@avi770/testteam 2.0.0 → 3.2.0

package/dist/agents/browser-use-client.d.ts

@@ -0,0 +1,68 @@
+/**
+ * Browser-Use client — TypeScript HTTP wrapper around the Python sidecar.
+ *
+ * The sidecar lives at agents/browser-use-sidecar/server.py and exposes
+ * `POST /explore` with `{ goal, start_url, max_steps, max_tokens }`.
+ *
+ * Cost guard: `MAX_TOKENS_PER_RUN` (default 10_000) is enforced server-side,
+ * but the client sends an explicit value to make the budget visible in code
+ * review and logs. The lower of (client, env, server-default) wins.
+ */
+/** Default token budget for a single Browser-Use exploratory run. */
+export declare const DEFAULT_MAX_TOKENS_PER_RUN = 10000;
+/** Default sidecar URL. Override via env BROWSER_USE_SIDECAR_URL. */
+export declare const DEFAULT_SIDECAR_URL = "http://127.0.0.1:8765";
+/** Default request timeout (ms) — Browser-Use can take a while; 5 min ceiling. */
+export declare const DEFAULT_REQUEST_TIMEOUT_MS: number;
+export interface BrowserUseExploreRequest {
+    readonly goal: string;
+    readonly startUrl: string;
+    readonly maxSteps: number;
+    /** Optional client-supplied token cap. Defaults to DEFAULT_MAX_TOKENS_PER_RUN. */
+    readonly maxTokens?: number;
+}
+export interface BrowserUseExploreStep {
+    readonly step: number;
+    readonly action: 'navigate' | 'click' | 'extract' | 'observe' | 'noop';
+    readonly target: string;
+    readonly note: string;
+}
+export interface BrowserUseExploreResponse {
+    readonly status: 'ok' | 'aborted-budget' | 'aborted-timeout' | 'mock';
+    readonly goal: string;
+    readonly startUrl: string;
+    readonly steps: readonly BrowserUseExploreStep[];
+    readonly tokensUsed: number;
+    readonly tokenCap: number;
+    readonly durationMs: number;
+    readonly notes: string;
+}
+export interface BrowserUseClientOptions {
+    /** Base URL of the sidecar. Defaults to env BROWSER_USE_SIDECAR_URL or DEFAULT_SIDECAR_URL. */
+    readonly baseUrl?: string;
+    /** Request timeout in ms. Defaults to DEFAULT_REQUEST_TIMEOUT_MS. */
+    readonly timeoutMs?: number;
+    /** Override fetch (useful for tests). */
+    readonly fetchImpl?: typeof fetch;
+}
+export declare class BrowserUseSidecarError extends Error {
+    readonly statusCode: number;
+    readonly body?: unknown | undefined;
+    constructor(message: string, statusCode: number, body?: unknown | undefined);
+}
+/** Thin client around the FastAPI sidecar. */
+export declare class BrowserUseClient {
+    private readonly baseUrl;
+    private readonly timeoutMs;
+    private readonly fetchImpl;
+    constructor(options?: BrowserUseClientOptions);
+    /** Liveness probe — call before `/explore` to fail fast. */
+    health(): Promise<{
+        status: string;
+        version: string;
+    }>;
+    /** Run an exploratory pass via the sidecar. */
+    explore(req: BrowserUseExploreRequest): Promise<BrowserUseExploreResponse>;
+    private requestWithTimeout;
+}
+//# sourceMappingURL=browser-use-client.d.ts.map

package/dist/agents/browser-use-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-use-client.d.ts","sourceRoot":"","sources":["../../agents/browser-use-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,qEAAqE;AACrE,eAAO,MAAM,0BAA0B,QAAS,CAAC;AAEjD,qEAAqE;AACrE,eAAO,MAAM,mBAAmB,0BAA0B,CAAC;AAE3D,kFAAkF;AAClF,eAAO,MAAM,0BAA0B,QAAgB,CAAC;AAExD,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,kFAAkF;IAClF,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,GAAG,MAAM,CAAC;IACvE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,MAAM,EAAE,IAAI,GAAG,gBAAgB,GAAG,iBAAiB,GAAG,MAAM,CAAC;IACtE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,SAAS,qBAAqB,EAAE,CAAC;IACjD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,uBAAuB;IACtC,+FAA+F;IAC/F,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,qEAAqE;IACrE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,yCAAyC;IACzC,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CACnC;AAED,qBAAa,sBAAuB,SAAQ,KAAK;aAG7B,UAAU,EAAE,MAAM;aAClB,IAAI,CAAC,EAAE,OAAO;gBAF9B,OAAO,EAAE,MAAM,EACC,UAAU,EAAE,MAAM,EAClB,IAAI,CAAC,EAAE,OAAO,YAAA;CAKjC;AAED,8CAA8C;AAC9C,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;gBAE7B,OAAO,GAAE,uBAA4B;IAOjD,4DAA4D;IACtD,MAAM,IAAI,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAM5D,+CAA+C;IACzC,OAAO,CAAC,GAAG,EAAE,wBAAwB,GAAG,OAAO,CAAC,yBAAyB,CAAC;YAsClE,kBAAkB;CAuBjC"}

package/dist/agents/browser-use-client.js

@@ -0,0 +1,92 @@
+/**
+ * Browser-Use client — TypeScript HTTP wrapper around the Python sidecar.
