@avi770/testteam 3.0.0 → 3.2.0

package/dist/bridge/router.js

@@ -0,0 +1,137 @@
+/**
+ * BridgeRouter — routes tasks to the correct executor based on executorType.
+ *
+ * Orchestrates the PlaywrightPool, ShellExecutor, FileScanner, and HttpClient
+ * to handle all task types including hybrid multi-step tasks.
+ */
+export class BridgeRouter {
+    playwrightPool;
+    shellExecutor;
+    fileScanner;
+    httpClient;
+    constructor(playwrightPool, shellExecutor, fileScanner, httpClient) {
+        this.playwrightPool = playwrightPool;
+        this.shellExecutor = shellExecutor;
+        this.fileScanner = fileScanner;
+        this.httpClient = httpClient;
+    }
+    /** Route a task to the appropriate executor and return the result. */
+    async execute(task) {
+        const start = performance.now();
+        try {
+            switch (task.executorType) {
+                case 'playwright':
+                    return await this.executePlaywright(task, start);
+                case 'shell':
+                    return await this.executeShell(task, start);
+                case 'file-scan':
+                    return await this.executeFileScan(task, start);
+                case 'http':
+                    return await this.executeHttp(task, start);
+                case 'hybrid':
+                    return await this.executeHybrid(task, start);
+                default: {
+                    const exhaustive = task.executorType;
+                    return {
+                        success: false,
+                        output: null,
+                        durationMs: Math.round(performance.now() - start),
+                        error: `Unknown executor type: ${String(exhaustive)}`,
+                    };
+                }
+            }
+        }
+        catch (error) {
+            // Log detailed internal error server-side, but do not expose internals to API clients.
+            console.error('[BridgeRouter.execute] executor failure:', error);
+            return {
+                success: false,
+                output: null,
+                durationMs: Math.round(performance.now() - start),
+                error: 'Task execution failed',
+            };
+        }
+    }
+    async executePlaywright(task, start) {
+        const config = task.config;
+        const page = await this.playwrightPool.acquire();
+        try {
+            await page.goto(config.url);
+            const actionResults = [];
+            if (config.actions) {
+                for (const action of config.actions) {
+                    // Actions are intentionally minimal — full Playwright scripting
+                    // happens inside individual agents, the bridge just manages the pool.
+                    actionResults.push({ type: action.type, completed: true });
+                }
+            }
+            return {
+                success: true,
+                output: { url: config.url, actions: actionResults },
+                durationMs: Math.round(performance.now() - start),
+            };
+        }
+        finally {
+            this.playwrightPool.release(page);
+        }
+    }
+    async executeShell(task, start) {
+        const config = task.config;
+        const result = await this.shellExecutor.execute(config.command, config.args, config.cwd, task.timeout);
+        return {
+            success: result.exitCode === 0,
+            output: result,
+            durationMs: Math.round(performance.now() - start),
+            error: result.exitCode !== 0 ? result.stderr || `Exit code: ${result.exitCode}` : undefined,
+        };
+    }
+    async executeFileScan(task, start) {
+        const config = task.config;
+        const result = this.fileScanner.scan(config.rootDir, config.patterns, config.fileGlobs);
+        return {
+            success: true,
+            output: result,
+            durationMs: Math.round(performance.now() - start),
+        };
+    }
+    async executeHttp(task, start) {
+        const config = task.config;
+        const result = await this.httpClient.request(config.url, config.method, config.body, config.headers, task.timeout);
+        return {
+            success: result.status >= 200 && result.status < 400,
+            output: result,
+            durationMs: Math.round(performance.now() - start),
+            error: result.status >= 400 ? `HTTP ${result.status}` : undefined,
+        };
+    }
+    async executeHybrid(task, start) {
+        const config = task.config;
+        const stepResults = [];
+        for (const step of config.steps) {
+            const subTask = {
+                agentId: task.agentId,
+                agentName: task.agentName,
+                executorType: step.executorType,
+                config: step.config,
+                timeout: step.timeout ?? task.timeout,
+            };
+            const result = await this.execute(subTask);
+            stepResults.push(result);
+            // Stop on first failure in a hybrid pipeline
+            if (!result.success) {
+                return {
+                    success: false,
+                    output: stepResults,
+                    durationMs: Math.round(performance.now() - start),
+                    error: `Hybrid step ${stepResults.length} failed: ${result.error ?? 'unknown error'}`,
+                };
+            }
+        }
+        return {
+            success: true,
+            output: stepResults,
+            durationMs: Math.round(performance.now() - start),
+        };
+    }
+}
+//# sourceMappingURL=router.js.map

