@delegance/claude-autopilot 5.0.0-alpha.5 → 5.0.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (277) hide show
  1. package/CHANGELOG.md +20 -0
  2. package/README.md +46 -9
  3. package/dist/presets/go/rules/go-sql-injection.d.ts +4 -0
  4. package/dist/presets/go/rules/go-sql-injection.d.ts.map +1 -0
  5. package/dist/presets/nextjs-supabase/rules/supabase-rls-bypass.d.ts +4 -0
  6. package/dist/presets/nextjs-supabase/rules/supabase-rls-bypass.d.ts.map +1 -0
  7. package/dist/presets/python-fastapi/rules/fastapi-missing-auth.d.ts +4 -0
  8. package/dist/presets/python-fastapi/rules/fastapi-missing-auth.d.ts.map +1 -0
  9. package/dist/presets/rails-postgres/rules/rails-sql-injection.d.ts +4 -0
  10. package/dist/presets/rails-postgres/rules/rails-sql-injection.d.ts.map +1 -0
  11. package/dist/presets/t3/rules/t3-server-only.d.ts +4 -0
  12. package/dist/presets/t3/rules/t3-server-only.d.ts.map +1 -0
  13. package/dist/src/adapters/base.d.ts +11 -0
  14. package/dist/src/adapters/base.d.ts.map +1 -0
  15. package/dist/src/adapters/council/claude.d.ts +3 -0
  16. package/dist/src/adapters/council/claude.d.ts.map +1 -0
  17. package/dist/src/adapters/council/openai.d.ts +3 -0
  18. package/dist/src/adapters/council/openai.d.ts.map +1 -0
  19. package/dist/src/adapters/council/types.d.ts +5 -0
  20. package/dist/src/adapters/council/types.d.ts.map +1 -0
  21. package/dist/src/adapters/loader.d.ts +11 -0
  22. package/dist/src/adapters/loader.d.ts.map +1 -0
  23. package/dist/src/adapters/migration-runner/supabase.d.ts +4 -0
  24. package/dist/src/adapters/migration-runner/supabase.d.ts.map +1 -0
  25. package/dist/src/adapters/migration-runner/types.d.ts +31 -0
  26. package/dist/src/adapters/migration-runner/types.d.ts.map +1 -0
  27. package/dist/src/adapters/review-bot-parser/cursor.d.ts +3 -0
  28. package/dist/src/adapters/review-bot-parser/cursor.d.ts.map +1 -0
  29. package/dist/src/adapters/review-bot-parser/declarative-base.d.ts +13 -0
  30. package/dist/src/adapters/review-bot-parser/declarative-base.d.ts.map +1 -0
  31. package/dist/src/adapters/review-bot-parser/types.d.ts +9 -0
  32. package/dist/src/adapters/review-bot-parser/types.d.ts.map +1 -0
  33. package/dist/src/adapters/review-engine/auto.d.ts +4 -0
  34. package/dist/src/adapters/review-engine/auto.d.ts.map +1 -0
  35. package/dist/src/adapters/review-engine/claude.d.ts +4 -0
  36. package/dist/src/adapters/review-engine/claude.d.ts.map +1 -0
  37. package/dist/src/adapters/review-engine/codex.d.ts +4 -0
  38. package/dist/src/adapters/review-engine/codex.d.ts.map +1 -0
  39. package/dist/src/adapters/review-engine/gemini.d.ts +4 -0
  40. package/dist/src/adapters/review-engine/gemini.d.ts.map +1 -0
  41. package/dist/src/adapters/review-engine/openai-compatible.d.ts +4 -0
  42. package/dist/src/adapters/review-engine/openai-compatible.d.ts.map +1 -0
  43. package/dist/src/adapters/review-engine/parse-output.d.ts +13 -0
  44. package/dist/src/adapters/review-engine/parse-output.d.ts.map +1 -0
  45. package/dist/src/adapters/review-engine/prompt-builder.d.ts +4 -0
  46. package/dist/src/adapters/review-engine/prompt-builder.d.ts.map +1 -0
  47. package/dist/src/adapters/review-engine/types.d.ts +28 -0
  48. package/dist/src/adapters/review-engine/types.d.ts.map +1 -0
  49. package/dist/src/adapters/vcs-host/commit-status.d.ts +12 -0
  50. package/dist/src/adapters/vcs-host/commit-status.d.ts.map +1 -0
  51. package/dist/src/adapters/vcs-host/github.d.ts +4 -0
  52. package/dist/src/adapters/vcs-host/github.d.ts.map +1 -0
  53. package/dist/src/adapters/vcs-host/types.d.ts +42 -0
  54. package/dist/src/adapters/vcs-host/types.d.ts.map +1 -0
  55. package/dist/src/cli/_pkg-root.d.ts +47 -0
  56. package/dist/src/cli/_pkg-root.d.ts.map +1 -0
  57. package/dist/src/cli/autoregress-bridge.d.ts +3 -0
  58. package/dist/src/cli/autoregress-bridge.d.ts.map +1 -0
  59. package/dist/src/cli/baseline.d.ts +7 -0
  60. package/dist/src/cli/baseline.d.ts.map +1 -0
  61. package/dist/src/cli/ci.d.ts +23 -0
  62. package/dist/src/cli/ci.d.ts.map +1 -0
  63. package/dist/src/cli/costs.d.ts +2 -0
  64. package/dist/src/cli/costs.d.ts.map +1 -0
  65. package/dist/src/cli/council.d.ts +8 -0
  66. package/dist/src/cli/council.d.ts.map +1 -0
  67. package/dist/src/cli/detector.d.ts +8 -0
  68. package/dist/src/cli/detector.d.ts.map +1 -0
