@bouncesecurity/aghast 0.0.13

package/dist/formatters/sarif-formatter.js

@@ -0,0 +1,103 @@
+/**
+ * SARIF 2.1.0 output formatter.
+ * Maps ScanResults to the SARIF schema for integration with
+ * code scanning UIs (e.g. GitHub Code Scanning) and SARIF viewers.
+ */
+/** Maps aghast severity to SARIF result level. */
+export function mapSeverityToLevel(severity) {
+    switch (severity) {
+        case 'critical':
+        case 'high':
+            return 'error';
+        case 'medium':
+            return 'warning';
+        case 'low':
+        case 'informational':
+        default:
+            return 'note';
+    }
+}
+export class SarifFormatter {
+    id = 'sarif';
+    fileExtension = '.sarif';
+    format(results) {
+        const rules = this.buildRules(results);
+        const sarifResults = this.buildResults(results.issues);
+        const sarif = {
+            $schema: 'https://docs.oasis-open.org/sarif/sarif/v2.1.0/errata01/os/schemas/sarif-schema-2.1.0.json',
+            version: '2.1.0',
+            runs: [
+                {
+                    tool: {
+                        driver: {
+                            name: 'aghast',
+                            semanticVersion: results.version,
+                            rules,
+                        },
+                    },
+                    results: sarifResults,
+                },
+            ],
+        };
+        return JSON.stringify(sarif, null, 2);
+    }
+    buildRules(results) {
+        const seen = new Map();
+        for (const check of results.checks) {
+            if (!seen.has(check.checkId)) {
+                seen.set(check.checkId, {
+                    id: check.checkId,
+                    name: check.checkName,
+                    shortDescription: { text: check.checkName },
+                });
+            }
+        }
+        return Array.from(seen.values());
+    }
+    buildResults(issues) {
+        return issues.map((issue) => {
+            const region = {
+                startLine: issue.startLine,
+                endLine: issue.endLine,
+            };
+            if (issue.codeSnippet) {
+                region.snippet = { text: issue.codeSnippet };
+            }
+            const result = {
+                ruleId: issue.checkId,
+                message: { text: issue.description },
+                level: mapSeverityToLevel(issue.severity),
+                locations: [
+                    {
+                        physicalLocation: {
+                            artifactLocation: { uri: issue.file },
+                            region,
+                        },
+                    },
+                ],
+            };
+            if (issue.dataFlow && issue.dataFlow.length > 0) {
+                result.codeFlows = [this.buildCodeFlow(issue.dataFlow)];
+            }
+            return result;
+        });
+    }
+    buildCodeFlow(steps) {
+        return {
+            threadFlows: [
+                {
+                    locations: steps.map((step) => ({
+                        location: {
+                            physicalLocation: {
+                                artifactLocation: { uri: step.file },
+                                region: { startLine: step.lineNumber },
+                            },
+                            message: { text: step.label },
+                        },
+                    })),
+                },
+            ],
+        };
+    }
+}
+//# sourceMappingURL=sarif-formatter.js.map

package/dist/formatters/sarif-formatter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sarif-formatter.js","sourceRoot":"","sources":["../../src/formatters/sarif-formatter.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,kDAAkD;AAClD,MAAM,UAAU,kBAAkB,CAAC,QAA4B;IAC7D,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,UAAU,CAAC;QAChB,KAAK,MAAM;YACT,OAAO,OAAO,CAAC;QACjB,KAAK,QAAQ;YACX,OAAO,SAAS,CAAC;QACnB,KAAK,KAAK,CAAC;QACX,KAAK,eAAe,CAAC;QACrB;YACE,OAAO,MAAM,CAAC;IAClB,CAAC;AACH,CAAC;AA0DD,MAAM,OAAO,cAAc;IAChB,EAAE,GAAG,OAAO,CAAC;IACb,aAAa,GAAG,QAAQ,CAAC;IAElC,MAAM,CAAC,OAAoB;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAEvD,MAAM,KAAK,GAAa;YACtB,OAAO,EAAE,4FAA4F;YACrG,OAAO,EAAE,OAAO;YAChB,IAAI,EAAE;gBACJ;oBACE,IAAI,EAAE;wBACJ,MAAM,EAAE;4BACN,IAAI,EAAE,QAAQ;4BACd,eAAe,EAAE,OAAO,CAAC,OAAO;4BAChC,KAAK;yBACN;qBACF;oBACD,OAAO,EAAE,YAAY;iBACtB;aACF;SACF,CAAC;QAEF,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACxC,CAAC;IAEO,UAAU,CAAC,OAAoB;QACrC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAqB,CAAC;QAC1C,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC7B,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE;oBACtB,EAAE,EAAE,KAAK,CAAC,OAAO;oBACjB,IAAI,EAAE,KAAK,CAAC,SAAS;oBACrB,gBAAgB,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,SAAS,EAAE;iBAC5C,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACnC,CAAC;IAEO,YAAY,CAAC,MAAuB;QAC1C,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YAC1B,MAAM,MAAM,GAAgB;gBAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;aACvB,CAAC;YACF,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;gBACtB,MAAM,CAAC,OAAO,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;YAC/C,CAAC;YAED,MAAM,MAAM,GAAgB;gBAC1B,MAAM,EAAE,KAAK,CAAC,OAAO;gBACrB,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,WAAW,EAAE;gBACpC,KAAK,EAAE,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC;gBACzC,SAAS,EAAE;oBACT;wBACE,gBAAgB,EAAE;4BAChB,gBAAgB,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE;4BACrC,MAAM;yBACP;qBACF;iBACF;aACF,CAAC;YAEF,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAChD,MAAM,CAAC,SAAS,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC1D,CAAC;YAED,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,aAAa,CAAC,KAAqB;QACzC,OAAO;YACL,WAAW,EAAE;gBACX;oBACE,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;wBAC9B,QAAQ,EAAE;4BACR,gBAAgB,EAAE;gCAChB,gBAAgB,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE;gCACpC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,EAAE;6BACvC;4BACD,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE;yBAC9B;qBACF,CAAC,CAAC;iBACJ;aACF;SACF,CAAC;IACJ,CAAC;CACF"}

package/dist/formatters/types.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Output formatter interface for scan results.
