// Final scoped verification only: records paths/hashes, never file contents.
import fs from 'node:fs';
import { createHash } from 'node:crypto';
import { fileURLToPath } from 'node:url';
import { resolve, relative, isAbsolute } from 'node:path';
import { registerHooks, syncBuiltinESMExports } from 'node:module';
const root = process.env.P5_SOURCE_ROOT;
const target = process.env.P5_INPUT_TRACE;
const read = fs.readFileSync.bind(fs), append = fs.appendFileSync.bind(fs);
const seen = new Set();
function record(path) {
  try {
    if (path instanceof URL) path = fileURLToPath(path);
    if (typeof path !== 'string') return;
    path = resolve(path);
    const rel = relative(root, path);
    if (rel.startsWith('..') || isAbsolute(rel) || rel.startsWith('agents/codex/work/queue-333/receipts/') || rel === relative(root,target)) return;
    const sha256 = createHash('sha256').update(read(path)).digest('hex');
    const key = rel + ':' + sha256;
    if (!seen.has(key)) { seen.add(key); append(target,JSON.stringify({path:rel,sha256})+'\n'); }
  } catch {}
}
fs.readFileSync = function(path,...args) { const answer=read(path,...args);record(path);return answer; };
syncBuiltinESMExports();
registerHooks({ load(url,context,next) { const answer=next(url,context);if(url.startsWith('file:'))record(fileURLToPath(url));return answer; } });
record(fileURLToPath(import.meta.url));