+ *
+ * The sidecar lives at agents/browser-use-sidecar/server.py and exposes
+ * `POST /explore` with `{ goal, start_url, max_steps, max_tokens }`.
+ *
+ * Cost guard: `MAX_TOKENS_PER_RUN` (default 10_000) is enforced server-side,
+ * but the client sends an explicit value to make the budget visible in code
+ * review and logs. The lower of (client, env, server-default) wins.
+ */
+/** Default token budget for a single Browser-Use exploratory run. */
+export const DEFAULT_MAX_TOKENS_PER_RUN = 10_000;
+/** Default sidecar URL. Override via env BROWSER_USE_SIDECAR_URL. */
+export const DEFAULT_SIDECAR_URL = 'http://127.0.0.1:8765';
+/** Default request timeout (ms) — Browser-Use can take a while; 5 min ceiling. */
+export const DEFAULT_REQUEST_TIMEOUT_MS = 5 * 60 * 1000;
+export class BrowserUseSidecarError extends Error {
+    statusCode;
+    body;
+    constructor(message, statusCode, body) {
+        super(message);
+        this.statusCode = statusCode;
+        this.body = body;
+        this.name = 'BrowserUseSidecarError';
+    }
+}
+/** Thin client around the FastAPI sidecar. */
+export class BrowserUseClient {
+    baseUrl;
+    timeoutMs;
+    fetchImpl;
+    constructor(options = {}) {
+        const envUrl = process.env.BROWSER_USE_SIDECAR_URL;
+        this.baseUrl = (options.baseUrl ?? envUrl ?? DEFAULT_SIDECAR_URL).replace(/\/+$/, '');
+        this.timeoutMs = options.timeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
+        this.fetchImpl = options.fetchImpl ?? globalThis.fetch.bind(globalThis);
+    }
+    /** Liveness probe — call before `/explore` to fail fast. */
+    async health() {
+        const url = `${this.baseUrl}/health`;
+        const res = await this.requestWithTimeout(url, { method: 'GET' });
+        return (await res.json());
+    }
+    /** Run an exploratory pass via the sidecar. */
+    async explore(req) {
+        const payload = {
+            goal: req.goal,
+            start_url: req.startUrl,
+            max_steps: req.maxSteps,
+            max_tokens: req.maxTokens ?? DEFAULT_MAX_TOKENS_PER_RUN,
+        };
+        const url = `${this.baseUrl}/explore`;
+        const res = await this.requestWithTimeout(url, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify(payload),
+        });
+        const raw = (await res.json());
+        return {
+            status: raw.status,
+            goal: raw.goal,
+            startUrl: raw.start_url,
+            steps: raw.steps,
+            tokensUsed: raw.tokens_used,
+            tokenCap: raw.token_cap,
+            durationMs: raw.duration_ms,
+            notes: raw.notes,
+        };
+    }
+    async requestWithTimeout(input, init) {
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), this.timeoutMs);
+        try {
+            const res = await this.fetchImpl(input, { ...init, signal: controller.signal });
+            if (!res.ok) {
+                let body;
+                try {
+                    body = await res.json();
+                }
+                catch {
+                    body = await res.text().catch(() => undefined);
+                }
+                throw new BrowserUseSidecarError(`Browser-Use sidecar request failed: ${res.status} ${res.statusText}`, res.status, body);
+            }
+            return res;
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
+}
+//# sourceMappingURL=browser-use-client.js.map

package/dist/agents/browser-use-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-use-client.js","sourceRoot":"","sources":["../../agents/browser-use-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,qEAAqE;AACrE,MAAM,CAAC,MAAM,0BAA0B,GAAG,MAAM,CAAC;AAEjD,qEAAqE;AACrE,MAAM,CAAC,MAAM,mBAAmB,GAAG,uBAAuB,CAAC;AAE3D,kFAAkF;AAClF,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAqCxD,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAG7B;IACA;IAHlB,YACE,OAAe,EACC,UAAkB,EAClB,IAAc;QAE9B,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,eAAU,GAAV,UAAU,CAAQ;QAClB,SAAI,GAAJ,IAAI,CAAU;QAG9B,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAED,8CAA8C;AAC9C,MAAM,OAAO,gBAAgB;IACV,OAAO,CAAS;IAChB,SAAS,CAAS;IAClB,SAAS,CAAe;IAEzC,YAAY,UAAmC,EAAE;QAC/C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;QACnD,IAAI,CAAC,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,MAAM,IAAI,mBAAmB,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACtF,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,0BAA0B,CAAC;QACjE,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC1E,CAAC;IAED,4DAA4D;IAC5D,KAAK,CAAC,MAAM;QACV,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,SAAS,CAAC;QACrC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAClE,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAwC,CAAC;IACnE,CAAC;IAED,+CAA+C;IAC/C,KAAK,CAAC,OAAO,CAAC,GAA6B;QACzC,MAAM,OAAO,GAAG;YACd,