@bouncesecurity/aghast 0.4.4 → 0.6.0

package/dist/cli.js

@@ -20,8 +20,10 @@ process.env._AGHAST_CLI = '1';
 const USAGE = `Usage: aghast <command> [options]
 
 Commands:
-  scan        Run security checks against a repository
-  new-check   Scaffold a new security check
+  scan           Run security checks against a repository
+  new-check      Scaffold a new security check
+  build-config   Build or edit a runtime-config.json (interactive or flag-driven)
+  stats          Print a cost summary from the scan history
 
 Options:
   --help      Show this help message
@@ -55,9 +57,13 @@ async function main() {
     process.on('SIGTERM', () => {
         process.exit(143);
     });
-    printLogo();
     const args = process.argv.slice(2);
     const command = args[0];
+    // Skip the logo for `stats --json` so machine-readable output is parseable.
+    const isStatsJson = command === 'stats' && args.includes('--json');
+    if (!isStatsJson) {
+        printLogo();
+    }
     if (!command || command === '--help' || command === '-h') {
         console.log(USAGE);
         process.exit(0);
@@ -78,6 +84,16 @@ async function main() {
             await runNewCheck(subArgs);
             break;
         }
+        case 'build-config': {
+            const { runBuildConfig } = await import('./build-config.js');
+            await runBuildConfig(subArgs);
+            break;
+        }
+        case 'stats': {
+            const { runStats } = await import('./stats.js');
+            await runStats(subArgs);
+            break;
+        }
         default:
             console.error(formatError(ERROR_CODES.E1002, `Unknown command: ${command}`));
             console.error('');

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;;;;;GASG;AAEH,OAAO,eAAe,CAAC;AACvB,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAE9E,6EAA6E;AAC7E,OAAO,CAAC,GAAG,CAAC,WAAW,GAAG,GAAG,CAAC;AAE9B,MAAM,KAAK,GAAG;;;;;;;;;;iEAUmD,CAAC;AAElE,SAAS,UAAU;IACjB,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,OAAO,CAAC,iBAAiB,CAAwB,CAAC;IAC9D,OAAO,GAAG,CAAC,OAAO,CAAC;AACrB,CAAC;AAED,SAAS,YAAY;IACnB,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,SAAS;IAChB,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;IACvE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC7C,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,4CAA4C;IAC9C,CAAC;AACH,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,qCAAqC;IACrC,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;QACxB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;IACH,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;QACzB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,SAAS,EAAE,CAAC;IAEZ,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAExB,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACzD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,OAAO,KAAK,WAAW,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QAChD,YAAY,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAE9B,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;YAC/C,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;YACvB,MAAM;QACR,CAAC;QACD,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;YACvD,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;YAC3B,MAAM;QACR,CAAC;QACD;YACE,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,WAAW,CAAC,KAAK,EAAE,oBAAoB,OAAO,EAAE,CAAC,CAAC,CAAC;YAC7E,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAClB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACrB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClB,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;IAChG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;;;;;GASG;AAEH,OAAO,eAAe,CAAC;AACvB,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAE9E,6EAA6E;AAC7E,OAAO,CAAC,GAAG,CAAC,WAAW,GAAG,GAAG,CAAC;AAE9B,MAAM,KAAK,GAAG;;;;;;;;;;;;iEAYmD,CAAC;AAElE,SAAS,UAAU;IACjB,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,OAAO,CAAC,iBAAiB,CAAwB,CAAC;IAC9D,OAAO,GAAG,CAAC,OAAO,CAAC;AACrB,CAAC;AAED,SAAS,YAAY;IACnB,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,SAAS;IAChB,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;IACvE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC7C,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,4CAA4C;IAC9C,CAAC;AACH,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,qCAAqC;IACrC,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;QACxB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;IACH,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;QACzB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAExB,4EAA4E;IAC5E,MAAM,WAAW,GAAG,OAAO,KAAK,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACnE,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,SAAS,EAAE,CAAC;IACd,CAAC;IAED,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACzD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,OAAO,KAAK,WAAW,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QAChD,YAAY,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAE9B,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;YAC/C,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;YACvB,MAAM;QACR,CAAC;QACD,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;YACvD,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;YAC3B,MAAM;QACR,CAAC;QACD,KAAK,cAAc,CAAC,CAAC,CAAC;YACpB,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;YAC7D,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC;YAC9B,MAAM;QACR,CAAC;QACD,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;YAChD,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;YACxB,MAAM;QACR,CAAC;QACD;YACE,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,WAAW,CAAC,KAAK,EAAE,oBAAoB,OAAO,EAAE,CAAC,CAAC,CAAC;YAC7E,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAClB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACrB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClB,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;IAChG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/colors.js

@@ -5,10 +5,10 @@
 import pc from 'picocolors';
 export function colorStatus(status) {
     switch (status) {
-        case 'PASS': return pc.green(status);
-        case 'FAIL': return pc.red(status);
-        case 'FLAG': return pc.yellow(status);
-        case 'ERROR': return pc.red(status);
+        case 'NO ISSUES DETECTED': return pc.green(status);
+        case 'ISSUES DETECTED': return pc.red(status);
+        case 'REVIEW REQUIRED': return pc.yellow(status);
+        case 'SCAN ERROR': return pc.red(status);
         default: return status;
     }
 }

package/dist/colors.js.map

@@ -1 +1 @@
-{"version":3,"file":"colors.js","sourceRoot":"","sources":["../src/colors.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,MAAM,YAAY,CAAC;AAE5B,MAAM,UAAU,WAAW,CAAC,MAAc;IACxC,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACrC,KAAK,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACnC,KAAK,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACtC,KAAK,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACpC,OAAO,CAAC,CAAC,OAAO,MAAM,CAAC;IACzB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,OAAe;IACxC,OAAO,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AACzB,CAAC"}
+{"version":3,"file":"colors.js","sourceRoot":"","sources":["../src/colors.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,MAAM,YAAY,CAAC;AAE5B,MAAM,UAAU,WAAW,CAAC,MAAc;IACxC,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,oBAAoB,CAAC,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACnD,KAAK,iBAAiB,CAAC,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9C,KAAK,iBAAiB,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACjD,KAAK,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACzC,OAAO,CAAC,CAAC,OAAO,MAAM,CAAC;IACzB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,OAAe;IACxC,OAAO,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AACzB,CAAC"}

