wingfoil 0.2.2 → 0.3.0

package/dist/core/dry-run.js

@@ -0,0 +1,45 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DRY_RUN_FLAG = void 0;
+exports.runAsDryRun = runAsDryRun;
+/**
+ * `--dry-run` for every mutating operation (task-210, `dl-106` W2, `spec-008-cli-grammar` §2).
+ *
+ * A surface runs an operation through {@link runAsDryRun} instead of calling its `fn` directly. The
+ * operation itself never learns of the mode: the commit primitive (`writeAndCommit`, `src/storage`)
+ * plans the commit instead of making it (`src/storage/dry-run.ts`). So every operation registered
+ * `mutates: true` — those in `CORE_MODULES` today and any added later — takes the flag by construction,
+ * and `test/cli/dry-run.integration.test.ts` holds each of them to it.
+ */
+const storage_1 = require("../storage");
+const types_1 = require("./types");
+/**
+ * The flag the CLI registrar adds to every command whose operation `mutates` (`src/cli/registrar.ts`).
+ * An operation never declares it; a command whose operation writes nothing does not take it.
+ */
+exports.DRY_RUN_FLAG = {
+    name: 'dry-run',
+    description: 'print the commit this command would make (subject, paths, diff) and write nothing',
+};
+/**
+ * Run `run` — one operation's `fn` — as a dry run:
+ *
+ * - it reached its commit → a success whose value is the {@link DryRunPlan} (exit `0`), with no
+ *   `commit`, since none was made, and the warnings the operation handed to the commit primitive
+ *   (`CommitOptions.warnings`) — the ones the real run would print;
+ * - it refused before writing → its own failed result, unchanged, so the exit code is the refusal's;
+ * - it threw → the same throw, for the surface to render as it renders any thrown error;
+ * - it succeeded without committing (a change that is already in place) → its own result, which is
+ *   what the real run would print too.
+ *
+ * A dry run stops at the operation's first commit (see `src/storage/dry-run.ts`).
+ */
+async function runAsDryRun(run) {
+    const outcome = await (0, storage_1.captureDryRun)(run);
+    if (outcome.kind === 'planned')
+        return (0, types_1.coreOk)(outcome.plan, undefined, outcome.warnings);
+    if (outcome.kind === 'threw')
+        throw outcome.error;
+    return outcome.value;
+}
+//# sourceMappingURL=dry-run.js.map

package/dist/core/dry-run.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dry-run.js","sourceRoot":"","sources":["../../src/core/dry-run.ts"],"names":[],"mappings":";;;AAsCA,kCAKC;AA3CD;;;;;;;;GAQG;AACH,wCAA4D;AAG5D,mCAAkD;AAIlD;;;GAGG;AACU,QAAA,YAAY,GAAa;IACpC,IAAI,EAAE,SAAS;IACf,WAAW,EAAE,mFAAmF;CACjG,CAAC;AAEF;;;;;;;;;;;;GAYG;AACI,KAAK,UAAU,WAAW,CAAI,GAAiC;IACpE,MAAM,OAAO,GAAG,MAAM,IAAA,uBAAa,EAAC,GAAG,CAAC,CAAC;IACzC,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,IAAA,cAAM,EAAC,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzF,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO;QAAE,MAAM,OAAO,CAAC,KAAK,CAAC;IAClD,OAAO,OAAO,CAAC,KAAK,CAAC;AACvB,CAAC"}

package/dist/core/element-ref.d.ts

@@ -0,0 +1,23 @@
+/**
+ * The element-ref, `<type>:<id>` (`spec-008` §7): how a surface names one Memory element by type —
+ * the `{role}-session` Prompt's `element` argument (task-195, `spec-004` §3.1) and `agent execute
+ * --element` (`spec-016`, task-218). One parser, so both surfaces accept and refuse the same strings.
+ *
+ * The grammar (`spec-008` §7, as tightened by task-195): exactly one `:`; a non-empty `<type>` before it
+ * and a non-empty `<id>` after it; no whitespace, no control character, and no `-->` anywhere — the
+ * `spec-012` §7 payload header and its `<!-- begin:<type>:<id> -->` markers could not carry one. Nothing
+ * else is checked here: whether `<type>` is a `memory.yaml` type and whether `<id>` names an element are
+ * questions for whoever resolves the ref.
+ */
+import type { ExecutionContextElement } from './context';
+import { type CoreResult } from './types';
+/** The refusal text of a malformed element-ref: the ref as a JSON string, so no byte of it is lost or interpreted. */
+export declare function malformedElementRefMessage(ref: string): string;
+/**
+ * Parse `ref` as an element-ref.
+ *
+ * @returns The `{type, id}` it names, or `VALIDATION` with {@link malformedElementRefMessage} when it
+ *   does not follow the grammar in this module's doc.
+ */
+export declare function parseElementRef(ref: string): CoreResult<ExecutionContextElement>;
+//# sourceMappingURL=element-ref.d.ts.map

package/dist/core/element-ref.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"element-ref.d.ts","sourceRoot":"","sources":["../../src/core/element-ref.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EAAmB,KAAK,UAAU,EAAE,MAAM,SAAS,CAAC;AAK3D,sHAAsH;AACtH,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAAC,uBAAuB,CAAC,CAIhF"}