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,SAAS,EAAE,GAAG,CAAC,QAAQ;YACvB,SAAS,EAAE,GAAG,CAAC,QAAQ;YACvB,UAAU,EAAE,GAAG,CAAC,SAAS,IAAI,0BAA0B;SACxD,CAAC;QAEF,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,UAAU,CAAC;QACtC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE;YAC7C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;SAC9B,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAS5B,CAAC;QAEF,OAAO;YACL,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,QAAQ,EAAE,GAAG,CAAC,SAAS;YACvB,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,UAAU,EAAE,GAAG,CAAC,WAAW;YAC3B,QAAQ,EAAE,GAAG,CAAC,SAAS;YACvB,UAAU,EAAE,GAAG,CAAC,WAAW;YAC3B,KAAK,EAAE,GAAG,CAAC,KAAK;SACjB,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAAC,KAAa,EAAE,IAAiB;QAC/D,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACnE,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;YAChF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,IAAI,IAAa,CAAC;gBAClB,IAAI,CAAC;oBACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;gBAC1B,CAAC;gBAAC,MAAM,CAAC;oBACP,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBACjD,CAAC;gBACD,MAAM,IAAI,sBAAsB,CAC9B,uCAAuC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,EACrE,GAAG,CAAC,MAAM,EACV,IAAI,CACL,CAAC;YACJ,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;CACF"}

package/dist/agents/lib/source-scan.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Lexical source masker shared by the static scanners.
+ *
+ * Static security/code scanners regex over raw source. That makes them fire on
+ * their own sink patterns when those patterns appear inside *comments* (doc
+ * examples, JSDoc) or *string/template literals* (pattern labels, `String.raw`
+ * regex sources). `maskNonCode` neutralises that whole class of false positive:
+ * it returns the source with comment bodies — and, by default, the contents of
+ * string and template literals — replaced by spaces.
+ *
+ * Key invariant: **offsets, total length, and line breaks are preserved
+ * exactly.** A regex run against the masked string yields `m.index` values that
+ * map 1:1 back to the original, so callers match on the masked text but read
+ * line numbers and snippets from the original source.
+ *
+ * What stays as code (so true positives survive):
+ *   - String/template **delimiters** (`'` `"` `` ` ``). Keeping them means a
+ *     `'x' + y` concat still reads as `' ' + y` and concat detection fires.
+ *   - Template-literal **`${ ... }` interpolation**, recursively. Tainted
+ *     values flowing through interpolation stay visible.
+ *
+ * This is a single-pass lexer, not a parser. Known limitation: regex *literals*
+ * (`/req\.body/`) are treated as code and are NOT masked — distinguishing a
+ * regex literal from division reliably needs real parsing. In practice the
+ * scanners' own patterns live in comments and string/template literals, which
+ * this does handle.
+ */
+export interface MaskOptions {
+    /**
+     * When `true` (default) the contents of string and template literals are
+     * blanked (delimiters and `${...}` interpolation are kept). Set `false` for
+     * scanners whose signal lives *inside* string literals (hardcoded URLs, CSP
+     * directives, secret keywords) — then only comments are blanked.
+     */
+    maskStrings?: boolean;
+}
+/**
+ * True when a path is test code — by filename (`*.test.ts`, `*.spec.ts`,
+ * hyphenated `-test`/`-spec`, NestJS `*.e2e-spec.ts`, or a test-runner config
+ * like `vitest.config.ts`) or by living under a conventional test directory
+ * (`tests/`, `test/`, `__tests__/`, `type-tests/`, `e2e/`, …).
+ *
+ * Pass `root` (the project root) whenever the input is absolute: the check then
+ * runs on the path *relative* to root, so a project that itself lives under a
+ * test-named directory (e.g. `…/integration-tests`) isn't wholly misclassified.
+ *
+ * Product scanners use this to skip fixtures: an unbounded query, a
+ * query-in-loop, or interpolated SQL inside a test is intentional, not a
+ * production risk, so flagging it is noise.
+ */
+export declare function isTestPath(file: string, root?: string): boolean;
+export declare function maskNonCode(src: string, opts?: MaskOptions): string;
+//# sourceMappingURL=source-scan.d.ts.map

package/dist/agents/lib/source-scan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-scan.d.ts","sourceRoot":"","sources":["../../../agents/lib/source-scan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,MAAM,WAAW,WAAW;IAC1B;;;;;OAKG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAqCD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAM/D;AASD,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,WAAgB,GAAG,MAAM,CAgIvE"}

package/dist/agents/lib/source-scan.js

@@ -0,0 +1,279 @@
+/**
+ * Lexical source masker shared by the static scanners.