  69. package/dist/src/cli/explain.d.ts +8 -0
  70. package/dist/src/cli/explain.d.ts.map +1 -0
  71. package/dist/src/cli/fix.d.ts +10 -0
  72. package/dist/src/cli/fix.d.ts.map +1 -0
  73. package/dist/src/cli/hook.d.ts +9 -0
  74. package/dist/src/cli/hook.d.ts.map +1 -0
  75. package/dist/src/cli/ignore-helper.d.ts +7 -0
  76. package/dist/src/cli/ignore-helper.d.ts.map +1 -0
  77. package/dist/src/cli/index.d.ts +3 -0
  78. package/dist/src/cli/index.d.ts.map +1 -0
  79. package/dist/src/cli/lsp.d.ts +29 -0
  80. package/dist/src/cli/lsp.d.ts.map +1 -0
  81. package/dist/src/cli/mcp.d.ts +5 -0
  82. package/dist/src/cli/mcp.d.ts.map +1 -0
  83. package/dist/src/cli/migrate-v4.d.ts +28 -0
  84. package/dist/src/cli/migrate-v4.d.ts.map +1 -0
  85. package/dist/src/cli/pr-comment.d.ts +13 -0
  86. package/dist/src/cli/pr-comment.d.ts.map +1 -0
  87. package/dist/src/cli/pr-desc.d.ts +31 -0
  88. package/dist/src/cli/pr-desc.d.ts.map +1 -0
  89. package/dist/src/cli/pr-review-comments.d.ts +12 -0
  90. package/dist/src/cli/pr-review-comments.d.ts.map +1 -0
  91. package/dist/src/cli/pr.d.ts +9 -0
  92. package/dist/src/cli/pr.d.ts.map +1 -0
  93. package/dist/src/cli/preflight.d.ts +8 -0
  94. package/dist/src/cli/preflight.d.ts.map +1 -0
  95. package/dist/src/cli/report.d.ts +7 -0
  96. package/dist/src/cli/report.d.ts.map +1 -0
  97. package/dist/src/cli/run.d.ts +23 -0
  98. package/dist/src/cli/run.d.ts.map +1 -0
  99. package/dist/src/cli/scan.d.ts +11 -0
  100. package/dist/src/cli/scan.d.ts.map +1 -0
  101. package/dist/src/cli/setup.d.ts +9 -0
  102. package/dist/src/cli/setup.d.ts.map +1 -0
  103. package/dist/src/cli/test-gen.d.ts +10 -0
  104. package/dist/src/cli/test-gen.d.ts.map +1 -0
  105. package/dist/src/cli/triage.d.ts +5 -0
  106. package/dist/src/cli/triage.d.ts.map +1 -0
  107. package/dist/src/cli/watch.d.ts +18 -0
  108. package/dist/src/cli/watch.d.ts.map +1 -0
  109. package/dist/src/cli/worker.d.ts +5 -0
  110. package/dist/src/cli/worker.d.ts.map +1 -0
  111. package/dist/src/core/cache/cached-engine.d.ts +8 -0
  112. package/dist/src/core/cache/cached-engine.d.ts.map +1 -0
  113. package/dist/src/core/cache/review-cache.d.ts +21 -0
  114. package/dist/src/core/cache/review-cache.d.ts.map +1 -0
  115. package/dist/src/core/chunking/index.d.ts +18 -0
  116. package/dist/src/core/chunking/index.d.ts.map +1 -0
  117. package/dist/src/core/chunking/risk-ranker.d.ts +10 -0
  118. package/dist/src/core/chunking/risk-ranker.d.ts.map +1 -0
  119. package/dist/src/core/config/loader.d.ts +3 -0
  120. package/dist/src/core/config/loader.d.ts.map +1 -0
  121. package/dist/src/core/config/preset-resolver.d.ts +9 -0
  122. package/dist/src/core/config/preset-resolver.d.ts.map +1 -0
  123. package/dist/src/core/config/schema.d.ts +342 -0
  124. package/dist/src/core/config/schema.d.ts.map +1 -0
  125. package/dist/src/core/config/types.d.ts +115 -0
  126. package/dist/src/core/config/types.d.ts.map +1 -0
  127. package/dist/src/core/council/config.d.ts +3 -0
  128. package/dist/src/core/council/config.d.ts.map +1 -0
  129. package/dist/src/core/council/context.d.ts +2 -0
  130. package/dist/src/core/council/context.d.ts.map +1 -0
  131. package/dist/src/core/council/runner.d.ts +4 -0
  132. package/dist/src/core/council/runner.d.ts.map +1 -0
  133. package/dist/src/core/council/types.d.ts +36 -0
  134. package/dist/src/core/council/types.d.ts.map +1 -0
  135. package/dist/src/core/detect/git-context.d.ts +12 -0
  136. package/dist/src/core/detect/git-context.d.ts.map +1 -0
  137. package/dist/src/core/detect/llm-key.d.ts +38 -0
  138. package/dist/src/core/detect/llm-key.d.ts.map +1 -0
  139. package/dist/src/core/detect/protected-paths.d.ts +6 -0
  140. package/dist/src/core/detect/protected-paths.d.ts.map +1 -0
  141. package/dist/src/core/detect/provider-usage.d.ts +17 -0
  142. package/dist/src/core/detect/provider-usage.d.ts.map +1 -0
  143. package/dist/src/core/detect/stack.d.ts +6 -0
  144. package/dist/src/core/detect/stack.d.ts.map +1 -0
  145. package/dist/src/core/detect/workspaces.d.ts +11 -0
  146. package/dist/src/core/detect/workspaces.d.ts.map +1 -0
  147. package/dist/src/core/errors.d.ts +17 -0
  148. package/dist/src/core/errors.d.ts.map +1 -0
  149. package/dist/src/core/findings/dedup.d.ts +4 -0
  150. package/dist/src/core/findings/dedup.d.ts.map +1 -0
  151. package/dist/src/core/findings/types.d.ts +33 -0