package/dist/cost-calculator.d.ts

@@ -0,0 +1,80 @@
+/**
+ * Cost calculator: maps token usage to estimated USD cost using per-model pricing.
+ *
+ * Pricing is loaded from `config/pricing.json` (built-in defaults) and may be
+ * overridden via the runtime config `pricing` section. Prices change over time
+ * and are not authoritative — they are estimates for budgeting/dashboarding.
+ */
+import type { TokenUsage } from './types.js';
+/** Per-million-token rates for a single model. */
+export interface ModelPricing {
+    inputPerMillion: number;
+    outputPerMillion: number;
+    cacheReadPerMillion?: number;
+    cacheWritePerMillion?: number;
+}
+/** Pricing config (default file or runtime override). */
+export interface PricingConfig {
+    currency?: string;
+    models: Record<string, ModelPricing>;
+}
+/** Computed cost for a single token-usage record. */
+export interface CostBreakdown {
+    inputCost: number;
+    outputCost: number;
+    cacheReadCost?: number;
+    cacheWriteCost?: number;
+    totalCost: number;
+    currency: string;
+    /** How the cost was determined. */
+    source: 'reported' | 'estimated' | 'estimated-unpriced' | 'legacy';
+    /** When source === 'reported', which provider reported it. */
+    reportedBy?: 'claude-agent-sdk' | 'opencode';
+    /** true when running with AGHAST_LOCAL_CLAUDE=true — amount is API-equivalent, not billed */
+    coveredBySubscription?: boolean;
+}
+/**
+ * Calculate cost for a TokenUsage value.
+ *
+ * Priority:
+ *   1. tokens.reportedCost — provider-reported amount used verbatim (source='reported').
+ *   2. Rate-table fallback — model must exist in pricing.models; includes cache and
+ *      reasoning tokens. Reasoning is billed at output rate (Decision 5).
+ *   3. Rate-table fallback but model unknown → source='estimated-unpriced', cost=$0 + warning.
+ *   4. tokens undefined → source='estimated', cost=$0.
+ */
+export declare function calculateCost(tokens: TokenUsage | undefined, model: string, pricing: PricingConfig): CostBreakdown;
+/**
+ * Sum a list of CostBreakdowns into one total. Returns zeros if list is empty.
+ * Currency is taken from the first non-empty entry (or USD by default).
+ */
+export declare function sumCosts(costs: CostBreakdown[]): CostBreakdown;
+/**
+ * Load the built-in pricing.json shipped with aghast.
+ *
+ * Behaviour:
+ *   - File missing (ENOENT): return empty pricing silently. This is expected
+ *     when running from a build that doesn't ship the file.
+ *   - File present but unreadable / invalid JSON / wrong shape: log a warning
+ *     and return empty pricing so the scan can still run. The empty pricing
+ *     means cost is reported as 0 — distinct from a corrupt pricing file
+ *     producing meaningless costs.
+ */
+export declare function loadDefaultPricing(): Promise<PricingConfig>;
+/**
+ * Merge a runtime-config override into a base pricing config.
+ * Per-model entries from the override replace those in the base. Unspecified
+ * models are inherited from the base.
+ */
+export declare function mergePricing(base: PricingConfig, override?: Partial<PricingConfig>): PricingConfig;
+/**
+ * Format a cost as a fixed-precision string with currency suffix.
+ * Used for CLI summaries.
+ */
+export declare function formatCost(cost: number, currency?: string): string;
+/**
+ * Map a CostBreakdown source (and optional reportedBy) to a human-readable
+ * label for banner / stats / JSON output.
+ */
+export declare function formatCostSourceLabel(source: CostBreakdown['source'] | undefined, reportedBy?: CostBreakdown['reportedBy'], coveredBySubscription?: boolean): string;
+//# sourceMappingURL=cost-calculator.d.ts.map

package/dist/cost-calculator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cost-calculator.d.ts","sourceRoot":"","sources":["../src/cost-calculator.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAM7C,kDAAkD;AAClD,MAAM,WAAW,YAAY;IAC3B,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,yDAAyD;AACzD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;CACtC;AAED,qDAAqD;AACrD,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,mCAAmC;IACnC,MAAM,EAAE,UAAU,GAAG,WAAW,GAAG,oBAAoB,GAAG,QAAQ,CAAC;IACnE,8DAA8D;IAC9D,UAAU,CAAC,EAAE,kBAAkB,GAAG,UAAU,CAAC;IAC7C,6FAA6F;IAC7F,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC;AAID;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,UAAU,GAAG,SAAS,EAC9B,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,aAAa,GACrB,aAAa,CA+Cf;AAED;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,aAAa,EAAE,GAAG,aAAa,CA8C9D;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,aAAa,CAAC,CA8CjE;AA4BD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,aAAa,EAAE,QAAQ,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC,GAAG,aAAa,CAMlG;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,GAAE,MAAyB,GAAG,MAAM,CAGpF;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,GAAG,SAAS,EAC3C,UAAU,CAAC,EAAE,aAAa,CAAC,YAAY,CAAC,EACxC,qBAAqB,CAAC,EAAE,OAAO,GAC9B,MAAM,CASR"}