package/dist/bridge/router.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"router.js","sourceRoot":"","sources":["../../bridge/router.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAgBH,MAAM,OAAO,YAAY;IAEJ;IACA;IACA;IACA;IAJnB,YACmB,cAA8B,EAC9B,aAA4B,EAC5B,WAAwB,EACxB,UAAsB;QAHtB,mBAAc,GAAd,cAAc,CAAgB;QAC9B,kBAAa,GAAb,aAAa,CAAe;QAC5B,gBAAW,GAAX,WAAW,CAAa;QACxB,eAAU,GAAV,UAAU,CAAY;IACtC,CAAC;IAEJ,sEAAsE;IACtE,KAAK,CAAC,OAAO,CAAC,IAAgB;QAC5B,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAEhC,IAAI,CAAC;YACH,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC;gBAC1B,KAAK,YAAY;oBACf,OAAO,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBACnD,KAAK,OAAO;oBACV,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBAC9C,KAAK,WAAW;oBACd,OAAO,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBACjD,KAAK,MAAM;oBACT,OAAO,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBAC7C,KAAK,QAAQ;oBACX,OAAO,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBAC/C,OAAO,CAAC,CAAC,CAAC;oBACR,MAAM,UAAU,GAAU,IAAI,CAAC,YAAY,CAAC;oBAC5C,OAAO;wBACL,OAAO,EAAE,KAAK;wBACd,MAAM,EAAE,IAAI;wBACZ,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;wBACjD,KAAK,EAAE,0BAA0B,MAAM,CAAC,UAAU,CAAC,EAAE;qBACtD,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,uFAAuF;YACvF,OAAO,CAAC,KAAK,CAAC,0CAA0C,EAAE,KAAK,CAAC,CAAC;YACjE,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,IAAI;gBACZ,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;gBACjD,KAAK,EAAE,uBAAuB;aAC/B,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAAC,IAAgB,EAAE,KAAa;QAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,MAA0B,CAAC;QAC/C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC;QAEjD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAE5B,MAAM,aAAa,GAAc,EAAE,CAAC;YACpC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;oBACpC,gEAAgE;oBAChE,sEAAsE;oBACtE,aAAa,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC7D,CAAC;YACH,CAAC;YAED,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,aAAa,EAAE;gBACnD,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;aAClD,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,IAAgB,EAAE,KAAa;QACxD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAqB,CAAC;QAC1C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAC7C,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,IAAI,EACX,MAAM,CAAC,GAAG,EACV,IAAI,CAAC,OAAO,CACb,CAAC;QAEF,OAAO;YACL,OAAO,EAAE,MAAM,CAAC,QAAQ,KAAK,CAAC;YAC9B,MAAM,EAAE,MAAM;YACd,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;YACjD,KAAK,EAAE,MAAM,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,cAAc,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;SAC5F,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,IAAgB,EAAE,KAAa;QAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAwB,CAAC;QAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QAExF,OAAO;YACL,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,MAAM;YACd,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;SAClD,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,IAAgB,EAAE,KAAa;QACvD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAoB,CAAC;QACzC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAC1C,MAAM,CAAC,GAAG,EACV,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,IAAI,EACX,MAAM,CAAC,OAAO,EACd,IAAI,CAAC,OAAO,CACb,CAAC;QAEF,OAAO;YACL,OAAO,EAAE,MAAM,CAAC,MAAM,IAAI,GAAG,IAAI,MAAM,CAAC,MAAM,GAAG,GAAG;YACpD,MAAM,EAAE,MAAM;YACd,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;YACjD,KAAK,EAAE,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,QAAQ,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS;SAClE,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,IAAgB,EAAE,KAAa;QACzD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAsB,CAAC;QAC3C,MAAM,WAAW,GAAmB,EAAE,CAAC;QAEvC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YAChC,MAAM,OAAO,GAAe;gBAC1B,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO;aACtC,CAAC;YAEF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAC3C,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAEzB,6CAA6C;YAC7C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,WAAW;oBACnB,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;oBACjD,KAAK,EAAE,eAAe,WAAW,CAAC,MAAM,YAAY,MAAM,CAAC,KAAK,IAAI,eAAe,EAAE;iBACtF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO;YACL,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,WAAW;YACnB,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;SAClD,CAAC;IACJ,CAAC;CACF"}