  152. package/dist/src/core/findings/types.d.ts.map +1 -0
  153. package/dist/src/core/fix/generator.d.ts +17 -0
  154. package/dist/src/core/fix/generator.d.ts.map +1 -0
  155. package/dist/src/core/git/diff-hunks.d.ts +22 -0
  156. package/dist/src/core/git/diff-hunks.d.ts.map +1 -0
  157. package/dist/src/core/git/touched-files.d.ts +11 -0
  158. package/dist/src/core/git/touched-files.d.ts.map +1 -0
  159. package/dist/src/core/ignore/index.d.ts +11 -0
  160. package/dist/src/core/ignore/index.d.ts.map +1 -0
  161. package/dist/src/core/index.d.ts +2 -0
  162. package/dist/src/core/index.d.ts.map +1 -0
  163. package/dist/src/core/logging/ndjson-writer.d.ts +16 -0
  164. package/dist/src/core/logging/ndjson-writer.d.ts.map +1 -0
  165. package/dist/src/core/logging/redaction.d.ts +4 -0
  166. package/dist/src/core/logging/redaction.d.ts.map +1 -0
  167. package/dist/src/core/mcp/concurrency.d.ts +2 -0
  168. package/dist/src/core/mcp/concurrency.d.ts.map +1 -0
  169. package/dist/src/core/mcp/handlers/fix-finding.d.ts +17 -0
  170. package/dist/src/core/mcp/handlers/fix-finding.d.ts.map +1 -0
  171. package/dist/src/core/mcp/handlers/get-capabilities.d.ts +14 -0
  172. package/dist/src/core/mcp/handlers/get-capabilities.d.ts.map +1 -0
  173. package/dist/src/core/mcp/handlers/get-findings.d.ts +13 -0
  174. package/dist/src/core/mcp/handlers/get-findings.d.ts.map +1 -0
  175. package/dist/src/core/mcp/handlers/review-diff.d.ts +18 -0
  176. package/dist/src/core/mcp/handlers/review-diff.d.ts.map +1 -0
  177. package/dist/src/core/mcp/handlers/scan-files.d.ts +15 -0
  178. package/dist/src/core/mcp/handlers/scan-files.d.ts.map +1 -0
  179. package/dist/src/core/mcp/handlers/validate-fix.d.ts +12 -0
  180. package/dist/src/core/mcp/handlers/validate-fix.d.ts.map +1 -0
  181. package/dist/src/core/mcp/run-store.d.ts +12 -0
  182. package/dist/src/core/mcp/run-store.d.ts.map +1 -0
  183. package/dist/src/core/mcp/workspace.d.ts +3 -0
  184. package/dist/src/core/mcp/workspace.d.ts.map +1 -0
  185. package/dist/src/core/persist/baseline.d.ts +39 -0
  186. package/dist/src/core/persist/baseline.d.ts.map +1 -0
  187. package/dist/src/core/persist/cost-log.d.ts +11 -0
  188. package/dist/src/core/persist/cost-log.d.ts.map +1 -0
  189. package/dist/src/core/persist/findings-cache.d.ts +9 -0
  190. package/dist/src/core/persist/findings-cache.d.ts.map +1 -0
  191. package/dist/src/core/persist/triage.d.ts +30 -0
  192. package/dist/src/core/persist/triage.d.ts.map +1 -0
  193. package/dist/src/core/phases/static-rules.d.ts +24 -0
  194. package/dist/src/core/phases/static-rules.d.ts.map +1 -0
  195. package/dist/src/core/phases/tests.d.ts +15 -0
  196. package/dist/src/core/phases/tests.d.ts.map +1 -0
  197. package/dist/src/core/pipeline/review-phase.d.ts +27 -0
  198. package/dist/src/core/pipeline/review-phase.d.ts.map +1 -0
  199. package/dist/src/core/pipeline/run.d.ts +27 -0
  200. package/dist/src/core/pipeline/run.d.ts.map +1 -0
  201. package/dist/src/core/runtime/idempotency.d.ts +2 -0
  202. package/dist/src/core/runtime/idempotency.d.ts.map +1 -0
  203. package/dist/src/core/runtime/lock.d.ts +5 -0
  204. package/dist/src/core/runtime/lock.d.ts.map +1 -0
  205. package/dist/src/core/runtime/state.d.ts +39 -0
  206. package/dist/src/core/runtime/state.d.ts.map +1 -0
  207. package/dist/src/core/schema-alignment/detector.d.ts +3 -0
  208. package/dist/src/core/schema-alignment/detector.d.ts.map +1 -0
  209. package/dist/src/core/schema-alignment/extractor/index.d.ts +3 -0
  210. package/dist/src/core/schema-alignment/extractor/index.d.ts.map +1 -0
  211. package/dist/src/core/schema-alignment/extractor/prisma.d.ts +3 -0
  212. package/dist/src/core/schema-alignment/extractor/prisma.d.ts.map +1 -0
  213. package/dist/src/core/schema-alignment/extractor/sql.d.ts +3 -0
  214. package/dist/src/core/schema-alignment/extractor/sql.d.ts.map +1 -0
  215. package/dist/src/core/schema-alignment/llm-check.d.ts +4 -0
  216. package/dist/src/core/schema-alignment/llm-check.d.ts.map +1 -0
  217. package/dist/src/core/schema-alignment/scanner.d.ts +3 -0
  218. package/dist/src/core/schema-alignment/scanner.d.ts.map +1 -0
  219. package/dist/src/core/schema-alignment/types.d.ts +38 -0
  220. package/dist/src/core/schema-alignment/types.d.ts.map +1 -0
  221. package/dist/src/core/shell.d.ts +15 -0