package/dist/core/element-ref.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.malformedElementRefMessage = malformedElementRefMessage;
+exports.parseElementRef = parseElementRef;
+const types_1 = require("./types");
+// eslint-disable-next-line no-control-regex
+const ELEMENT_REF = /^([^:\s\u0000-\u001f\u007f]+):([^:\s\u0000-\u001f\u007f]+)$/;
+/** The refusal text of a malformed element-ref: the ref as a JSON string, so no byte of it is lost or interpreted. */
+function malformedElementRefMessage(ref) {
+    return `malformed element-ref ${JSON.stringify(ref)}: expected <type>:<id>`;
+}
+/**
+ * Parse `ref` as an element-ref.
+ *
+ * @returns The `{type, id}` it names, or `VALIDATION` with {@link malformedElementRefMessage} when it
+ *   does not follow the grammar in this module's doc.
+ */
+function parseElementRef(ref) {
+    const match = ELEMENT_REF.exec(ref);
+    if (match === null || ref.includes('-->'))
+        return (0, types_1.coreErr)({ code: 'VALIDATION', message: malformedElementRefMessage(ref) });
+    return (0, types_1.coreOk)({ type: match[1], id: match[2] });
+}
+//# sourceMappingURL=element-ref.js.map

package/dist/core/element-ref.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"element-ref.js","sourceRoot":"","sources":["../../src/core/element-ref.ts"],"names":[],"mappings":";;AAkBA,gEAEC;AAQD,0CAIC;AApBD,mCAA2D;AAE3D,4CAA4C;AAC5C,MAAM,WAAW,GAAG,6DAA6D,CAAC;AAElF,sHAAsH;AACtH,SAAgB,0BAA0B,CAAC,GAAW;IACpD,OAAO,yBAAyB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,wBAAwB,CAAC;AAC9E,CAAC;AAED;;;;;GAKG;AACH,SAAgB,eAAe,CAAC,GAAW;IACzC,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,KAAK,KAAK,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,IAAA,eAAO,EAAC,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,0BAA0B,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC5H,OAAO,IAAA,cAAM,EAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAE,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC;AACpD,CAAC"}

package/dist/core/error-details.d.ts

@@ -0,0 +1,20 @@
+import type { CoreError } from './types';
+/** One operator-facing entry of a refusal: the file an issue names and/or its explanation. */
+export interface ErrorDetail {
+    readonly file?: string;
+    readonly detail?: string;
+}
+/**
+ * The operator-facing details of `error`, in issue order (REQ-SYS-07 — the order core recorded, never
+ * re-sorted). An issue contributes an entry only when it names a non-empty `file` or `detail`, and the
+ * entry carries only the fields it has. Anything else in `details` is ignored: the list is empty for
+ * an error with no `details.issues`, which is the case for every error that carried no details before.
+ *
+ * A `file` the error's `message` already contains, verbatim, is not repeated (task-130 review):
+ * `ValidationError`'s message embeds `(<file>)` for every issue, so repeating it would print the path
+ * twice. The entry keeps its `detail`, and an entry left with neither field is dropped. What remains is
+ * exactly what the reason does not already say — for the illegal-transition refusal, whose message is
+ * the bare `dl-032` contract string, both the file and the explanation.
+ */
+export declare function errorDetails(error: CoreError): readonly ErrorDetail[];
+//# sourceMappingURL=error-details.d.ts.map

package/dist/core/error-details.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-details.d.ts","sourceRoot":"","sources":["../../src/core/error-details.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAEzC,8FAA8F;AAC9F,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,SAAS,GAAG,SAAS,WAAW,EAAE,CAgBrE"}

package/dist/core/error-details.js

@@ -0,0 +1,65 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.errorDetails = errorDetails;
+/**
+ * What of a {@link CoreError}'s `details` every surface shows (task-130, `dl-055` option 1,
+ * `spec-005` §3, `spec-004`).
+ *
+ * Every core refusal built from a `ValidationError` carries `details: { issues }`, and two fields of
+ * an issue are for the operator: the `file` it was found in (`bug-031`'s missing file name) and the
+ * `detail` that explains a pinned contract message (`dl-032` option (c)). Until this module no surface
+ * read either. A spec-003 loader refusal (task-136) carries `details: { diagnostics }` instead; each
+ * diagnostic is shown in the reason form (see `diagnosticDetails`). Deciding *which* fields are shown once, here, is what keeps the CLI (`src/cli/error.ts`)
+ * and the MCP registrar (`src/mcp/registrar.ts`) from drifting apart (REQ-SYS-05); each surface only
+ * decides how to write the list in its own format.
+ */
+const validation_1 = require("../validation");
+/**
+ * The operator-facing details of `error`, in issue order (REQ-SYS-07 — the order core recorded, never
+ * re-sorted). An issue contributes an entry only when it names a non-empty `file` or `detail`, and the
+ * entry carries only the fields it has. Anything else in `details` is ignored: the list is empty for
+ * an error with no `details.issues`, which is the case for every error that carried no details before.
+ *
+ * A `file` the error's `message` already contains, verbatim, is not repeated (task-130 review):
+ * `ValidationError`'s message embeds `(<file>)` for every issue, so repeating it would print the path
+ * twice. The entry keeps its `detail`, and an entry left with neither field is dropped. What remains is
+ * exactly what the reason does not already say — for the illegal-transition refusal, whose message is
+ * the bare `dl-032` contract string, both the file and the explanation.
+ */
+function errorDetails(error) {
+    const diagnostics = error.details?.diagnostics;
+    if (Array.isArray(diagnostics))
+        return diagnosticDetails(error.message, diagnostics);
+    const issues = error.details?.issues;
+    if (!Array.isArray(issues))
+        return [];
+    const entries = [];
+    for (const issue of issues) {
+        if (typeof issue !== 'object' || issue === null)
+            continue;
+        const { file, detail } = issue;
+        const entry = {
+            ...(typeof file === 'string' && file !== '' && !error.message.includes(file) ? { file } : {}),
+            ...(typeof detail === 'string' && detail !== '' ? { detail } : {}),
+        };
+        if (entry.file !== undefined || entry.detail !== undefined)
+            entries.push(entry);
+    }
+    return entries;
+}
+/**
+ * The details of a refusal that carries spec-003 `diagnostics` (task-136) rather than `issues`: one
+ * entry per diagnostic, in the loader's order, its `detail` the diagnostic in the reason form
+ * (`formatDiagnostic`: code, path, file and message), so every further error and every warning reaches
+ * the operator. The diagnostic the reason already is — the first error — is not repeated.
+ */
+function diagnosticDetails(reason, diagnostics) {
+    const entries = [];
+    for (const diagnostic of diagnostics) {
+        const line = (0, validation_1.formatDiagnostic)(diagnostic);
+        if (line !== reason)
+            entries.push({ detail: line });
+    }
+    return entries;
+}
+//# sourceMappingURL=error-details.js.map