package/dist/bridge/run-stream.d.ts

@@ -0,0 +1,47 @@
+/**
+ * RunStreamDriver — per-request SSE orchestration shim for GET /runs/stream.
+ *
+ * Decouples the HTTP layer (bridge/server.ts) from the core Orchestrator so
+ * the server route can be tested with a stub driver and the real driver can be
+ * wired in production without touching transport code.
+ */
+import type { Phase } from '../core/types.js';
+import type { ValidatedConfig } from '../core/config.js';
+import { RunEventEmitter } from '../core/run-events/index.js';
+import type { PauseGate } from '../core/escalation/pause-gate.js';
+import { type FrameStreamer } from '../core/run-mode/index.js';
+import type { LoopEvent } from '../core/loop-engine/index.js';
+/**
+ * A function that runs one pipeline phase, funnelling events through `emitter`.
+ * The caller owns the emitter's sink (SSE response) and the AbortController.
+ *
+ * Contract:
+ * - If `signal.aborted` on entry, return immediately (best-effort; the
+ *   orchestrator has no native cancellation so mid-run abort is not supported).
+ * - On completion (pass or fail), resolve — do NOT call runFinished; the
+ *   server owns that final bookend.
+ * - On fatal error, reject so the server can write a terminal error frame.
+ *
+ * The optional 4th parameter `gate` is a PauseGate the driver may use to pause
+ * and ask the human a question; the optional 5th `frames` is a FrameStreamer the
+ * driver may push screencast frames to (they reach the Cockpit as `event: frame`
+ * SSE lines). `params.headed` requests a visible run. Existing 3-arg drivers
+ * remain assignable — they simply ignore the extra params.
+ */
+export type RunStreamDriver = (params: {
+    readonly phase: Phase;
+    readonly headed?: boolean;
+}, emitter: RunEventEmitter, signal: AbortSignal, gate?: PauseGate, frames?: FrameStreamer, loopEventObserver?: (agentId: number, agentName: string, event: LoopEvent) => void) => Promise<void>;
+/**
+ * Build the production RunStreamDriver from a validated config.
+ *
+ * Each call to the returned driver creates a fresh runDir (timestamped) and a
+ * fresh Orchestrator so concurrent requests are fully isolated.
+ *
+ * Mid-run abort is best-effort: if the signal fires after the Orchestrator has
+ * started dispatching agents there is no way to interrupt them, but we guard
+ * at the entry point so a request cancelled before work starts returns
+ * immediately.
+ */
+export declare function createOrchestratorRunStreamDriver(config: ValidatedConfig): RunStreamDriver;
+//# sourceMappingURL=run-stream.d.ts.map

package/dist/bridge/run-stream.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-stream.d.ts","sourceRoot":"","sources":["../../bridge/run-stream.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEtD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAErD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAkB,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAIrD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,eAAe,GAAG,CAC5B,MAAM,EAAE;IAAE,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAAE,EAC5D,OAAO,EAAE,eAAe,EACxB,MAAM,EAAE,WAAW,EACnB,IAAI,CAAC,EAAE,SAAS,EAChB,MAAM,CAAC,EAAE,aAAa,EAGtB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,KAAK,IAAI,KAC/E,OAAO,CAAC,IAAI,CAAC,CAAC;AAEnB;;;;;;;;;;GAUG;AACH,wBAAgB,iCAAiC,CAAC,MAAM,EAAE,eAAe,GAAG,eAAe,CA0D1F"}