  222. package/dist/src/core/shell.d.ts.map +1 -0
  223. package/dist/src/core/static-rules/registry.d.ts +5 -0
  224. package/dist/src/core/static-rules/registry.d.ts.map +1 -0
  225. package/dist/src/core/static-rules/rules/brand-tokens.d.ts +3 -0
  226. package/dist/src/core/static-rules/rules/brand-tokens.d.ts.map +1 -0
  227. package/dist/src/core/static-rules/rules/console-log.d.ts +3 -0
  228. package/dist/src/core/static-rules/rules/console-log.d.ts.map +1 -0
  229. package/dist/src/core/static-rules/rules/hardcoded-secrets.d.ts +3 -0
  230. package/dist/src/core/static-rules/rules/hardcoded-secrets.d.ts.map +1 -0
  231. package/dist/src/core/static-rules/rules/insecure-redirect.d.ts +3 -0
  232. package/dist/src/core/static-rules/rules/insecure-redirect.d.ts.map +1 -0
  233. package/dist/src/core/static-rules/rules/large-file.d.ts +3 -0
  234. package/dist/src/core/static-rules/rules/large-file.d.ts.map +1 -0
  235. package/dist/src/core/static-rules/rules/missing-auth.d.ts +3 -0
  236. package/dist/src/core/static-rules/rules/missing-auth.d.ts.map +1 -0
  237. package/dist/src/core/static-rules/rules/missing-tests.d.ts +3 -0
  238. package/dist/src/core/static-rules/rules/missing-tests.d.ts.map +1 -0
  239. package/dist/src/core/static-rules/rules/npm-audit.d.ts +3 -0
  240. package/dist/src/core/static-rules/rules/npm-audit.d.ts.map +1 -0
  241. package/dist/src/core/static-rules/rules/package-lock-sync.d.ts +3 -0
  242. package/dist/src/core/static-rules/rules/package-lock-sync.d.ts.map +1 -0
  243. package/dist/src/core/static-rules/rules/schema-alignment.d.ts +3 -0
  244. package/dist/src/core/static-rules/rules/schema-alignment.d.ts.map +1 -0
  245. package/dist/src/core/static-rules/rules/sql-injection.d.ts +3 -0
  246. package/dist/src/core/static-rules/rules/sql-injection.d.ts.map +1 -0
  247. package/dist/src/core/static-rules/rules/ssrf.d.ts +3 -0
  248. package/dist/src/core/static-rules/rules/ssrf.d.ts.map +1 -0
  249. package/dist/src/core/static-rules/rules/todo-fixme.d.ts +3 -0
  250. package/dist/src/core/static-rules/rules/todo-fixme.d.ts.map +1 -0
  251. package/dist/src/core/static-rules/tailwind-extractor.d.ts +7 -0
  252. package/dist/src/core/static-rules/tailwind-extractor.d.ts.map +1 -0
  253. package/dist/src/core/test-gen/coverage-analyzer.d.ts +7 -0
  254. package/dist/src/core/test-gen/coverage-analyzer.d.ts.map +1 -0
  255. package/dist/src/core/test-gen/framework-detector.d.ts +3 -0
  256. package/dist/src/core/test-gen/framework-detector.d.ts.map +1 -0
  257. package/dist/src/core/test-gen/test-writer.d.ts +4 -0
  258. package/dist/src/core/test-gen/test-writer.d.ts.map +1 -0
  259. package/dist/src/core/ui/design-context-loader.d.ts +7 -0
  260. package/dist/src/core/ui/design-context-loader.d.ts.map +1 -0
  261. package/dist/src/core/worker/client.d.ts +23 -0
  262. package/dist/src/core/worker/client.d.ts.map +1 -0
  263. package/dist/src/core/worker/lockfile.d.ts +12 -0
  264. package/dist/src/core/worker/lockfile.d.ts.map +1 -0
  265. package/dist/src/core/worker/server.d.ts +17 -0
  266. package/dist/src/core/worker/server.d.ts.map +1 -0
  267. package/dist/src/formatters/github-annotations.d.ts +5 -0
  268. package/dist/src/formatters/github-annotations.d.ts.map +1 -0
  269. package/dist/src/formatters/index.d.ts +4 -0
  270. package/dist/src/formatters/index.d.ts.map +1 -0
  271. package/dist/src/formatters/junit.d.ts +5 -0
  272. package/dist/src/formatters/junit.d.ts.map +1 -0
  273. package/dist/src/formatters/sarif.d.ts +56 -0
  274. package/dist/src/formatters/sarif.d.ts.map +1 -0
  275. package/dist/src/index.d.ts +4 -0
  276. package/dist/src/index.d.ts.map +1 -0
  277. package/package.json +4 -4
package/CHANGELOG.md CHANGED
@@ -1,5 +1,25 @@
1
1
  # Changelog
2
2
 
3
+ ## [5.0.0] — 2026-04-27
4
+
5
+ First GA release after a five-alpha soak cycle. Promotes `5.0.0-alpha.5` to GA unchanged on the code side; the only diff is the version bump, README rebranding away from `@alpha` channel guidance, and a new "Reproducing the benchmark" section.
6
+
7
+ ### Added
8
+ - **README hero benchmark.** Documented 13/13 on the seeded Next.js fixture with Claude Opus at $0.21 / 38s. Includes a "Reproducing the benchmark" section at the bottom with the full procedure, the categories measured, and explicit non-claims (e.g. doesn't measure false-positive rate on clean repos).