package/dist/cost-calculator.js

@@ -0,0 +1,226 @@
+/**
+ * Cost calculator: maps token usage to estimated USD cost using per-model pricing.
+ *
+ * Pricing is loaded from `config/pricing.json` (built-in defaults) and may be
+ * overridden via the runtime config `pricing` section. Prices change over time
+ * and are not authoritative — they are estimates for budgeting/dashboarding.
+ */
+import { readFile } from 'node:fs/promises';
+import { resolve, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { logWarn } from './logging.js';
+const TAG = 'pricing';
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const DEFAULT_CURRENCY = 'USD';
+/**
+ * Calculate cost for a TokenUsage value.
+ *
+ * Priority:
+ *   1. tokens.reportedCost — provider-reported amount used verbatim (source='reported').
+ *   2. Rate-table fallback — model must exist in pricing.models; includes cache and
+ *      reasoning tokens. Reasoning is billed at output rate (Decision 5).
+ *   3. Rate-table fallback but model unknown → source='estimated-unpriced', cost=$0 + warning.
+ *   4. tokens undefined → source='estimated', cost=$0.
+ */
+export function calculateCost(tokens, model, pricing) {
+    const currency = pricing.currency ?? DEFAULT_CURRENCY;
+    if (tokens?.reportedCost !== undefined) {
+        return {
+            inputCost: 0,
+            outputCost: 0,
+            totalCost: tokens.reportedCost.amountUsd,
+            currency,
+            source: 'reported',
+            reportedBy: tokens.reportedCost.source,
+            ...(tokens.reportedCost.coveredBySubscription ? { coveredBySubscription: true } : {}),
+        };
+    }
+    if (!tokens) {
+        return { inputCost: 0, outputCost: 0, totalCost: 0, currency, source: 'estimated' };
+    }
+    const rates = pricing.models[model];
+    if (!rates) {
+        logWarn(TAG, `Model "${model}" not in pricing table; cost reported as $0`);
+        return { inputCost: 0, outputCost: 0, totalCost: 0, currency, source: 'estimated-unpriced' };
+    }
+    // Reasoning tokens billed at output rate (Decision 5).
+    const billableOutputTokens = tokens.outputTokens + (tokens.reasoningTokens ?? 0);
+    const inputCost = (tokens.inputTokens / 1_000_000) * rates.inputPerMillion;
+    const outputCost = (billableOutputTokens / 1_000_000) * rates.outputPerMillion;
+    const cacheReadCost = rates.cacheReadPerMillion !== undefined && tokens.cacheReadInputTokens !== undefined
+        ? (tokens.cacheReadInputTokens / 1_000_000) * rates.cacheReadPerMillion
+        : undefined;
+    const cacheWriteCost = rates.cacheWritePerMillion !== undefined && tokens.cacheCreationInputTokens !== undefined
+        ? (tokens.cacheCreationInputTokens / 1_000_000) * rates.cacheWritePerMillion
+        : undefined;
+    return {
+        inputCost,
+        outputCost,
+        cacheReadCost,
+        cacheWriteCost,
+        totalCost: inputCost + outputCost + (cacheReadCost ?? 0) + (cacheWriteCost ?? 0),
+        currency,
+        source: 'estimated',
+    };
+}
+/**
+ * Sum a list of CostBreakdowns into one total. Returns zeros if list is empty.
+ * Currency is taken from the first non-empty entry (or USD by default).
+ */
+export function sumCosts(costs) {
+    if (costs.length === 0) {
+        return { inputCost: 0, outputCost: 0, totalCost: 0, currency: DEFAULT_CURRENCY, source: 'estimated' };
+    }
+    let inputCost = 0;
+    let outputCost = 0;
+    let cacheReadCost = 0;
+    let cacheWriteCost = 0;
+    // totalCost must be accumulated directly from each entry rather than derived as
+    // inputCost+outputCost at the end. Two reasons:
+    //   1. For 'reported' breakdowns, calculateCost returns inputCost=0/outputCost=0
+    //      with the full amount in totalCost — deriving from the sub-fields drops it.
+    //   2. For 'estimated' breakdowns, totalCost includes cache costs (cacheReadCost,
+    //      cacheWriteCost) that are not reflected in inputCost or outputCost.
+    let totalCost = 0;
+    for (const c of costs) {
+        inputCost += c.inputCost;
+        outputCost += c.outputCost;
+        cacheReadCost += c.cacheReadCost ?? 0;
+        cacheWriteCost += c.cacheWriteCost ?? 0;
+        totalCost += c.totalCost;
+    }
+    // Pick the most authoritative source across all summands.
+    // Precedence: reported > estimated > estimated-unpriced > legacy.
+    const SOURCE_PRIORITY = {
+        reported: 3,
+        estimated: 2,
+        'estimated-unpriced': 1,
+        legacy: 0,
+    };
+    const dominant = costs.reduce((best, c) => SOURCE_PRIORITY[c.source] > SOURCE_PRIORITY[best.source] ? c : best);
+    // coveredBySubscription is true only when ALL summands are covered.
+    const allCovered = costs.every((c) => c.coveredBySubscription === true);
+    return {
+        inputCost,
+        outputCost,
+        ...(cacheReadCost > 0 ? { cacheReadCost } : {}),
+        ...(cacheWriteCost > 0 ? { cacheWriteCost } : {}),
+        totalCost,
+        currency: costs[0].currency,
+        source: dominant.source,
+        reportedBy: dominant.reportedBy,
+        ...(allCovered ? { coveredBySubscription: true } : {}),
+    };
+}
+/**
+ * Load the built-in pricing.json shipped with aghast.
+ *
+ * Behaviour:
+ *   - File missing (ENOENT): return empty pricing silently. This is expected
+ *     when running from a build that doesn't ship the file.
+ *   - File present but unreadable / invalid JSON / wrong shape: log a warning
+ *     and return empty pricing so the scan can still run. The empty pricing
+ *     means cost is reported as 0 — distinct from a corrupt pricing file
+ *     producing meaningless costs.
+ */
+export async function loadDefaultPricing() {
+    // src/cost-calculator.ts -> ../config/pricing.json
+    const pricingPath = resolve(__dirname, '..', 'config', 'pricing.json');
+    let content;
+    try {
+        content = await readFile(pricingPath, 'utf-8');
+    }
+    catch (err) {
+        if (err.code !== 'ENOENT') {
+            logWarn(TAG, `Could not read pricing file at ${pricingPath} (${err instanceof Error ? err.message : String(err)}); cost estimates will be 0.`);
+        }
+        return { currency: DEFAULT_CURRENCY, models: {} };
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(content);
+    }
+    catch (err) {
+        logWarn(TAG, `Pricing file at ${pricingPath} contains invalid JSON (${err instanceof Error ? err.message : String(err)}); cost estimates will be 0.`);
+        return { currency: DEFAULT_CURRENCY, models: {} };
+    }
+    // JSON parsed, but the shape may still be wrong (e.g., null, an array, or a
+    // bare string). Normalize defensively and report shape errors with a
+    // distinct message so the user knows it's not a JSON-syntax problem.
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        logWarn(TAG, `Pricing file at ${pricingPath} did not contain a JSON object; cost estimates will be 0.`);
+        return { currency: DEFAULT_CURRENCY, models: {} };
+    }
+    try {
+        return normalizePricing(parsed);
+    }
+    catch (err) {
+        logWarn(TAG, `Pricing file at ${pricingPath} could not be parsed as a pricing config (${err instanceof Error ? err.message : String(err)}); cost estimates will be 0.`);
+        return { currency: DEFAULT_CURRENCY, models: {} };
+    }
+}
+/**
+ * Normalize a raw object into a PricingConfig, dropping unknown keys.
+ * Tolerant of extra fields (e.g. `_comment`).
+ */
+function normalizePricing(raw) {
+    const currency = typeof raw.currency === 'string' ? raw.currency : DEFAULT_CURRENCY;
+    const models = {};
+    const rawModels = raw.models;
+    if (rawModels && typeof rawModels === 'object' && !Array.isArray(rawModels)) {
+        for (const [name, def] of Object.entries(rawModels)) {
+            if (def && typeof def === 'object' && !Array.isArray(def)) {
+                const d = def;
+                if (typeof d.inputPerMillion === 'number' && typeof d.outputPerMillion === 'number') {
+                    models[name] = {
+                        inputPerMillion: d.inputPerMillion,
+                        outputPerMillion: d.outputPerMillion,
+                        ...(typeof d.cacheReadPerMillion === 'number' ? { cacheReadPerMillion: d.cacheReadPerMillion } : {}),
+                        ...(typeof d.cacheWritePerMillion === 'number' ? { cacheWritePerMillion: d.cacheWritePerMillion } : {}),
+                    };
+                }
+            }
+        }
+    }
+    return { currency, models };
+}
+/**
+ * Merge a runtime-config override into a base pricing config.
+ * Per-model entries from the override replace those in the base. Unspecified
+ * models are inherited from the base.
+ */
+export function mergePricing(base, override) {
+    if (!override)
+        return base;
+    return {
+        currency: override.currency ?? base.currency ?? DEFAULT_CURRENCY,
+        models: { ...base.models, ...(override.models ?? {}) },
+    };
+}
+/**
+ * Format a cost as a fixed-precision string with currency suffix.
+ * Used for CLI summaries.
+ */
+export function formatCost(cost, currency = DEFAULT_CURRENCY) {
+    // 4 decimal places preserves sub-cent precision for individual checks.
+    return `${cost.toFixed(4)} ${currency}`;
+}
+/**
+ * Map a CostBreakdown source (and optional reportedBy) to a human-readable
+ * label for banner / stats / JSON output.
+ */
+export function formatCostSourceLabel(source, reportedBy, coveredBySubscription) {
+    if (source === 'reported') {
+        if (coveredBySubscription)
+            return '(covered by subscription — claude-agent-sdk)';
+        if (reportedBy === 'opencode')
+            return '(reported by opencode — see docs/cost-tracking.md)';
+        return '(reported by claude-agent-sdk)';
+    }
+    if (source === 'estimated-unpriced')
+        return '(estimated — model not in pricing table)';
+    if (source === 'legacy')
+        return '(legacy estimate)';
+    return '(estimated from config/pricing.json)';
+}
+//# sourceMappingURL=cost-calculator.js.map