+ *
+ * Static security/code scanners regex over raw source. That makes them fire on
+ * their own sink patterns when those patterns appear inside *comments* (doc
+ * examples, JSDoc) or *string/template literals* (pattern labels, `String.raw`
+ * regex sources). `maskNonCode` neutralises that whole class of false positive:
+ * it returns the source with comment bodies — and, by default, the contents of
+ * string and template literals — replaced by spaces.
+ *
+ * Key invariant: **offsets, total length, and line breaks are preserved
+ * exactly.** A regex run against the masked string yields `m.index` values that
+ * map 1:1 back to the original, so callers match on the masked text but read
+ * line numbers and snippets from the original source.
+ *
+ * What stays as code (so true positives survive):
+ *   - String/template **delimiters** (`'` `"` `` ` ``). Keeping them means a
+ *     `'x' + y` concat still reads as `' ' + y` and concat detection fires.
+ *   - Template-literal **`${ ... }` interpolation**, recursively. Tainted
+ *     values flowing through interpolation stay visible.
+ *
+ * This is a single-pass lexer, not a parser. Known limitation: regex *literals*
+ * (`/req\.body/`) are treated as code and are NOT masked — distinguishing a
+ * regex literal from division reliably needs real parsing. In practice the
+ * scanners' own patterns live in comments and string/template literals, which
+ * this does handle.
+ */
+/** Keywords after which a `/` begins a regex literal, not division. */
+const REGEX_PRECEDING_KEYWORDS = new Set([
+    'return', 'typeof', 'instanceof', 'in', 'of', 'new', 'delete', 'void',
+    'throw', 'do', 'else', 'yield', 'await', 'case',
+]);
+/** Non-regular test directory names (no `tests?`/`specs?` suffix to key on). */
+const TEST_DIR_SEGMENTS = new Set(['__tests__', '__mocks__', 'e2e', 'cypress']);
+/**
+ * A path segment that is a test directory: `test`, `tests`, `spec`, `specs`,
+ * or a hyphenated variant — `type-tests`, `js-tests`, `unit-test`, `api-specs`.
+ * The optional `xxx-` prefix must end in `-`, so `attestation` / `contest` /
+ * `abtest` (no hyphen before `test`) are not matched.
+ */
+const TEST_DIR_RE = /^(?:[\w.]+-)?(?:tests?|specs?)$/;
+/**
+ * A test-runner config or setup file (`vitest.config.ts`, `jest.config.cjs`,
+ * `playwright.config.ts`, `vitest-ci.config.ts`, `jest.setup.js`,
+ * `vitest.setup.ts`). These are test infrastructure, not the app — their
+ * `process.env.X` / URLs are test/CI knobs, not production config. Build/app
+ * configs (`next.config`, `vite.config`, `webpack.config`) are NOT matched.
+ */
+const TEST_RUNNER_CONFIG_RE = /^(?:vitest|jest|playwright|cypress|wdio|karma|ava|mocha)(?:[.-][\w.-]+)?\.(?:config|setup)\.[cm]?[jt]s$/;
+/**
+ * True when a path is test code — by filename (`*.test.ts`, `*.spec.ts`,
+ * hyphenated `-test`/`-spec`, NestJS `*.e2e-spec.ts`, or a test-runner config
+ * like `vitest.config.ts`) or by living under a conventional test directory
+ * (`tests/`, `test/`, `__tests__/`, `type-tests/`, `e2e/`, …).
+ *
+ * Pass `root` (the project root) whenever the input is absolute: the check then
+ * runs on the path *relative* to root, so a project that itself lives under a
+ * test-named directory (e.g. `…/integration-tests`) isn't wholly misclassified.
+ *
+ * Product scanners use this to skip fixtures: an unbounded query, a
+ * query-in-loop, or interpolated SQL inside a test is intentional, not a
+ * production risk, so flagging it is noise.