9
+ - README install instructions now use bare `npm install -g @delegance/claude-autopilot` (no `@alpha` pin) — assumes the `latest` dist-tag has advanced to 5.0.0.
10
+
11
+ ### Changed
12
+ - Migration guide install snippets drop the `@alpha` pin and the alpha-cycle warning.
13
+ - Removed the alpha-era CLI note from the README ("Alpha.1 CLI note: subcommands are flat …" → just "CLI note").
14
+
15
+ ### Manual GA steps (for the publisher)
16
+ After this lands and `v5.0.0` is tagged + auto-published:
17
+
18
+ 1. `cd packages/guardrail-tombstone && npm publish` — publishes `@delegance/guardrail@5.0.0` thin wrapper.
19
+ 2. `npm dist-tag add @delegance/claude-autopilot@5.0.0 latest` — moves `latest` from the legacy 2.5.0 to GA.
20
+ 3. `npm deprecate @delegance/claude-autopilot@"<5.0.0" "Pre-rename — use 5.x"` — flags the orphaned 1.0.0-rc.1 / 2.x / 5.0.0-alpha.* releases.
21
+ 4. `npm deprecate @delegance/guardrail@"<5.0.0" "Renamed — use @delegance/claude-autopilot"` — tells v4 users to migrate (the `5.0.0` tombstone forwards their existing CLI usage transparently).
22
+
3
23
  ## [5.0.0-alpha.5] — 2026-04-27
4
24
 
5
25
  Second hotfix from the soak. Alpha.4 fixed `init`'s preset resolution but `scan` / `run` still crashed on compiled output with `Failed to import adapter from .../auto.ts` — the adapter loader and static-rule registry use dynamic-import string literals that tsc's `rewriteRelativeImportExtensions` doesn't touch.
package/README.md CHANGED
@@ -15,6 +15,18 @@ claude-autopilot brainstorm "add SSO with SAML for enterprise tenants"
15
15
 
16
16
  ---
17
17
 
18
+ ## Benchmark
19
+
20
+ On a Next.js fixture seeded with 13 production-realistic bugs covering the categories the README advertises — SQL injection, hardcoded secret, missing auth, IDOR, CORS wildcard, SSRF, open redirect, TOCTOU race, silent error swallow, off-by-one, missing rate limit, console.log in prod, and missing input validation:
21
+
22
+ | Configuration | Bugs caught | Cost | Time |
23
+ |---|---|---|---|
24
+ | **`claude-autopilot scan --all` with Claude Opus** | **13 / 13** | $0.21 | 38 s |
25
+
26
+ Every finding came with a concrete remediation (often a code patch or named library — `Zod` for validation, atomic Postgres updates for TOCTOU, allowlist + DNS resolution for SSRF). [Reproduce the benchmark.](#reproducing-the-benchmark)
27
+
28
+ ---
29
+
18
30
  ## Why this vs the alternatives
19
31
 
20
32
  AI coding tools fall into three buckets. Here's where claude-autopilot sits.
@@ -39,11 +51,11 @@ The architectural differences that matter most in practice:
39
51
  ## 30-second quickstart
40
52
 
41
53
  ```bash
42
- # Install (alpha channel — use @alpha through the v5 alpha cycle)
43
- npm install -g @delegance/claude-autopilot@alpha
54
+ # Install
55
+ npm install -g @delegance/claude-autopilot
44
56
 
45
57
  # One-shot setup — detects stack, writes config, installs skills, sets hooks
46
- npx claude-autopilot@alpha init
58
+ claude-autopilot init
47
59
 
48
60
  # Ship a feature end-to-end
49
61
  claude-autopilot brainstorm "add rate limiting to the public API"
@@ -93,16 +105,12 @@ claude-autopilot run --format sarif --output out.sarif
93
105
  claude-autopilot fix --verify # LLM patch + test gate + revert on fail
94
106
  ```
95
107
 
96
- > **Alpha.1 CLI note:** subcommands are flat (`run`, `scan`, `ci`, `fix`, `baseline`, `explain`, …). The grouped `claude-autopilot review <verb>` form lands in alpha.2 as an alias — flat forms continue to work indefinitely.
108
+ > **CLI note:** subcommands are flat (`run`, `scan`, `ci`, `fix`, `baseline`, `explain`, …). The grouped `claude-autopilot review <verb>` form is also accepted as an alias — flat and grouped both work.
97
109
 
98
110
  ## Install & requirements
99
111
 
100
112
  ```bash
101
- # v5 alpha — current release channel
102
- npm install -g @delegance/claude-autopilot@alpha
103
-
104
- # When 5.0.0 GA ships, the `latest` tag will advance and you can drop the @alpha:
105
- # npm install -g @delegance/claude-autopilot
113
+ npm install -g @delegance/claude-autopilot
106
114
  ```
107
115
 
108
116
  - Node 22+
@@ -274,6 +282,35 @@ Four pluggable adapter points:
274
282
 
275
283
  **Monorepo:** Auto-detects npm/yarn/pnpm workspaces, Turborepo, and Nx.
276
284
 
285
+ ## Reproducing the benchmark
286
+
287
+ The 13/13 benchmark cited in the [Benchmark](#benchmark) section is reproducible end-to-end. The fixture is a minimal Next.js app that seeds each of the README-advertised bug categories at a specific file:line, then `claude-autopilot scan --all` is run with the `claude` adapter and the result is compared to the seed list.
