSL reading a
- * Windows drive (9P, ~20 ms a call, far worse while `git status` runs) one search over 36 repos
- * froze the host for minutes. Here an entry's kind comes from the directory listing and only a
- * symlink or a file the filter wants is `stat`ed, every call awaited.
+ * baselines). On WSL reading a Windows drive one search over 36 repos walked synchronously froze
+ * the host for minutes; here every disk call is awaited.
  */
-export declare function discoverArtifactsAsync(worktree: string, opts?: Parameters<typeof discoverArtifacts>[1]): Promise<{
+export declare function discoverArtifactsAsync(worktree: string, opts?: ArtifactWalkOpts): Promise<{
     files: FileEntry[];
     truncated: boolean;
 }>;

package/packages/host/dist/files.js

@@ -484,11 +484,15 @@ export function readInTree(worktree, relPath, opts = {}) {
     }
 }
 /**
- * Walk a worktree (or just the outbox) for viewable artifacts, newest first.
- * `scope`: "outbox" = the outbox dirs in OUTBOX_SUBDIRS (.claude/outbox + .outbox),
- * else the whole tree minus SKIP_DIRS and the inbox.
+ * The artifact walk, ONCE — `discoverArtifacts` drives it with sync calls and
+ * `discoverArtifactsAsync` with awaited ones, so the walk, its filters and its
+ * containment rule cannot drift apart. It never touches the disk itself: each
+ * `yield` is a question (`readdir` → `Dirent[]`, `stat` → stats, `null` on
+ * failure). An entry's kind comes from the directory listing; only a symlink or
+ * a file the filter wants is `stat`ed — on WSL reading a Windows drive (9P,
+ * ~20 ms a call) a `stat` of every entry froze the host for minutes.
  */
-export function discoverArtifacts(worktree, opts = {}) {
+function* artifactWalk(worktree, opts) {
     const scope = opts.scope ?? "repo";
     const limit = Math.min(opts.limit ?? 300, 1000);
     const cutoff = opts.sinceSeconds ? Date.now() - opts.sinceSeconds * 1000 : 0;
@@ -508,118 +512,41 @@ export function discoverArtifacts(worktree, opts = {}) {
     const nestedFull = join(root, NESTED_WORKTREES);
     while (stack.length) {
         const dir = stack.pop();
-        let entries;
-        try {
-            entries = readdirSync(dir);
-        }
-        catch {
+        const entries = (yield { readdir: dir });
+        if (!entries)
             continue;
-        }
-        for (const name of entries) {
-            const full = join(dir, name);
-            let st;
-            try {
-                // A link that leaves the worktree is neither walked nor listed: a committed
-                // `docs/home -> ~` would otherwise list every picture under the home directory.
-                if (lstatSync(full).isSymbolicLink() && containedReal(root, relative(root, full)) === null)
-                    continue;
-                st = statSync(full);
-            }
-            catch {
-                continue;
-            }
-            if (st.isDirectory()) {
-                if (SKIP_DIRS.has(name))
-                    continue;
-                if (scope === "repo" && !opts.includeInbox && full === inboxFull)
-                    continue; // inbox is phone→repo
-                if (full === nestedFull)
-                    continue; // other checkouts, not this tree's files
-                stack.push(full);
-            }
-            else if (st.isFile() && allow.has(extname(name).toLowerCase())) {
-                if (cutoff && st.mtimeMs < cutoff)
-                    continue;
-                if (q && !name.toLowerCase().includes(q))
-                    continue;
-                out.push({ name, relPath: relative(root, full).split(sep).join("/"), size: st.size, mtime: st.mtimeMs, ctime: birthMs(st) });
-            }
-        }
-    }
-    out.sort((a, b) => b.mtime - a.mtime);
-    const truncated = out.length > limit;
-    return { files: out.slice(0, limit), truncated };
-}
-/**
- * `discoverArtifacts` without holding the event loop: the same walk, the same filters, the same
- * answer — for every REPO-scope caller (the cross-repo search, a session's image and auto-pull
- * baselines). The sync walk `stat`s every entry of the whole tree in one go; on WSL reading a
- * Windows drive (9P, ~20 ms a call, far worse while `git status` runs) one search over 36 repos
- * froze the host for minutes. Here an entry's kind comes from the directory listing and only a
- * symlink or a file the filter wants is `stat`ed, every call awaited.