package/dist/bridge/run-stream.js

@@ -0,0 +1,67 @@
+/**
+ * RunStreamDriver — per-request SSE orchestration shim for GET /runs/stream.
+ *
+ * Decouples the HTTP layer (bridge/server.ts) from the core Orchestrator so
+ * the server route can be tested with a stub driver and the real driver can be
+ * wired in production without touching transport code.
+ */
+import * as path from 'node:path';
+import { Orchestrator } from '../core/orchestrator.js';
+import { registerAllAgents } from '../agents/registry.js';
+import { resolveRunMode } from '../core/run-mode/index.js';
+import { checkSLA } from '../enterprise/sla.js';
+import { writeSla } from '../core/evidence.js';
+/**
+ * Build the production RunStreamDriver from a validated config.
+ *
+ * Each call to the returned driver creates a fresh runDir (timestamped) and a
+ * fresh Orchestrator so concurrent requests are fully isolated.
+ *
+ * Mid-run abort is best-effort: if the signal fires after the Orchestrator has
+ * started dispatching agents there is no way to interrupt them, but we guard
+ * at the entry point so a request cancelled before work starts returns
+ * immediately.
+ */
+export function createOrchestratorRunStreamDriver(config) {
+    return async (params, emitter, signal, gate, frames, loopEventObserver) => {
+        // Early-abort guard — mid-run cancellation is best-effort only (documented).
+        if (signal.aborted) {
+            return;
+        }
+        const runDir = path.join(process.cwd(), '.run', `run-${Date.now()}`);
+        // A headed bridge run threads a visible RunMode AND the per-run FrameStreamer to every agent
+        // (Phase 3.2): agents open real browsers on the bridge host and the browser-launching ones pipe
+        // their page into `frames` via `startScreencast(page, this.frames)`, so the Cockpit sees live
+        // `event: frame` SSE lines. Capture is wired into the representative agent (#5 Browser Crawler);
+        // rolling it into the remaining browser agents is tracked in docs/AUTONOMOUS_BUILD_LOG.md.
+        const runMode = resolveRunMode({ headed: params.headed ?? false });
+        // Track (a): forward the per-run PauseGate (when the server supplied one) as the
+        // Orchestrator's escalation config, so the fix loop can pause-and-ask the human via
+        // this gate. The server already subscribes the gate to the SSE stream and routes
+        // POST /runs/answer back to it, completing the loop. No gate ⇒ legacy auto-fix.
+        const orch = new Orchestrator(config, runDir, undefined, emitter, gate ? { gate } : undefined);
+        registerAllAgents(orch, config, params.phase, runDir, undefined, runMode, frames, loopEventObserver);
+        const result = await orch.runPhase(params.phase);
+        // Enterprise SLA (opt-in via config.sla): evaluate the run against the
+        // configured thresholds and persist sla.json so the dashboard /runs/:id can
+        // surface an SLA card. Best-effort — an SLA/persist error never fails the run.
+        if (config.sla) {
+            try {
+                const runState = {
+                    runId: path.basename(runDir),
+                    startedAt: new Date().toISOString(),
+                    currentPhase: params.phase,
+                    phaseAttempt: 1,
+                    agentResults: new Map(Object.entries(result.agentResults).map(([id, r]) => [Number(id), r])),
+                    gateResults: [result.gate],
+                    totalCost: 0,
+                };
+                await writeSla(runDir, checkSLA(runState, config.sla));
+            }
+            catch (err) {
+                console.error('[run-stream] SLA evaluation/persist failed:', err);
+            }
+        }
+    };
+}
+//# sourceMappingURL=run-stream.js.map

package/dist/bridge/run-stream.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-stream.js","sourceRoot":"","sources":["../../bridge/run-stream.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAGlC,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAEvD,OAAO,EAAE,cAAc,EAAsB,MAAM,kBAAkB,CAAC;AAGtE,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AA8B5C;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iCAAiC,CAAC,MAAuB;IACvE,OAAO,KAAK,EACV,MAA4D,EAC5D,OAAwB,EACxB,MAAmB,EACnB,IAAgB,EAChB,MAAsB,EACtB,iBAAkF,EACnE,EAAE;QACjB,6EAA6E;QAC7E,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACrE,6FAA6F;QAC7F,gGAAgG;QAChG,8FAA8F;QAC9F,iGAAiG;QACjG,2FAA2F;QAC3F,MAAM,OAAO,GAAG,cAAc,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,KAAK,EAAE,CAAC,CAAC;QACnE,iFAAiF;QACjF,oFAAoF;QACpF,iFAAiF;QACjF,gFAAgF;QAChF,MAAM,IAAI,GAAG,IAAI,YAAY,CAC3B,MAAM,EACN,MAAM,EACN,SAAS,EACT,OAAO,EACP,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAC5B,CAAC;QACF,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,iBAAiB,CAAC,CAAC;QAErG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAEjD,uEAAuE;QACvE,4EAA4E;QAC5E,+EAA+E;QAC/E,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;YACf,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAa;oBACzB,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;oBAC5B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;oBACnC,YAAY,EAAE,MAAM,CAAC,KAAK;oBAC1B,YAAY,EAAE,CAAC;oBACf,YAAY,EAAE,IAAI,GAAG,CACnB,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CACtE;oBACD,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC;oBAC1B,SAAS,EAAE,CAAC;iBACb,CAAC;gBACF,MAAM,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YACzD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAC,6CAA6C,EAAE,GAAG,CAAC,CAAC;YACpE,CAAC;QACH,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/bridge/runs-reader.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Run artifact reader.
+ *
+ * Reads the run directories the orchestrator writes under `.run/` and shapes
+ * them into the summaries + detail the dashboard consumes. Filesystem-only
+ * (no deps), so the Bridge server can expose real run history over HTTP.
+ */
+import type { AgentResult, Phase } from '../core/types.js';
+import type { CorrelationResult } from '../core/finding-correlation.js';
+import type { SLAReport } from '../enterprise/sla.js';
+import { type RunQuality } from '../core/quality-score/from-run.js';
+export interface RunSummary {
+    runId: string;
+    startedAt: string;
+    completedAt: string;
+    currentPhase: Phase;
+    totalAgents: number;
+    passed: number;
+    failed: number;
+    skipped: number;
+    /** Scheduled agents that couldn't run (no app / unmet precondition) — Sprint 48 status. */
+    idle: number;
+    totalFindings: number;
+    criticalFindings: number;
+    totalCost: number;
+}
+export interface RunDetail {
+    summary: RunSummary;
+    agents: AgentResult[];
+    /** Cross-agent finding correlation for the furthest phase, when persisted. */
+    correlation?: CorrelationResult;
+    /** Enterprise SLA report, when SLA thresholds were configured for the run. */
+    sla?: SLAReport;
+    /** QualityScore ("The Judge") projection of the run's agent outcomes + release gate. */
+    quality?: RunQuality;
+}
+/** Summaries for every run under `runsDir`, newest first. */
+export declare function listRuns(runsDir: string): RunSummary[];
+/** Full detail (summary + agent results) for one run, or null if not found. */
+export declare function readRun(runsDir: string, runId: string): RunDetail | null;
+//# sourceMappingURL=runs-reader.d.ts.map