+ * Follows the AIProvider interface pattern from src/types.ts.
+ */
+import type { ScanResults } from '../types.js';
+export interface OutputFormatter {
+    readonly id: string;
+    readonly fileExtension: string;
+    format(results: ScanResults): string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/formatters/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/formatters/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE/C,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,MAAM,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM,CAAC;CACtC"}

package/dist/formatters/types.js

@@ -0,0 +1,6 @@
+/**
+ * Output formatter interface for scan results.
+ * Follows the AIProvider interface pattern from src/types.ts.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/formatters/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/formatters/types.ts"],"names":[],"mappings":"AAAA;;;GAGG"}

package/dist/index.d.ts

@@ -0,0 +1,7 @@
+/**
+ * CLI entry point for aghast.
+ * Usage: aghast scan <repository-path> --config-dir <path> [options]
+ */
+import 'dotenv/config';
+export declare function runScan(args: string[]): Promise<void>;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,eAAe,CAAC;AAmPvB,wBAAsB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsN3D"}

package/dist/index.js

@@ -0,0 +1,406 @@
+/**
+ * CLI entry point for aghast.
+ * Usage: aghast scan <repository-path> --config-dir <path> [options]
+ */
+import 'dotenv/config';
+import { readFile, writeFile, stat, mkdir, readdir } from 'node:fs/promises';
+import { resolve, dirname } from 'node:path';
+import { runMultiScan } from './scan-runner.js';
+import { createProviderByName, getProviderNames, DEFAULT_PROVIDER_NAME } from './provider-registry.js';
+import { loadCheckRegistry, discoverCheckFolders, resolveChecks, filterChecksForRepository, validateCheck, loadCheckDetails, } from './check-library.js';
+import { analyzeRepository } from './repository-analyzer.js';
+import { loadRuntimeConfig } from './runtime-config.js';
+import { logProgress, logDebug, setLogLevel, createTimer } from './logging.js';
+import { MOCK_MODEL_NAME, DEFAULT_AI_MODEL } from './types.js';
+import { getFormatter } from './formatters/index.js';
+import { verifySemgrepInstalled } from './semgrep-runner.js';
+import { MockAIProvider } from './mock-ai-provider.js';
+import { ERROR_CODES, formatError, formatFatalError } from './error-codes.js';
+import { colorStatus } from './colors.js';
+import { createRequire } from 'node:module';
+const TAG = 'aghast';
+async function createMockProvider() {
+    // AGHAST_MOCK_AI='true' → default empty response; AGHAST_MOCK_AI=<path> → read from that file
+    const mockAiValue = process.env.AGHAST_MOCK_AI;
+    let rawResponse = '{"issues": []}';
+    if (mockAiValue && mockAiValue !== 'true') {
+        try {
+            rawResponse = await readFile(resolve(mockAiValue), 'utf-8');
+        }
+        catch (err) {
+            throw new Error(`Failed to read AGHAST_MOCK_AI response file: ${mockAiValue}`, { cause: err });
+        }
+    }
+    const provider = new MockAIProvider({ rawResponse });
+    await provider.initialize({});
+    return provider;
+}
+const SCAN_HELP = `Usage: aghast scan <repo-path> --config-dir <path> [options]
+
+Run security checks against a repository.
+
+Arguments:
+  <repo-path>                Path to the repository to scan
+
+Options:
+  --config-dir <path>        Config directory containing checks-config.json,
+                             checks/ folder, and optionally runtime-config.json.
+                             Required unless AGHAST_CONFIG_DIR is set.
