@delegance/claude-autopilot 2.4.0 → 5.0.0-alpha.1

package/src/core/static-rules/rules/hardcoded-secrets.ts

@@ -3,7 +3,33 @@ import type { StaticRule } from '../../phases/static-rules.ts';
 import type { Finding } from '../../findings/types.ts';
 
 const SECRET_PATTERNS: { regex: RegExp; label: string }[] = [
+  // Cloud provider keys
   { regex: /\bAKIA[0-9A-Z]{16}\b/, label: 'AWS Access Key ID' },
+  { regex: /\b(?:aws|AWS)_?(?:secret|SECRET)_?(?:key|KEY|access|ACCESS)\s*[:=]\s*['"][A-Za-z0-9/+]{40}['"]/, label: 'AWS Secret Access Key' },
+
+  // LLM / AI providers
+  { regex: /\bsk-ant-[a-zA-Z0-9\-_]{20,}\b/, label: 'Anthropic API key' },
+  { regex: /\bsk-[a-zA-Z0-9]{20,}\b(?!.*placeholder)/, label: 'OpenAI API key' },
+  { regex: /\bgsk_[a-zA-Z0-9]{20,}\b/, label: 'Groq API key' },
+
+  // Payment
+  { regex: /\bsk_live_[a-zA-Z0-9]{24,}\b/, label: 'Stripe secret key (live)' },
+  { regex: /\brk_live_[a-zA-Z0-9]{24,}\b/, label: 'Stripe restricted key (live)' },
+
+  // Source control / CI
+  { regex: /\bghp_[a-zA-Z0-9]{36}\b/, label: 'GitHub personal access token' },
+  { regex: /\bghs_[a-zA-Z0-9]{36}\b/, label: 'GitHub Actions token' },
+  { regex: /\bgithub_pat_[a-zA-Z0-9_]{82}\b/, label: 'GitHub fine-grained PAT' },
+
+  // Communication
+  { regex: /\bSG\.[a-zA-Z0-9\-_]{22,}\.[a-zA-Z0-9\-_]{43,}\b/, label: 'SendGrid API key' },
+  { regex: /\bAC[a-f0-9]{32}\b/, label: 'Twilio Account SID' },
+
+  // Database / BaaS
+  { regex: /\bservice_role\b.*\beyJ[a-zA-Z0-9._-]{100,}\b/, label: 'Supabase service role JWT' },
+  { regex: /\beyJ[a-zA-Z0-9._-]{150,}\b/, label: 'Long JWT (possible service key)' },
+
+  // Generic patterns
   { regex: /(?:^|[^a-z])(?:password|passwd|pwd)\s*[:=]\s*['"](?!\/)[^'"]{6,}['"]/, label: 'Hardcoded password' },
   { regex: /(?:api_key|apikey|api-key)\s*[:=]\s*['"][^'"]{8,}['"]/, label: 'Hardcoded API key' },
   { regex: /(?:secret|secret_key|secretkey)\s*[:=]\s*['"][^'"]{8,}['"]/, label: 'Hardcoded secret' },
@@ -13,7 +39,7 @@ const SECRET_PATTERNS: { regex: RegExp; label: string }[] = [
 ];
 
 // Patterns that indicate a placeholder, not a real secret
-const PLACEHOLDER = /(?:your[-_]?|xxx|placeholder|example|test|fake|dummy|changeme|<[^>]+>)/i;
+const PLACEHOLDER = /(?:your[-_]?|xxx|placeholder|example|test|fake|dummy|changeme|<[^>]+>|process\.env|import\.meta\.env|\$\{)/i;
 const SKIP_EXTS = new Set(['.md', '.txt', '.yaml', '.yml', '.json', '.lock', '.snap']);
 const TEST_PATH = /(?:__tests__|\.test\.|\.spec\.|\/test\/|\/tests\/)/;
 