package/dist/bridge/runs-reader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runs-reader.d.ts","sourceRoot":"","sources":["../../bridge/runs-reader.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,KAAK,EAAE,WAAW,EAAW,KAAK,EAAE,MAAM,eAAe,CAAC;AACjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAoB,KAAK,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAGnF,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,KAAK,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,2FAA2F;IAC3F,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,UAAU,CAAC;IACpB,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,8EAA8E;IAC9E,WAAW,CAAC,EAAE,iBAAiB,CAAC;IAChC,8EAA8E;IAC9E,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB,wFAAwF;IACxF,OAAO,CAAC,EAAE,UAAU,CAAC;CACtB;AAmHD,6DAA6D;AAC7D,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,UAAU,EAAE,CAqBtD;AAoBD,+EAA+E;AAC/E,wBAAgB,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAiBxE"}

package/dist/bridge/runs-reader.js

@@ -0,0 +1,185 @@
+/**
+ * Run artifact reader.
+ *
+ * Reads the run directories the orchestrator writes under `.run/` and shapes
+ * them into the summaries + detail the dashboard consumes. Filesystem-only
+ * (no deps), so the Bridge server can expose real run history over HTTP.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { deriveRunQuality } from '../core/quality-score/from-run.js';
+import { normalizeFinding } from './finding-normalize.js';
+/** Reads the persisted `correlation.json` for a run dir, or undefined if absent/unreadable. */
+function readCorrelationSync(runDir) {
+    try {
+        return JSON.parse(fs.readFileSync(path.join(runDir, 'correlation.json'), 'utf-8'));
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Reads the persisted `sla.json` for a run dir, or undefined if absent/unreadable. */
+function readSlaSync(runDir) {
+    try {
+        return JSON.parse(fs.readFileSync(path.join(runDir, 'sla.json'), 'utf-8'));
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Phase ordering used to pick the "furthest" phase a run reached. */
+const PHASE_ORDER = ['alpha', 'beta', 'uat', 'release'];
+/** Only directories named like a run id are considered (also blocks traversal). */
+const RUN_ID_RE = /^run-[A-Za-z0-9_-]+$/;
+function readAgentResults(runDir) {
+    const dir = path.join(runDir, 'agent-results');
+    let entries;
+    try {
+        entries = fs.readdirSync(dir).filter((f) => f.endsWith('.json'));
+    }
+    catch {
+        return [];
+    }
+    const results = [];
+    for (const file of entries) {
+        try {
+            const parsed = JSON.parse(fs.readFileSync(path.join(dir, file), 'utf-8'));
+            // Trust-boundary guard: a file whose content is the bare literal `null`,
+            // a primitive, or an array is valid JSON but NOT an AgentResult. Pushing
+            // it would crash the sort below (`null.agentId`) — and because that throw
+            // was caught by listRuns' per-run try/catch, the ENTIRE run (including its
+            // valid sibling agent-results) was silently dropped from every reader.
+            // Skip non-object entries instead so one corrupt file can't erase a run.
+            if (parsed !== null && typeof parsed === 'object' && !Array.isArray(parsed)) {
+                results.push(parsed);
+            }
+        }
+        catch {
+            // skip unreadable/partial result files
+        }
+    }
+    // Sort defensively: an object missing a numeric agentId sorts last rather
+    // than producing a NaN comparator (undefined ordering).
+    return results.sort((a, b) => (typeof a.agentId === 'number' ? a.agentId : Infinity) -
+        (typeof b.agentId === 'number' ? b.agentId : Infinity));
+}
+function summarise(runId, agents) {
+    let passed = 0;
+    let failed = 0;
+    let skipped = 0;
+    let idle = 0;
+    let totalFindings = 0;
+    let criticalFindings = 0;
+    let startedAt = '';
+    let completedAt = '';
+    let furthestPhase = 'alpha';
+    for (const a of agents) {
+        if (a.status === 'passed')
+            passed++;
+        else if (a.status === 'failed')
+            failed++;
+        else if (a.status === 'skipped')
+            skipped++;
+        else if (a.status === 'idle')