+  --output <path>            Output file path for results
+                             (default: <repo-path>/security_checks_results.<ext>)
+  --output-format json|sarif Output format (default: json)
+  --fail-on-check-failure    Exit with code 1 if any check FAILs or ERRORs
+  --debug                    Enable verbose debug output
+  --model <model>            AI model override (e.g. claude-sonnet-4-20250514)
+  --ai-provider <name>       AI provider name (default: claude-code)
+  --generic-prompt <file>    Generic prompt template filename in prompts/ dir
+  --runtime-config <path>    Path to runtime config file (replaces individual flags
+                             for persistent configuration)
+  -h, --help                 Show this help message
+
+Environment variables:
+  ANTHROPIC_API_KEY           API key for Claude (required for AI-based checks)
+  AGHAST_CONFIG_DIR           Default config directory (CLI --config-dir takes precedence)
+  AGHAST_AI_MODEL             AI model override (CLI --model takes precedence)
+  AGHAST_GENERIC_PROMPT       Generic prompt template filename (CLI --generic-prompt takes precedence)
+  AGHAST_DEBUG                Set to "true" to enable debug output (same as --debug)
+
+Examples:
+  aghast scan ./my-repo --config-dir ./my-checks
+  aghast scan ./my-repo --config-dir ./my-checks --output results.sarif --output-format sarif
+  aghast scan ./my-repo --config-dir ./my-checks --fail-on-check-failure --debug
+  aghast scan ./my-repo --config-dir ./my-checks --model claude-sonnet-4-20250514`;
+function parseArgs(args) {
+    if (args.length < 1 || args[0] === '--help' || args[0] === '-h') {
+        console.log(SCAN_HELP);
+        process.exit(0);
+    }
+    const repositoryPath = resolve(args[0]);
+    let configDir;
+    let outputFormat;
+    let outputPath;
+    const failOnCheckFailure = args.includes('--fail-on-check-failure');
+    const debug = args.includes('--debug');
+    let runtimeConfigPath;
+    let model;
+    let aiProvider;
+    let genericPrompt;
+    for (let i = 1; i < args.length; i++) {
+        switch (args[i]) {
+            case '--config-dir': {
+                configDir = args[i + 1];
+                if (!configDir) {
+                    console.error(formatError(ERROR_CODES.E1001, '--config-dir requires a path argument'));
+                    process.exit(1);
+                }
+                configDir = resolve(configDir);
+                i++;
+                break;
+            }
+            case '--output': {
+                outputPath = args[i + 1];
+                if (!outputPath) {
+                    console.error(formatError(ERROR_CODES.E1001, '--output requires a path argument'));
+                    process.exit(1);
+                }
+                outputPath = resolve(outputPath);
+                i++;
+                break;
+            }
+            case '--output-format': {
+                outputFormat = args[i + 1];
+                if (!outputFormat) {
+                    console.error(formatError(ERROR_CODES.E1001, '--output-format requires a format argument'));
+                    process.exit(1);
+                }
+                i++;
+                break;
+            }
+            case '--runtime-config': {
+                runtimeConfigPath = args[i + 1];
+                if (!runtimeConfigPath) {
+                    console.error(formatError(ERROR_CODES.E1001, '--runtime-config requires a path argument'));
+                    process.exit(1);
+                }
+                runtimeConfigPath = resolve(runtimeConfigPath);
+                i++;
+                break;
+            }
+            case '--model': {
+                model = args[i + 1];
+                if (!model) {
+                    console.error(formatError(ERROR_CODES.E1001, '--model requires a model name argument'));
+                    process.exit(1);
+                }
+                i++;
+                break;
+            }
+            case '--ai-provider': {
+                aiProvider = args[i + 1];
+                if (!aiProvider) {
+                    console.error(formatError(ERROR_CODES.E1001, '--ai-provider requires a provider name argument'));
+                    process.exit(1);
+                }
+                i++;
+                break;
+            }
+            case '--generic-prompt': {
+                genericPrompt = args[i + 1];
+                if (!genericPrompt) {
+                    console.error(formatError(ERROR_CODES.E1001, '--generic-prompt requires a filename argument'));
+                    process.exit(1);
+                }
+                i++;
+                break;
+            }
+            // --fail-on-check-failure and --debug are handled above via includes()
+        }
+    }
+    return {
+        repositoryPath, configDir, outputPath, outputFormat,
+        failOnCheckFailure, debug, runtimeConfigPath, model, aiProvider,
+        genericPrompt,
+    };
+}
+async function createProvider(useMock, aiProviderName, modelOverride) {
+    if (useMock) {
+        logProgress(TAG, `MOCK AI provider enabled via AGHAST_MOCK_AI=${process.env.AGHAST_MOCK_AI}`);
+        return { provider: await createMockProvider(), modelName: MOCK_MODEL_NAME };
+    }
+    const provider = createProviderByName(aiProviderName);
+    await provider.initialize({
+        apiKey: process.env.ANTHROPIC_API_KEY,
+        model: modelOverride,
+    });
+    const modelName = provider.getModelName?.() ?? DEFAULT_AI_MODEL;
+    return { provider, modelName };
+}
+/**
+ * Validate that the config directory has the required structure.
+ * Returns early with a clear error message if anything is missing.