288
+
289
+ ```bash
290
+ # 1. Install the CLI
291
+ npm install -g @delegance/claude-autopilot
292
+
293
+ # 2. Seed the fixture (one file per bug category)
294
+ SEED=$(mktemp -d) && cd $SEED && npm init -y >/dev/null
295
+ mkdir -p app/api/{users,coupons,profile,redirect,proxy} lib
296
+
297
+ # (Add the 13 seeded files — the canonical fixture lives at
298
+ # https://github.com/axledbetter/claude-autopilot/tree/master/tests/v4-compat/fixtures/13-bugs)
299
+
300
+ # 3. Init + scan
301
+ claude-autopilot init --preset nextjs-supabase
302
+ ANTHROPIC_API_KEY=sk-ant-... claude-autopilot scan --all
303
+ ```
304
+
305
+ **What "13 of 13" means:** the scan output flags each category as a distinct critical or warning finding with file path, line, and concrete remediation. We count one hit per seed regardless of severity bucket. The categories are: SQL injection, hardcoded secret, missing auth, IDOR, CORS wildcard, SSRF, open redirect, TOCTOU race, silent error swallow, off-by-one, missing rate limit, console.log in prod, missing input validation.
306
+
307
+ **What this doesn't measure:**
308
+ - False positive rate on a clean repo (separate test, expected ~3 findings on real production code per the cold-start eval)
309
+ - Detection rate with cheaper models — this is Claude Opus. Sonnet typically catches 11/13. Llama 3.3 70B (via Groq) caught 8/13 in independent testing
310
+ - Bugs the scan missed: there are none in the 13-category set we measure, but real production bugs are not always in this set
311
+
312
+ We do not claim 13/13 reflects every real-world repo — it's a reproducible upper bound on a fixture that exercises the categories we explicitly target.
313
+
277
314
  ## License
278
315
 
279
316
  MIT
@@ -0,0 +1,4 @@
1
+ import type { StaticRule } from '../../../src/core/phases/static-rules.ts';
2
+ export declare const goSqlInjectionRule: StaticRule;
3
+ export default goSqlInjectionRule;
4
+ //# sourceMappingURL=go-sql-injection.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"go-sql-injection.d.ts","sourceRoot":"","sources":["../../../../presets/go/rules/go-sql-injection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0CAA0C,CAAC;AAU3E,eAAO,MAAM,kBAAkB,EAAE,UAoDhC,CAAC;AAEF,eAAe,kBAAkB,CAAC"}
@@ -0,0 +1,4 @@
1
+ import type { StaticRule } from '../../../src/core/phases/static-rules.ts';
2
+ export declare const supabaseRlsBypassRule: StaticRule;
3
+ export default supabaseRlsBypassRule;
4
+ //# sourceMappingURL=supabase-rls-bypass.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"supabase-rls-bypass.d.ts","sourceRoot":"","sources":["../../../../presets/nextjs-supabase/rules/supabase-rls-bypass.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0CAA0C,CAAC;AAE3E,eAAO,MAAM,qBAAqB,EAAE,UAgCnC,CAAC;AAEF,eAAe,qBAAqB,CAAC"}
@@ -0,0 +1,4 @@
1
+ import type { StaticRule } from '../../../src/core/phases/static-rules.ts';
2
+ export declare const fastapiMissingAuthRule: StaticRule;
3
+ export default fastapiMissingAuthRule;
4
+ //# sourceMappingURL=fastapi-missing-auth.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"fastapi-missing-auth.d.ts","sourceRoot":"","sources":["../../../../presets/python-fastapi/rules/fastapi-missing-auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0CAA0C,CAAC;AAQ3E,eAAO,MAAM,sBAAsB,EAAE,UAuCpC,CAAC;AAEF,eAAe,sBAAsB,CAAC"}
@@ -0,0 +1,4 @@
1
+ import type { StaticRule } from '../../../src/core/phases/static-rules.ts';
2
+ export declare const railsSqlInjectionRule: StaticRule;
3
+ export default railsSqlInjectionRule;
4
+ //# sourceMappingURL=rails-sql-injection.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"rails-sql-injection.d.ts","sourceRoot":"","sources":["../../../../presets/rails-postgres/rules/rails-sql-injection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0CAA0C,CAAC;AAO3E,eAAO,MAAM,qBAAqB,EAAE,UAgCnC,CAAC;AAEF,eAAe,qBAAqB,CAAC"}
@@ -0,0 +1,4 @@
1
+ import type { StaticRule } from '../../../src/core/phases/static-rules.ts';
2
+ export declare const t3ServerOnlyRule: StaticRule;
3
+ export default t3ServerOnlyRule;
4
+ //# sourceMappingURL=t3-server-only.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"t3-server-only.d.ts","sourceRoot":"","sources":["../../../../presets/t3/rules/t3-server-only.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0CAA0C,CAAC;AAI3E,eAAO,MAAM,gBAAgB,EAAE,UA4B9B,CAAC;AAEF,eAAe,gBAAgB,CAAC"}
@@ -0,0 +1,11 @@
1
+ export interface AdapterBase {
2
+ name: string;
3
+ apiVersion: string;
4
+ getCapabilities(): Capabilities;
5
+ }
6
+ export interface Capabilities {
7
+ [feature: string]: boolean | number | string;
8
+ }
9
+ export declare const CORE_ADAPTER_API_VERSION_MAJOR = 1;
10
+ export declare function checkApiVersionCompatibility(adapterApiVersion: string): boolean;
11
+ //# sourceMappingURL=base.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../../src/adapters/base.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,IAAI,YAAY,CAAC;CACjC;AAED,MAAM,WAAW,YAAY;IAC3B,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC;CAC9C;AAED,eAAO,MAAM,8BAA8B,IAAI,CAAC;AAEhD,wBAAgB,4BAA4B,CAAC,iBAAiB,EAAE,MAAM,GAAG,OAAO,CAI/E"}
@@ -0,0 +1,3 @@
1
+ import type { CouncilAdapter } from './types.ts';
2
+ export declare function makeClaudeCouncilAdapter(model: string, label: string): CouncilAdapter;
3