+            idle++;
+        // A parseable-but-misshaped result file (valid JSON, wrong shape — e.g. no
+        // `findings` array) must not throw here: one bad run artifact would 500 the
+        // whole GET /runs listing. Coerce to a safe array before counting.
+        const findings = Array.isArray(a.findings) ? a.findings : [];
+        totalFindings += findings.length;
+        criticalFindings += findings.filter((f) => f.severity === 'critical').length;
+        if (a.startedAt && (!startedAt || a.startedAt < startedAt))
+            startedAt = a.startedAt;
+        if (a.completedAt && (!completedAt || a.completedAt > completedAt))
+            completedAt = a.completedAt;
+        const idx = PHASE_ORDER.indexOf(a.phase);
+        if (idx > PHASE_ORDER.indexOf(furthestPhase))
+            furthestPhase = a.phase;
+    }
+    return {
+        runId,
+        startedAt,
+        completedAt,
+        currentPhase: furthestPhase,
+        totalAgents: agents.length,
+        passed,
+        failed,
+        skipped,
+        idle,
+        totalFindings,
+        criticalFindings,
+        totalCost: 0, // cost is not persisted to run artifacts
+    };
+}
+/** True if `runId` is a safe run-directory name that exists under `runsDir`. */
+function resolveRunDir(runsDir, runId) {
+    if (!RUN_ID_RE.test(runId))
+        return null;
+    const dir = path.join(runsDir, runId);
+    if (!fs.existsSync(dir) || !fs.statSync(dir).isDirectory())
+        return null;
+    return dir;
+}
+/** Summaries for every run under `runsDir`, newest first. */
+export function listRuns(runsDir) {
+    let names;
+    try {
+        names = fs.readdirSync(runsDir).filter((n) => RUN_ID_RE.test(n));
+    }
+    catch {
+        return [];
+    }
+    // Guard each run individually: a single corrupt run directory must not sink
+    // the whole listing with a 500. summarise() is already defensive about
+    // misshaped agent results; this try/catch is belt-and-suspenders for anything
+    // that still throws (e.g. an unreadable sub-path), skipping only that run.
+    const summaries = names.flatMap((runId) => {
+        try {
+            return [summarise(runId, readAgentResults(path.join(runsDir, runId)))];
+        }
+        catch {
+            return [];
+        }
+    });
+    // Newest first: run ids are `run-<epoch-ms>`, so reverse-lexical works, but
+    // fall back to completedAt for safety.
+    return summaries.sort((a, b) => b.runId.localeCompare(a.runId));
+}
+/**
+ * Coerce every finding in an agent result to a safe, typed shape at the
+ * GET /runs/:id trust boundary. Run artifacts are `JSON.parse(...) as
+ * AgentResult` with no runtime check, so a partial/old-schema finding could
+ * otherwise reach a consumer with a missing/non-string field and throw — the
+ * dashboard's FindingsBrowser (`description.slice`) and AgentDrilldown
+ * (`severity.toUpperCase`), and `deriveRunQuality` itself (which reads
+ * `f.severity` on each finding). Coercing here — mirroring the client-side
+ * guard — protects EVERY consumer of this endpoint, present and future.
+ * Non-object entries are dropped.
+ */
+function coerceAgentFindings(a) {
+    const findings = Array.isArray(a.findings)
+        ? a.findings.map(normalizeFinding).filter((f) => f !== null)
+        : [];
+    return { ...a, findings };
+}
+/** Full detail (summary + agent results) for one run, or null if not found. */
+export function readRun(runsDir, runId) {
+    const dir = resolveRunDir(runsDir, runId);
+    if (!dir)
+        return null;
+    // Coerce at the boundary so summarise/deriveRunQuality and every downstream
+    // consumer see well-typed findings (never a missing/non-string field).
+    const agents = readAgentResults(dir).map(coerceAgentFindings);
+    const correlation = readCorrelationSync(dir);
+    const sla = readSlaSync(dir);
+    // Derived at read-time from the run's agent outcomes (no persistence needed).
+    const quality = deriveRunQuality(agents) ?? undefined;
+    return {
+        summary: summarise(runId, agents),
+        agents,
+        ...(correlation ? { correlation } : {}),
+        ...(sla ? { sla } : {}),
+        ...(quality ? { quality } : {}),
+    };
+}
+//# sourceMappingURL=runs-reader.js.map