package/src/core/static-rules/rules/insecure-redirect.ts

@@ -0,0 +1,67 @@
+import * as fs from 'node:fs';
+import type { StaticRule } from '../../phases/static-rules.ts';
+import type { Finding } from '../../findings/types.ts';
+
+// Redirect calls in Next.js / Express / Node
+const REDIRECT_CALL = /(?:\bredirect\s*\(|NextResponse\.redirect\s*\(|res\.redirect\s*\(|router\.push\s*\()/;
+
+// User-controlled input sources
+const USER_INPUT_SOURCES = /(?:req\.|request\.|params\.|query\.|body\.|searchParams\.|headers\.|getParam|getQuery|getSearchParam)/;
+
+// Template interpolation of user input into redirect target
+const TAINTED_REDIRECT_TEMPLATE = /`[^`]*\$\{[^}]*(?:url|redirect|return|next|callback|target|to|from|path|href|location)[^}]*\}`/i;
+const TAINTED_REDIRECT_VAR       = /(?:url|redirect|returnUrl|returnTo|next|callbackUrl|target|to|from|path|href|location)\b/;
+
+const CODE_EXTS = new Set(['.ts', '.tsx', '.js', '.jsx', '.mts', '.cts', '.mjs', '.cjs']);
+const TEST_PATH = /(?:__tests__|\.test\.|\.spec\.|\/test\/|\/tests\/)/;
+
+export const insecureRedirectRule: StaticRule = {
+  name: 'insecure-redirect',
+  severity: 'warning',
+
+  async check(touchedFiles: string[]): Promise<Finding[]> {
+    const findings: Finding[] = [];
+    for (const file of touchedFiles) {
+      const ext = file.slice(file.lastIndexOf('.'));
+      if (!CODE_EXTS.has(ext) || TEST_PATH.test(file)) continue;
+      let content: string;
+      try { content = fs.readFileSync(file, 'utf8'); } catch { continue; }
+      const lines = content.split('\n');
+
+      for (let i = 0; i < lines.length; i++) {
+        const line = lines[i]!;
+        if (line.trim().startsWith('//') || line.trim().startsWith('*')) continue;
+
+        if (!REDIRECT_CALL.test(line)) continue;
+
+        // Check if the redirect target is user-controlled
+        const hasTaint = TAINTED_REDIRECT_TEMPLATE.test(line) || USER_INPUT_SOURCES.test(line);
+        if (!hasTaint) {
+          // Check if a variable with a suspicious name is passed
+          const argStr = line.replace(REDIRECT_CALL, '');
+          const hasRedirectVar = TAINTED_REDIRECT_VAR.test(line) && !/['"`]/.test(argStr);
+          if (!hasRedirectVar) continue;
+        }
+
+        // Skip if there's obvious validation nearby (startsWith, URL constructor, allowlist)
+        const context = lines.slice(Math.max(0, i - 5), i + 1).join('\n');
+        const hasValidation = /(?:startsWith\s*\(\s*['"]\/|new\s+URL|allowedRedirects|trustedOrigins|encodeURIComponent)/.test(context);
+        if (hasValidation) continue;
+
+        findings.push({
+          id: `insecure-redirect:${file}:${i + 1}`,
+          source: 'static-rules',
+          severity: 'warning',
+          category: 'insecure-redirect',
+          file,
+          line: i + 1,
+          message: 'Possible open redirect: redirect target may be user-controlled',
+          suggestion: 'Validate redirect targets — allow only relative paths (startsWith("/")) or an explicit allowlist of trusted origins',
+          protectedPath: false,
+          createdAt: new Date().toISOString(),
+        });
+      }
+    }
+    return findings;
+  },
+};