package/dist/cost-calculator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cost-calculator.js","sourceRoot":"","sources":["../src/cost-calculator.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAGvC,MAAM,GAAG,GAAG,SAAS,CAAC;AAEtB,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAgC1D,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAE/B;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAC3B,MAA8B,EAC9B,KAAa,EACb,OAAsB;IAEtB,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,gBAAgB,CAAC;IAEtD,IAAI,MAAM,EAAE,YAAY,KAAK,SAAS,EAAE,CAAC;QACvC,OAAO;YACL,SAAS,EAAE,CAAC;YACZ,UAAU,EAAE,CAAC;YACb,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,SAAS;YACxC,QAAQ;YACR,MAAM,EAAE,UAAU;YAClB,UAAU,EAAE,MAAM,CAAC,YAAY,CAAC,MAAM;YACtC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtF,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACtF,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,GAAG,EAAE,UAAU,KAAK,6CAA6C,CAAC,CAAC;QAC3E,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAC/F,CAAC;IAED,uDAAuD;IACvD,MAAM,oBAAoB,GAAG,MAAM,CAAC,YAAY,GAAG,CAAC,MAAM,CAAC,eAAe,IAAI,CAAC,CAAC,CAAC;IACjF,MAAM,SAAS,GAAG,CAAC,MAAM,CAAC,WAAW,GAAG,SAAS,CAAC,GAAG,KAAK,CAAC,eAAe,CAAC;IAC3E,MAAM,UAAU,GAAG,CAAC,oBAAoB,GAAG,SAAS,CAAC,GAAG,KAAK,CAAC,gBAAgB,CAAC;IAC/E,MAAM,aAAa,GACjB,KAAK,CAAC,mBAAmB,KAAK,SAAS,IAAI,MAAM,CAAC,oBAAoB,KAAK,SAAS;QAClF,CAAC,CAAC,CAAC,MAAM,CAAC,oBAAoB,GAAG,SAAS,CAAC,GAAG,KAAK,CAAC,mBAAmB;QACvE,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,cAAc,GAClB,KAAK,CAAC,oBAAoB,KAAK,SAAS,IAAI,MAAM,CAAC,wBAAwB,KAAK,SAAS;QACvF,CAAC,CAAC,CAAC,MAAM,CAAC,wBAAwB,GAAG,SAAS,CAAC,GAAG,KAAK,CAAC,oBAAoB;QAC5E,CAAC,CAAC,SAAS,CAAC;IAEhB,OAAO;QACL,SAAS;QACT,UAAU;QACV,aAAa;QACb,cAAc;QACd,SAAS,EAAE,SAAS,GAAG,UAAU,GAAG,CAAC,aAAa,IAAI,CAAC,CAAC,GAAG,CAAC,cAAc,IAAI,CAAC,CAAC;QAChF,QAAQ;QACR,MAAM,EAAE,WAAW;KACpB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,QAAQ,CAAC,KAAsB;IAC7C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACxG,CAAC;IACD,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,cAAc,GAAG,CAAC,CAAC;IACvB,gFAAgF;IAChF,gDAAgD;IAChD,iFAAiF;IACjF,kFAAkF;IAClF,kFAAkF;IAClF,0EAA0E;IAC1E,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,SAAS,IAAI,CAAC,CAAC,SAAS,CAAC;QACzB,UAAU,IAAI,CAAC,CAAC,UAAU,CAAC;QAC3B,aAAa,IAAI,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC;QACtC,cAAc,IAAI,CAAC,CAAC,cAAc,IAAI,CAAC,CAAC;QACxC,SAAS,IAAI,CAAC,CAAC,SAAS,CAAC;IAC3B,CAAC;IACD,0DAA0D;IAC1D,kEAAkE;IAClE,MAAM,eAAe,GAA4C;QAC/D,QAAQ,EAAE,CAAC;QACX,SAAS,EAAE,CAAC;QACZ,oBAAoB,EAAE,CAAC;QACvB,MAAM,EAAE,CAAC;KACV,CAAC;IACF,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CACxC,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CACpE,CAAC;IACF,oEAAoE;IACpE,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,qBAAqB,KAAK,IAAI,CAAC,CAAC;IACxE,OAAO;QACL,SAAS;QACT,UAAU;QACV,GAAG,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,cAAc,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,SAAS;QACT,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ;QAC3B,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB;IACtC,mDAAmD;IACnD,MAAM,WAAW,GAAG,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;IACvE,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,OAAO,CACL,GAAG,EACH,kCAAkC,WAAW,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,8BAA8B,CACjI,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACpD,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CACL,GAAG,EACH,mBAAmB,WAAW,2BAA2B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,8BAA8B,CACxI,CAAC;QACF,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACpD,CAAC;IAED,4EAA4E;IAC5E,qEAAqE;IACrE,qEAAqE;IACrE,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,OAAO,CACL,GAAG,EACH,mBAAmB,WAAW,2DAA2D,CAC1F,CAAC;QACF,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACpD,CAAC;IACD,IAAI,CAAC;QACH,OAAO,gBAAgB,CAAC,MAAiC,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CACL,GAAG,EACH,mBAAmB,WAAW,6CAA6C,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,8BAA8B,CAC1J,CAAC;QACF,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACpD,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CAAC,GAA4B;IACpD,MAAM,QAAQ,GAAG,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC;IACpF,MAAM,MAAM,GAAiC,EAAE,CAAC;IAChD,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC;IAC7B,IAAI,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5E,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAoC,CAAC,EAAE,CAAC;YAC/E,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1D,MAAM,CAAC,GAAG,GAA8B,CAAC;gBACzC,IAAI,OAAO,CAAC,CAAC,eAAe,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,gBAAgB,KAAK,QAAQ,EAAE,CAAC;oBACpF,MAAM,CAAC,IAAI,CAAC,GAAG;wBACb,eAAe,EAAE,CAAC,CAAC,eAAe;wBAClC,gBAAgB,EAAE,CAAC,CAAC,gBAAgB;wBACpC,GAAG,CAAC,OAAO,CAAC,CAAC,mBAAmB,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBACpG,GAAG,CAAC,OAAO,CAAC,CAAC,oBAAoB,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,CAAC,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBACxG,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;AAC9B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,IAAmB,EAAE,QAAiC;IACjF,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,OAAO;QACL,QAAQ,EAAE,QAAQ,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,IAAI,gBAAgB;QAChE,MAAM,EAAE,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE;KACvD,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,WAAmB,gBAAgB;IAC1E,uEAAuE;IACvE,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,QAAQ,EAAE,CAAC;AAC1C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAA2C,EAC3C,UAAwC,EACxC,qBAA+B;IAE/B,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;QAC1B,IAAI,qBAAqB;YAAE,OAAO,8CAA8C,CAAC;QACjF,IAAI,UAAU,KAAK,UAAU;YAAE,OAAO,oDAAoD,CAAC;QAC3F,OAAO,gCAAgC,CAAC;IAC1C,CAAC;IACD,IAAI,MAAM,KAAK,oBAAoB;QAAE,OAAO,0CAA0C,CAAC;IACvF,IAAI,MAAM,KAAK,QAAQ;QAAE,OAAO,mBAAmB,CAAC;IACpD,OAAO,sCAAsC,CAAC;AAChD,CAAC"}

