zelari-code 2.46.1 → 2.48.0

package/dist/cli/automations/browser/session.js

@@ -0,0 +1,243 @@
+/**
+ * automations/browser/session.ts — persistent-profile browser sessions (F3.1).
+ *
+ * Manual HUMAN login; cookies live under
+ *   <os.homedir()>/.zelari-code/browser-profiles/<channel>/
+ *   - openLoginSession: headed window → user logs in → close/timeout → headless confirm.
+ *   - checkLogin:       headless → is this profile currently logged in?
+ *
+ * Playwright is loaded lazily via the existing browser_check loader, so it stays
+ * an OPTIONAL dependency (no static import, no new dep). All access goes through
+ * the minimal seams in ./pageAdapter.ts, so the orchestration is unit-testable
+ * with a fake browser (tests never launch Chromium). The page/context seams are
+ * re-exported here for back-compat with existing importers.
+ */
+import { mkdir } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import path from 'node:path';
+import { loadPlaywright } from '../../browser/driver.js';
+import { probeSessionCookiesOnDisk } from './cookieDisk.js';
+import { isSupportedChannel, loadSelectors, SUPPORTED_CHANNELS } from './selectors.js';
+import { adaptContext, } from './pageAdapter.js';
+export { SELECTOR_TIMEOUT_MS, } from './pageAdapter.js';
+/** Navigation timeout for a login-state check (short on purpose). */
+export const NAV_TIMEOUT_MS = 15_000;
+/** Default window for the manual login before we give up (seconds). */
+export const DEFAULT_LOGIN_TIMEOUT_SEC = 300;
+/** Shown verbatim when Playwright is absent — same UX as the browser_check gate. */
+export const PLAYWRIGHT_UNAVAILABLE_HINT = 'browser automation unavailable — Playwright is not installed in this workspace. ' +
+    'Install it with: `zelari-code --plugins-install playwright --cwd .` ' +
+    '(or Desktop banner “Install”, or CLI `/plugins install playwright`, or ' +
+    '`npm i -D playwright && npx playwright install chromium`).';
+/** `<os.homedir()>/.zelari-code/browser-profiles/<channel>/`. Throws if unknown. */
+export function profileDir(channel) {
+    if (!isSupportedChannel(channel)) {
+        throw new Error(`unknown social channel: ${channel} (supported: ${SUPPORTED_CHANNELS.join(', ')})`);
+    }
+    return path.join(homedir(), '.zelari-code', 'browser-profiles', channel);
+}
+const nowIso = () => new Date().toISOString();
+/** True when Playwright resolves in the given tree (never throws). */
+export async function playwrightAvailable(cwd) {
+    try {
+        return (await loadPlaywright(cwd ?? process.cwd())) !== null;
+    }
+    catch {
+        return false;
+    }
+}
+/** Default opener: real Playwright persistent context on the channel profile. */
+export const defaultContextOpener = async ({ channel, headless, cwd }) => {
+    const pw = (await loadPlaywright(cwd ?? process.cwd()));
+    if (!pw?.chromium || typeof pw.chromium.launchPersistentContext !== 'function')
+        return null;
+    const dir = profileDir(channel);
+    await mkdir(dir, { recursive: true });
+    // A headed login launched from a background process (Desktop IPC, OS
+    // scheduler) can open BEHIND the active window — Windows foreground lock.
+    // An explicit on-screen position/size makes the window impossible to miss.
+    const launchOpts = headless
+        ? { headless }
+        : { headless, args: ['--window-position=100,80', '--window-size=1180,880'] };
+    return adaptContext(await pw.chromium.launchPersistentContext(dir, launchOpts));
+};
+/** First entry of `entries` whose selector is present on `page` (or undefined). */
+async function firstMatch(page, entries) {
+    for (const e of entries) {
+        if (await page.hasSelector(e.selector))
+            return e.label;
+    }
+    return undefined;
+}
+/**
+ * Headless login-state check against the on-disk profile. Returns a
+ * HealthReport; a technical failure (Playwright missing, launch/navigation
+ * error) THROWS — so "not logged in" is never confused with "could not check".
+ */
+export async function checkLogin(channel, deps = {}) {
+    if (!isSupportedChannel(channel)) {
+        throw new Error(`unknown social channel: ${channel} (supported: ${SUPPORTED_CHANNELS.join(', ')})`);
+    }
+    const sel = await loadSelectors(channel);
+    const wanted = sel.sessionCookies ?? [];
+    // Skip the default disk probe when a test injects `opener` (otherwise we'd
+    // read the real user profile). An explicit `diskProbe` always runs first.
+    const probe = deps.diskProbe ?? (deps.opener ? undefined : probeSessionCookiesOnDisk);
+    if (probe && wanted.length > 0) {
+        const disk = await probe(profileDir(channel), wanted);
+        if (disk === 'present') {
+            return { channel, loggedIn: true, matched: `cookies:disk:${wanted.join('+')}`, checkedAt: nowIso() };
+        }
+        if (disk === 'locked') {
+            // Chromium already has the profile — not logged-out. Don't fight it.
+            return { channel, loggedIn: true, matched: 'profile-in-use', checkedAt: nowIso() };
+        }
+        if (disk === 'missing') {
+            return { channel, loggedIn: false, matched: 'cookies:missing-on-disk', checkedAt: nowIso() };
+        }
+    }
+    const ctx = await (deps.opener ?? defaultContextOpener)({ channel, headless: true, cwd: deps.cwd });
+    if (!ctx)
+        throw new Error(PLAYWRIGHT_UNAVAILABLE_HINT);
+    try {
+        const page = ctx.pages()[0] ?? (await ctx.newPage());
+        await page.goto(sel.loginUrl, {
+            timeout: deps.navTimeoutMs ?? NAV_TIMEOUT_MS,
+            waitUntil: 'domcontentloaded',
+        });
+        // PRIMARY signal — session cookies (locale-proof, A/B-proof). A profile
+        // holding ALL the channel's auth cookies IS logged in, whatever the
+        // (translated, shuffled) DOM renders. DOM chains remain the fallback for
+        // channels without sessionCookies or contexts without cookie access.