package/src/core/static-rules/rules/missing-auth.ts

@@ -0,0 +1,70 @@
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import type { StaticRule } from '../../phases/static-rules.ts';
+import type { Finding } from '../../findings/types.ts';
+
+// Next.js App Router API routes and pages with data mutations
+const API_ROUTE_PATTERN = /(?:app[/\\]api[/\\].*route\.[tj]sx?|pages[/\\]api[/\\].*\.[tj]sx?)$/;
+
+// Auth function signatures — any of these indicate auth is checked
+const AUTH_PATTERNS = [
+  /getServerSession\s*\(/,
+  /\bauth\s*\(\s*\)/,           // next-auth v5 auth()
+  /createServerSupabase\s*\(/,
+  /createServerClient\s*\(/,
+  /getSession\s*\(/,
+  /verifyToken\s*\(/,
+  /authenticate\s*\(/,
+  /requireAuth\s*\(/,
+  /currentUser\s*\(/,
+  /withAuth\s*\(/,
+  /checkAuth\s*\(/,
+  /isAuthenticated\s*\(/,
+  /useServerSession\s*\(/,
+  /jwtVerify\s*\(/,
+  /verify\s*\(.*token/i,
+  /clerkClient/,
+  /getAuth\s*\(/,               // Clerk
+  /session\s*\.\s*user/,
+  /req\s*\.\s*user\b/,
+];
+
+// Mutation handler exports — GET-only routes are less critical
+const MUTATION_EXPORT = /export\s+(?:async\s+)?function\s+(?:POST|PUT|PATCH|DELETE)\b/;
+const MUTATION_HANDLER = /(?:POST|PUT|PATCH|DELETE)\s*\(/;
+
+export const missingAuthRule: StaticRule = {
+  name: 'missing-auth',
+  severity: 'critical',
+
+  async check(touchedFiles: string[]): Promise<Finding[]> {
+    const findings: Finding[] = [];
+    for (const file of touchedFiles) {
+      if (!API_ROUTE_PATTERN.test(file)) continue;
+      let content: string;
+      try { content = fs.readFileSync(file, 'utf8'); } catch { continue; }
+
+      // Only flag mutation handlers
+      if (!MUTATION_EXPORT.test(content) && !MUTATION_HANDLER.test(content)) continue;
+
+      // Check if any auth pattern is present in the file
+      const hasAuth = AUTH_PATTERNS.some(p => p.test(content));
+      if (hasAuth) continue;
+
+      const rel = path.basename(file);
+      findings.push({
+        id: `missing-auth:${file}:1`,
+        source: 'static-rules',
+        severity: 'critical',
+        category: 'missing-auth',
+        file,
+        line: 1,
+        message: `API route ${rel} has mutation handlers (POST/PUT/PATCH/DELETE) with no visible auth check`,
+        suggestion: 'Add authentication: call getServerSession(), auth(), or equivalent before processing the request body',
+        protectedPath: false,
+        createdAt: new Date().toISOString(),
+      });
+    }
+    return findings;
+  },
+};