package/dist/defaults.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Central registry of scanner defaults used when a value is absent from CLI flags,
+ * environment variables, and runtime-config.json.
+ *
+ * These are surfaced to users by `aghast build-config`, and applied at runtime by
+ * the scanner. Single source of truth — do not duplicate these literals elsewhere.
+ *
+ * (Provider and model defaults live alongside their respective registries:
+ *  `DEFAULT_PROVIDER_NAME` in `provider-registry.ts`, `DEFAULT_MODEL` in `types.ts`.)
+ */
+/** Default output format for scan reports. */
+export declare const DEFAULT_OUTPUT_FORMAT = "json";
+/** Default console log level when none is specified. */
+export declare const DEFAULT_LOG_LEVEL = "info";
+/** Default log file handler type when --log-file is set without --log-type. */
+export declare const DEFAULT_LOG_TYPE = "file";
+/** Default generic prompt template filename prepended to check instructions. */
+export declare const DEFAULT_GENERIC_PROMPT = "generic-instructions.md";
+/** Default for whether the scan should exit non-zero on FAIL/ERROR results. */
+export declare const DEFAULT_FAIL_ON_CHECK_FAILURE = false;
+//# sourceMappingURL=defaults.d.ts.map

package/dist/defaults.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"defaults.d.ts","sourceRoot":"","sources":["../src/defaults.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,8CAA8C;AAC9C,eAAO,MAAM,qBAAqB,SAAS,CAAC;AAE5C,wDAAwD;AACxD,eAAO,MAAM,iBAAiB,SAAS,CAAC;AAExC,+EAA+E;AAC/E,eAAO,MAAM,gBAAgB,SAAS,CAAC;AAEvC,gFAAgF;AAChF,eAAO,MAAM,sBAAsB,4BAA4B,CAAC;AAEhE,+EAA+E;AAC/E,eAAO,MAAM,6BAA6B,QAAQ,CAAC"}

package/dist/defaults.js

@@ -0,0 +1,21 @@
+/**
+ * Central registry of scanner defaults used when a value is absent from CLI flags,
+ * environment variables, and runtime-config.json.
+ *
+ * These are surfaced to users by `aghast build-config`, and applied at runtime by
+ * the scanner. Single source of truth — do not duplicate these literals elsewhere.
+ *
+ * (Provider and model defaults live alongside their respective registries:
+ *  `DEFAULT_PROVIDER_NAME` in `provider-registry.ts`, `DEFAULT_MODEL` in `types.ts`.)
+ */
+/** Default output format for scan reports. */
+export const DEFAULT_OUTPUT_FORMAT = 'json';
+/** Default console log level when none is specified. */
+export const DEFAULT_LOG_LEVEL = 'info';
+/** Default log file handler type when --log-file is set without --log-type. */
+export const DEFAULT_LOG_TYPE = 'file';
+/** Default generic prompt template filename prepended to check instructions. */
+export const DEFAULT_GENERIC_PROMPT = 'generic-instructions.md';
+/** Default for whether the scan should exit non-zero on FAIL/ERROR results. */
+export const DEFAULT_FAIL_ON_CHECK_FAILURE = false;
+//# sourceMappingURL=defaults.js.map

package/dist/defaults.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"defaults.js","sourceRoot":"","sources":["../src/defaults.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,8CAA8C;AAC9C,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC;AAE5C,wDAAwD;AACxD,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAExC,+EAA+E;AAC/E,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAEvC,gFAAgF;AAChF,MAAM,CAAC,MAAM,sBAAsB,GAAG,yBAAyB,CAAC;AAEhE,+EAA+E;AAC/E,MAAM,CAAC,MAAM,6BAA6B,GAAG,KAAK,CAAC"}

package/dist/discoveries/openant-discovery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"openant-discovery.d.ts","sourceRoot":"","sources":["../../src/discoveries/openant-discovery.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,OAAO,KAAK,EAAE,eAAe,EAAsC,MAAM,iBAAiB,CAAC;AAK3F,eAAO,MAAM,gBAAgB,EAAE,eAuC9B,CAAC"}
+{"version":3,"file":"openant-discovery.d.ts","sourceRoot":"","sources":["../../src/discoveries/openant-discovery.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,OAAO,KAAK,EAAE,eAAe,EAAsC,MAAM,iBAAiB,CAAC;AAK3F,eAAO,MAAM,gBAAgB,EAAE,eAuC9B,CAAC"}

package/dist/discoveries/openant-discovery.js

@@ -8,10 +8,11 @@
 import { runOpenAnt } from '../openant-runner.js';
 import { loadDatasetFromFile, filterUnits, formatUnitPromptSection } from '../openant-loader.js';
 import { logProgress, logDebug } from '../logging.js';
+import { DEFAULT_GENERIC_PROMPT } from '../defaults.js';
 const TAG = 'openant-discovery';
 export const openantDiscovery = {
     name: 'openant',
-    defaultGenericPrompt: 'generic-instructions.md',
+    defaultGenericPrompt: DEFAULT_GENERIC_PROMPT,
     needsInstructions: true,
     async discover(check, repoPath, _options) {
         const checkTarget = check.checkTarget;
@@ -31,7 +32,7 @@ export const openantDiscovery = {
                     endLine: origin.end_line,
                     label: `[unit ${idx + 1}/${units.length}]`,
                     promptEnrichment: formatUnitPromptSection(unit),
-                    aiOptions: { maxTurns: 20 },
+                    agentOptions: { maxTurns: 20 },
                 };
             });
         }