+ //# sourceMappingURL=claude.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"claude.d.ts","sourceRoot":"","sources":["../../../../src/adapters/council/claude.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAKjD,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,cAAc,CAgCrF"}
@@ -0,0 +1,3 @@
1
+ import type { CouncilAdapter } from './types.ts';
2
+ export declare function makeOpenAICouncilAdapter(model: string, label: string): CouncilAdapter;
3
+ //# sourceMappingURL=openai.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"openai.d.ts","sourceRoot":"","sources":["../../../../src/adapters/council/openai.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAKjD,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,cAAc,CA+BrF"}
@@ -0,0 +1,5 @@
1
+ export interface CouncilAdapter {
2
+ readonly label: string;
3
+ consult(prompt: string, context: string): Promise<string>;
4
+ }
5
+ //# sourceMappingURL=types.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/adapters/council/types.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC3D"}
@@ -0,0 +1,11 @@
1
+ import { type AdapterBase } from './base.ts';
2
+ export type IntegrationPoint = 'review-engine' | 'vcs-host' | 'migration-runner' | 'review-bot-parser';
3
+ export interface LoadAdapterOptions {
4
+ point: IntegrationPoint;
5
+ ref: string;
6
+ options?: Record<string, unknown>;
7
+ /** Allow loading adapters from arbitrary local paths. Off by default for security. */
8
+ unsafeAllowLocalAdapters?: boolean;
9
+ }
10
+ export declare function loadAdapter<T extends AdapterBase>(options: LoadAdapterOptions): Promise<T>;
11
+ //# sourceMappingURL=loader.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../../src/adapters/loader.ts"],"names":[],"mappings":"AAEA,OAAO,EAAgC,KAAK,WAAW,EAAE,MAAM,WAAW,CAAC;AAG3E,MAAM,MAAM,gBAAgB,GAAG,eAAe,GAAG,UAAU,GAAG,kBAAkB,GAAG,mBAAmB,CAAC;AAEvG,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,gBAAgB,CAAC;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,sFAAsF;IACtF,wBAAwB,CAAC,EAAE,OAAO,CAAC;CACpC;AA0BD,wBAAsB,WAAW,CAAC,CAAC,SAAS,WAAW,EAAE,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,CAAC,CAAC,CAmDhG"}
@@ -0,0 +1,4 @@
1
+ import type { MigrationRunner } from './types.ts';
2
+ export declare const supabaseAdapter: MigrationRunner;
3
+ export default supabaseAdapter;
4
+ //# sourceMappingURL=supabase.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"supabase.d.ts","sourceRoot":"","sources":["../../../../src/adapters/migration-runner/supabase.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,eAAe,EAAmE,MAAM,YAAY,CAAC;AAEnH,eAAO,MAAM,eAAe,EAAE,eA+C7B,CAAC;AAEF,eAAe,eAAe,CAAC"}
@@ -0,0 +1,31 @@
1
+ import type { AdapterBase } from '../base.ts';
2
+ export type MigrationEnv = 'dev' | 'qa' | 'prod';
3
+ export interface Migration {
4
+ name: string;
5
+ path: string;
6
+ content?: string;
7
+ }
8
+ export interface DryRunResult {
9
+ ok: boolean;
10
+ errors?: string[];
11
+ warnings?: string[];
12
+ }
13
+ export interface ApplyResult {
14
+ ok: boolean;
15
+ appliedSha?: string;
16
+ durationMs?: number;
17
+ errors?: string[];
18
+ }
19
+ export interface LedgerEntry {
20
+ name: string;
21
+ appliedAt: string;
22
+ sha?: string;
23
+ }
24
+ export interface MigrationRunner extends AdapterBase {
25
+ discover(touchedFiles: string[]): Migration[];
26
+ dryRun(migration: Migration): Promise<DryRunResult>;
27
+ apply(migration: Migration, env: MigrationEnv): Promise<ApplyResult>;
28
+ ledger(env: MigrationEnv): Promise<LedgerEntry[]>;
29
+ alreadyApplied(migration: Migration, env: MigrationEnv): Promise<boolean>;
30
+ }
31
+ //# sourceMappingURL=types.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/adapters/migration-runner/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,MAAM,MAAM,YAAY,GAAG,KAAK,GAAG,IAAI,GAAG,MAAM,CAAC;AAEjD,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,OAAO,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,eAAgB,SAAQ,WAAW;IAClD,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC;IAC9C,MAAM,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACpD,KAAK,CAAC,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACrE,MAAM,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAClD,cAAc,CAAC,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC3E"}
@@ -0,0 +1,3 @@
1
+ export declare const cursorAdapter: import("./types.ts").ReviewBotParser;
2
+ export default cursorAdapter;
3
+ //# sourceMappingURL=cursor.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"cursor.d.ts","sourceRoot":"","sources":["../../../../src/adapters/review-bot-parser/cursor.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,aAAa,sCAQxB,CAAC;AAEH,eAAe,aAAa,CAAC"}
@@ -0,0 +1,13 @@
1
+ import type { ReviewBotParser } from './types.ts';
2
+ export interface DeclarativeParserConfig {
3
+ name: string;
4
+ author: string | RegExp;
5
+ severityMap: {
6
+ critical?: RegExp;
7
+ warning?: RegExp;
8
+ note?: RegExp;
9
+ };
10
+ dismissalKeywords: string[];
11
+ }
12
+ export declare function makeDeclarativeParser(config: DeclarativeParserConfig): ReviewBotParser;
13
+ //# sourceMappingURL=declarative-base.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"declarative-base.d.ts","sourceRoot":"","sources":["../../../../src/adapters/review-bot-parser/declarative-base.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,WAAW,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACpE,iBAAiB,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,uBAAuB,GAAG,eAAe,CA0CtF"}