package/dist/core/error-details.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-details.js","sourceRoot":"","sources":["../../src/core/error-details.ts"],"names":[],"mappings":";;AAiCA,oCAgBC;AAjDD;;;;;;;;;;;GAWG;AACH,8CAAkE;AASlE;;;;;;;;;;;GAWG;AACH,SAAgB,YAAY,CAAC,KAAgB;IAC3C,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,EAAE,WAAW,CAAC;IAC/C,IAAI,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC;QAAE,OAAO,iBAAiB,CAAC,KAAK,CAAC,OAAO,EAAE,WAAoC,CAAC,CAAC;IAC9G,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC;IACrC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,CAAC;IACtC,MAAM,OAAO,GAAkB,EAAE,CAAC;IAClC,KAAK,MAAM,KAAK,IAAI,MAA4B,EAAE,CAAC;QACjD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;YAAE,SAAS;QAC1D,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,KAA6C,CAAC;QACvE,MAAM,KAAK,GAAgB;YACzB,GAAG,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7F,GAAG,CAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnE,CAAC;QACF,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,MAAc,EAAE,WAAkC;IAC3E,MAAM,OAAO,GAAkB,EAAE,CAAC;IAClC,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,IAAA,6BAAgB,EAAC,UAAU,CAAC,CAAC;QAC1C,IAAI,IAAI,KAAK,MAAM;YAAE,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/core/exit-code.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"exit-code.d.ts","sourceRoot":"","sources":["../../src/core/exit-code.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,SAAS,EAAiB,UAAU,EAAE,MAAM,SAAS,CAAC;AAGpE,wGAAwG;AACxG,MAAM,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAgBjC,+DAA+D;AAC/D,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,SAAS,GAAG,QAAQ,CAE3D;AAED,kGAAkG;AAClG,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,UAAU,CAAC,OAAO,CAAC,GAAG,QAAQ,CAEvE;AAED;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC3B,sFAAsF;IACtF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,gGAAgG;IAChG,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAqDD;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,iEAAiE;IACjE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B;;;;;;OAMG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;CAClC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,YAAY,GAAG,gBAAgB,CAM5E;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,YAAY,GAAG,QAAQ,CAEvE;AAED,sGAAsG;AACtG,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;CAC7B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,aAAa,CAS9D"}
+{"version":3,"file":"exit-code.d.ts","sourceRoot":"","sources":["../../src/core/exit-code.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,SAAS,EAAiB,UAAU,EAAE,MAAM,SAAS,CAAC;AAGpE,wGAAwG;AACxG,MAAM,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAgBjC,+DAA+D;AAC/D,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,SAAS,GAAG,QAAQ,CAE3D;AAED,kGAAkG;AAClG,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,UAAU,CAAC,OAAO,CAAC,GAAG,QAAQ,CAEvE;AAED;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC3B,sFAAsF;IACtF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,gGAAgG;IAChG,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAoDD;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,iEAAiE;IACjE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B;;;;;;OAMG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;CAClC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,YAAY,GAAG,gBAAgB,CAM5E;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,YAAY,GAAG,QAAQ,CAEvE;AAED,sGAAsG;AACtG,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;CAC7B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,aAAa,CAS9D"}

package/dist/core/exit-code.js

@@ -64,13 +64,12 @@ function exitCodeForResult(result) {
  * version surface: a Commander upgrade that renames or adds one must revisit this set, which is why
  * the codes are listed explicitly here rather than inferred from the suggested exit code.
  *
- * One of them, `commander.excessArguments`, is reached in production only by the two hand-wired
- * bootstrap commands (`wingfoil init extra` → `error: too many arguments for 'init'…`, exit `2`,
- * pinned by `test/cli/commander-parse-exit-codes.integration.test.ts`). A command derived from
- * `CORE_MODULES` never raises it: `src/cli/program.ts` registers a declared positional as an optional
- * variadic list and lets a command without one accept excess operands (task-120), so
- * `wingfoil dna show project extra` is accepted and an extra positional on a write verb is refused by
- * WingFoil's own check instead, already at exit `2`.
+ * One of them, `commander.excessArguments`, is reached by no shipped command: a command derived from
+ * `CORE_MODULES` registers a declared positional as an optional variadic list and lets a command
+ * without one accept excess operands (task-120), and the two hand-wired bootstrap commands `init` and
+ * `mcp` accept them too (task-165, `bug-179`), so a surplus operand is refused by WingFoil's own check
+ * (`extraOperandsReason`, task-129), already at exit `2`. The code stays in the set so that a command
+ * registered later without that opt-in still exits `2` on Commander's refusal.
  */
 const USAGE_ERROR_PARSE_CODES = new Set([
     'commander.unknownCommand',