+ */
+async function validateConfigDir(configDir) {
+    // Check checks-config.json exists
+    const registryPath = resolve(configDir, 'checks-config.json');
+    try {
+        await stat(registryPath);
+    }
+    catch {
+        console.error(formatError(ERROR_CODES.E2002, `Config directory is missing checks-config.json: ${registryPath}`));
+        console.error(`  Use 'aghast new-check --config-dir ${configDir}' to bootstrap a config directory.`);
+        process.exit(1);
+    }
+    // Check checks/ directory exists
+    const checksPath = resolve(configDir, 'checks');
+    try {
+        const checksStat = await stat(checksPath);
+        if (!checksStat.isDirectory()) {
+            console.error(formatError(ERROR_CODES.E2002, `${checksPath} exists but is not a directory`));
+            process.exit(1);
+        }
+    }
+    catch {
+        console.error(formatError(ERROR_CODES.E2002, `Config directory is missing checks/ folder: ${checksPath}`));
+        console.error(`  Use 'aghast new-check --config-dir ${configDir}' to add checks.`);
+        process.exit(1);
+    }
+    // Check that checks/ has at least one subfolder
+    const entries = await readdir(checksPath);
+    if (entries.length === 0) {
+        console.error(formatError(ERROR_CODES.E2003, `No checks found in ${checksPath}`));
+        console.error(`  Use 'aghast new-check --config-dir ${configDir}' to add checks.`);
+        process.exit(1);
+    }
+}
+export async function runScan(args) {
+    const globalTimer = createTimer();
+    const parsed = parseArgs(args);
+    // --config-dir is required (CLI flag > AGHAST_CONFIG_DIR env var)
+    const rawConfigDir = parsed.configDir || process.env.AGHAST_CONFIG_DIR;
+    if (!rawConfigDir) {
+        console.error(formatError(ERROR_CODES.E2001, "--config-dir is required (or set AGHAST_CONFIG_DIR). Use 'aghast new-check --config-dir <path>' to create a config directory."));
+        process.exit(1);
+    }
+    const configDir = resolve(rawConfigDir);
+    // Validate config directory structure
+    await validateConfigDir(configDir);
+    // Load runtime configuration
+    let runtimeConfig;
+    try {
+        runtimeConfig = await loadRuntimeConfig(configDir, parsed.runtimeConfigPath);
+    }
+    catch (err) {
+        console.error(formatError(ERROR_CODES.E2005, err instanceof Error ? err.message : String(err)));
+        process.exit(1);
+    }
+    // Set log level: --debug flag or AGHAST_DEBUG env var enables debug
+    const debug = parsed.debug || process.env.AGHAST_DEBUG === 'true';
+    setLogLevel(debug ? 'debug' : 'info');
+    // Validate repository path exists and is a directory
+    try {
+        const repoStat = await stat(parsed.repositoryPath);
+        if (!repoStat.isDirectory()) {
+            console.error(formatError(ERROR_CODES.E4001, `Repository path is not a directory: ${parsed.repositoryPath}`));
+            process.exit(1);
+        }
+    }
+    catch (err) {
+        if (err instanceof Error && 'code' in err && err.code === 'ENOENT') {
+            console.error(formatError(ERROR_CODES.E4001, `Repository path does not exist: ${parsed.repositoryPath}`));
+            process.exit(1);
+        }
+        throw err;
+    }
+    // Resolve output format: CLI > runtime config > default
+    const resolvedOutputFormat = parsed.outputFormat ?? runtimeConfig.reporting?.outputFormat ?? 'json';
+    // Resolve formatter early — fail fast on unknown format
+    const formatter = getFormatter(resolvedOutputFormat);
+    // Treat AGHAST_MOCK_AI=false (or empty) as disabled; any other truthy value enables mock mode
+    const mockAiEnv = process.env.AGHAST_MOCK_AI;
+    const useMock = !!(mockAiEnv && mockAiEnv !== 'false');
+    // ─── Load and filter checks BEFORE AI validation ───
+    // Checks always live in <config-dir>/checks/
+    const checksDirs = [resolve(configDir, 'checks')];
+    // Resolve generic prompt: CLI > env > runtime config > default (handled in buildPrompt)
+    const genericPrompt = parsed.genericPrompt ?? process.env.AGHAST_GENERIC_PROMPT ?? runtimeConfig.genericPrompt;
+    logDebug(TAG, `Config dir: ${configDir}, checks dir: ${checksDirs[0]}`);
+    // Two-layer config loading
+    const registry = await loadCheckRegistry(configDir);
+    const checkFolders = await discoverCheckFolders(checksDirs);
+    if (checkFolders.size === 0) {
+        console.error(formatError(ERROR_CODES.E2003, `No valid checks found in ${checksDirs[0]}. Each check needs a <id>/<id>.json file.`));
+        process.exit(1);
+    }
+    const allChecks = await resolveChecks(registry, checkFolders);
+    // Analyze repository to get remote URL for check filtering
+    const repoAnalysis = await analyzeRepository(parsed.repositoryPath);
+    const repoUrl = repoAnalysis.repository.remoteUrl ?? parsed.repositoryPath;
+    const matchingChecks = filterChecksForRepository(allChecks, repoUrl);
+    logProgress(TAG, `Found ${matchingChecks.length} matching checks (of ${allChecks.length} total)`);
+    if (matchingChecks.length === 0) {
+        logProgress(TAG, 'No matching checks found for this repository');
+    }
+    // Validate and load check details
+    const checksWithDetails = [];
+    for (const check of matchingChecks) {
+        // instructionsFile is already absolute from resolveChecks — validate against ''
+        const validation = await validateCheck(check, '');
+        if (!validation.valid) {