package/src/core/static-rules/rules/schema-alignment.ts

@@ -0,0 +1,132 @@
+// src/core/static-rules/rules/schema-alignment.ts
+import type { StaticRule } from '../../phases/static-rules.ts';
+import type { Finding } from '../../findings/types.ts';
+import type { SchemaAlignmentConfig, LayerScanResult, AlignmentFinding, Evidence, SchemaEntity } from '../../schema-alignment/types.ts';
+import type { ReviewEngine } from '../../../adapters/review-engine/types.ts';
+import { detect } from '../../schema-alignment/detector.ts';
+import { extract } from '../../schema-alignment/extractor/index.ts';
+import { scanLayers } from '../../schema-alignment/scanner.ts';
+import { runLlmCheck } from '../../schema-alignment/llm-check.ts';
+
+function isDestructive(entity: { operation: string }): boolean {
+  return entity.operation === 'drop_column' || entity.operation === 'rename_column';
+}
+
+function toFinding(af: AlignmentFinding, fallbackFile: string): Finding {
+  return {
+    id: `schema-alignment:${af.entity.table}:${af.entity.column ?? ''}:${af.layer}`,
+    source: 'static-rules',
+    severity: af.severity === 'error' ? 'critical' : 'warning',
+    category: 'schema-alignment',
+    // LLM may supply an explicit `file`; otherwise fall back to the migration
+    // file that triggered the check. Never use the table name as a path.
+    file: af.file ?? fallbackFile,
+    message: af.message,
+    suggestion: `Update the ${af.layer} layer to reflect the schema change in "${af.entity.column ?? af.entity.table}"`,
+    protectedPath: false,
+    createdAt: new Date().toISOString(),
+  };
+}
+
+function layerEvidence(result: LayerScanResult, layer: 'type' | 'api' | 'ui'): Evidence | null {
+  return layer === 'type' ? result.typeLayer : layer === 'api' ? result.apiLayer : result.uiLayer;
+}
+
+function structuralFinding(
+  result: LayerScanResult,
+  layer: 'type' | 'api' | 'ui',
+  defaultSev: 'warning' | 'error',
+  sourceFile: string,
+): Finding {
+  const destructive = isDestructive(result.entity);
+  const name = result.entity.column ?? result.entity.table;
+  const message = destructive
+    ? `Stale reference to dropped/renamed "${name}" still present in ${layer} layer after schema change`
+    : `No reference to "${name}" found in ${layer} layer — update may be missing after schema change`;
+  const severity: Finding['severity'] = destructive ? 'critical' : (defaultSev === 'error' ? 'critical' : 'warning');
+  // Destructive findings have Evidence (the stale reference's actual file);
+  // non-destructive findings don't have a layer file (that's the gap), so point
+  // back to the migration that caused the change.
+  const evidence = destructive ? layerEvidence(result, layer) : null;
+  return {
+    id: `schema-alignment:${result.entity.table}:${result.entity.column ?? ''}:${layer}`,
+    source: 'static-rules',
+    severity,
+    category: 'schema-alignment',
+    file: evidence?.file ?? sourceFile,
+    line: evidence?.line,
+    message,
+    suggestion: `Check the ${layer} layer for references to "${name}"`,
+    protectedPath: false,
+    createdAt: new Date().toISOString(),
+  };
+}
+
+export const schemaAlignmentRule: StaticRule = {
+  name: 'schema-alignment',
+  severity: 'warning',
+
+  async check(touchedFiles: string[], config: Record<string, unknown> = {}): Promise<Finding[]> {
+    const saConfig = config['schema-alignment'] as SchemaAlignmentConfig | undefined;
+    if (saConfig?.enabled === false) return [];
+
+    const cwd = process.cwd();
+    const migrationFiles = detect(touchedFiles, saConfig);
+    if (migrationFiles.length === 0) return [];
+
+    // Preserve source migration file for each entity so findings can point back
+    // to the SQL/Prisma file that caused the change.
+    type EntityWithSource = { entity: SchemaEntity; sourceFile: string };
+    const allEntities: EntityWithSource[] = migrationFiles.flatMap(f =>
+      extract(f).map(entity => ({ entity, sourceFile: f })),
+    );
+    if (allEntities.length === 0) return [];
+
+    const scanResults = scanLayers(allEntities.map(e => e.entity), cwd, saConfig);
+    // Index source files back onto scan results (scanLayers preserves order)
+    const resultsWithSource = scanResults.map((r, i) => ({ result: r, sourceFile: allEntities[i]!.sourceFile }));
+
+    // For destructive ops: gap = evidence WAS found (stale ref remains)
+    // For add/create: gap = evidence NOT found (layer not updated)
+    const gapResults = resultsWithSource.filter(({ result: r }) => {
+      if (isDestructive(r.entity)) return r.typeLayer !== null || r.apiLayer !== null || r.uiLayer !== null;
+      return r.typeLayer === null || r.apiLayer === null || r.uiLayer === null;
+    });
+
+    if (gapResults.length === 0) return [];
+
+    const defaultSev = saConfig?.severity ?? 'warning';
+    const llmEnabled = saConfig?.llmCheck !== false;
+    const engine = config['_engine'] as ReviewEngine | undefined;
+
+    // Structural mode — always compute these so we can fall back if LLM path yields nothing
+    const structural: Finding[] = [];
+    for (const { result: r, sourceFile } of gapResults) {
+      if (isDestructive(r.entity)) {
+        if (r.typeLayer) structural.push(structuralFinding(r, 'type', defaultSev, sourceFile));
+        if (r.apiLayer) structural.push(structuralFinding(r, 'api', defaultSev, sourceFile));
+        if (r.uiLayer) structural.push(structuralFinding(r, 'ui', defaultSev, sourceFile));
+      } else {
+        if (!r.typeLayer) structural.push(structuralFinding(r, 'type', defaultSev, sourceFile));
+        if (!r.apiLayer) structural.push(structuralFinding(r, 'api', defaultSev, sourceFile));
+        if (!r.uiLayer) structural.push(structuralFinding(r, 'ui', defaultSev, sourceFile));
+      }
+    }
+
+    if (llmEnabled && engine) {
+      const llmFindings = await runLlmCheck(migrationFiles, gapResults.map(g => g.result), engine);
+      // Fall back to structural findings if the LLM returned nothing parseable —
+      // avoids silently dropping real gaps when the model is down or returns prose.
+      if (llmFindings.length > 0) {
+        // Build table → sourceFile index so each LLM finding can be attributed
+        // back to its originating migration when the model didn't return a file.
+        const tableToSource = new Map<string, string>();
+        for (const { entity, sourceFile } of allEntities) tableToSource.set(entity.table, sourceFile);
+        return llmFindings.map(af => toFinding(af, tableToSource.get(af.entity.table) ?? migrationFiles[0]!));
+      }
+      return structural;
+    }
+
+    return structural;
+  },
+};