+ */
+export function isTestPath(file, root) {
+    const rel = root ? relativeWithin(root, file) : file;
+    const segments = rel.split(/[\\/]/);
+    const base = segments[segments.length - 1] ?? rel;
+    if (/[.-](test|spec)\.[tj]sx?$/.test(base) || TEST_RUNNER_CONFIG_RE.test(base))
+        return true;
+    return segments.some((seg) => TEST_DIR_SEGMENTS.has(seg) || TEST_DIR_RE.test(seg));
+}
+/** Strip a leading `root` prefix from `file` (both normalised to `/`). */
+function relativeWithin(root, file) {
+    const r = root.replace(/[\\/]+$/, '').replace(/\\/g, '/');
+    const f = file.replace(/\\/g, '/');
+    return f === r ? '' : f.startsWith(`${r}/`) ? f.slice(r.length + 1) : f;
+}
+export function maskNonCode(src, opts = {}) {
+    const maskStrings = opts.maskStrings !== false;
+    const n = src.length;
+    const out = src.split('');
+    const blank = (i) => {
+        if (i < 0 || i >= n)
+            return;
+        const c = src[i];
+        if (c !== '\n' && c !== '\r')
+            out[i] = ' ';
+    };
+    // A `/` starts a regex literal (not division) unless the previous significant
+    // code char is a value (identifier/number/`)`/`]`) — except after a keyword
+    // like `return`/`typeof` that expects an expression. `lastSig` tracks that
+    // char (string/template/regex literals collapse to a value marker `)`), so a
+    // regex's own quotes/backticks aren't mis-lexed as string openers (which would
+    // corrupt masking of everything after it).
+    let lastSig = '';
+    const regexAllowed = (slashIdx) => {
+        if (lastSig === '')
+            return true; // start of input → expression position
+        if (/[A-Za-z0-9_$]/.test(lastSig)) {
+            let k = slashIdx - 1;
+            while (k >= 0 && /\s/.test(src[k]))
+                k--;
+            const end = k;
+            while (k >= 0 && /[A-Za-z0-9_$]/.test(src[k]))
+                k--;
+            return REGEX_PRECEDING_KEYWORDS.has(src.slice(k + 1, end + 1));
+        }
+        return lastSig !== ')' && lastSig !== ']';
+    };
+    const stack = [{ kind: 'code' }];
+    let i = 0;
+    while (i < n) {
+        const m = stack[stack.length - 1];
+        const c = src[i];
+        const c2 = i + 1 < n ? src[i + 1] : '';
+        // --- code / template interpolation: look for comment & string openers ---
+        if (m.kind === 'code' || m.kind === 'interp') {
+            if (c === '/' && c2 === '/') {
+                stack.push({ kind: 'line' });
+                blank(i);
+                blank(i + 1);
+                i += 2;
+                continue;
+            }
+            if (c === '/' && c2 === '*') {
+                stack.push({ kind: 'block' });
+                blank(i);
+                blank(i + 1);
+                i += 2;
+                continue;
+            }
+            if (c === '/' && regexAllowed(i)) {
+                // Consume a regex literal as code: skip escapes and `[...]` classes
+                // (a `/` inside a class doesn't close it). Bail on newline — a real
+                // regex literal doesn't span lines, so it was division after all.
+                let j = i + 1;
+                let inClass = false;
+                let closed = false;
+                while (j < n) {
+                    const rc = src[j];
+                    if (rc === '\\') {
+                        j += 2;
+                        continue;
+                    }
+                    if (rc === '\n')
+                        break;
+                    if (rc === '[')
+                        inClass = true;
+                    else if (rc === ']')
+                        inClass = false;
+                    else if (rc === '/' && !inClass) {
+                        j++;
+                        closed = true;
+                        break;
+                    }
+                    j++;
+                }
+                if (closed) {
+                    while (j < n && /[a-z]/i.test(src[j]))
+                        j++; // flags
+                    lastSig = ')'; // a regex is a value
+                    i = j;
+                    continue;
+                }
+                // not a real regex — fall through and treat `/` as a code char
+            }
+            if (c === "'") {
+                stack.push({ kind: 'sq' });
+                i++;
+                continue;
+            } // keep delimiter
+            if (c === '"') {
+                stack.push({ kind: 'dq' });
+                i++;
+                continue;
+            }
+            if (c === '`') {
+                stack.push({ kind: 'tpl' });
+                i++;
+                continue;
+            }
+            if (m.kind === 'interp') {
+                if (c === '{') {
+                    m.braceDepth++;
+                    i++;
+                    continue;
+                }
+                if (c === '}') {
+                    if (m.braceDepth === 0) {
+                        stack.pop();
+                        i++;
+                        continue;
+                    } // back to enclosing template
+                    m.braceDepth--;
+                    i++;
+                    continue;