+            logProgress(TAG, `Skipping invalid check "${check.id}": ${validation.errors.join(', ')}`);
+            continue;
+        }
+        // checkTarget rules already resolved by resolveChecks — no additional path resolution needed
+        // semgrep-only checks have no instructions markdown — use synthetic details
+        if (check.checkTarget?.type === 'semgrep-only') {
+            checksWithDetails.push({
+                check,
+                details: { id: check.id, name: check.name, overview: '', content: '' },
+            });
+            continue;
+        }
+        const details = await loadCheckDetails(check, '');
+        checksWithDetails.push({ check, details });
+    }
+    // ─── Determine which prerequisites are needed ───
+    const needsAI = checksWithDetails.some(c => c.check.checkTarget?.type !== 'semgrep-only');
+    const needsSemgrep = checksWithDetails.some(c => c.check.checkTarget?.type === 'semgrep' || c.check.checkTarget?.type === 'semgrep-only');
+    // ─── Conditional AI provider setup ───
+    const aiProviderName = parsed.aiProvider ?? runtimeConfig.aiProvider?.name ?? DEFAULT_PROVIDER_NAME;
+    if (needsAI && !useMock) {
+        // Validate AI provider name before checking credentials (config errors before auth errors)
+        if (!getProviderNames().includes(aiProviderName)) {
+            console.error(formatError(ERROR_CODES.E3002, `Unknown AI provider "${aiProviderName}". Supported providers: ${getProviderNames().join(', ')}`));
+            process.exit(1);
+        }
+        // Validate ANTHROPIC_API_KEY (not needed when using mock or local Claude)
+        if (!process.env.ANTHROPIC_API_KEY && process.env.AGHAST_LOCAL_CLAUDE !== 'true') {
+            console.error(formatError(ERROR_CODES.E3001, 'ANTHROPIC_API_KEY environment variable is required (or set AGHAST_LOCAL_CLAUDE=true)'));
+            process.exit(1);
+        }
+    }
+    // Resolve model precedence: CLI --model > env AGHAST_AI_MODEL > runtime config > default
+    const modelOverride = parsed.model ?? process.env.AGHAST_AI_MODEL ?? runtimeConfig.aiProvider?.model;
+    let provider;
+    let modelName;
+    if (needsAI) {
+        ({ provider, modelName } = await createProvider(useMock, aiProviderName, modelOverride));
+        if (debug) {
+            provider.enableDebug?.();
+        }
+        logProgress(TAG, `Using model: ${modelName}`);
+    }
+    // ─── Conditional Semgrep verification ───
+    if (needsSemgrep && !process.env.AGHAST_MOCK_SEMGREP) {
+        try {
+            await verifySemgrepInstalled();
+        }
+        catch (err) {
+            console.error(formatError(ERROR_CODES.E5001, err instanceof Error ? err.message : String(err)));
+            process.exit(1);
+        }
+    }
+    const results = await runMultiScan({
+        repositoryPath: parsed.repositoryPath,
+        checks: checksWithDetails,
+        aiProvider: provider,
+        aiModelName: needsAI ? modelName : undefined,
+        repositoryInfo: repoAnalysis.repository,
+        aiProviderName: needsAI ? (useMock ? 'mock' : aiProviderName) : undefined,
+        configDir,
+        genericPrompt,
+    });
+    // Resolve output path: --output flag > runtime config dir > default
+    let outputPath;
+    if (parsed.outputPath) {
+        outputPath = parsed.outputPath;
+    }
+    else if (runtimeConfig.reporting?.outputDirectory) {
+        const dir = resolve(runtimeConfig.reporting.outputDirectory);
+        outputPath = resolve(dir, 'security_checks_results' + formatter.fileExtension);
+    }
+    else {
+        outputPath = resolve(parsed.repositoryPath, 'security_checks_results' + formatter.fileExtension);
+    }
+    await mkdir(dirname(outputPath), { recursive: true });
+    await writeFile(outputPath, formatter.format(results), 'utf-8');
+    // Summary output
+    const statusIcon = results.summary.failedChecks > 0
+        ? 'FAIL'
+        : results.summary.flaggedChecks > 0
+            ? 'FLAG'
+            : results.summary.errorChecks > 0
+                ? 'ERROR'
+                : 'PASS';
+    console.log('');
+    console.log('='.repeat(60));
+    console.log(`AGHAST Scan Complete: ${colorStatus(statusIcon)}`);
+    console.log('='.repeat(60));
+    console.log(`  Total checks:  ${results.summary.totalChecks}`);
+    console.log(`  Passed:        ${results.summary.passedChecks}`);
+    console.log(`  Failed:        ${results.summary.failedChecks}`);
+    console.log(`  Flagged:       ${results.summary.flaggedChecks}`);
+    console.log(`  Errors:        ${results.summary.errorChecks}`);
+    console.log(`  Total issues:  ${results.summary.totalIssues}`);
+    if (results.tokenUsage) {
+        console.log(`  Tokens:        ${results.tokenUsage.totalTokens.toLocaleString()} (in: ${results.tokenUsage.inputTokens.toLocaleString()}, out: ${results.tokenUsage.outputTokens.toLocaleString()})`);
+    }
+    console.log(`  Duration:      ${globalTimer.elapsedStr()}`);
+    console.log(`  Results:       ${outputPath}`);
+    console.log('='.repeat(60));
+    // Exit code based on --fail-on-check-failure flag or runtime config (spec Section 9.3)
+    const failOnCheckFailure = parsed.failOnCheckFailure || runtimeConfig.failOnCheckFailure === true;
+    const shouldFail = failOnCheckFailure && (results.summary.failedChecks > 0 || results.summary.errorChecks > 0);
+    process.exit(shouldFail ? 1 : 0);
+}
+// Auto-run when executed directly (pnpm scan / tsx src/index.ts), but not when imported by cli.ts.