package/src/core/static-rules/rules/sql-injection.ts

@@ -0,0 +1,71 @@
+import * as fs from 'node:fs';
+import type { StaticRule } from '../../phases/static-rules.ts';
+import type { Finding } from '../../findings/types.ts';
+
+// String interpolation or concatenation inside a SQL-like string
+const SQL_KEYWORDS = /\b(?:SELECT|INSERT|UPDATE|DELETE|FROM|WHERE|JOIN|INTO|VALUES|SET|DROP|CREATE|ALTER|TRUNCATE|EXEC|EXECUTE)\b/i;
+
+// Template literal or concatenation patterns with SQL
+const TEMPLATE_SQL = /`[^`]*\$\{[^}]+\}[^`]*`/;
+const CONCAT_SQL   = /(?:["'][^"']*["']\s*\+\s*\w|[\w)\]]\s*\+\s*["'][^"']*["'])/;
+
+// Common DB call patterns that accept raw SQL strings
+const DB_CALL = /(?:\.query|\.execute|\.exec|\.run|\.prepare|db\.|pool\.|connection\.|knex\.|sequelize\.query|prisma\.\$queryRaw|drizzle\.execute)\s*\(/;
+
+const CODE_EXTS = new Set(['.ts', '.tsx', '.js', '.jsx', '.mts', '.cts', '.mjs', '.cjs']);
+const TEST_PATH = /(?:__tests__|\.test\.|\.spec\.|\/test\/|\/tests\/)/;
+
+export const sqlInjectionRule: StaticRule = {
+  name: 'sql-injection',
+  severity: 'critical',
+
+  async check(touchedFiles: string[]): Promise<Finding[]> {
+    const findings: Finding[] = [];
+    for (const file of touchedFiles) {
+      const ext = file.slice(file.lastIndexOf('.'));
+      if (!CODE_EXTS.has(ext) || TEST_PATH.test(file)) continue;
+      let content: string;
+      try { content = fs.readFileSync(file, 'utf8'); } catch { continue; }
+      const lines = content.split('\n');
+
+      for (let i = 0; i < lines.length; i++) {
+        const line = lines[i]!;
+        if (line.trim().startsWith('//') || line.trim().startsWith('*')) continue;
+
+        // Look for template literals or concatenation containing SQL keywords
+        const hasSql = SQL_KEYWORDS.test(line);
+        const hasInterpolation = TEMPLATE_SQL.test(line) || CONCAT_SQL.test(line);
+        const isDbCall = DB_CALL.test(line) || (i > 0 && DB_CALL.test(lines[i - 1]!));
+
+        if (hasSql && hasInterpolation) {
+          findings.push({
+            id: `sql-injection:${file}:${i + 1}`,
+            source: 'static-rules',
+            severity: 'critical',
+            category: 'sql-injection',
+            file,
+            line: i + 1,
+            message: 'Possible SQL injection: user input appears interpolated into SQL string',
+            suggestion: 'Use parameterized queries (e.g. db.query("... WHERE id = $1", [id])) or a query builder',
+            protectedPath: false,
+            createdAt: new Date().toISOString(),
+          });
+        } else if (isDbCall && hasInterpolation) {
+          findings.push({
+            id: `sql-injection:${file}:${i + 1}`,
+            source: 'static-rules',
+            severity: 'critical',
+            category: 'sql-injection',
+            file,
+            line: i + 1,
+            message: 'Possible SQL injection: dynamic string passed to DB query method',
+            suggestion: 'Use parameterized queries or a typed query builder instead of string concatenation',
+            protectedPath: false,
+            createdAt: new Date().toISOString(),
+          });
+        }
+      }
+    }
+    return findings;
+  },
+};