package/dist/discoveries/openant-discovery.js.map

@@ -1 +1 @@
-{"version":3,"file":"openant-discovery.js","sourceRoot":"","sources":["../../src/discoveries/openant-discovery.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AACjG,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAItD,MAAM,GAAG,GAAG,mBAAmB,CAAC;AAEhC,MAAM,CAAC,MAAM,gBAAgB,GAAoB;IAC/C,IAAI,EAAE,SAAS;IACf,oBAAoB,EAAE,yBAAyB;IAC/C,iBAAiB,EAAE,IAAI;IAEvB,KAAK,CAAC,QAAQ,CACZ,KAAoB,EACpB,QAAgB,EAChB,QAA2B;QAE3B,MAAM,WAAW,GAAG,KAAK,CAAC,WAAY,CAAC;QAEvC,kCAAkC;QAClC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC;QAE5D,IAAI,CAAC;YACH,wBAAwB;YACxB,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,WAAW,CAAC,CAAC;YACvD,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;YACxC,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC;YAE9D,WAAW,CAAC,GAAG,EAAE,UAAU,UAAU,WAAW,KAAK,CAAC,MAAM,mBAAmB,CAAC,CAAC;YAEjF,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;gBAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC;gBACxC,OAAO;oBACL,IAAI,EAAE,MAAM,CAAC,SAAS;oBACtB,SAAS,EAAE,MAAM,CAAC,UAAU;oBAC5B,OAAO,EAAE,MAAM,CAAC,QAAQ;oBACxB,KAAK,EAAE,SAAS,GAAG,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG;oBAC1C,gBAAgB,EAAE,uBAAuB,CAAC,IAAI,CAAC;oBAC/C,SAAS,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;iBAC5B,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,MAAM,OAAO,EAAE,CAAC;YAChB,QAAQ,CAAC,GAAG,EAAE,qCAAqC,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;CACF,CAAC"}
+{"version":3,"file":"openant-discovery.js","sourceRoot":"","sources":["../../src/discoveries/openant-discovery.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AACjG,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAIxD,MAAM,GAAG,GAAG,mBAAmB,CAAC;AAEhC,MAAM,CAAC,MAAM,gBAAgB,GAAoB;IAC/C,IAAI,EAAE,SAAS;IACf,oBAAoB,EAAE,sBAAsB;IAC5C,iBAAiB,EAAE,IAAI;IAEvB,KAAK,CAAC,QAAQ,CACZ,KAAoB,EACpB,QAAgB,EAChB,QAA2B;QAE3B,MAAM,WAAW,GAAG,KAAK,CAAC,WAAY,CAAC;QAEvC,kCAAkC;QAClC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC;QAE5D,IAAI,CAAC;YACH,wBAAwB;YACxB,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,WAAW,CAAC,CAAC;YACvD,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;YACxC,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC;YAE9D,WAAW,CAAC,GAAG,EAAE,UAAU,UAAU,WAAW,KAAK,CAAC,MAAM,mBAAmB,CAAC,CAAC;YAEjF,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;gBAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC;gBACxC,OAAO;oBACL,IAAI,EAAE,MAAM,CAAC,SAAS;oBACtB,SAAS,EAAE,MAAM,CAAC,UAAU;oBAC5B,OAAO,EAAE,MAAM,CAAC,QAAQ;oBACxB,KAAK,EAAE,SAAS,GAAG,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG;oBAC1C,gBAAgB,EAAE,uBAAuB,CAAC,IAAI,CAAC;oBAC/C,YAAY,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;iBAC/B,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,MAAM,OAAO,EAAE,CAAC;YAChB,QAAQ,CAAC,GAAG,EAAE,qCAAqC,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;CACF,CAAC"}

package/dist/discoveries/sarif-discovery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sarif-discovery.d.ts","sourceRoot":"","sources":["../../src/discoveries/sarif-discovery.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAOH,OAAO,KAAK,EAAE,eAAe,EAAsC,MAAM,iBAAiB,CAAC;AA0B3F,eAAO,MAAM,cAAc,EAAE,eA6C5B,CAAC"}
+{"version":3,"file":"sarif-discovery.d.ts","sourceRoot":"","sources":["../../src/discoveries/sarif-discovery.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAQH,OAAO,KAAK,EAAE,eAAe,EAAsC,MAAM,iBAAiB,CAAC;AA0B3F,eAAO,MAAM,cAAc,EAAE,eA6C5B,CAAC"}

package/dist/discoveries/sarif-discovery.js

@@ -9,6 +9,7 @@ import { resolve } from 'node:path';
 import { parseSARIF, deduplicateTargets } from '../sarif-parser.js';
 import { logDebug } from '../logging.js';
 import { ERROR_CODES, formatError } from '../error-codes.js';
+import { DEFAULT_GENERIC_PROMPT } from '../defaults.js';
 const TAG = 'sarif-discovery';
 function buildFindingPromptEnrichment(file, startLine, endLine, message, snippet) {
     const snippetSection = snippet ? `\n- Code snippet from tool: ${snippet}` : '';
@@ -26,7 +27,7 @@ You MUST:
 }
 export const sarifDiscovery = {
     name: 'sarif',
-    defaultGenericPrompt: 'generic-instructions.md',
+    defaultGenericPrompt: DEFAULT_GENERIC_PROMPT,
     needsInstructions: true,
     async discover(check, repoPath, _options) {
         const checkTarget = check.checkTarget;