+                }
+            }
+            if (c !== ' ' && c !== '\t' && c !== '\n' && c !== '\r')
+                lastSig = c;
+            i++;
+            continue;
+        }
+        if (m.kind === 'line') {
+            if (c === '\n') {
+                stack.pop();
+                i++;
+                continue;
+            }
+            blank(i);
+            i++;
+            continue;
+        }
+        if (m.kind === 'block') {
+            if (c === '*' && c2 === '/') {
+                blank(i);
+                blank(i + 1);
+                stack.pop();
+                i += 2;
+                continue;
+            }
+            blank(i); // preserves newlines
+            i++;
+            continue;
+        }
+        if (m.kind === 'sq' || m.kind === 'dq') {
+            const quote = m.kind === 'sq' ? "'" : '"';
+            if (c === '\\') {
+                if (maskStrings) {
+                    blank(i);
+                    blank(i + 1);
+                }
+                i += 2;
+                continue;
+            }
+            if (c === quote) {
+                stack.pop();
+                lastSig = ')';
+                i++;
+                continue;
+            } // keep closing delimiter; string is a value
+            if (c === '\n') {
+                stack.pop();
+                lastSig = ')';
+                i++;
+                continue;
+            } // unterminated — fail safe back to code
+            if (maskStrings)
+                blank(i);
+            i++;
+            continue;
+        }
+        // template literal
+        if (c === '\\') {
+            if (maskStrings) {
+                blank(i);
+                blank(i + 1);
+            }
+            i += 2;
+            continue;
+        }
+        if (c === '`') {
+            stack.pop();
+            lastSig = ')';
+            i++;
+            continue;
+        } // template is a value
+        if (c === '$' && c2 === '{') {
+            stack.push({ kind: 'interp', braceDepth: 0 });
+            i += 2;
+            continue;
+        }
+        if (maskStrings)
+            blank(i);
+        i++;
+    }
+    return out.join('');
+}
+//# sourceMappingURL=source-scan.js.map

package/dist/agents/lib/source-scan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-scan.js","sourceRoot":"","sources":["../../../agents/lib/source-scan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAYH,uEAAuE;AACvE,MAAM,wBAAwB,GAAwB,IAAI,GAAG,CAAC;IAC5D,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM;IACrE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM;CAChD,CAAC,CAAC;AAWH,gFAAgF;AAChF,MAAM,iBAAiB,GAAwB,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;AAErG;;;;;GAKG;AACH,MAAM,WAAW,GAAG,iCAAiC,CAAC;AAEtD;;;;;;GAMG;AACH,MAAM,qBAAqB,GAAG,yGAAyG,CAAC;AAExI;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,IAAa;IACpD,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACrD,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC;IAClD,IAAI,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5F,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AACrF,CAAC;AAED,0EAA0E;AAC1E,SAAS,cAAc,CAAC,IAAY,EAAE,IAAY;IAChD,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC1D,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACnC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,OAAoB,EAAE;IAC7D,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC;IAC/C,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC;IACrB,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAE1B,MAAM,KAAK,GAAG,CAAC,CAAS,EAAQ,EAAE;QAChC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO;QAC5B,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACjB,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC;IAC7C,CAAC,CAAC;IAEF,8EAA8E;IAC9E,4EAA4E;IAC5E,2EAA2E;IAC3E,6EAA6E;IAC7E,+EAA+E;IAC/E,2CAA2C;IAC3C,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,MAAM,YAAY,GAAG,CAAC,QAAgB,EAAW,EAAE;QACjD,IAAI,OAAO,KAAK,EAAE;YAAE,OAAO,IAAI,CAAC,CAAC,uCAAuC;QACxE,IAAI,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAClC,IAAI,CAAC,GAAG,QAAQ,GAAG,CAAC,CAAC;YACrB,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBAAE,CAAC,EAAE,CAAC;YACxC,MAAM,GAAG,GAAG,CAAC,CAAC;YACd,OAAO,CAAC,IAAI,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBAAE,CAAC,EAAE,CAAC;YACnD,OAAO,wBAAwB,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,GAAG,CAAC;IAC5C,CAAC,CAAC;IAEF,MAAM,KAAK,GAAW,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IACzC,IAAI,CAAC,GAAG,CAAC,CAAC;IAEV,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACb,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAClC,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACjB,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAEvC,2EAA2E;QAC3E,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7C,IAAI,CAAC,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;gBAC5B,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;gBAC7B,KAAK,CAAC,CAAC,CAAC,CAAC;gBACT,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBACb,CAAC,IAAI,CAAC,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,CAAC,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;gBAC5B,