package/dist/core/exit-code.js.map

@@ -1 +1 @@
-{"version":3,"file":"exit-code.js","sourceRoot":"","sources":["../../src/core/exit-code.ts"],"names":[],"mappings":";;AA8CA,4CAEC;AAGD,8CAEC;AA0GD,oDAMC;AAOD,0DAEC;AAqBD,4CASC;AA5MD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,8CAAgD;AAGhD,+CAA2C;AAK3C;;;;;GAKG;AACH,MAAM,kBAAkB,GAAoC;IAC1D,SAAS,EAAE,CAAC;IACZ,kBAAkB,EAAE,CAAC;IACrB,UAAU,EAAE,CAAC;IACb,QAAQ,EAAE,CAAC;IACX,EAAE,EAAE,CAAC;CACN,CAAC;AAEF,+DAA+D;AAC/D,SAAgB,gBAAgB,CAAC,KAAgB;IAC/C,OAAO,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AACxC,CAAC;AAED,kGAAkG;AAClG,SAAgB,iBAAiB,CAAC,MAA2B;IAC3D,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACxD,CAAC;AAgBD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,uBAAuB,GAAwB,IAAI,GAAG,CAAC;IAC3D,0BAA0B;IAC1B,yBAAyB;IACzB,2BAA2B;IAC3B,2BAA2B;IAC3B,iCAAiC;IACjC,uCAAuC;IACvC,6BAA6B;IAC7B,2BAA2B;IAC3B,iBAAiB;CAClB,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,gCAAgC,GAAG,gBAAgB,CAAC;AAmB1D;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,SAAgB,oBAAoB,CAAC,OAAqB;IACxD,IAAI,uBAAuB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;IAC7F,IAAI,OAAO,CAAC,IAAI,KAAK,gCAAgC,IAAI,OAAO,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QAChF,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;IAC/C,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;AAC7E,CAAC;AAED;;;;GAIG;AACH,SAAgB,uBAAuB,CAAC,OAAqB;IAC3D,OAAO,oBAAoB,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC;AAChD,CAAC;AAQD;;;;;;;;;;;;GAYG;AACH,SAAgB,gBAAgB,CAAC,KAAc;IAC7C,IAAI,KAAK,YAAY,wBAAU,EAAE,CAAC;QAChC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IAChD,CAAC;IACD,IAAI,KAAK,YAAY,4BAAe,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;QAC/G,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5D,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;AACzF,CAAC"}
+{"version":3,"file":"exit-code.js","sourceRoot":"","sources":["../../src/core/exit-code.ts"],"names":[],"mappings":";;AA8CA,4CAEC;AAGD,8CAEC;AAyGD,oDAMC;AAOD,0DAEC;AAqBD,4CASC;AA3MD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,8CAAgD;AAGhD,+CAA2C;AAK3C;;;;;GAKG;AACH,MAAM,kBAAkB,GAAoC;IAC1D,SAAS,EAAE,CAAC;IACZ,kBAAkB,EAAE,CAAC;IACrB,UAAU,EAAE,CAAC;IACb,QAAQ,EAAE,CAAC;IACX,EAAE,EAAE,CAAC;CACN,CAAC;AAEF,+DAA+D;AAC/D,SAAgB,gBAAgB,CAAC,KAAgB;IAC/C,OAAO,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AACxC,CAAC;AAED,kGAAkG;AAClG,SAAgB,iBAAiB,CAAC,MAA2B;IAC3D,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACxD,CAAC;AAgBD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,uBAAuB,GAAwB,IAAI,GAAG,CAAC;IAC3D,0BAA0B;IAC1B,yBAAyB;IACzB,2BAA2B;IAC3B,2BAA2B;IAC3B,iCAAiC;IACjC,uCAAuC;IACvC,6BAA6B;IAC7B,2BAA2B;IAC3B,iBAAiB;CAClB,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,gCAAgC,GAAG,gBAAgB,CAAC;AAmB1D;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,SAAgB,oBAAoB,CAAC,OAAqB;IACxD,IAAI,uBAAuB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;IAC7F,IAAI,OAAO,CAAC,IAAI,KAAK,gCAAgC,IAAI,OAAO,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QAChF,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;IAC/C,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;AAC7E,CAAC;AAED;;;;GAIG;AACH,SAAgB,uBAAuB,CAAC,OAAqB;IAC3D,OAAO,oBAAoB,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC;AAChD,CAAC;AAQD;;;;;;;;;;;;GAYG;AACH,SAAgB,gBAAgB,CAAC,KAAc;IAC7C,IAAI,KAAK,YAAY,wBAAU,EAAE,CAAC;QAChC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IAChD,CAAC;IACD,IAAI,KAAK,YAAY,4BAAe,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;QAC/G,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5D,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;AACzF,CAAC"}