package/src/core/static-rules/rules/ssrf.ts

@@ -0,0 +1,63 @@
+import * as fs from 'node:fs';
+import type { StaticRule } from '../../phases/static-rules.ts';
+import type { Finding } from '../../findings/types.ts';
+
+// HTTP client calls
+const HTTP_CALL = /\b(?:fetch|axios\.get|axios\.post|axios\.put|axios\.delete|axios\.request|axios\s*\(|http\.get|https\.get|http\.request|https\.request|got\s*\(|needle\.get|superagent\.get|request\s*\()\s*\(/;
+
+// User-controlled input sources
+const USER_INPUT = /(?:req\.|request\.|params\.|query\.|body\.|searchParams\.|headers\.|url\b|getParam|getQuery|getHeader)/;
+
+// Template literal or concatenation with a user-controlled value followed by URL context
+const TAINTED_URL_TEMPLATE = /`[^`]*\$\{[^}]*(?:req|params|query|body|url|host|origin|domain|endpoint|target)[^}]*\}[^`]*`/i;
+const TAINTED_URL_CONCAT   = /(?:req|params|query|body|url|host|origin|domain|endpoint|target)\s*[+]/i;
+
+const CODE_EXTS = new Set(['.ts', '.tsx', '.js', '.jsx', '.mts', '.cts', '.mjs', '.cjs']);
+const TEST_PATH = /(?:__tests__|\.test\.|\.spec\.|\/test\/|\/tests\/)/;
+
+export const ssrfRule: StaticRule = {
+  name: 'ssrf',
+  severity: 'critical',
+
+  async check(touchedFiles: string[]): Promise<Finding[]> {
+    const findings: Finding[] = [];
+    for (const file of touchedFiles) {
+      const ext = file.slice(file.lastIndexOf('.'));
+      if (!CODE_EXTS.has(ext) || TEST_PATH.test(file)) continue;
+      let content: string;
+      try { content = fs.readFileSync(file, 'utf8'); } catch { continue; }
+      const lines = content.split('\n');
+
+      for (let i = 0; i < lines.length; i++) {
+        const line = lines[i]!;
+        if (line.trim().startsWith('//') || line.trim().startsWith('*')) continue;
+
+        const isHttpCall = HTTP_CALL.test(line);
+        if (!isHttpCall) continue;
+
+        // Check if the argument contains user-controlled input
+        const hasTaint = TAINTED_URL_TEMPLATE.test(line) || TAINTED_URL_CONCAT.test(line) || USER_INPUT.test(line);
+        if (!hasTaint) continue;
+
+        // Skip if there's obvious URL validation on nearby lines (allowlist, startsWith, etc.)
+        const context = lines.slice(Math.max(0, i - 3), i + 1).join('\n');
+        const hasValidation = /(?:allowlist|allowedOrigins|trustedDomains|startsWith|includes\s*\(\s*['"]https:\/\/|new\s+URL\s*\()/.test(context);
+        if (hasValidation) continue;
+
+        findings.push({
+          id: `ssrf:${file}:${i + 1}`,
+          source: 'static-rules',
+          severity: 'critical',
+          category: 'ssrf',
+          file,
+          line: i + 1,
+          message: 'Possible SSRF: HTTP request URL appears to be derived from user input',
+          suggestion: 'Validate the URL against an allowlist of trusted domains before making the request',
+          protectedPath: false,
+          createdAt: new Date().toISOString(),
+        });
+      }
+    }
+    return findings;
+  },
+};