+        const wanted = sel.sessionCookies ?? [];
+        if (wanted.length > 0 && typeof ctx.cookies === 'function') {
+            const names = new Set((await ctx.cookies()).map((c) => c.name));
+            if (wanted.every((n) => names.has(n))) {
+                return {
+                    channel,
+                    loggedIn: true,
+                    matched: `cookies:${wanted.join('+')}`,
+                    checkedAt: nowIso(),
+                };
+            }
+            const missing = wanted.filter((n) => !names.has(n));
+            return {
+                channel,
+                loggedIn: false,
+                matched: `cookies:missing ${missing.join('+')}`,
+                checkedAt: nowIso(),
+            };
+        }
+        const inHit = await firstMatch(page, sel.loggedIn);
+        if (inHit)
+            return { channel, loggedIn: true, matched: inHit, checkedAt: nowIso() };
+        const outHit = await firstMatch(page, sel.loggedOut);
+        return { channel, loggedIn: false, matched: outHit, checkedAt: nowIso() };
+    }
+    finally {
+        await ctx.close().catch(() => undefined);
+    }
+}
+/**
+ * Resolve as soon as the profile gains ALL wanted cookies (login detected —
+ * the caller then closes the window), the context closes, or `timeoutMs`
+ * elapses — whichever comes first.
+ */
+function waitForLoginCloseOrTimeout(ctx, timeoutMs, loginDetected, pollMs = 2_500) {
+    return new Promise((resolve) => {
+        let settled = false;
+        let timer;
+        let poller;
+        const done = (r) => {
+            if (settled)
+                return;
+            settled = true;
+            if (timer)
+                clearTimeout(timer);
+            if (poller)
+                clearInterval(poller);
+            resolve(r);
+        };
+        timer = setTimeout(() => done('timeout'), timeoutMs);
+        ctx.onClose(() => done('closed'));
+        poller = setInterval(() => {
+            void loginDetected()
+                .then((hit) => {
+                if (hit)
+                    done('login');
+            })
+                .catch(() => undefined);
+        }, pollMs);
+    });
+}
+/**
+ * Open a HEADED window on the persistent profile for a manual login, then
+ * confirm headlessly. Returns { ok:false } (never throws) when the window closed
+ * without a logged-in state — that is "unproven" (exit 4), not a technical error.
+ */
+export async function openLoginSession(channel, opts = {}) {
+    if (!isSupportedChannel(channel)) {
+        throw new Error(`unknown social channel: ${channel} (supported: ${SUPPORTED_CHANNELS.join(', ')})`);
+    }
+    const sel = await loadSelectors(channel);
+    const log = opts.log ?? ((line) => process.stdout.write(`${line}\n`));
+    const opener = opts.opener ?? defaultContextOpener;
+    const timeoutSec = opts.timeoutSec && opts.timeoutSec > 0 ? opts.timeoutSec : DEFAULT_LOGIN_TIMEOUT_SEC;
+    const ctx = await opener({ channel, headless: false, cwd: opts.cwd });
+    if (!ctx)
+        throw new Error(PLAYWRIGHT_UNAVAILABLE_HINT);
+    try {
+        const page = ctx.pages()[0] ?? (await ctx.newPage());
+        log(`Opening ${sel.loginUrl} …`);
+        log(`Log in to ${channel} manually, then close the window — or wait up to ${timeoutSec}s. ` +
+            `The profile is saved under ${profileDir(channel)}. ` +
+            `If you do not see the window, look for Chromium in the taskbar.`);
+        try {
+            await page.goto(sel.loginUrl, {
+                timeout: opts.navTimeoutMs ?? NAV_TIMEOUT_MS,
+                waitUntil: 'domcontentloaded',
+            });
+        }
+        catch (err) {
+            log(`Could not navigate to ${sel.loginUrl} (${err instanceof Error ? err.message : String(err)}) — ` +
+                'if the window stays blank, type the address in it manually.');
+        }
+        // Best-effort foreground: raise the login window above the app that spawned
+        // us (e.g. the Desktop Automations tab). Noop on pages without the method.
+        if (typeof page.bringToFront === 'function') {
+            await page.bringToFront().catch(() => undefined);
+        }
+        // Poll the profile cookies WHILE the window is open: the moment all the
+        // channel's auth cookies land, the login is detected and the window closes
+        // itself — no guessing about when the user is done.
+        const wanted = sel.sessionCookies ?? [];
+        const cookieCheck = async () => {
+            if (wanted.length === 0 || typeof ctx.cookies !== 'function')
+                return false;
+            const names = new Set((await ctx.cookies()).map((c) => c.name));
+            return wanted.every((n) => names.has(n));
+        };
+        const outcome = await waitForLoginCloseOrTimeout(ctx, timeoutSec * 1000, cookieCheck, opts.loginPollMs);
+        if (outcome === 'login') {
+            log('Login detected (session cookies present) — closing the window…');
+        }
+        else {
+            log(outcome === 'closed' ? 'Window closed — verifying login…' : 'Timed out — verifying login…');
+        }
+    }
+    finally {
+        await ctx.close().catch(() => undefined);
+    }
+    const health = await checkLogin(channel, { opener, cwd: opts.cwd, navTimeoutMs: opts.navTimeoutMs });
+    if (health.loggedIn)
+        return { ok: true, loginUrl: sel.loginUrl, loggedIn: true };
+    return {
+        ok: false,
+        loggedIn: false,
+        loginUrl: sel.loginUrl,
+        reason: `no logged-in state detected — the profile lacks ${sel.sessionCookies?.join('+') ?? 'a login'}` +
+            (health.matched ? ` (${health.matched})` : '') +
+            ` — re-run \`automation login ${channel}\` and complete the login in the window`,
+    };
+}
+//# sourceMappingURL=session.js.map

package/dist/cli/automations/browser/session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../../../../src/cli/automations/browser/session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,yBAAyB,EAAwB,MAAM,iBAAiB,CAAC;AAClF,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACvF,OAAO,EACL,YAAY,GAMb,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,mBAAmB,GAIpB,MAAM,kBAAkB,CAAC;AAE1B,qEAAqE;AACrE,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC;AACrC,uEAAuE;AACvE,MAAM,CAAC,MAAM,yBAAyB,GAAG,GAAG,CAAC;AAE7C,oFAAoF;AACpF,MAAM,CAAC,MAAM,2BAA2B,GACtC,kFAAkF;IAClF,sEAAsE;IACtE,yEAAyE;IACzE,4DAA4D,CAAC;AAoB/D,oFAAoF;AACpF,MAAM,UAAU,UAAU,CAAC,OAAe;IACxC,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,2BAA2B,OAAO,gBAAgB,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACnF,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,OAAO,CAAC,CAAC;AAC3E,CAAC;AAED,MAAM,MAAM,GAAG,GAAW,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AAEtD,sEAAsE;AACtE,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,GAAY;IACpD,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,cAAc,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,MAAM,oBAAoB,GAAkB,KAAK,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,EAAE;IACtF,MAAM,EAAE,GAAG,CAAC,MAAM,cAAc,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAmC,CAAC;IAC1F,IAAI,CAAC,EAAE,EAAE,QAAQ,IAAI,OAAO,EAAE,CAAC,QAAQ,CAAC,uBAAuB,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IAC5F,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IAChC,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,qEAAqE;IACrE,0EAA0E;IAC1E,2EAA2E;IAC3E,MAAM,UAAU,GAAG,QAAQ;QACzB,CAAC,CAAC,EAAE,QAAQ,EAAE;QACd,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,0BAA0B,EAAE,wBAAwB,CAAC,EAAE,CAAC;IAC/E,OAAO,YAAY,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,uBAAuB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC;AAClF,CAAC,CAAC;AAEF,mFAAmF;AACnF,KAAK,UAAU,UAAU,CACvB,IAAqB,EACrB,OAAuD;IAEvD