package/dist/core/git-identity.d.ts

@@ -9,24 +9,59 @@ import { type CoreResult } from './types';
  * only ever looks at the *current* live git config). Pure predicate — no git/filesystem access.
  */
 export declare function isConfiguredIdentity(name: string, email: string): boolean;
-/** The `user.name`/`user.email` pair `readGitIdentity` resolves at a given root — either may be `''` (unset). */
+/**
+ * The author identity {@link readGitIdentity} resolves at a given root — either field may be `''`
+ * (unresolved). It is the one value a mutating operation checks (REQ-SEC-01), authorizes
+ * (REQ-SEC-03), writes into an `Approver:` line and pins as its commit's author (task-132, `bug-149`).
+ */
 export interface GitIdentity {
     readonly name: string;
     readonly email: string;
 }
 /**
- * Read the live `user.name`/`user.email` git identity configured at `root`, with no "is it valid"
- * judgement of its own (that is {@link isConfiguredIdentity}'s job) — the single read primitive both
- * {@link requireGitIdentity} (REQ-SEC-01) and `src/core/approval-authority.ts`'s
- * `requireApprovalAuthority` (REQ-SEC-03, task-040-role-based-approval-authority) build on, so the two
- * checks never each re-implement their own `git config` read.
+ * Resolve the identity git would record as the author of a commit made at `root` — `GIT_AUTHOR_NAME`
+ * / `GIT_AUTHOR_EMAIL`, then `author.name` / `author.email`, then `user.name` / `user.email`, each
+ * field independently, as `git commit` does — with no "is it valid" judgement of its own (that is
+ * {@link isConfiguredIdentity}'s job).
+ *
+ * Before task-132 this read `user.*` alone, while the commit itself was authored by git's precedence,
+ * so with `GIT_AUTHOR_EMAIL` set the identity an approval was authorized for and the one it was
+ * recorded under could differ (`bug-149`). Reading in git's order makes the value the one the user
+ * meant; the transition verbs then pin it as the commit's author (`commitMemoryTransition`, through
+ * `GIT_AUTHOR_*` in the commit's environment), so the recorded author is this value by construction
+ * rather than by agreement between two readers.
+ *
+ * One `git config` subprocess (it used to be two per read, and an approval read three times — six
+ * subprocesses, `dl-064` Context (ii)). Called once per operation, by {@link requireGitIdentity}; the
+ * result is passed on, never re-read (`dl-064` B.1).
+ *
+ * A git that cannot be run resolves nothing here: both fields are `''`, as before task-284. Only
+ * {@link requireGitIdentity} turns that case into its own refusal; this reader has no error channel
+ * and its read-only caller (`workflow next --assigned-to me`) treats an unresolved email as no member.
  */
 export declare function readGitIdentity(root: string): GitIdentity;
 /**
- * Verify a git identity is configured at `root` before a state mutation. Returns a
- * `CoreResult.error` (code `VALIDATION` — a failed precondition, mapped to exit `1` by
- * `exitCodeForError`) carrying the exact REQ-SEC-01 message when either `user.name` or `user.email`
- * is unset; otherwise `ok`.
+ * Verify that a commit made at `root` now would be attributable, and return its author. Every
+ * mutating operation runs this before it reads or writes anything else (REQ-SEC-01), so a refusal
+ * leaves the repository exactly as it was.
+ *
+ * Three refusals, all exit `1` by `exitCodeForError`:
+ *
+ * - **git could not be run** (`IO`, task-284, `bug-377`) — the `git config` spawn itself failed
+ *   ({@link readIdentityConfig}): `could not run git: <cause>`, the cause being the spawn error's
+ *   message (`spawnSync git ENOENT`). git is the storage, so this is a failure of the storage, not of
+ *   the identity, and REQ-SEC-01's message would point the user at the wrong thing.
+ * - **Unresolved** (`VALIDATION`) — the author's or the committer's name or email does not resolve
+ *   ({@link resolveField}): REQ-SEC-01's exact message. The committer is checked too because
+ *   `git commit` refuses without one: an author supplied by `GIT_AUTHOR_*` or `author.*` alone passed
+ *   this check after task-132's first pass, and `git commit` then died on "Committer identity
+ *   unknown" AFTER the document had been written and staged (task-132 review, finding 1).
+ * - **Unusable** (`VALIDATION`) — one of the four values holds `<`, `>` or a control character
+ *   ({@link hasUnsafeIdentityCharacter}): `git identity not usable: the <role> <field> contains '<',
+ *   '>' or a control character`.
+ *
+ * On success the value is the author — the one "who" every later step uses: the authority check,
+ * the `Approver:` line and the commit author (`dl-064` B.1, task-132) — never read again.
  */
-export declare function requireGitIdentity(root: string): CoreResult<void>;
+export declare function requireGitIdentity(root: string): CoreResult<GitIdentity>;
 //# sourceMappingURL=git-identity.d.ts.map

package/dist/core/git-identity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"git-identity.d.ts","sourceRoot":"","sources":["../../src/core/git-identity.ts"],"names":[],"mappings":"AAaA,OAAO,EAAmB,KAAK,UAAU,EAAE,MAAM,SAAS,CAAC;AAqB3D;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAEzE;AAED,iHAAiH;AACjH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,CAEzD;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAMjE"}
+{"version":3,"file":"git-identity.d.ts","sourceRoot":"","sources":["../../src/core/git-identity.ts"],"names":[],"mappings":"AAcA,OAAO,EAAmB,KAAK,UAAU,EAAE,MAAM,SAAS,CAAC;AAwD3D;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAEzE;AAED;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AA0CD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,CAGzD;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CAAC,WAAW,CAAC,CAoBxE"}