package/src/core/static-rules/tailwind-extractor.ts

@@ -0,0 +1,38 @@
+import * as fs from 'node:fs';
+
+const HEX_COLOR = /#([0-9a-fA-F]{6}|[0-9a-fA-F]{3})\b/g;
+
+/**
+ * Extract canonical hex color values from a Tailwind config file.
+ * Uses regex extraction — reads theme.colors and theme.extend.colors values.
+ * Returns normalized lowercase hex strings, deduplicated.
+ */
+export function extractTailwindColors(configPath: string): string[] {
+  if (!fs.existsSync(configPath)) return [];
+  let content: string;
+  try {
+    content = fs.readFileSync(configPath, 'utf8');
+  } catch {
+    return [];
+  }
+
+  // Narrow to theme block to avoid false matches outside theme config
+  const themeMatch = content.match(/theme\s*[=:]\s*\{([\s\S]*)/);
+  const searchContent = themeMatch ? themeMatch[0] : content;
+
+  const colors = new Set<string>();
+  HEX_COLOR.lastIndex = 0;
+  let m: RegExpExecArray | null;
+  while ((m = HEX_COLOR.exec(searchContent)) !== null) {
+    const raw = m[0]!.toLowerCase();
+    // Expand 3-digit shorthand to 6-digit
+    if (raw.length === 4) {
+      const r = raw[1]!, g = raw[2]!, b = raw[3]!;
+      colors.add(`#${r}${r}${g}${g}${b}${b}`);
+    } else {
+      colors.add(raw);
+    }
+  }
+
+  return [...colors];
+}

package/src/core/test-gen/coverage-analyzer.ts

@@ -0,0 +1,93 @@
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+export interface CoverageGap {
+  file: string;          // absolute path of source file
+  exports: string[];     // names of uncovered exports
+  testFile: string;      // where the test should go (may not exist yet)
+}
+
+// Matches: export function foo, export const foo, export class Foo, export async function foo
+const EXPORT_RE = /^\s*export\s+(?:async\s+)?(?:function|const|class|let|var)\s+(\w+)/gm;
+// Matches: export default
+const DEFAULT_EXPORT_RE = /^\s*export\s+default\s+(?:function|class|\w)/;
+
+const TEST_EXTS = new Set(['.test.ts', '.test.tsx', '.test.js', '.spec.ts', '.spec.tsx', '.spec.js']);
+const SOURCE_EXTS = new Set(['.ts', '.tsx', '.js', '.jsx']);
+
+function isTestFile(filePath: string): boolean {
+  const base = path.basename(filePath);
+  return TEST_EXTS.has(path.extname(filePath))
+    || base.includes('.test.')
+    || base.includes('.spec.')
+    || filePath.includes('__tests__')
+    || filePath.includes('/tests/');
+}
+
+function candidateTestPaths(sourceFile: string): string[] {
+  const dir = path.dirname(sourceFile);
+  const base = path.basename(sourceFile, path.extname(sourceFile));
+  const ext = path.extname(sourceFile);
+  return [
+    path.join(dir, `${base}.test${ext}`),
+    path.join(dir, `${base}.test.ts`),
+    path.join(dir, '__tests__', `${base}.test${ext}`),
+    path.join(dir, '__tests__', `${base}.test.ts`),
+    path.join(path.dirname(dir), 'tests', path.basename(dir), `${base}.test.ts`),
+  ];
+}
+
+function extractExports(content: string): string[] {
+  const names = new Set<string>();
+  EXPORT_RE.lastIndex = 0;
+  let m: RegExpExecArray | null;
+  while ((m = EXPORT_RE.exec(content)) !== null) {
+    if (m[1]) names.add(m[1]);
+  }
+  if (DEFAULT_EXPORT_RE.test(content)) names.add('default');
+  return [...names];
+}
+
+function testCoversExport(testContent: string, exportName: string, sourceBasename: string): boolean {
+  if (exportName === 'default') {
+    return testContent.includes(sourceBasename) || testContent.includes('import ');
+  }
+  return testContent.includes(exportName);
+}
+
+export function findCoverageGaps(files: string[]): CoverageGap[] {
+  const gaps: CoverageGap[] = [];
+
+  for (const file of files) {
+    const ext = path.extname(file);
+    if (!SOURCE_EXTS.has(ext) || isTestFile(file)) continue;
+
+    let content: string;
+    try { content = fs.readFileSync(file, 'utf8'); } catch { continue; }
+
+    const exports = extractExports(content);
+    if (exports.length === 0) continue;
+
+    // Find existing test file
+    const candidates = candidateTestPaths(file);
+    const existingTestPath = candidates.find(p => fs.existsSync(p));
+    const testFile = existingTestPath ?? candidates[0]!;
+
+    // Check which exports are covered
+    let testContent = '';
+    if (existingTestPath) {
+      try { testContent = fs.readFileSync(existingTestPath, 'utf8'); } catch { /* no test */ }
+    }
+
+    const sourceBasename = path.basename(file, ext);
+    const uncovered = existingTestPath
+      ? exports.filter(name => !testCoversExport(testContent, name, sourceBasename))
+      : exports;
+
+    if (uncovered.length > 0) {
+      gaps.push({ file, exports: uncovered, testFile });
+    }
+  }
+
+  return gaps;
+}