package/dist/discoveries/sarif-discovery.js.map

@@ -1 +1 @@
-{"version":3,"file":"sarif-discovery.js","sourceRoot":"","sources":["../../src/discoveries/sarif-discovery.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACpE,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAI7D,MAAM,GAAG,GAAG,iBAAiB,CAAC;AAE9B,SAAS,4BAA4B,CACnC,IAAY,EACZ,SAAiB,EACjB,OAAe,EACf,OAAe,EACf,OAAgB;IAEhB,MAAM,cAAc,GAAG,OAAO,CAAC,CAAC,CAAC,+BAA+B,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/E,OAAO;;UAEC,IAAI;WACH,SAAS,IAAI,OAAO;gCACC,OAAO,GAAG,cAAc;;;;;;CAMvD,CAAC;AACF,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAoB;IAC7C,IAAI,EAAE,OAAO;IACb,oBAAoB,EAAE,yBAAyB;IAC/C,iBAAiB,EAAE,IAAI;IAEvB,KAAK,CAAC,QAAQ,CACZ,KAAoB,EACpB,QAAgB,EAChB,QAA2B;QAE3B,MAAM,WAAW,GAAG,KAAK,CAAC,WAAY,CAAC;QAEvC,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CACb,WAAW,CAAC,WAAW,CAAC,KAAK,EAAE,UAAU,KAAK,CAAC,EAAE,uEAAuE,CAAC,CAC1H,CAAC;QACJ,CAAC;QAED,gDAAgD;QAChD,MAAM,aAAa,GAAG,OAAO,CAAC,QAAQ,EAAE,WAAW,CAAC,SAAS,CAAC,CAAC;QAE/D,QAAQ,CAAC,GAAG,EAAE,uBAAuB,aAAa,EAAE,CAAC,CAAC;QACtD,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QAE5D,IAAI,OAAO,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;QACvC,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAEtC,QAAQ,CAAC,GAAG,EAAE,cAAc,OAAO,CAAC,MAAM,WAAW,CAAC,CAAC;QAEvD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YACnC,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,KAAK,EAAE,YAAY,GAAG,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG;YAC/C,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,gBAAgB,EAAE,4BAA4B,CAC5C,MAAM,CAAC,IAAI,EACX,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,OAAO,CACf;SACF,CAAC,CAAC,CAAC;IACN,CAAC;CACF,CAAC"}
+{"version":3,"file":"sarif-discovery.js","sourceRoot":"","sources":["../../src/discoveries/sarif-discovery.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACpE,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAIxD,MAAM,GAAG,GAAG,iBAAiB,CAAC;AAE9B,SAAS,4BAA4B,CACnC,IAAY,EACZ,SAAiB,EACjB,OAAe,EACf,OAAe,EACf,OAAgB;IAEhB,MAAM,cAAc,GAAG,OAAO,CAAC,CAAC,CAAC,+BAA+B,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/E,OAAO;;UAEC,IAAI;WACH,SAAS,IAAI,OAAO;gCACC,OAAO,GAAG,cAAc;;;;;;CAMvD,CAAC;AACF,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAoB;IAC7C,IAAI,EAAE,OAAO;IACb,oBAAoB,EAAE,sBAAsB;IAC5C,iBAAiB,EAAE,IAAI;IAEvB,KAAK,CAAC,QAAQ,CACZ,KAAoB,EACpB,QAAgB,EAChB,QAA2B;QAE3B,MAAM,WAAW,GAAG,KAAK,CAAC,WAAY,CAAC;QAEvC,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CACb,WAAW,CAAC,WAAW,CAAC,KAAK,EAAE,UAAU,KAAK,CAAC,EAAE,uEAAuE,CAAC,CAC1H,CAAC;QACJ,CAAC;QAED,gDAAgD;QAChD,MAAM,aAAa,GAAG,OAAO,CAAC,QAAQ,EAAE,WAAW,CAAC,SAAS,CAAC,CAAC;QAE/D,QAAQ,CAAC,GAAG,EAAE,uBAAuB,aAAa,EAAE,CAAC,CAAC;QACtD,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QAE5D,IAAI,OAAO,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;QACvC,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAEtC,QAAQ,CAAC,GAAG,EAAE,cAAc,OAAO,CAAC,MAAM,WAAW,CAAC,CAAC;QAEvD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YACnC,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,KAAK,EAAE,YAAY,GAAG,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG;YAC/C,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,gBAAgB,EAAE,4BAA4B,CAC5C,MAAM,CAAC,IAAI,EACX,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,OAAO,CACf;SACF,CAAC,CAAC,CAAC;IACN,CAAC;CACF,CAAC"}

package/dist/discoveries/semgrep-discovery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"semgrep-discovery.d.ts","sourceRoot":"","sources":["../../src/discoveries/semgrep-discovery.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,KAAK,EAAE,eAAe,EAAsC,MAAM,iBAAiB,CAAC;AAoB3F,eAAO,MAAM,gBAAgB,EAAE,eAmC9B,CAAC"}
+{"version":3,"file":"semgrep-discovery.d.ts","sourceRoot":"","sources":["../../src/discoveries/semgrep-discovery.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,OAAO,KAAK,EAAE,eAAe,EAAsC,MAAM,iBAAiB,CAAC;AA4B3F,eAAO,MAAM,gBAAgB,EAAE,eAmC9B,CAAC"}

package/dist/discoveries/semgrep-discovery.js

@@ -7,6 +7,7 @@
 import { runSemgrep } from '../semgrep-runner.js';
 import { parseSARIF, deduplicateTargets } from '../sarif-parser.js';
 import { logDebug } from '../logging.js';
+import { DEFAULT_GENERIC_PROMPT } from '../defaults.js';
 const TAG = 'semgrep-discovery';
 function buildTargetPromptEnrichment(file, startLine, endLine) {
     return `\n\nTARGET LOCATION:
@@ -18,13 +19,21 @@ You are analyzing a specific code location:
 You MUST:
 - Analyze ONLY this specific target location — do not search for or report issues at other locations
 - You may read other files to understand context (e.g., imports, type definitions, data flow), but only report issues for this target
-- If the code at this location is not vulnerable, return {"issues": []}
+- If the code at this location is not vulnerable, return {"issues": []} — do not "spend" the target by reporting an issue you noticed somewhere else in the file
 - Do NOT scan the broader repository for other instances of this vulnerability pattern
+
+REPORTING RULES (strict — these prevent cross-target hallucinations):
+- Each reported issue's "file"/"startLine"/"endLine" MUST point at this target's range above, OR at a line inside a function this target directly/transitively calls. They must NOT point at a sibling location (e.g. another function, another route handler, another class) that simply happens to live in the same file. If that sibling is genuinely vulnerable, it has its own target run — leave it alone here.
+
+DESCRIPTION OPENING (mandatory output contract):
+- Your description's first heading MUST identify the entry point this target represents — its function name, route path+verb, class method, or equivalent — exactly as it appears in the source. For example: a route handler → "## Missing X in DELETE /:id"; a function → "## Missing X in processPayment".
+- The rest of the description must then describe THAT specific symbol's vulnerability — not a sibling's. If, while writing, you find yourself describing a different route/function than the one you opened with, stop: you are hallucinating across targets. Discard the issue and return {"issues": []}.
+- If you noticed a real vulnerability while reading the file but it is in a sibling location, do NOT smuggle it into this target's report. That sibling has its own target run.
 `;
 }
 export const semgrepDiscovery = {
     name: 'semgrep',
-    defaultGenericPrompt: 'generic-instructions.md',
+    defaultGenericPrompt: DEFAULT_GENERIC_PROMPT,
     needsInstructions: true,
     async discover(check, repoPath, _options) {
         const checkTarget = check.checkTarget;