package/dist/bridge/runs-reader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runs-reader.js","sourceRoot":"","sources":["../../bridge/runs-reader.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAIlC,OAAO,EAAE,gBAAgB,EAAmB,MAAM,gCAAgC,CAAC;AACnF,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AA6BvD,+FAA+F;AAC/F,SAAS,mBAAmB,CAAC,MAAc;IACzC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,kBAAkB,CAAC,EAAE,OAAO,CAAC,CAAsB,CAAC;IAC1G,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,uFAAuF;AACvF,SAAS,WAAW,CAAC,MAAc;IACjC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,OAAO,CAAC,CAAc,CAAC;IAC1F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,sEAAsE;AACtE,MAAM,WAAW,GAAY,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;AAEjE,mFAAmF;AACnF,MAAM,SAAS,GAAG,sBAAsB,CAAC;AAEzC,SAAS,gBAAgB,CAAC,MAAc;IACtC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAC/C,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,OAAO,GAAkB,EAAE,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;YACnF,yEAAyE;YACzE,yEAAyE;YACzE,0EAA0E;YAC1E,2EAA2E;YAC3E,uEAAuE;YACvE,yEAAyE;YACzE,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC5E,OAAO,CAAC,IAAI,CAAC,MAAqB,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,uCAAuC;QACzC,CAAC;IACH,CAAC;IACD,0EAA0E;IAC1E,wDAAwD;IACxD,OAAO,OAAO,CAAC,IAAI,CACjB,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACP,CAAC,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;QACtD,CAAC,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CACzD,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,KAAa,EAAE,MAAqB;IACrD,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,gBAAgB,GAAG,CAAC,CAAC;IACzB,IAAI,SAAS,GAAG,EAAE,CAAC;IACnB,IAAI,WAAW,GAAG,EAAE,CAAC;IACrB,IAAI,aAAa,GAAU,OAAO,CAAC;IAEnC,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ;YAAE,MAAM,EAAE,CAAC;aAC/B,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ;YAAE,MAAM,EAAE,CAAC;aACpC,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,EAAE,CAAC;aACtC,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM;YAAE,IAAI,EAAE,CAAC;QAErC,2EAA2E;QAC3E,4EAA4E;QAC5E,mEAAmE;QACnE,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,aAAa,IAAI,QAAQ,CAAC,MAAM,CAAC;QACjC,gBAAgB,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,MAAM,CAAC;QAE7E,IAAI,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,SAAS,GAAG,SAAS,CAAC;YAAE,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC;QACpF,IAAI,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,WAAW,GAAG,WAAW,CAAC;YAAE,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC;QAEhG,MAAM,GAAG,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,GAAG,GAAG,WAAW,CAAC,OAAO,CAAC,aAAa,CAAC;YAAE,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC;IACxE,CAAC;IAED,OAAO;QACL,KAAK;QACL,SAAS;QACT,WAAW;QACX,YAAY,EAAE,aAAa;QAC3B,WAAW,EAAE,MAAM,CAAC,MAAM;QAC1B,MAAM;QACN,MAAM;QACN,OAAO;QACP,IAAI;QACJ,aAAa;QACb,gBAAgB;QAChB,SAAS,EAAE,CAAC,EAAE,yCAAyC;KACxD,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,SAAS,aAAa,CAAC,OAAe,EAAE,KAAa;IACnD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACtC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;QAAE,OAAO,IAAI,CAAC;IACxE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,QAAQ,CAAC,OAAe;IACtC,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,4EAA4E;IAC5E,uEAAuE;IACvE,8EAA8E;IAC9E,2EAA2E;IAC3E,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;QACxC,IAAI,CAAC;YACH,OAAO,CAAC,SAAS,CAAC,KAAK,EAAE,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACzE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CAAC;IACH,4EAA4E;IAC5E,uCAAuC;IACvC,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,mBAAmB,CAAC,CAAc;IACzC,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;QACxC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAgB,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC;QAC1E,CAAC,CAAC,EAAE,CAAC;IACP,OAAO,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,CAAC;AAC5B,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,OAAO,CAAC,OAAe,EAAE,KAAa;IACpD,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC1C,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,4EAA4E;IAC5E,uEAAuE;IACvE,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAC9D,MAAM,WAAW,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC7B,8EAA8E;IAC9E,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC;IACtD,OAAO;QACL,OAAO,EAAE,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC;QACjC,MAAM;QACN,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvB,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChC,CAAC;AACJ,CAAC"}