+if (!process.env._AGHAST_CLI) {
+    runScan(process.argv.slice(2)).catch((err) => {
+        const require = createRequire(import.meta.url);
+        const pkg = require('../package.json');
+        console.error('');
+        console.error(formatFatalError(err instanceof Error ? err.message : String(err), pkg.version));
+        logDebug(TAG, 'Error details', err);
+        process.exit(1);
+    });
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,eAAe,CAAC;AACvB,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AACvG,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,aAAa,EACb,yBAAyB,EACzB,aAAa,EACb,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC/E,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAmB,MAAM,YAAY,CAAC;AAChF,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAC9E,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,MAAM,GAAG,GAAG,QAAQ,CAAC;AAErB,KAAK,UAAU,kBAAkB;IAC/B,8FAA8F;IAC9F,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IAC/C,IAAI,WAAW,GAAG,gBAAgB,CAAC;IACnC,IAAI,WAAW,IAAI,WAAW,KAAK,MAAM,EAAE,CAAC;QAC1C,IAAI,CAAC;YACH,WAAW,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC,CAAC;QAC9D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,gDAAgD,WAAW,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACjG,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,cAAc,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC;IACrD,MAAM,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IAC9B,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,SAAS,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kFAkCgE,CAAC;AAEnF,SAAS,SAAS,CAAC,IAAc;IAY/B,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAChE,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACvB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACxC,IAAI,SAA6B,CAAC;IAClC,IAAI,YAAgC,CAAC;IACrC,IAAI,UAA8B,CAAC;IACnC,MAAM,kBAAkB,GAAG,IAAI,CAAC,QAAQ,CAAC,yBAAyB,CAAC,CAAC;IACpE,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IACvC,IAAI,iBAAqC,CAAC;IAC1C,IAAI,KAAyB,CAAC;IAC9B,IAAI,UAA8B,CAAC;IACnC,IAAI,aAAiC,CAAC;IAEtC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,QAAQ,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAChB,KAAK,cAAc,CAAC,CAAC,CAAC;gBACpB,SAAS,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBACxB,IAAI,CAAC,SAAS,EAAE,CAAC;oBACf,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,WAAW,CAAC,KAAK,EAAE,uCAAuC,CAAC,CAAC,CAAC;oBACvF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAClB,CAAC;gBACD,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;gBAC/B,CAAC,EAAE,CAAC;gBACJ,MAAM;YACR,CAAC;YACD,KAAK,UAAU,CAAC,CAAC,CAAC;gBAChB,UAAU,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBACzB,IAAI,CAAC,UAAU,EAAE,CAAC;oBAChB,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,WAAW,CAAC,KAAK,EAAE,mCAAmC,CAAC,CAAC,CAAC;oBACnF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAClB,CAAC;gBACD,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;gBACjC,CAAC,EAAE,CAAC;gBACJ,MAAM;YACR,CAAC;YACD,KAAK,iBAAiB,CAAC,CAAC,CAAC;gBACvB,YAAY,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC3B,IAAI,CAAC,YAAY,EAAE,CAAC;oBAClB,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,WAAW,CAAC,KAAK,EAAE,4CAA4C,CAAC,CAAC,CAAC;oBAC5F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAClB,CAAC;gBACD,CAAC,EAAE,CAAC;gBACJ,MAAM;YACR,CAAC;YACD,KAAK,kBAAkB,CAAC,CAAC,CAAC;gBACxB,iBAAiB,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBAChC,IAAI,CAAC,iBAAiB,EAAE,CAAC;oBACvB,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,WAAW,CAAC,KAAK,EAAE,2CAA2C,CAAC,CAAC,CAAC;oBAC3F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAClB,CAAC;gBACD,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;gBAC/C,CAAC,EAAE,CAAC;gBACJ,MAAM;YACR,CAAC;YACD,KAAK,SAAS,CAAC,CAAC,CAAC;gBACf,KAAK,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBACpB,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,WAAW,CAAC,KAAK,EAAE,wCAAwC,CAAC,CAAC,CAAC;oBACxF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAClB,CAAC;gBACD,CAAC,EAAE,CAAC;gBACJ,MAAM;YACR,CAAC;YACD,KAAK,eAAe,CAAC,CAAC,CAAC;gBACrB,UAAU,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBACzB,IAAI,CAAC,UAAU,EAAE,CAAC;oBAChB,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,WAAW,CAAC,KAAK,EAAE,iDAAiD,CAAC,CAAC,CAAC;oBACjG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAClB,CAAC;gBACD,CAAC,EAAE,CAAC;gBACJ,MAAM;YACR,CAAC;YACD,KAAK,kBAAkB,CAAC,CAAC,CAAC;gBACxB,aAAa,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC5B,IAAI,CAAC,aAAa,EAAE,CAAC;oBACnB,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,WAAW,CAAC,KAAK,EAAE,+CAA+C,CAAC,CAAC,CAAC;oBAC/F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAClB,CAAC;gBACD,CAAC,EAAE,CAAC;gBACJ,MAAM;YACR,CAAC;YACD,uEAAuE;QACzE,CAAC;IACH,CAAC;IAED,OAAO;QACL,cAAc,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY;QACnD,kBAAkB,EAAE,KAAK,EAAE,iBAAiB,EAAE,KAAK,EAAE,UAAU;QAC/D,aAAa;KACd,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,OAAgB,EAChB,cAAsB,EACtB,aAAsB;IAEtB,IAAI,OAAO,EAAE,CAAC;QACZ,WAAW,CAAC,GAAG,EAAE,+CAA+C,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC;QAC9F,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,EAAE,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC;IAC9E,CAAC;IAED,MAAM,QAAQ,GAAG,oBAAoB,CAAC,cAAc,CAAC,CAAC;IACtD,MAAM,QAAQ,CAAC,UAAU,CAAC;QACxB,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB;QACrC,KAAK,EAAE,aAAa;KACrB,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,QAAQ,CAAC,YAAY,EAAE,EAAE,IAAI,gBAAgB,CAAC;IAChE