package/dist/core/git-identity.js

@@ -9,8 +9,9 @@ exports.requireGitIdentity = requireGitIdentity;
  *
  * Git identity is WingFoil's sole attribution mechanism: the commit author *is* the "who" of the
  * audit trail (adr-001 / adr-006 — no separate auth/session/IAM layer). So every state-mutating
- * operation must refuse to run when `user.name`/`user.email` are unset, rather than produce a commit
- * with an unattributable author. This check lives in `src/core` so the CLI and every MCP Tool enforce
+ * operation must refuse to run when no author or no committer resolves (`user.name`/`user.email`, or
+ * what outranks them for git: `GIT_AUTHOR_*`/`author.*`, `GIT_COMMITTER_*`/`committer.*` — task-132),
+ * rather than produce a commit with an unattributable author, or fail half-way through one. This check lives in `src/core` so the CLI and every MCP Tool enforce
  * it identically by construction (REQ-SYS-05) — a mutation calls it first and returns its
  * `CoreResult.error` unchanged, so the surface renders the exact message and writes nothing.
  */
@@ -18,21 +19,49 @@ const node_child_process_1 = require("node:child_process");
 const types_1 = require("./types");
 /** Exact refusal message required by REQ-SEC-01's fit criterion — do not reword. */
 const IDENTITY_ERROR = 'git identity not configured (user.name/user.email)';
+/** The six config keys an author or committer identity can come from, as `git config` prints them. */
+const IDENTITY_KEYS = /^(author|committer|user)\.(name|email)$/;
 /**
- * The effective value of a git config `key` at `root`, or `''` when it is unset — git exits non-zero
- * for an unset key, which we treat as absent (the same "empty means unconfigured" contract the check
- * relies on). Resolves local → global → system exactly as any git command would.
+ * The effective values of `author.*`, `committer.*` and `user.*` (`name`, `email`) at `root`, in ONE
+ * `git config` subprocess. `--get-regexp` lists every scope's entry, lowest precedence first
+ * (system, global, local), so the last value seen for a key is the effective one, exactly as
+ * `git config <key>` would answer. `-z` keeps a value with unusual bytes intact.
+ *
+ * Three outcomes (task-284, `bug-377`):
+ *
+ * - **git could not be run** — the spawn itself failed (`ENOENT`: no `git` on `PATH`; `EACCES`: not
+ *   executable; `EPERM`: a sandbox forbids it), so git never answered: `ran: false`, with the spawn
+ *   error's message (`spawnSync git ENOENT`) as the cause. Before task-284 this read as "no value", and
+ *   the check sent the user to configure an identity that may have been right. An output past
+ *   `spawnSync`'s default `maxBuffer` also sets the spawn error (`ENOBUFS`) and takes this branch, read
+ *   as `could not run git: spawnSync git ENOBUFS`.
+ * - **git ran and exited non-zero** — `1` when no key matches, `128` for a root git cannot enter or a
+ *   config file it cannot parse, or a signal: every key is absent, the "empty means unconfigured"
+ *   contract the check relies on, kept on purpose for these exits (the approver's ruling on task-284,
+ *   D2).
+ * - **exit `0`** — the values git printed. A key that is unset is simply absent.
  */
-function readGitConfig(root, key) {
-    try {
-        // `env: process.env` is passed explicitly (identical to the default in production): it makes git's
-        // config resolution follow the current environment by design, so a caller/test can scope it via
-        // `GIT_CONFIG_GLOBAL`/`GIT_CONFIG_SYSTEM`/`GIT_CONFIG_NOSYSTEM` deterministically.
-        return (0, node_child_process_1.execFileSync)('git', ['-C', root, 'config', key], { encoding: 'utf-8', env: process.env }).trim();
-    }
-    catch {
-        return '';
+function readIdentityConfig(root) {
+    // `env: process.env` is passed explicitly (identical to the default in production): it makes git's
+    // config resolution follow the current environment by design, so a caller/test can scope it via
+    // `GIT_CONFIG_GLOBAL`/`GIT_CONFIG_SYSTEM`/`GIT_CONFIG_NOSYSTEM` deterministically.
+    const run = (0, node_child_process_1.spawnSync)('git', ['-C', root, 'config', '-z', '--get-regexp', IDENTITY_KEYS.source], {
+        encoding: 'utf-8',
+        env: process.env,
+        stdio: ['ignore', 'pipe', 'ignore'],
+    });
+    if (run.error !== undefined)
+        return { ran: false, cause: run.error.message };
+    const values = new Map();
+    if (run.status !== 0)
+        return { ran: true, values };
+    for (const record of run.stdout.split('\0')) {
+        const newline = record.indexOf('\n');
+        if (newline < 0)
+            continue;
+        values.set(record.slice(0, newline), record.slice(newline + 1).trim());
     }
+    return { ran: true, values };
 }
 /**
  * The single source of truth for "a configured/attributable identity": non-empty `name` AND
@@ -47,26 +76,110 @@ function isConfiguredIdentity(name, email) {
     return name.length > 0 && email.length > 0;
 }
 /**
- * Read the live `user.name`/`user.email` git identity configured at `root`, with no "is it valid"
- * judgement of its own (that is {@link isConfiguredIdentity}'s job) — the single read primitive both
- * {@link requireGitIdentity} (REQ-SEC-01) and `src/core/approval-authority.ts`'s
- * `requireApprovalAuthority` (REQ-SEC-03, task-040-role-based-approval-authority) build on, so the two
- * checks never each re-implement their own `git config` read.
+ * One field of the `role` identity, resolved in `git commit`'s own order: the `GIT_AUTHOR_*` /
+ * `GIT_COMMITTER_*` environment variable, then the `author.*` / `committer.*` config key, then
+ * `user.*`. A variable that is SET wins even when blank, never falling back: git refuses a blank name
+ * ("empty ident name not allowed") and records a blank email as `<>`; a blank one resolves to `''`
+ * and the check refuses both (task-132 review, finding 4). A blank config value falls through to the next key.
+ *
+ * Deliberately NOT followed further down git's chain: the `EMAIL` environment variable and git's
+ * hostname guess. Both are what REQ-SEC-01 exists to refuse — an identity nobody configured — and the