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,MAAM,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC;YAAE,OAAO,CAAC,CAAC,KAAK,CAAC;IACzD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAUD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,OAAe,EAAE,OAAuB,EAAE;IACzE,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,2BAA2B,OAAO,gBAAgB,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACtG,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC;IACxC,2EAA2E;IAC3E,0EAA0E;IAC1E,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC;IACtF,IAAI,KAAK,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;QACtD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,gBAAgB,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC;QACvG,CAAC;QACD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,qEAAqE;YACrE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC;QACrF,CAAC;QACD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,yBAAyB,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC;QAC/F,CAAC;IACH,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,oBAAoB,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACpG,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IACvD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACrD,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE;YAC5B,OAAO,EAAE,IAAI,CAAC,YAAY,IAAI,cAAc;YAC5C,SAAS,EAAE,kBAAkB;SAC9B,CAAC,CAAC;QACH,wEAAwE;QACxE,oEAAoE;QACpE,yEAAyE;QACzE,qEAAqE;QACrE,MAAM,MAAM,GAAG,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC;QACxC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;YAC3D,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAChE,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtC,OAAO;oBACL,OAAO;oBACP,QAAQ,EAAE,IAAI;oBACd,OAAO,EAAE,WAAW,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;oBACtC,SAAS,EAAE,MAAM,EAAE;iBACpB,CAAC;YACJ,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACpD,OAAO;gBACL,OAAO;gBACP,QAAQ,EAAE,KAAK;gBACf,OAAO,EAAE,mBAAmB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;gBAC/C,SAAS,EAAE,MAAM,EAAE;aACpB,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;QACnD,IAAI,KAAK;YAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC;QACnF,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;QACrD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC;IAC5E,CAAC;YAAS,CAAC;QACT,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC3C,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,0BAA0B,CACjC,GAA0B,EAC1B,SAAiB,EACjB,aAAqC,EACrC,MAAM,GAAG,KAAK;IAEd,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,KAAgD,CAAC;QACrD,IAAI,MAAkD,CAAC;QACvD,MAAM,IAAI,GAAG,CAAC,CAAiC,EAAQ,EAAE;YACvD,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,IAAI,KAAK;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;YAC/B,IAAI,MAAM;gBAAE,aAAa,CAAC,MAAM,CAAC,CAAC;YAClC,OAAO,CAAC,CAAC,CAAC,CAAC;QACb,CAAC,CAAC;QACF,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,CAAC;QACrD,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;QAClC,MAAM,GAAG,WAAW,CAAC,GAAG,EAAE;YACxB,KAAK,aAAa,EAAE;iBACjB,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;gBACZ,IAAI,GAAG;oBAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YACzB,CAAC,CAAC;iBACD,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5B,CAAC,EAAE,MAAM,CAAC,CAAC;IACb,CAAC,CAAC,CAAC;AACL,CAAC;AAcD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAe,EACf,OAA4B,EAAE;IAE9B,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,2BAA2B,OAAO,gBAAgB,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACtG,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC;IAC9E,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,oBAAoB,CAAC;IACnD,MAAM,UAAU,GACd,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,yBAAyB,CAAC;IAEvF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACtE,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IACvD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACrD,GAAG,CAAC,WAAW,GAAG,CAAC,QAAQ,IAAI,CAAC,CAAC;QACjC,GAAG,CACD,aAAa,OAAO,oDAAoD,UAAU,KAAK;YACrF,8BAA8B,UAAU,CAAC,OAAO,CAAC,IAAI;YACrD,iEAAiE,CACpE,CAAC;QACF,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE;gBAC5B,OAAO,EAAE,IAAI,CAAC,YAAY,IAAI,cAAc;gBAC5C,SAAS,EAAE,kBAAkB;aAC9B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CACD,yBAAyB,GAAG,CAAC,QAAQ,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM;gBAC9F,6DAA6D,CAChE,CAAC;QACJ,CAAC;QACD,4EAA4E;QAC5E,2EAA2E;QAC3E,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,UAAU,EAAE,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACnD,CAAC;QACD,wEAAwE;QACxE,2EAA2E;QAC3E,oDAAoD;QACpD,MAAM,MAAM,GAAG,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC;QACxC,MAAM,WAAW,GAAG,KAAK,IAAsB,EAAE;YAC/C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,UAAU;gBAAE,OAAO,KAAK,CAAC;YAC3E,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAChE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3C,CAAC,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,0BAA0B,CAC9C,GAAG,EACH,UAAU,GAAG,IAAI,EACjB,WAAW,EACX,IAAI,CAAC,WAAW,CACjB,CAAC;QACF,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;YACxB,GAAG,CAAC,gEAAgE,CAAC,CAAC;QACxE,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,kCAAkC,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC;QAClG,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;IACrG,IAAI,MAAM,CAAC,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACjF,OAAO;QACL,EAAE,EAAE,KAAK;QACT,QAAQ,EAAE,KAAK;QACf,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,MAAM,EACJ,mDAAmD,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,SAAS,EAAE;YAC/F,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9C,gCAAgC,OAAO,yCAAyC;KACnF,CAAC;AACJ,CAAC"}

package/dist/cli/budget/budgetRuntime.js

@@ -24,6 +24,7 @@
  */
 import { computeBudget, defaultResourcePolicy } from '@zelari/core';
 import { ResourceLedger, rebuildLedgerFromEvents } from './resourceLedger.js';
+import { loadEssentialBashPatterns } from './essentialBashConfig.js';
 import { buildResourceSnapshot, shouldEmitSnapshot, withResourceSnapshotContext, } from './resourceSnapshot.js';
 /**
  * §11.3 verification-essential tools: test/typecheck/build/diff/read
@@ -46,17 +47,6 @@ const DEFAULT_ESSENTIAL_TOOLS = [
 const ADVISORY_NOTICE = 'Resource advisory: verification reserve reached. Prioritize test/typecheck/build/diff and targeted repair; avoid broad exploration or delegation.';
 const PROTECTED_DENIAL = 'Resource protected: remaining tool calls are reserved for verification and targeted repair. Run the required checks (test/typecheck/build), read the failure, apply a minimal fix, retest — or report BLOCKED with the evidence you have.';
 const HARD_LIMIT_DENIAL = 'Resource exhausted: this turn\'s execution budget (maxToolCalls) is spent. No further billable tool calls are allowed in this turn — summarize what was verified and report BLOCKED/resource-exhausted with the evidence already collected. A later user turn starts a fresh execution budget.';
-/** bash commands that count as verification-essential (plan §13). */
-const ESSENTIAL_BASH = [
-    /\b(npm|pnpm|yarn|bun)\s+(run\s+)?(test|vitest|jest)\b/,
-    /\b(npm|pnpm|yarn|bun)\s+run\s+[\w:-]*(typecheck|lint|build)\b/,
-    /\bnpx\s+(vitest|tsc|typescript|eslint)\b/,
-    /\b(npx\s+)?tsc\b/,
-    /\bvitest\b/,
-    /\bjest\b/,
-    /\bnode\s+--run\b/,
-    /\bgit\s+(diff|status|log|show)\b/,
-];
 /** Phase selector — advisory by default (§11.4), protected via env (Phase 3). */
 export function resolveResourceEnforcement(env = process.env) {
     return env.ZELARI_RESOURCE_ENFORCEMENT === 'protected' ? 'protected' : 'advisory';
@@ -77,13 +67,19 @@ function bashCommand(args) {
  * Essential = test/typecheck/build/lint, git diff/status, targeted
  * read/grep/repair. NOT essential = arbitrary bash, repo-wide speculative
  * grep, dependency install, delegation.