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;gBAC9B,KAAK,CAAC,CAAC,CAAC,CAAC;gBACT,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBACb,CAAC,IAAI,CAAC,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,CAAC,KAAK,GAAG,IAAI,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjC,oEAAoE;gBACpE,oEAAoE;gBACpE,kEAAkE;gBAClE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACd,IAAI,OAAO,GAAG,KAAK,CAAC;gBACpB,IAAI,MAAM,GAAG,KAAK,CAAC;gBACnB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;oBACb,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;oBAClB,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;wBAAC,CAAC,IAAI,CAAC,CAAC;wBAAC,SAAS;oBAAC,CAAC;oBACtC,IAAI,EAAE,KAAK,IAAI;wBAAE,MAAM;oBACvB,IAAI,EAAE,KAAK,GAAG;wBAAE,OAAO,GAAG,IAAI,CAAC;yBAC1B,IAAI,EAAE,KAAK,GAAG;wBAAE,OAAO,GAAG,KAAK,CAAC;yBAChC,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;wBAAC,CAAC,EAAE,CAAC;wBAAC,MAAM,GAAG,IAAI,CAAC;wBAAC,MAAM;oBAAC,CAAC;oBAC/D,CAAC,EAAE,CAAC;gBACN,CAAC;gBACD,IAAI,MAAM,EAAE,CAAC;oBACX,OAAO,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;wBAAE,CAAC,EAAE,CAAC,CAAC,QAAQ;oBACpD,OAAO,GAAG,GAAG,CAAC,CAAC,qBAAqB;oBACpC,CAAC,GAAG,CAAC,CAAC;oBACN,SAAS;gBACX,CAAC;gBACD,+DAA+D;YACjE,CAAC;YACD,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;gBAAC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;gBAAC,CAAC,EAAE,CAAC;gBAAC,SAAS;YAAC,CAAC,CAAC,iBAAiB;YAC/E,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;gBAAC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;gBAAC,CAAC,EAAE,CAAC;gBAAC,SAAS;YAAC,CAAC;YAC7D,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;gBAAC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;gBAAC,CAAC,EAAE,CAAC;gBAAC,SAAS;YAAC,CAAC;YAC9D,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACxB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;oBAAC,CAAC,CAAC,UAAU,EAAE,CAAC;oBAAC,CAAC,EAAE,CAAC;oBAAC,SAAS;gBAAC,CAAC;gBACjD,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;oBACd,IAAI,CAAC,CAAC,UAAU,KAAK,CAAC,EAAE,CAAC;wBAAC,KAAK,CAAC,GAAG,EAAE,CAAC;wBAAC,CAAC,EAAE,CAAC;wBAAC,SAAS;oBAAC,CAAC,CAAC,6BAA6B;oBACrF,CAAC,CAAC,UAAU,EAAE,CAAC;oBACf,CAAC,EAAE,CAAC;oBACJ,SAAS;gBACX,CAAC;YACH,CAAC;YACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI;gBAAE,OAAO,GAAG,CAAC,CAAC;YACrE,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QAED,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YACtB,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;gBAAC,KAAK,CAAC,GAAG,EAAE,CAAC;gBAAC,CAAC,EAAE,CAAC;gBAAC,SAAS;YAAC,CAAC;YAC/C,KAAK,CAAC,CAAC,CAAC,CAAC;YACT,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QAED,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACvB,IAAI,CAAC,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;gBAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAC,KAAK,CAAC,GAAG,EAAE,CAAC;gBAAC,CAAC,IAAI,CAAC,CAAC;gBAAC,SAAS;YAAC,CAAC;YACvF,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,qBAAqB;YAC/B,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QAED,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACvC,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YAC1C,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;gBAAC,IAAI,WAAW,EAAE,CAAC;oBAAC,KAAK,CAAC,CAAC,CAAC,CAAC;oBAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAC,CAAC;gBAAC,CAAC,IAAI,CAAC,CAAC;gBAAC,SAAS;YAAC,CAAC;YAClF,IAAI,CAAC,KAAK,KAAK,EAAE,CAAC;gBAAC,KAAK,CAAC,GAAG,EAAE,CAAC;gBAAC,OAAO,GAAG,GAAG,CAAC;gBAAC,CAAC,EAAE,CAAC;gBAAC,SAAS;YAAC,CAAC,CAAC,4CAA4C;YAC5G,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;gBAAC,KAAK,CAAC,GAAG,EAAE,CAAC;gBAAC,OAAO,GAAG,GAAG,CAAC;gBAAC,CAAC,EAAE,CAAC;gBAAC,SAAS;YAAC,CAAC,CAAC,wCAAwC;YACvG,IAAI,WAAW;gBAAE,KAAK,CAAC,CAAC,CAAC,CAAC;YAC1B,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QAED,mBAAmB;QACnB,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YAAC,IAAI,WAAW,EAAE,CAAC;gBAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAAC,CAAC;YAAC,CAAC,IAAI,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QAClF,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YAAC,KAAK,CAAC,GAAG,EAAE,CAAC;YAAC,OAAO,GAAG,GAAG,CAAC;YAAC,CAAC,EAAE,CAAC;YAAC,SAAS;QAAC,CAAC,CAAC,sBAAsB;QACpF,IAAI,CAAC,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAAC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC;YAAC,CAAC,IAAI,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QACjG,IAAI,WAAW;YAAE,KAAK,CAAC,CAAC,CAAC,CAAC;QAC1B,CAAC,EAAE,CAAC;IACN,CAAC;IAED,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACtB,CAAC"}

package/dist/agents/registry.d.ts

@@ -1,15 +1,22 @@
-import type { ValidatedConfig } from '../core/config';
-import type { Phase } from '../core/types';
-import type { Orchestrator } from '../core/orchestrator';
+import type { ValidatedConfig } from '../core/config.js';
+import type { Phase } from '../core/types.js';
+import type { Orchestrator } from '../core/orchestrator.js';
+import type { TotalRecallClient } from '../clients/total-recall.js';
+import { type RunMode, type FrameStreamer } from '../core/run-mode/index.js';
+import type { LoopEvent } from '../core/loop-engine/index.js';
 /** License tier type used for agent gating */
 export type LicenseTier = 'free' | 'pro' | 'enterprise';
 /**
  * Maps each agent number to its license tier.