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,iBAAiB,CAAC,SAAiB;IAChD,kCAAkC;IAClC,MAAM,YAAY,GAAG,OAAO,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IAC9D,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,YAAY,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,WAAW,CAAC,KAAK,EAAE,mDAAmD,YAAY,EAAE,CAAC,CAAC,CAAC;QACjH,OAAO,CAAC,KAAK,CAAC,wCAAwC,SAAS,oCAAoC,CAAC,CAAC;QACrG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,iCAAiC;IACjC,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC;QAC1C,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC;YAC9B,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,UAAU,gCAAgC,CAAC,CAAC,CAAC;YAC7F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,WAAW,CAAC,KAAK,EAAE,+CAA+C,UAAU,EAAE,CAAC,CAAC,CAAC;QAC3G,OAAO,CAAC,KAAK,CAAC,wCAAwC,SAAS,kBAAkB,CAAC,CAAC;QACnF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,gDAAgD;IAChD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC;IAC1C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,WAAW,CAAC,KAAK,EAAE,sBAAsB,UAAU,EAAE,CAAC,CAAC,CAAC;QAClF,OAAO,CAAC,KAAK,CAAC,wCAAwC,SAAS,kBAAkB,CAAC,CAAC;QACnF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAc;IAC1C,MAAM,WAAW,GAAG,WAAW,EAAE,CAAC;IAClC,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAE/B,kEAAkE;IAClE,MAAM,YAAY,GAAG,MAAM,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IACvE,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,WAAW,CAAC,KAAK,EAAE,+HAA+H,CAAC,CAAC,CAAC;QAC/K,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAExC,sCAAsC;IACtC,MAAM,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAEnC,6BAA6B;IAC7B,IAAI,aAA4D,CAAC;IACjE,IAAI,CAAC;QACH,aAAa,GAAG,MAAM,iBAAiB,CAAC,SAAS,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC;IAC/E,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAChG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,oEAAoE;IACpE,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,KAAK,MAAM,CAAC;IAClE,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAEtC,qDAAqD;IACrD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QACnD,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC;YAC5B,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,WAAW,CAAC,KAAK,EAAE,uCAAuC,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC;YAC9G,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,IAAI,GAAG,YAAY,KAAK,IAAI,MAAM,IAAI,GAAG,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9F,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,WAAW,CAAC,KAAK,EAAE,mCAAmC,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC;YAC1G,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,wDAAwD;IACxD,MAAM,oBAAoB,GAAG,MAAM,CAAC,YAAY,IAAI,aAAa,CAAC,SAAS,EAAE,YAAY,IAAI,MAAM,CAAC;IAEpG,wDAAwD;IACxD,MAAM,SAAS,GAAG,YAAY,CAAC,oBAAoB,CAAC,CAAC;IAErD,8FAA8F;IAC9F,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IAC7C,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,SAAS,IAAI,SAAS,KAAK,OAAO,CAAC,CAAC;IAEvD,sDAAsD;IAEtD,6CAA6C;IAC7C,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;IAElD,wFAAwF;IACxF,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,aAAa,CAAC,aAAa,CAAC;IAE/G,QAAQ,CAAC,GAAG,EAAE,eAAe,SAAS,iBAAiB,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAExE,2BAA2B;IAC3B,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,SAAS,CAAC,CAAC;IACpD,MAAM,YAAY,GAAG,MAAM,oBAAoB,CAAC,UAAU,CAAC,CAAC;IAE5D,IAAI,YAAY,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,WAAW,CAAC,KAAK,EAAE,4BAA4B,UAAU,CAAC,CAAC,CAAC,2CAA2C,CAAC,CAAC,CAAC;QACpI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAE9D,2DAA2D;IAC3D,MAAM,YAAY,GAAG,MAAM,iBAAiB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,YAAY,CAAC,UAAU,CAAC,SAAS,IAAI,MAAM,CAAC,cAAc,CAAC;IAE3E,MAAM,cAAc,GAAG,yBAAyB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACrE,WAAW,CAAC,GAAG,EAAE,SAAS,cAAc,CAAC,MAAM,wBAAwB,SAAS,CAAC,MAAM,SAAS,CAAC,CAAC;IAElG,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,WAAW,CAAC,GAAG,EAAE,8CAA8C,CAAC,CAAC;IACnE,CAAC;IAED,kCAAkC;IAClC,MAAM,iBAAiB,GAAsG,EAAE,CAAC;IAChI,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;QACnC,gFAAgF;QAChF,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YACtB,WAAW,CAAC,GAAG,EAAE,2BAA2B,KAAK,CAAC,EAAE,MAAM,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC1F,SAAS;QACX,CAAC;QAED,6FAA6F;QAE7F,4EAA4E;QAC5E,IAAI,KAAK,CAAC,WAAW,EAAE,IAAI,KAAK,cAAc,EAAE,CAAC;YAC/C,iBAAiB,CAAC,IAAI,CAAC;gBACrB,KAAK;gBACL,OAAO,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;aACvE,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAClD,iBAAiB,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,mDAAmD;IACnD,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,KAAK,cAAc,CAAC,CAAC;IAC1F,MAAM,YAAY,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAC9C,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,KAAK,cAAc,CACxF,CAAC;IAEF,wCAAwC;IACxC,MAAM,cAAc,GAAG,MAAM,CAAC,UAAU,IAAI,aAAa,CAAC,UAAU,EAAE,IAAI,IAAI,qBAAqB,CAAC;IAEpG,IAAI,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;QACxB,2FAA2F;QAC3F,IAAI,CAAC,gBAAgB,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YACjD,OAAO,CAAC,KAAK,CACX,WAAW,CAAC,WAAW,CAAC,KAAK,EAAE,wBAAwB,cAAc,2BAA2B,gBAAgB,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CACjI,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,0EAA0E;QAC1E,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,KAAK,MAAM,EAAE,CAAC;YACjF,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,WAAW,CAAC,KAAK,EAAE,sFAAsF,CAAC,CAAC,CAAC;YACtI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