+ * check's message names `user.name`/`user.email` as the thing to set.
+ */
+function resolveField(config, role, field) {
+    const fromEnv = process.env[`GIT_${role.toUpperCase()}_${field.toUpperCase()}`];
+    if (fromEnv !== undefined)
+        return fromEnv.trim();
+    const fromRole = config.get(`${role}.${field}`) ?? '';
+    if (fromRole.length > 0)
+        return fromRole;
+    return config.get(`user.${field}`) ?? '';
+}
+function resolveIdentity(config, role) {
+    return { name: resolveField(config, role, 'name'), email: resolveField(config, role, 'email') };
+}
+/**
+ * Whether `value` holds a character git's ident format cannot carry verbatim: `<` and `>` delimit the
+ * email in a commit's `author`/`committer` header, and a control character (newline included) can end
+ * a line of the commit body. Either lets a recorded identity, or an `Approver:` line built from it,
+ * say something other than what was authorized (task-132 review, finding 2).
+ */
+function hasUnsafeIdentityCharacter(value) {
+    for (const char of value) {
+        const code = char.codePointAt(0) ?? 0;
+        if (char === '<' || char === '>' || code < 0x20 || code === 0x7f)
+            return true;
+    }
+    return false;
+}
+/**
+ * Resolve the identity git would record as the author of a commit made at `root` — `GIT_AUTHOR_NAME`
+ * / `GIT_AUTHOR_EMAIL`, then `author.name` / `author.email`, then `user.name` / `user.email`, each
+ * field independently, as `git commit` does — with no "is it valid" judgement of its own (that is
+ * {@link isConfiguredIdentity}'s job).
+ *
+ * Before task-132 this read `user.*` alone, while the commit itself was authored by git's precedence,
+ * so with `GIT_AUTHOR_EMAIL` set the identity an approval was authorized for and the one it was
+ * recorded under could differ (`bug-149`). Reading in git's order makes the value the one the user
+ * meant; the transition verbs then pin it as the commit's author (`commitMemoryTransition`, through
+ * `GIT_AUTHOR_*` in the commit's environment), so the recorded author is this value by construction
+ * rather than by agreement between two readers.
+ *
+ * One `git config` subprocess (it used to be two per read, and an approval read three times — six
+ * subprocesses, `dl-064` Context (ii)). Called once per operation, by {@link requireGitIdentity}; the
+ * result is passed on, never re-read (`dl-064` B.1).
+ *
+ * A git that cannot be run resolves nothing here: both fields are `''`, as before task-284. Only
+ * {@link requireGitIdentity} turns that case into its own refusal; this reader has no error channel
+ * and its read-only caller (`workflow next --assigned-to me`) treats an unresolved email as no member.
  */
 function readGitIdentity(root) {
-    return { name: readGitConfig(root, 'user.name'), email: readGitConfig(root, 'user.email') };
+    const config = readIdentityConfig(root);
+    return resolveIdentity(config.ran ? config.values : new Map(), 'author');
 }
 /**
- * Verify a git identity is configured at `root` before a state mutation. Returns a
- * `CoreResult.error` (code `VALIDATION` — a failed precondition, mapped to exit `1` by
- * `exitCodeForError`) carrying the exact REQ-SEC-01 message when either `user.name` or `user.email`
- * is unset; otherwise `ok`.
+ * Verify that a commit made at `root` now would be attributable, and return its author. Every
+ * mutating operation runs this before it reads or writes anything else (REQ-SEC-01), so a refusal
+ * leaves the repository exactly as it was.
+ *
+ * Three refusals, all exit `1` by `exitCodeForError`:
+ *
+ * - **git could not be run** (`IO`, task-284, `bug-377`) — the `git config` spawn itself failed
+ *   ({@link readIdentityConfig}): `could not run git: <cause>`, the cause being the spawn error's
+ *   message (`spawnSync git ENOENT`). git is the storage, so this is a failure of the storage, not of
+ *   the identity, and REQ-SEC-01's message would point the user at the wrong thing.
+ * - **Unresolved** (`VALIDATION`) — the author's or the committer's name or email does not resolve
+ *   ({@link resolveField}): REQ-SEC-01's exact message. The committer is checked too because
+ *   `git commit` refuses without one: an author supplied by `GIT_AUTHOR_*` or `author.*` alone passed
+ *   this check after task-132's first pass, and `git commit` then died on "Committer identity
+ *   unknown" AFTER the document had been written and staged (task-132 review, finding 1).
+ * - **Unusable** (`VALIDATION`) — one of the four values holds `<`, `>` or a control character
+ *   ({@link hasUnsafeIdentityCharacter}): `git identity not usable: the <role> <field> contains '<',
+ *   '>' or a control character`.
+ *
+ * On success the value is the author — the one "who" every later step uses: the authority check,
+ * the `Approver:` line and the commit author (`dl-064` B.1, task-132) — never read again.
  */
 function requireGitIdentity(root) {
-    const { name, email } = readGitIdentity(root);
-    if (!isConfiguredIdentity(name, email)) {
+    const read = readIdentityConfig(root);
+    if (!read.ran)
+        return (0, types_1.coreErr)({ code: 'IO', message: `could not run git: ${read.cause}` });
+    const config = read.values;
+    const author = resolveIdentity(config, 'author');
+    const committer = resolveIdentity(config, 'committer');
+    if (!isConfiguredIdentity(author.name, author.email) || !isConfiguredIdentity(committer.name, committer.email)) {
         return (0, types_1.coreErr)({ code: 'VALIDATION', message: IDENTITY_ERROR });
     }
-    return (0, types_1.coreOk)(undefined);
+    for (const [role, identity] of [['author', author], ['committer', committer]]) {
+        for (const field of ['name', 'email']) {
+            if (hasUnsafeIdentityCharacter(identity[field])) {
+                return (0, types_1.coreErr)({
+                    code: 'VALIDATION',
+                    message: `git identity not usable: the ${role} ${field} contains '<', '>' or a control character`,
+                });
+            }
+        }
+    }
+    return (0, types_1.coreOk)(author);
 }
 //# sourceMappingURL=git-identity.js.map