package/dist/bridge/sentinel-reader.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Sentinel posture reader (dashboard S3 — The Sentinel).
+ *
+ * The Security Audit layer (agent #8, core/security-audit) is a LIBRARY: a full
+ * active scan needs a live {@link ScanTarget} (prod/staging URLs, dependency
+ * manifest, IaC blobs) the bridge does not have. So — mirroring the S2
+ * knowledge-map reader — this derives a REAL security posture from data the
+ * bridge DOES have: the latest pipeline run's persisted findings from the
+ * engine "security" squad (agents 07, 34, 35, 36, 37, 38 — the agents the
+ * Sentinel composes), fed through the Sentinel's own PURE scoring functions
+ * (buildAttackPaths → computePostureScore → rankFindings).
+ *
+ * Decision D-UI-6: posture is run-derived, not a live active/deep scan. EPSS +
+ * CVE reachability + data-sensitivity blast-radius weighting require an active
+ * scan (the CLI path), so at read-time EPSS defaults to 0.5 and blast-radius to
+ * 1.0 — the same conservative defaults the Sentinel uses when unknown. This is
+ * disclosed on the snapshot (`enrichment: 'run-derived'`) so the UI never
+ * implies live threat-intel it doesn't have.
+ */
+import type { PostureScore, AttackPath, RankedFinding } from '../core/security-audit/index.js';
+export interface SecurityPostureSnapshot {
+    /** Run the posture was derived from, or null when no run has been recorded. */
+    readonly sourceRunId: string | null;
+    /** ISO completion time of the source run, or null. */
+    readonly scannedAt: string | null;
+    /** Posture score + itemised deductions, or null when there is no run to score. */
+    readonly postureScore: PostureScore | null;
+    /** Chained attack paths derived from the security findings. */
+    readonly attackPaths: readonly AttackPath[];
+    /** Top findings ranked by severity × EPSS × blast-radius (capped). */
+    readonly rankedFindings: readonly RankedFinding[];
+    /** Total security-squad findings in the source run. */
+    readonly findingCount: number;
+    /** Count of security-squad agents PRESENT in the source run (whether or not
+     *  they produced any findings). */
+    readonly securityAgentCount: number;
+    /**
+     * How the posture was produced. 'run-derived' means it comes from persisted
+     * run findings with default EPSS/blast-radius (no live threat-intel); an
+     * active scan would set this differently. Lets the UI label the data honestly.
+     */
+    readonly enrichment: 'run-derived';
+}
+/**
+ * Build the security-posture snapshot from the newest recorded run under
+ * `runsDir`. Returns an empty (null-scored) snapshot when no run exists or the
+ * newest run's detail is unreadable. A run that IS present but has zero
+ * security-squad findings is scored as a clean 100/A with a non-null
+ * `sourceRunId` (not an empty snapshot). Never throws — a misshaped run artifact
+ * degrades to an empty/clean posture so the caller renders a state, not a 500.
+ *
+ * @param nowMs - injectable clock for deterministic tests; defaults to Date.now().
+ */
+export declare function buildSecurityPostureSnapshot(runsDir: string, nowMs?: number): SecurityPostureSnapshot;
+//# sourceMappingURL=sentinel-reader.d.ts.map

package/dist/bridge/sentinel-reader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sentinel-reader.d.ts","sourceRoot":"","sources":["../../bridge/sentinel-reader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAKH,OAAO,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAY,MAAM,wBAAwB,CAAC;AAUhG,MAAM,WAAW,uBAAuB;IACtC,+EAA+E;IAC/E,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,sDAAsD;IACtD,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,kFAAkF;IAClF,QAAQ,CAAC,YAAY,EAAE,YAAY,GAAG,IAAI,CAAC;IAC3C,+DAA+D;IAC/D,QAAQ,CAAC,WAAW,EAAE,SAAS,UAAU,EAAE,CAAC;IAC5C,sEAAsE;IACtE,QAAQ,CAAC,cAAc,EAAE,SAAS,aAAa,EAAE,CAAC;IAClD,uDAAuD;IACvD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B;uCACmC;IACnC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC;CACpC;AAgBD;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,MAAM,EACf,KAAK,GAAE,MAAmB,GACzB,uBAAuB,CAuCzB"}