- */
-export async function discoverArtifactsAsync(worktree, opts = {}) {
-    const scope = opts.scope ?? "repo";
-    const limit = Math.min(opts.limit ?? 300, 1000);
-    const cutoff = opts.sinceSeconds ? Date.now() - opts.sinceSeconds * 1000 : 0;
-    const allow = kindExt(opts.kind, scope);
-    const q = opts.query?.trim().toLowerCase() || "";
-    const root = resolve(worktree);
-    const starts = scope === "outbox"
-        ? OUTBOX_SUBDIRS.map((sub) => transportDir(worktree, sub)).filter((d) => d !== null && existsSync(d))
-        : (existsSync(root) ? [root] : []);
-    if (!starts.length)
-        return { files: [], truncated: false };
-    const out = [];
-    const stack = [...starts];
-    const inboxFull = inboxDir(worktree);
-    const nestedFull = join(root, NESTED_WORKTREES);
-    while (stack.length) {
-        const dir = stack.pop();
-        let entries;
-        try {
-            entries = await readdirAsync(dir, { withFileTypes: true });
-        }
-        catch {
-            continue;
-        }
         for (const e of entries) {
             const name = e.name;
             const full = join(dir, name);
             let isDir = e.isDirectory();
             let isFile = e.isFile();
             if (e.isSymbolicLink()) {
-                // Followed like the sync walk — only while its target stays in the worktree.
+                // A link that leaves the worktree is neither walked nor listed: a committed
+                // `docs/home -> ~` would otherwise list every picture under the home directory.
+                // One that stays inside is followed.
                 if (containedReal(root, relative(root, full)) === null)
                     continue;
-                try {
-                    const st = await statAsync(full);
-                    isDir = st.isDirectory();
-                    isFile = st.isFile();
-                }
-                catch {
+                const st = (yield { stat: full });
+                if (!st)
                     continue;
-                }
+                isDir = st.isDirectory();
+                isFile = st.isFile();
             }
             if (isDir) {
                 if (SKIP_DIRS.has(name))
                     continue;
                 if (scope === "repo" && !opts.includeInbox && full === inboxFull)
-                    continue;
+                    continue; // inbox is phone→repo
                 if (full === nestedFull)
-                    continue;
+                    continue; // other checkouts, not this tree's files
                 stack.push(full);
             }
             else if (isFile && allow.has(extname(name).toLowerCase())) {
                 if (q && !name.toLowerCase().includes(q))
                     continue;
-                let st;
-                try {
-                    st = await statAsync(full);
-                }
-                catch {
+                const st = (yield { stat: full });
+                if (!st)
                     continue;
-                }
                 if (cutoff && st.mtimeMs < cutoff)
                     continue;
                 out.push({ name, relPath: relative(root, full).split(sep).join("/"), size: st.size, mtime: st.mtimeMs, ctime: birthMs(st) });
@@ -630,6 +557,49 @@ export async function discoverArtifactsAsync(worktree, opts = {}) {
     const truncated = out.length > limit;
     return { files: out.slice(0, limit), truncated };
 }
+function answerSync(ask) {
+    try {
+        return "readdir" in ask ? readdirSync(ask.readdir, { withFileTypes: true }) : statSync(ask.stat);
+    }
+    catch {
+        return null;
+    }
+}
+async function answerAsync(ask) {
+    try {
+        return "readdir" in ask ? await readdirAsync(ask.readdir, { withFileTypes: true }) : await statAsync(ask.stat);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Walk a worktree (or just the outbox) for viewable artifacts, newest first.
+ * `scope`: "outbox" = the outbox dirs in OUTBOX_SUBDIRS (.claude/outbox + .outbox),
+ * else the whole tree minus SKIP_DIRS and the inbox. Blocks the loop for the
+ * whole walk — its callers are outbox-scope; a repo-scope caller wants
+ * `discoverArtifactsAsync`.
+ */
+export function discoverArtifacts(worktree, opts = {}) {
+    const walk = artifactWalk(worktree, opts);
+    let step = walk.next();
+    while (!step.done)
+        step = walk.next(answerSync(step.value));
+    return step.value;
+}
+/**
+ * `discoverArtifacts` without holding the event loop: the same walk, the same filters, the same
+ * answer — for every REPO-scope caller (the cross-repo search, a session's image and auto-pull
+ * baselines). On WSL reading a Windows drive one search over 36 repos walked synchronously froze
+ * the host for minutes; here every disk call is awaited.
+ */
+export async function discoverArtifactsAsync(worktree, opts = {}) {
+    const walk = artifactWalk(worktree, opts);
+    let step = walk.next();
+    while (!step.done)
+        step = walk.next(await answerAsync(step.value));
+    return step.value;
+}
 /**
  * Every file in a transport directory — **not** the gallery's viewable subset.
  *