package/dist/core/git-identity.js.map

@@ -1 +1 @@
-{"version":3,"file":"git-identity.js","sourceRoot":"","sources":["../../src/core/git-identity.ts"],"names":[],"mappings":";;AA2CA,oDAEC;AAeD,0CAEC;AAQD,gDAMC;AA5ED;;;;;;;;;;GAUG;AACH,2DAAkD;AAElD,mCAA2D;AAE3D,oFAAoF;AACpF,MAAM,cAAc,GAAG,oDAAoD,CAAC;AAE5E;;;;GAIG;AACH,SAAS,aAAa,CAAC,IAAY,EAAE,GAAW;IAC9C,IAAI,CAAC;QACH,mGAAmG;QACnG,gGAAgG;QAChG,mFAAmF;QACnF,OAAO,IAAA,iCAAY,EAAC,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1G,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,oBAAoB,CAAC,IAAY,EAAE,KAAa;IAC9D,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;AAC7C,CAAC;AAQD;;;;;;GAMG;AACH,SAAgB,eAAe,CAAC,IAAY;IAC1C,OAAO,EAAE,IAAI,EAAE,aAAa,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,KAAK,EAAE,aAAa,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,CAAC;AAC9F,CAAC;AAED;;;;;GAKG;AACH,SAAgB,kBAAkB,CAAC,IAAY;IAC7C,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IAC9C,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;QACvC,OAAO,IAAA,eAAO,EAAC,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,IAAA,cAAM,EAAO,SAAS,CAAC,CAAC;AACjC,CAAC"}
+{"version":3,"file":"git-identity.js","sourceRoot":"","sources":["../../src/core/git-identity.ts"],"names":[],"mappings":";;AA+EA,oDAEC;AAyED,0CAGC;AAyBD,gDAoBC;AA1MD;;;;;;;;;;;GAWG;AACH,2DAA+C;AAE/C,mCAA2D;AAE3D,oFAAoF;AACpF,MAAM,cAAc,GAAG,oDAAoD,CAAC;AAE5E,sGAAsG;AACtG,MAAM,aAAa,GAAG,yCAAyC,CAAC;AAUhE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,SAAS,kBAAkB,CAAC,IAAY;IACtC,mGAAmG;IACnG,gGAAgG;IAChG,mFAAmF;IACnF,MAAM,GAAG,GAAG,IAAA,8BAAS,EAAC,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,EAAE,aAAa,CAAC,MAAM,CAAC,EAAE;QAC/F,QAAQ,EAAE,OAAO;QACjB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;KACpC,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;IAC7E,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACnD,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,OAAO,GAAG,CAAC;YAAE,SAAS;QAC1B,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC/B,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,oBAAoB,CAAC,IAAY,EAAE,KAAa;IAC9D,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;AAC7C,CAAC;AAeD;;;;;;;;;;GAUG;AACH,SAAS,YAAY,CAAC,MAAmC,EAAE,IAAkB,EAAE,KAAuB;IACpG,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAChF,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC,IAAI,EAAE,CAAC;IACjD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC;IACtD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IACzC,OAAO,MAAM,CAAC,GAAG,CAAC,QAAQ,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC;AAC3C,CAAC;AAED,SAAS,eAAe,CAAC,MAAmC,EAAE,IAAkB;IAC9E,OAAO,EAAE,IAAI,EAAE,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,KAAK,EAAE,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;AAClG,CAAC;AAED;;;;;GAKG;AACH,SAAS,0BAA0B,CAAC,KAAa;IAC/C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,GAAG,IAAI,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;IAChF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,SAAgB,eAAe,CAAC,IAAY;IAC1C,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACxC,OAAO,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,EAAE,QAAQ,CAAC,CAAC;AAC3E,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,SAAgB,kBAAkB,CAAC,IAAY;IAC7C,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,CAAC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAA,eAAO,EAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,sBAAsB,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC3F,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC3B,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACjD,MAAM,SAAS,GAAG,eAAe,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACvD,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/G,OAAO,IAAA,eAAO,EAAC,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC,WAAW,EAAE,SAAS,CAAC,CAAU,EAAE,CAAC;QACvF,KAAK,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,OAAO,CAAU,EAAE,CAAC;YAC/C,IAAI,0BAA0B,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;gBAChD,OAAO,IAAA,eAAO,EAAC;oBACb,IAAI,EAAE,YAAY;oBAClB,OAAO,EAAE,gCAAgC,IAAI,IAAI,KAAK,2CAA2C;iBAClG,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAA,cAAM,EAAC,MAAM,CAAC,CAAC;AACxB,CAAC"}