package/src/core/test-gen/framework-detector.ts

@@ -0,0 +1,21 @@
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+export type TestFramework = 'jest' | 'vitest' | 'node:test';
+
+export function detectTestFramework(cwd: string): TestFramework {
+  const pkgPath = path.join(cwd, 'package.json');
+  if (!fs.existsSync(pkgPath)) return 'node:test';
+  try {
+    const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8')) as {
+      devDependencies?: Record<string, string>;
+      dependencies?: Record<string, string>;
+    };
+    const deps = { ...pkg.devDependencies, ...pkg.dependencies };
+    if ('vitest' in deps) return 'vitest';
+    if ('jest' in deps || '@jest/globals' in deps || 'ts-jest' in deps) return 'jest';
+    return 'node:test';
+  } catch {
+    return 'node:test';
+  }
+}

package/src/core/test-gen/test-writer.ts

@@ -0,0 +1,33 @@
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import type { CoverageGap } from './coverage-analyzer.ts';
+
+export function writeGeneratedTest(gap: CoverageGap, generatedCode: string): string {
+  const dir = path.dirname(gap.testFile);
+  fs.mkdirSync(dir, { recursive: true });
+  fs.writeFileSync(gap.testFile, generatedCode, 'utf8');
+  return gap.testFile;
+}
+
+export function buildGenerationPrompt(gap: CoverageGap, sourceContent: string, framework: string): string {
+  const relPath = gap.file;
+  const exports = gap.exports.join(', ');
+  return `Generate a complete test file for the following TypeScript module.
+
+Source file: ${relPath}
+Uncovered exports: ${exports}
+Test framework: ${framework}
+
+Source code:
+\`\`\`typescript
+${sourceContent.slice(0, 4000)}
+\`\`\`
+
+Requirements:
+- Import the exports from "${relPath}" using a relative path
+- Write one describe block per export
+- Include a happy-path test and at least one edge case per export
+- Use ${framework === 'node:test' ? "import { describe, it } from 'node:test'; import assert from 'node:assert/strict';" : `import { describe, it, expect } from '${framework}';`}
+- Do NOT use mocks unless the function clearly requires external I/O
+- Output ONLY the test file contents, no explanation`;
+}