- * - free (8 agents): core testing pipeline
- * - pro (26 agents): advanced testing capabilities
- * - enterprise (36 agents): full platform auditing
+ * - free (41 agents): core pipeline + the full static-analysis suite (#87–120)
+ * - pro (37 agents): advanced testing capabilities
+ * - enterprise (42 agents): full platform auditing
  */
 export declare const AGENT_TIERS: Record<number, LicenseTier>;
+/** Record a custom (SDK) agent's tier so `getAgentTier` / `isAgentAvailable` work for it. */
+export declare function registerCustomAgentTier(agentNumber: number, tier: LicenseTier): void;
+/** Clear all registered custom-agent tiers (test isolation). */
+export declare function clearCustomAgentTiers(): void;
 /** Returns the tier classification for a given agent number. */
 export declare function getAgentTier(agentNumber: number): LicenseTier;
 /**
@@ -20,10 +27,22 @@ export declare function getAgentTier(agentNumber: number): LicenseTier;
  */
 export declare function isAgentAvailable(agentNumber: number, licenseTier: LicenseTier): boolean;
 /**
- * Register all 70 agents with the orchestrator.
+ * Agent IDs that opt into the shared Loop Engine kernel AT RUNTIME (Option B). Only these agents
+ * forward a live loop-event observer to their kernel, so a headed run streams their genuine
+ * cognition on the `event: loop-event` channel. Every other agent ignores the observer entirely
+ * (zero overhead), and headless/CI runs pass no observer at all. Add agents here as they adopt
+ * kernel cognition — see agents/89-repair-retest.ts for the first adopter.
+ */
+export declare const KERNEL_OPTED_AGENTS: ReadonlySet<number>;
+/**
+ * Register all 120 agents with the orchestrator.
  * Each agent is instantiated with the validated config, phase, and run directory.
  * Since agents may run in different phases, we register them for all phases
  * and the orchestrator handles dispatching only the ones needed per phase.
+ *
+ * `loopEventObserver` (Option B): when supplied (a headed Cockpit run), it is wired to each
+ * KERNEL_OPTED agent so that agent's per-cycle LoopEvents stream live, tagged with the agent's
+ * id + name. Omitted on headless/CI runs — those agents then run with no observer (no cost).
  */
-export declare function registerAllAgents(orchestrator: Orchestrator, config: ValidatedConfig, phase: Phase, runDir: string): void;
+export declare function registerAllAgents(orchestrator: Orchestrator, config: ValidatedConfig, phase: Phase, runDir: string, totalRecall?: TotalRecallClient, runMode?: RunMode, frames?: FrameStreamer, loopEventObserver?: (agentId: number, agentName: string, event: LoopEvent) => void): void;
 //# sourceMappingURL=registry.d.ts.map

package/dist/agents/registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../agents/registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEzD,8CAA8C;AAC9C,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,KAAK,GAAG,YAAY,CAAC;AAExD;;;;;GAKG;AACH,eAAO,MAAM,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CA4EnD,CAAC;AAEF,gEAAgE;AAChE,wBAAgB,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,WAAW,CAM7D;AAQD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,GAAG,OAAO,CAGvF;AAyED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,YAAY,EAAE,YAAY,EAC1B,MAAM,EAAE,eAAe,EACvB,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,MAAM,GACb,IAAI,CA6EN"}
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../agents/registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,EAAoB,KAAK,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACtF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAErD,8CAA8C;AAC9C,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,KAAK,GAAG,YAAY,CAAC;AAExD;;;;;GAKG;AACH,eAAO,MAAM,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CA4LnD,CAAC;AAMF,6FAA6F;AAC7F,wBAAgB,uBAAuB,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CAEpF;AAED,gEAAgE;AAChE,wBAAgB,qBAAqB,IAAI,IAAI,CAE5C;AAED,gEAAgE;AAChE,wBAAgB,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,WAAW,CAM7D;AAQD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,GAAG,OAAO,CAGvF;AA2HD;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAElD,CAAC;AAEH;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAC/B,YAAY,EAAE,YAAY,EAC1B,MAAM,EAAE,eAAe,EACvB,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,MAAM,EACd,WAAW,CAAC,EAAE,iBAAiB,EAC/B,OAAO,GAAE,OAA0B,EACnC,MAAM,CAAC,EAAE,aAAa,EACtB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,KAAK,IAAI,GACjF,IAAI,CAsIN"}