+ *
+ * K2.5 (F21): the bash matchers are now the built-in set ∪ repo-configured
+ * extras (`.zelari/zelari.config.json` → `essentialBash`) ∪ declared
+ * package.json scripts (`<pm> run <script>`), so cargo/pytest/mvn repos can
+ * run their own verification commands in protected mode. `root` defaults to
+ * the process cwd (the CLI project root) — see loadEssentialBashPatterns.
  */
-export function isVerificationEssential(toolName, args, _stage = 'implement') {
+export function isVerificationEssential(toolName, args, _stage = 'implement', root = process.cwd()) {
     if (toolName === 'bash') {
         const cmd = bashCommand(args);
         if (!cmd)
             return false;
-        return ESSENTIAL_BASH.some((re) => re.test(cmd));
+        return loadEssentialBashPatterns(root).some((re) => re.test(cmd));
     }
     if (toolName === 'grep_content') {
         // Targeted grep: bounded by an explicit path/pattern scope is essential;

package/dist/cli/budget/budgetRuntime.js.map

@@ -1 +1 @@
-{"version":3,"file":"budgetRuntime.js","sourceRoot":"","sources":["../../../src/cli/budget/budgetRuntime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAA2C,MAAM,cAAc,CAAC;AAE7G,OAAO,EAAE,cAAc,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAC9E,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAElB,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAI/B;;;;;GAKG;AACH,MAAM,uBAAuB,GAAsB;IACjD,WAAW;IACX,MAAM;IACN,YAAY;IACZ,4EAA4E;IAC5E,2EAA2E;IAC3E,WAAW;IACX,YAAY;IACZ,cAAc;IACd,YAAY;IACZ,WAAW;CACZ,CAAC;AAEF,MAAM,eAAe,GACnB,mJAAmJ,CAAC;AAEtJ,MAAM,gBAAgB,GACpB,2OAA2O,CAAC;AAE9O,MAAM,iBAAiB,GACrB,gSAAgS,CAAC;AAEnS,qEAAqE;AACrE,MAAM,cAAc,GAAG;IACrB,uDAAuD;IACvD,+DAA+D;IAC/D,0CAA0C;IAC1C,kBAAkB;IAClB,YAAY;IACZ,UAAU;IACV,kBAAkB;IAClB,kCAAkC;CACnC,CAAC;AAEF,iFAAiF;AACjF,MAAM,UAAU,0BAA0B,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC7E,OAAO,GAAG,CAAC,2BAA2B,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC;AACpF,CAAC;AAED,oEAAoE;AACpE,SAAS,WAAW,CAAC,IAAa;IAChC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACjD,MAAM,GAAG,GAAG,IAA+B,CAAC;IAC5C,KAAK,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC/C,IAAI,OAAO,GAAG,CAAC,GAAG,CAAC,KAAK,QAAQ;YAAE,OAAO,GAAG,CAAC,GAAG,CAAW,CAAC;IAC9D,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CACrC,QAAgB,EAChB,IAAa,EACb,SAAwB,WAAW;IAEnC,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,CAAC,GAAG;YAAE,OAAO,KAAK,CAAC;QACvB,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,QAAQ,KAAK,cAAc,EAAE,CAAC;QAChC,yEAAyE;QACzE,yEAAyE;QACzE,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACnD,MAAM,GAAG,GAAG,IAA+B,CAAC;QAC5C,MAAM,QAAQ,GAAG,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC;QACvF,OAAO,QAAQ,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC;IACrD,CAAC;IACD,OAAO,uBAAuB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACpD,CAAC;AAsCD,MAAM,OAAO,aAAa;IACf,MAAM,CAAiB;IACvB,WAAW,CAAsB;IACzB,MAAM,CAAiB;IACvB,SAAS,CAAsB;IAC/B,YAAY,CAAgB;IACrC,KAAK,CAAgB;IACrB,KAAK,GAAG,CAAC,CAAC;IACV,iBAAiB,GAAG,EAAE,aAAa,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;IACnE,WAAW,CAA2B;IACtC,kBAAkB,GAAG,KAAK,CAAC;IAEnC,YAAY,SAAiB,EAAE,OAA6B,EAAE;QAC5D,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,IAAI,qBAAqB,CAAC,SAAS,CAAC,CAAC;QACnE,2EAA2E;QAC3E,wEAAwE;QACxE,oEAAoE;QACpE,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAC5E,IAAI,CAAC,MAAM;YACT,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,UAAU,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC;QAChG,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,UAAU,CAAC;QAClD,IAAI,CAAC,SAAS,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,cAAc,IAAI,uBAAuB,CAAC,CAAC;QACzE,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,KAAK,IAAI,WAAW,CAAC;QAC9C,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC;QAC/B,IAAI,CAAC,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;IACrC,CAAC;IAED;;;OAGG;IACH,SAAS;QACP,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAC7C,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;QAChB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC;QAC/B,IAAI,CAAC,kBAAkB,GAAG,KAAK,CAAC;QAChC,IAAI,CAAC,WAAW,GAAG,SAAS,CAAC;QAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,+DAA+D;IAC/D,YAAY;QACV,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IAC7B,CAAC;IAED;;;OAGG;IACH,YAAY;QACV,OAAO,IAAI,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC;IACzC,CAAC;IAED;;;;;OAKG;IACH,eAAe;QACb,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAChC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAC5B,IAAI,SAAS,GAA0B,IAAI,CAAC;QAC5C,MAAM,IAAI,GAAG;YACX,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,IAAI,EAAE,IAAI,CAAC,aAAa;YACxB,KAAK,EAAE,IAAI,CAAC,cAAc;YAC1B,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;SAChD,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,kBAAkB,IAAI,IAAI,CAAC,kBAAkB,IAAI,CAAC,EAAE,CAAC;YAC7D,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC;YAC/B,SAAS,GAAG,EAAE,IAAI,EAAE,wBAAwB,EAAE,IAAI,EAAE,CAAC;QACvD,CAAC;aAAM,IAAI,IAAI,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;YAC5B,SAAS,GAAG,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC;QACjD,CAAC;QACD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACvG,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACjC,CAAC;IAED,4EAA4E;IAC5E,qBAAqB;QACnB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC;QACtC,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACjC,CAAC;IAED,0BAA0B;IAC1B,eAAe;QACb,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACjC,CAAC;IAED,+DAA+D;IAC/D,QAAQ,CAAC,KAAoB;QAC3B,IAAI,KAAK,KAAK,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACtC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC;IAC1B,CAAC;IAED,+DAA+D;IAC/D,cAAc;QACZ,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACvC,OAAO,aAAa,CAClB,IAAI,CAAC,MAAM,EACX;YACE,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,CAAC,aAAa,GAAG,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC;YAC3F,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,CAAC,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC;YACzE,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,CAAC,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC;SACnF,EACD,IAAI,CAAC,KAAK,CACX,CAAC;IACJ,CAAC;IAED,2CAA2C;IAC3C,OAAO;QACL,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACvC,OAAO,2BAA2B,CAAC,qBAAqB,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE;YAC5F,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,oBAAoB,EAAE,UAAU,CAAC,aAAa;SAC/C,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,YAAY,CAAC,eAA2C;QACtD,MAAM,KAAK,GACT,OAAO,eAAe,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC;QACxF,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAChC,iEAAiE;QACjE,8DAA8D;QAC9D,IAAI,QAAQ,CAAC,kBAAkB,IAAI,CAAC,EAAE,CAAC;YACrC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QACnG,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,gBAAgB;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;QACpF,IAAI,IAAI,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;YACpC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC;QAC9E,CAAC;QACD,MAAM,SAAS,GACb,KAAK,CAAC,QAAQ,KAAK,MAAM,IAAI,KAAK,CAAC,QAAQ,KAAK,cAAc;YAC5D,CAAC,CAAC,uBAAuB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC;YAChF,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACzC,IAAI,SAAS,EAAE,CAAC;YACd,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC;QAC9E,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,CAAC;IACjF,CAAC;IAED,2EAA2E;IAC3E,qBAAqB,CAAC,MAAuC;QAC3D,MAAM,OAAO,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QACxC,IAAI,UAAU,GAAG,CAAC,CAAC,CAAC;QACpB,IAAI,iBAAiB,GAAG,CAAC,CAAC,CAAC;QAC3B,IAAI,aAAa,GAAG,CAAC,CAAC;QACtB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvC,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC;YACzB,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc;gBAAE,iBAAiB,GAAG,CAAC,CAAC;YACzD,IAAI,KAAK,CAAC,IAAI,KAAK,wBAAwB,EAAE,CAAC;gBAC5C,UAAU,GAAG,CAAC,CAAC;gBACf,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;gBAC/B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,aAAa,EAAE,CAAC;oBAClF,aAAa,GAAG,KAAK,CAAC;gBACxB,CAAC;YACH,CAAC;QACH,CAAC;QACD,MAAM,WAAW,GAAG,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC;QACrE,IAAI,CAAC,iBAAiB;YACpB,WAAW,IAAI,CAAC;gBACd,CAAC,CAAC,uBAAuB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE;gBACnE,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;QACrD,IAAI,CAAC,KAAK,GAAG,aAAa,CAAC;QAC3B,IAAI,CAAC,WAAW,GAAG,SAAS,CAAC;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAC3B,IAAI,CAAC,kBAAkB,GAAG,GAAG,CAAC,kBAAkB,IAAI,CAAC,CAAC;IACxD,CAAC;IAED,sEAAsE;IACtE,aAAa;QACX,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAEO,SAAS;QACf,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAC5B,IAAI,kBAAkB,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC;YAC/C,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;YACxB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}
+{"version":3,"file":"budgetRuntime.js","sourceRoot":"","sources":["../../../src/cli/budget/budgetRuntime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAA2C,MAAM,cAAc,CAAC;AAE7G,OAAO,EAAE,cAAc,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAC9E,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAElB,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAI/B;;;;;GAKG;AACH,MAAM,uBAAuB,GAAsB;IACjD,WAAW;IACX,MAAM;IACN,YAAY;IACZ,4EAA4E;IAC5E,2EAA2E;IAC3E,WAAW;IACX,YAAY;IACZ,cAAc;IACd,YAAY;IACZ,WAAW;CACZ,CAAC;AAEF,MAAM,eAAe,GACnB,mJAAmJ,CAAC;AAEtJ,MAAM,gBAAgB,GACpB,2OAA2O,CAAC;AAE9O,MAAM,iBAAiB,GACrB,gSAAgS,CAAC;AAEnS,iFAAiF;AACjF,MAAM,UAAU,0BAA0B,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC7E,OAAO,GAAG,CAAC,2BAA2B,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC;AACpF,CAAC;AAED,oEAAoE;AACpE,SAAS,WAAW,CAAC,IAAa;IAChC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACjD,MAAM,GAAG,GAAG,IAA+B,CAAC;IAC5C,KAAK,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC/C,IAAI,OAAO,GAAG,CAAC,GAAG,CAAC,KAAK,QAAQ;YAAE,OAAO,GAAG,CAAC,GAAG,CAAW,CAAC;IAC9D,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,uBAAuB,CACrC,QAAgB,EAChB,IAAa,EACb,SAAwB,WAAW,EACnC,OAAe,OAAO,CAAC,GAAG,EAAE;IAE5B,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,CAAC,GAAG;YAAE,OAAO,KAAK,CAAC;QACvB,OAAO,yBAAyB,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,QAAQ,KAAK,cAAc,EAAE,CAAC;QAChC,yEAAyE;QACzE,yEAAyE;QACzE,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACnD,MAAM,GAAG,GAAG,IAA+B,CAAC;QAC5C,MAAM,QAAQ,GAAG,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC;QACvF,OAAO,QAAQ,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC;IACrD,CAAC;IACD,OAAO,uBAAuB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACpD,CAAC;AAsCD,MAAM,OAAO,aAAa;IACf,MAAM,CAAiB;IACvB,WAAW,CAAsB;IACzB,MAAM,CAAiB;IACvB,SAAS,CAAsB;IAC/B,YAAY,CAAgB;IACrC,KAAK,CAAgB;IACrB,KAAK,GAAG,CAAC,CAAC;IACV,iBAAiB,GAAG,EAAE,aAAa,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;IACnE,WAAW,CAA2B;IACtC,kBAAkB,GAAG,KAAK,CAAC;IAEnC,YAAY,SAAiB,EAAE,OAA6B,EAAE;QAC5D,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,IAAI,qBAAqB,CAAC,SAAS,CAAC,CAAC;QACnE,2EAA2E;QAC3E,wEAAwE;QACxE,oEAAoE;QACpE,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAC5E,IAAI,CAAC,MAAM;YACT,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,UAAU,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC;QAChG,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,UAAU,CAAC;QAClD,IAAI,CAAC,SAAS,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,cAAc,IAAI,uBAAuB,CAAC,CAAC;QACzE,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,KAAK,IAAI,WAAW,CAAC;QAC9C,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC;QAC/B,IAAI,CAAC,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;IACrC,CAAC;IAED;;;OAGG;IACH,SAAS;QACP,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAC7C,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;QAChB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC;QAC/B,IAAI,CAAC,kBAAkB,GAAG,KAAK,CAAC;QAChC,IAAI,CAAC,WAAW,GAAG,SAAS,CAAC;QAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,+DAA+D;IAC/D,YAAY;QACV,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IAC7B,CAAC;IAED;;;OAGG;IACH,YAAY;QACV,OAAO,IAAI,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC;IACzC,CAAC;IAED;;;;;OAKG;IACH,eAAe;QACb,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAChC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAC5B,IAAI,SAAS,GAA0B,IAAI,CAAC;QAC5C,MAAM,IAAI,GAAG;YACX,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,IAAI,EAAE,IAAI,CAAC,aAAa;YACxB,KAAK,EAAE,IAAI,CAAC,cAAc;YAC1B,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;SAChD,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,kBAAkB,IAAI,IAAI,CAAC,kBAAkB,IAAI,CAAC,EAAE,CAAC;YAC7D,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC;YAC/B,SAAS,GAAG,EAAE,IAAI,EAAE,wBAAwB,EAAE,IAAI,EAAE,CAAC;QACvD,CAAC;aAAM,IAAI,IAAI,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;YAC5B,SAAS,GAAG,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC;QACjD,CAAC;QACD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACvG,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACjC,CAAC;IAED,4EAA4E;IAC5E,qBAAqB;QACnB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC;QACtC,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACjC,CAAC;IAED,0BAA0B;IAC1B,eAAe;QACb,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACjC,CAAC;IAED,+DAA+D;IAC/D,QAAQ,CAAC,KAAoB;QAC3B,IAAI,KAAK,KAAK,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACtC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC;IAC1B,CAAC;IAED,+DAA+D;IAC/D,cAAc;QACZ,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACvC,OAAO,aAAa,CAClB,IAAI,CAAC,MAAM,EACX;YACE,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,CAAC,aAAa,GAAG,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC;YAC3F,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,CAAC,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC;YACzE,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,CAAC,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC;SACnF,EACD,IAAI,CAAC,KAAK,CACX,CAAC;IACJ,CAAC;IAED,2CAA2C;IAC3C,OAAO;QACL,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACvC,OAAO,2BAA2B,CAAC,qBAAqB,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE;YAC5F,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,oBAAoB,EAAE,UAAU,CAAC,aAAa;SAC/C,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,YAAY,CAAC,eAA2C;QACtD,MAAM,KAAK,GACT,OAAO,eAAe,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC;QACxF,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAChC,iEAAiE;QACjE,8DAA8D;QAC9D,IAAI,QAAQ,CAAC,kBAAkB,IAAI,CAAC,EAAE,CAAC;YACrC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QACnG,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,gBAAgB;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;QACpF,IAAI,IAAI,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;YACpC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC;QAC9E,CAAC;QACD,MAAM,SAAS,GACb,KAAK,CAAC,QAAQ,KAAK,MAAM,IAAI,KAAK,CAAC,QAAQ,KAAK,cAAc;YAC5D,CAAC,CAAC,uBAAuB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC;YAChF,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACzC,IAAI,SAAS,EAAE,CAAC;YACd,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC;QAC9E,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,CAAC;IACjF,CAAC;IAED,2EAA2E;IAC3E,qBAAqB,CAAC,MAAuC;QAC3D,MAAM,OAAO,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QACxC,IAAI,UAAU,GAAG,CAAC,CAAC,CAAC;QACpB,IAAI,iBAAiB,GAAG,CAAC,CAAC,CAAC;QAC3B,IAAI,aAAa,GAAG,CAAC,CAAC;QACtB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvC,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC;YACzB,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc;gBAAE,iBAAiB,GAAG,CAAC,CAAC;YACzD,IAAI,KAAK,CAAC,IAAI,KAAK,wBAAwB,EAAE,CAAC;gBAC5C,UAAU,GAAG,CAAC,CAAC;gBACf,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;gBAC/B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,aAAa,EAAE,CAAC;oBAClF,aAAa,GAAG,KAAK,CAAC;gBACxB,CAAC;YACH,CAAC;QACH,CAAC;QACD,MAAM,WAAW,GAAG,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC;QACrE,IAAI,CAAC,iBAAiB;YACpB,WAAW,IAAI,CAAC;gBACd,CAAC,CAAC,uBAAuB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE;gBACnE,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;QACrD,IAAI,CAAC,KAAK,GAAG,aAAa,CAAC;QAC3B,IAAI,CAAC,WAAW,GAAG,SAAS,CAAC;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAC3B,IAAI,CAAC,kBAAkB,GAAG,GAAG,CAAC,kBAAkB,IAAI,CAAC,CAAC;IACxD,CAAC;IAED,sEAAsE;IACtE,aAAa;QACX,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAEO,SAAS;QACf,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAC5B,IAAI,kBAAkB,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC;YAC/C,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;YACxB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}

package/dist/cli/budget/essentialBashConfig.js

@@ -0,0 +1,118 @@
+/**
+ * essentialBashConfig — extensible verification-essential bash classifier
+ * (plan K2.5, hardening F21).