,yFAAyF;IACzF,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,aAAa,CAAC,UAAU,EAAE,KAAK,CAAC;IAErG,IAAI,QAAgC,CAAC;IACrC,IAAI,SAA6B,CAAC;IAClC,IAAI,OAAO,EAAE,CAAC;QACZ,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,cAAc,EAAE,aAAa,CAAC,CAAC,CAAC;QACzF,IAAI,KAAK,EAAE,CAAC;YACV,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC;QAC3B,CAAC;QACD,WAAW,CAAC,GAAG,EAAE,gBAAgB,SAAS,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,2CAA2C;IAC3C,IAAI,YAAY,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,CAAC;QACrD,IAAI,CAAC;YACH,MAAM,sBAAsB,EAAE,CAAC;QACjC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAChG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC;QACjC,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,MAAM,EAAE,iBAAiB;QACzB,UAAU,EAAE,QAAQ;QACpB,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;QAC5C,cAAc,EAAE,YAAY,CAAC,UAAU;QACvC,cAAc,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS;QACzE,SAAS;QACT,aAAa;KACd,CAAC,CAAC;IAEH,oEAAoE;IACpE,IAAI,UAAkB,CAAC;IACvB,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QACtB,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;IACjC,CAAC;SAAM,IAAI,aAAa,CAAC,SAAS,EAAE,eAAe,EAAE,CAAC;QACpD,MAAM,GAAG,GAAG,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QAC7D,UAAU,GAAG,OAAO,CAAC,GAAG,EAAE,yBAAyB,GAAG,SAAS,CAAC,aAAa,CAAC,CAAC;IACjF,CAAC;SAAM,CAAC;QACN,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,yBAAyB,GAAG,SAAS,CAAC,aAAa,CAAC,CAAC;IACnG,CAAC;IACD,MAAM,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,MAAM,SAAS,CAAC,UAAU,EAAE,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;IAEhE,iBAAiB;IACjB,MAAM,UAAU,GACd,OAAO,CAAC,OAAO,CAAC,YAAY,GAAG,CAAC;QAC9B,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,GAAG,CAAC;YACjC,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,GAAG,CAAC;gBAC/B,CAAC,CAAC,OAAO;gBACT,CAAC,CAAC,MAAM,CAAC;IAEjB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5B,OAAO,CAAC,GAAG,CAAC,yBAAyB,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IAChE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5B,OAAO,CAAC,GAAG,CAAC,oBAAoB,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAC/D,OAAO,CAAC,GAAG,CAAC,oBAAoB,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAChE,OAAO,CAAC,GAAG,CAAC,oBAAoB,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAChE,OAAO,CAAC,GAAG,CAAC,oBAAoB,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IACjE,OAAO,CAAC,GAAG,CAAC,oBAAoB,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAC/D,OAAO,CAAC,GAAG,CAAC,oBAAoB,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAC/D,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,oBAAoB,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,cAAc,EAAE,SAAS,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,cAAc,EAAE,UAAU,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;IACxM,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,oBAAoB,WAAW,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC5D,OAAO,CAAC,GAAG,CAAC,oBAAoB,UAAU,EAAE,CAAC,CAAC;IAC9C,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAE5B,uFAAuF;IACvF,MAAM,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,IAAI,aAAa,CAAC,kBAAkB,KAAK,IAAI,CAAC;IAClG,MAAM,UAAU,GACd,kBAAkB,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,GAAG,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC;IAC9F,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACnC,CAAC;AAED,mGAAmG;AACnG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;IAC7B,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QAC3C,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/C,MAAM,GAAG,GAAG,OAAO,CAAC,iBAAiB,CAAwB,CAAC;QAC9D,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/F,QAAQ,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,CAAC,CAAC;QACpC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/logging.d.ts

@@ -0,0 +1,26 @@
+export type LogLevel = 'silent' | 'info' | 'debug';
+export declare function getLogLevel(): LogLevel;
+/**
+ * Programmatically set the log level (avoids env var race conditions with --debug flag).
+ */
+export declare function setLogLevel(level: LogLevel): void;
+/**
+ * Log a progress/activity message at info level.
+ */
+export declare function logProgress(tag: string, message: string, details?: Record<string, unknown>): void;
+/**
+ * Create a timer for measuring elapsed time.
+ */
+export declare function createTimer(): {
+    elapsed: () => number;
+    elapsedStr: () => string;
+};
+/**
+ * Log debug information (single line, compact).
+ */
+export declare function logDebug(tag: string, message: string, data?: unknown): void;
+/**
+ * Log debug information without truncation (for full prompts and responses).
+ */
+export declare function logDebugFull(tag: string, message: string, data?: string): void;
+//# sourceMappingURL=logging.d.ts.map

package/dist/logging.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logging.d.ts","sourceRoot":"","sources":["../src/logging.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,QAAQ,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,CAAC;AAUnD,wBAAgB,WAAW,IAAI,QAAQ,CAItC;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,QAAQ,GAAG,IAAI,CAEjD;AAMD;;GAEG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAMjG;AAED;;GAEG;AACH,wBAAgB,WAAW,IAAI;IAAE,OAAO,EAAE,MAAM,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,MAAM,CAAA;CAAE,CAWjF;AAED;;GAEG;AACH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,IAAI,CAW3E;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAS9E"}