package/dist/discoveries/semgrep-discovery.js.map

@@ -1 +1 @@
-{"version":3,"file":"semgrep-discovery.js","sourceRoot":"","sources":["../../src/discoveries/semgrep-discovery.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACpE,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAIzC,MAAM,GAAG,GAAG,mBAAmB,CAAC;AAEhC,SAAS,2BAA2B,CAAC,IAAY,EAAE,SAAiB,EAAE,OAAe;IACnF,OAAO;;;UAGC,IAAI;WACH,SAAS,IAAI,OAAO;;;;;;;CAO9B,CAAC;AACF,CAAC;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAoB;IAC/C,IAAI,EAAE,SAAS;IACf,oBAAoB,EAAE,yBAAyB;IAC/C,iBAAiB,EAAE,IAAI;IAEvB,KAAK,CAAC,QAAQ,CACZ,KAAoB,EACpB,QAAgB,EAChB,QAA2B;QAE3B,MAAM,WAAW,GAAG,KAAK,CAAC,WAAY,CAAC;QAEvC,QAAQ,CAAC,GAAG,EAAE,8BAA8B,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;QAExD,MAAM,YAAY,GAAG,MAAM,UAAU,CAAC;YACpC,cAAc,EAAE,QAAQ;YACxB,KAAK,EAAE,WAAW,CAAC,KAAK;YACxB,MAAM,EAAE,WAAW,CAAC,MAAM;SAC3B,CAAC,CAAC;QAEH,IAAI,OAAO,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;QACvC,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAEtC,QAAQ,CAAC,GAAG,EAAE,cAAc,OAAO,CAAC,MAAM,UAAU,CAAC,CAAC;QAEtD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YACnC,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,KAAK,EAAE,WAAW,GAAG,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG;YAC9C,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,gBAAgB,EAAE,2BAA2B,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC;SAC7F,CAAC,CAAC,CAAC;IACN,CAAC;CACF,CAAC"}
+{"version":3,"file":"semgrep-discovery.js","sourceRoot":"","sources":["../../src/discoveries/semgrep-discovery.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACpE,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAIxD,MAAM,GAAG,GAAG,mBAAmB,CAAC;AAEhC,SAAS,2BAA2B,CAAC,IAAY,EAAE,SAAiB,EAAE,OAAe;IACnF,OAAO;;;UAGC,IAAI;WACH,SAAS,IAAI,OAAO;;;;;;;;;;;;;;;CAe9B,CAAC;AACF,CAAC;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAoB;IAC/C,IAAI,EAAE,SAAS;IACf,oBAAoB,EAAE,sBAAsB;IAC5C,iBAAiB,EAAE,IAAI;IAEvB,KAAK,CAAC,QAAQ,CACZ,KAAoB,EACpB,QAAgB,EAChB,QAA2B;QAE3B,MAAM,WAAW,GAAG,KAAK,CAAC,WAAY,CAAC;QAEvC,QAAQ,CAAC,GAAG,EAAE,8BAA8B,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;QAExD,MAAM,YAAY,GAAG,MAAM,UAAU,CAAC;YACpC,cAAc,EAAE,QAAQ;YACxB,KAAK,EAAE,WAAW,CAAC,KAAK;YACxB,MAAM,EAAE,WAAW,CAAC,MAAM;SAC3B,CAAC,CAAC;QAEH,IAAI,OAAO,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;QACvC,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAEtC,QAAQ,CAAC,GAAG,EAAE,cAAc,OAAO,CAAC,MAAM,UAAU,CAAC,CAAC;QAEtD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YACnC,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,KAAK,EAAE,WAAW,GAAG,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG;YAC9C,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,gBAAgB,EAAE,2BAA2B,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC;SAC7F,CAAC,CAAC,CAAC;IACN,CAAC;CACF,CAAC"}

package/dist/discovery.d.ts

@@ -21,8 +21,8 @@ export interface DiscoveredTarget {
     label: string;
     /** Extra context appended to prompt per target (e.g. call graph for openant, finding details for sarif). */
     promptEnrichment?: string;
-    /** Discovery-specific AI provider options (e.g. maxTurns for openant). */
-    aiOptions?: {
+    /** Discovery-specific agent provider options (e.g. maxTurns for openant). */
+    agentOptions?: {
         maxTurns?: number;
     };
     /** Message from the discovery tool (e.g. Semgrep finding description). */
@@ -71,4 +71,10 @@ export declare function getRegisteredDiscoveries(): string[];
  * Clear all registered discoveries. For testing only.
  */
 export declare function clearDiscoveryRegistry(): void;
+/**
+ * Remove a single discovery by name. Returns true if the entry existed.
+ * Intended for tests that want to register a one-off discovery and clean
+ * it up without disturbing the standard registrations.
+ */
+export declare function unregisterDiscovery(name: string): boolean;
 //# sourceMappingURL=discovery.d.ts.map

package/dist/discovery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"discovery.d.ts","sourceRoot":"","sources":["../src/discovery.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAKhD;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,iDAAiD;IACjD,IAAI,EAAE,MAAM,CAAC;IACb,mCAAmC;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,iCAAiC;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,wDAAwD;IACxD,KAAK,EAAE,MAAM,CAAC;IACd,4GAA4G;IAC5G,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,0EAA0E;IAC1E,SAAS,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAClC,0EAA0E;IAC1E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mEAAmE;IACnE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAID;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,qCAAqC;IACrC,cAAc,EAAE,MAAM,CAAC;CACxB;AAID;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,qEAAqE;IACrE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,wEAAwE;IACxE,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC;;;OAGG;IACH,QAAQ,CACN,KAAK,EAAE,aAAa,EACpB,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;CAChC;AAMD;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,eAAe,GAAG,IAAI,CAElE;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,CAS1D;AAED;;GAEG;AACH,wBAAgB,wBAAwB,IAAI,MAAM,EAAE,CAEnD;AAED;;GAEG;AACH,wBAAgB,sBAAsB,IAAI,IAAI,CAE7C"}
+{"version":3,"file":"discovery.d.ts","sourceRoot":"","sources":["../src/discovery.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAKhD;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,iDAAiD;IACjD,IAAI,EAAE,MAAM,CAAC;IACb,mCAAmC;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,iCAAiC;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,wDAAwD;IACxD,KAAK,EAAE,MAAM,CAAC;IACd,4GAA4G;IAC5G,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,6EAA6E;IAC7E,YAAY,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACrC,0EAA0E;IAC1E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mEAAmE;IACnE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAID;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,qCAAqC;IACrC,cAAc,EAAE,MAAM,CAAC;CACxB;AAID;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,qEAAqE;IACrE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,wEAAwE;IACxE,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC;;;OAGG;IACH,QAAQ,CACN,KAAK,EAAE,aAAa,EACpB,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;CAChC;AAMD;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,eAAe,GAAG,IAAI,CAElE;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,CAS1D;AAED;;GAEG;AACH,wBAAgB,wBAAwB,IAAI,MAAM,EAAE,CAEnD;AAED;;GAEG;AACH,wBAAgB,sBAAsB,IAAI,IAAI,CAE7C;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEzD"}

package/dist/discovery.js

@@ -38,4 +38,12 @@ export function getRegisteredDiscoveries() {
 export function clearDiscoveryRegistry() {
     discoveryRegistry.clear();
 }
+/**
+ * Remove a single discovery by name. Returns true if the entry existed.
+ * Intended for tests that want to register a one-off discovery and clean
+ * it up without disturbing the standard registrations.
+ */
+export function unregisterDiscovery(name) {
+    return discoveryRegistry.delete(name);
+}
 //# sourceMappingURL=discovery.js.map