+ *
+ * `isVerificationEssential` (budgetRuntime.ts) originally recognised only a
+ * hardcoded npm/tsc/vitest/git set, so a protected-mode run on a
+ * cargo/pytest/mvn repo could not execute its own verification commands — a
+ * forced BLOCKED. This module loads EXTRA matchers and merges them with the
+ * built-in list:
+ *
+ *   1. built-ins (BUILTIN_ESSENTIAL_BASH, plan §13) — always present;
+ *   2. `<root>/.zelari/zelari.config.json` → top-level `essentialBash` (an
+ *      array of RegExp SOURCE strings). This is the project settings file
+ *      userSettings.ts documents (`SETTINGS_FILE_NAME`); the key is read
+ *      directly here because it only feeds the budget classifier;
+ *   3. `<root>/package.json` `scripts` — any `<pm> run <script>` whose
+ *      `<script>` is declared is essential (repo-native verification entry
+ *      points, e.g. a `native-test` script that shells out to cargo/pytest).
+ *
+ * Fail-open by contract: a missing/unreadable/corrupt config contributes
+ * nothing; an invalid user RegExp is IGNORED (warned once) and never breaks
+ * the built-in list. Loading is lazy + cached per resolved root; tests reset
+ * the cache with resetEssentialBashCache().
+ */
+import { readFileSync } from 'node:fs';
+import path from 'node:path';
+import { SETTINGS_FILE_NAME } from '../userSettings.js';
+/** bash commands that count as verification-essential out of the box (plan §13). */
+export const BUILTIN_ESSENTIAL_BASH = [
+    /\b(npm|pnpm|yarn|bun)\s+(run\s+)?(test|vitest|jest)\b/,
+    /\b(npm|pnpm|yarn|bun)\s+run\s+[\w:-]*(typecheck|lint|build)\b/,
+    /\bnpx\s+(vitest|tsc|typescript|eslint)\b/,
+    /\b(npx\s+)?tsc\b/,
+    /\bvitest\b/,
+    /\bjest\b/,
+    /\bnode\s+--run\b/,
+    /\bgit\s+(diff|status|log|show)\b/,
+];
+const PACKAGE_MANAGERS = 'npm|pnpm|yarn|bun';
+/** Per-resolved-root memo of the merged list (never keyed by relative path). */
+const cache = new Map();
+let warnedInvalidRegex = false;
+/** Drop the memo (tests, or a config edit mid-process). */
+export function resetEssentialBashCache() {
+    cache.clear();
+    warnedInvalidRegex = false;
+}
+/** Best-effort JSON object read; absent/unreadable/corrupt → null (fail-open). */
+function readJsonObject(file) {
+    try {
+        const parsed = JSON.parse(readFileSync(file, 'utf8'));
+        return parsed !== null && typeof parsed === 'object' && !Array.isArray(parsed)
+            ? parsed
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** RegExp-source strings from `<root>/.zelari/zelari.config.json` (project scope). */
+function settingsExtraSources(root) {
+    const settings = readJsonObject(path.join(root, '.zelari', SETTINGS_FILE_NAME));
+    const raw = settings?.['essentialBash'];
+    if (!Array.isArray(raw))
+        return [];
+    return raw.filter((v) => typeof v === 'string' && v.trim() !== '');
+}
+/** Compile user RegExp sources; an invalid one is ignored (warned once). */
+function compileUserSources(sources) {
+    const out = [];
+    for (const source of sources) {
+        try {
+            out.push(new RegExp(source));
+        }
+        catch {
+            if (!warnedInvalidRegex) {
+                warnedInvalidRegex = true;
+                console.warn(`[essential-bash] ignoring invalid regex in ${SETTINGS_FILE_NAME}.essentialBash: ${JSON.stringify(source)}`);
+            }
+        }
+    }
+    return out;
+}
+function escapeRegExp(literal) {
+    return literal.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+/** `<pm> run <script>` matchers for every declared package.json script. */
+function scriptPatterns(root) {
+    const pkg = readJsonObject(path.join(root, 'package.json'));
+    const scripts = pkg?.['scripts'];
+    if (scripts === null || typeof scripts !== 'object' || Array.isArray(scripts))
+        return [];
+    const out = [];
+    for (const [name, body] of Object.entries(scripts)) {
+        if (typeof body !== 'string' || body === '')
+            continue;
+        out.push(new RegExp(`\\b(${PACKAGE_MANAGERS})\\s+run\\s+${escapeRegExp(name)}\\b`));
+    }
+    return out;
+}
+/**
+ * Merged essential-bash matchers for `root`: built-ins ∪ settings extras ∪
+ * package.json scripts. Lazy + cached per resolved root. Never throws.
+ */
+export function loadEssentialBashPatterns(root = process.cwd()) {
+    const key = path.resolve(root);
+    const cached = cache.get(key);
+    if (cached)
+        return cached;
+    const merged = [
+        ...BUILTIN_ESSENTIAL_BASH,
+        ...compileUserSources(settingsExtraSources(key)),
+        ...scriptPatterns(key),
+    ];
+    cache.set(key, merged);
+    return merged;
+}
+//# sourceMappingURL=essentialBashConfig.js.map

package/dist/cli/budget/essentialBashConfig.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"essentialBashConfig.js","sourceRoot":"","sources":["../../../src/cli/budget/essentialBashConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAExD,oFAAoF;AACpF,MAAM,CAAC,MAAM,sBAAsB,GAAsB;IACvD,uDAAuD;IACvD,+DAA+D;IAC/D,0CAA0C;IAC1C,kBAAkB;IAClB,YAAY;IACZ,UAAU;IACV,kBAAkB;IAClB,kCAAkC;CACnC,CAAC;AAEF,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AAE7C,gFAAgF;AAChF,MAAM,KAAK,GAAG,IAAI,GAAG,EAA6B,CAAC;AACnD,IAAI,kBAAkB,GAAG,KAAK,CAAC;AAE/B,2DAA2D;AAC3D,MAAM,UAAU,uBAAuB;IACrC,KAAK,CAAC,KAAK,EAAE,CAAC;IACd,kBAAkB,GAAG,KAAK,CAAC;AAC7B,CAAC;AAED,kFAAkF;AAClF,SAAS,cAAc,CAAC,IAAY;IAClC,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QAC/D,OAAO,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAC5E,CAAC,CAAE,MAAkC;YACrC,CAAC,CAAC,IAAI,CAAC;IACX,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,sFAAsF;AACtF,SAAS,oBAAoB,CAAC,IAAY;IACxC,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAChF,MAAM,GAAG,GAAG,QAAQ,EAAE,CAAC,eAAe,CAAC,CAAC;IACxC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAClF,CAAC;AAED,4EAA4E;AAC5E,SAAS,kBAAkB,CAAC,OAA0B;IACpD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,GAAG,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBACxB,kBAAkB,GAAG,IAAI,CAAC;gBAC1B,OAAO,CAAC,IAAI,CACV,8CAA8C,kBAAkB,mBAAmB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAC5G,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,YAAY,CAAC,OAAe;IACnC,OAAO,OAAO,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AACxD,CAAC;AAED,2EAA2E;AAC3E,SAAS,cAAc,CAAC,IAAY;IAClC,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACjC,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,CAAC;IACzF,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAkC,CAAC,EAAE,CAAC;QAC9E,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,EAAE;YAAE,SAAS;QACtD,GAAG,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,gBAAgB,eAAe,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAAe,OAAO,CAAC,GAAG,EAAE;IACpE,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,MAAM,MAAM,GAAG;QACb,GAAG,sBAAsB;QACzB,GAAG,kBAAkB,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAChD,GAAG,cAAc,CAAC,GAAG,CAAC;KACvB,CAAC;IACF,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACvB,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/cli/headless/runOneTurn.js

@@ -34,8 +34,10 @@ import { createStreamScrubber } from '../utils/streamScrub.js';
 import { promises as fs } from 'node:fs';
 import path from 'node:path';
 import { evaluateStrictBuildGate, repairExcerptsFromEvaluation, strictEnvOverlay, strictGateEventPayload, strictGateExitCode, STRICT_DONE_EXIT_CODE, strictDoneEnabled } from '../kraken/verificationBridge.js';
+import { honestUnevaluatedPayload } from '../kraken/verifyHonestVerdict.js';
 // t78 (ADR-0033 slice): runtime general⇒verify obligation on the task tool path.
-import { outcomeMemoryAllowed, taskVerifyObligation } from '../tools/taskTool.js';
+import { hydrateTaskVerifyDebtFromSpine, outcomeMemoryAllowed, taskVerifyObligation } from '../tools/taskTool.js';
+import { bindVerifyDebtSpineEmit, flushVerifyDebtSpine, formatHeadlessVerifyDebtNotice } from '../tools/verifyDebtSpine.js';
 import { writeCompletionProofDetailed } from '../kraken/completionProof.js';
 import { enforceRequiredProofPersistence } from '../kraken/completionProofPersist.js';
 import { promoteOpsKnowledgeSafe, skippedOpsKnowledgeResult } from '../memory/opsKnowledge.js';
@@ -312,6 +314,17 @@ export async function runOneTurn(opts, provider, model, providerStream, extras)
         // 2.6.1 (plan §7): deep specs from THIS run’s registry.
         toolSpecs: typeof toolRegistry.fingerprints === 'function' ? toolRegistry.fingerprints() : undefined,
     });
+    // K1.5 / F5: bind debt emit to this turn's spine, then merge un-cleared
+    // opens from the log (do not wipe — callers/tests may have seeded debt).
+    bindVerifyDebtSpineEmit(async (input) => ({ seq: await spine.appendEvent(input) }));
+    // Fresh sessions have no prior debt; only `--resume` must replay the log
+    // (and must not race the just-opened writer on win32).
+    if (opts.resumeSessionId) {
+        await hydrateTaskVerifyDebtFromSpine({
+            sessionsDir: spine.spine.sessionsDir,
+            sessionId: spine.sessionId,
+        }).catch(() => 0);
+    }
     // W2: bind the memory telemetry sink to the now-open spine.
     spineHolder.current = spine;
     // T4-S3: drain pre-bind buffered memory events (cap 32) onto the spine.
@@ -717,7 +730,10 @@ export async function runOneTurn(opts, provider, model, providerStream, extras)
         // payload and as its own spine event. Never fails the parent run.
         await runAdvisoryVerifierReview(strictGate, verifierReviewDeps).catch(() => undefined);
         const gate = strictGate.gate;
-        const verificationPayload = strictGateEventPayload(strictGate);
+        // K1.7: strict-off evaluations are UNEVALUATED, never a silent/fake PASS.
+        const verificationPayload = strictGate.strict
+            ? strictGateEventPayload(strictGate)
+            : honestUnevaluatedPayload('kraken');
         spine.verificationRun(verificationPayload);
         if (opts.output === 'json') {
             emitEvent({ type: 'verification_run', ...verificationPayload });
@@ -758,7 +774,9 @@ export async function runOneTurn(opts, provider, model, providerStream, extras)
             };
             const after = await evaluateStrictBuildGate('build', { emit: async (input) => ({ seq: await spine.appendEvent(input) }), cwd, env: strictEnv });
             await runAdvisoryVerifierReview(after, verifierReviewDeps).catch(() => undefined);
-            const afterPayload = strictGateEventPayload(after);
+            const afterPayload = after.strict
+                ? strictGateEventPayload(after)
+                : honestUnevaluatedPayload('kraken');
             spine.verificationRun(afterPayload);
             if (opts.output === 'json') {
                 emitEvent({ type: 'verification_run', ...afterPayload });
@@ -781,11 +799,25 @@ export async function runOneTurn(opts, provider, model, providerStream, extras)
             }
         }
     }
+    else if (pass.finalReason === 'completed' &&
+        pass.exitCode === 0 &&
+        isKrakenMode(opts.mode) &&
+        !planModeFromOpts(opts)) {
+        // K1.7: no selection/pack → the gate above never ran. Silence would be
+        // indistinguishable from "never verified" on --resume / TUI replay.
+        const honest = honestUnevaluatedPayload('kraken');
+        spine.verificationRun(honest);
+        if (opts.output === 'json') {
+            emitEvent({ type: 'verification_run', ...honest });
+        }
+    }
     // t78 (ADR-0033 slice): a `task agent=general` that finished this turn
     // without a passing verify — the tool's auto-spawned verify reported FAIL
     // after the rework budget, produced no parseable verdict, or could not run —
     // must NOT close as success. Strict done is blocked ⇒ dedicated exit code.
     // `ZELARI_STRICT_DONE=0` remains the only opt-out (no new env flag).
+    await flushVerifyDebtSpine();
+    bindVerifyDebtSpineEmit(undefined);
     const verifyDebt = taskVerifyObligation();
     if (strictExit === 0 &&
         pass.finalReason === 'completed' &&
@@ -795,9 +827,7 @@ export async function runOneTurn(opts, provider, model, providerStream, extras)
         verifyDebt !== null &&
         strictDoneEnabled('kraken', strictEnv)) {
         strictExit = STRICT_DONE_EXIT_CODE;
-        const debtMsg = `[headless] Kraken BUILD: task general "${verifyDebt.description}" finished without a ` +
-            `passing verify — strict done blocked (exit ${STRICT_DONE_EXIT_CODE}): ` +
-            `${verifyDebt.detail ?? 'unverified work'}`;
+        const debtMsg = formatHeadlessVerifyDebtNotice(verifyDebt, STRICT_DONE_EXIT_CODE);
         if (opts.output === 'json')
             emitEvent({ type: 'log', message: debtMsg });
         else