@@ -0,0 +1,9 @@
1
+ import type { AdapterBase } from '../base.ts';
2
+ import type { Finding } from '../../core/findings/types.ts';
3
+ import type { GenericComment, VcsHost } from '../vcs-host/types.ts';
4
+ export interface ReviewBotParser extends AdapterBase {
5
+ detect(comment: GenericComment): boolean;
6
+ fetchFindings(vcs: VcsHost, pr: number | string): Promise<Finding[]>;
7
+ detectDismissal(reply: string): boolean;
8
+ }
9
+ //# sourceMappingURL=types.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/adapters/review-bot-parser/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,8BAA8B,CAAC;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAEpE,MAAM,WAAW,eAAgB,SAAQ,WAAW;IAClD,MAAM,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC;IACzC,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IACrE,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;CACzC"}
@@ -0,0 +1,4 @@
1
+ import type { ReviewEngine } from './types.ts';
2
+ export declare const autoAdapter: ReviewEngine;
3
+ export default autoAdapter;
4
+ //# sourceMappingURL=auto.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"auto.d.ts","sourceRoot":"","sources":["../../../../src/adapters/review-engine/auto.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAA6B,MAAM,YAAY,CAAC;AAwE1E,eAAO,MAAM,WAAW,EAAE,YAkBzB,CAAC;AAEF,eAAe,WAAW,CAAC"}
@@ -0,0 +1,4 @@
1
+ import type { ReviewEngine } from './types.ts';
2
+ export declare const claudeAdapter: ReviewEngine;
3
+ export default claudeAdapter;
4
+ //# sourceMappingURL=claude.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"claude.d.ts","sourceRoot":"","sources":["../../../../src/adapters/review-engine/claude.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAA6B,MAAM,YAAY,CAAC;AAoC1E,eAAO,MAAM,aAAa,EAAE,YA0D3B,CAAC;AAEF,eAAe,aAAa,CAAC"}
@@ -0,0 +1,4 @@
1
+ import type { ReviewEngine } from './types.ts';
2
+ export declare const codexAdapter: ReviewEngine;
3
+ export default codexAdapter;
4
+ //# sourceMappingURL=codex.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"codex.d.ts","sourceRoot":"","sources":["../../../../src/adapters/review-engine/codex.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,YAAY,EAA6B,MAAM,YAAY,CAAC;AA8B1E,eAAO,MAAM,YAAY,EAAE,YA6C1B,CAAC;AAEF,eAAe,YAAY,CAAC"}
@@ -0,0 +1,4 @@
1
+ import type { ReviewEngine } from './types.ts';
2
+ export declare const geminiAdapter: ReviewEngine;
3
+ export default geminiAdapter;
4
+ //# sourceMappingURL=gemini.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"gemini.d.ts","sourceRoot":"","sources":["../../../../src/adapters/review-engine/gemini.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,YAAY,EAA6B,MAAM,YAAY,CAAC;AA2C1E,eAAO,MAAM,aAAa,EAAE,YAuD3B,CAAC;AAEF,eAAe,aAAa,CAAC"}
@@ -0,0 +1,4 @@
1
+ import type { ReviewEngine } from './types.ts';
2
+ export declare const openaiCompatibleAdapter: ReviewEngine;
3
+ export default openaiCompatibleAdapter;
4
+ //# sourceMappingURL=openai-compatible.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"openai-compatible.d.ts","sourceRoot":"","sources":["../../../../src/adapters/review-engine/openai-compatible.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,YAAY,EAA6B,MAAM,YAAY,CAAC;AA8B1E,eAAO,MAAM,uBAAuB,EAAE,YA+DrC,CAAC;AAEF,eAAe,uBAAuB,CAAC"}
@@ -0,0 +1,13 @@
1
+ import type { Finding } from '../../core/findings/types.ts';
2
+ /**
3
+ * Parses the structured CRITICAL|WARNING|NOTE markdown format produced by all review
4
+ * engine adapters. Extracts file:line references from the finding body when present.
5
+ *
6
+ * Tolerates common LLM format drift (missing brackets, bold wrappers) because the prompt
7
+ * alone doesn't guarantee literal `### [CRITICAL]` — models routinely emit
8
+ * `### CRITICAL` or `### **CRITICAL**`. A strict parser silently returns zero findings
9
+ * on otherwise-valid output, which is exactly the silent-failure mode this file exists to
10
+ * prevent.
11
+ */
12
+ export declare function parseReviewOutput(output: string, idPrefix: string): Finding[];
13
+ //# sourceMappingURL=parse-output.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"parse-output.d.ts","sourceRoot":"","sources":["../../../../src/adapters/review-engine/parse-output.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,8BAA8B,CAAC;AA2B5D;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,EAAE,CAoC7E"}
@@ -0,0 +1,4 @@
1
+ import type { ReviewInput } from './types.ts';
2
+ export declare function buildSystemPrompt(input: ReviewInput, template: string): string;
3
+ export declare function classifyError(message: string): 'auth' | 'rate_limit' | 'transient_network';
4
+ //# sourceMappingURL=prompt-builder.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"prompt-builder.d.ts","sourceRoot":"","sources":["../../../../src/adapters/review-engine/prompt-builder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAI9C,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAQ9E;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,YAAY,GAAG,mBAAmB,CAI1F"}
@@ -0,0 +1,28 @@
1
+ import type { AdapterBase } from '../base.ts';
2
+ import type { Finding } from '../../core/findings/types.ts';
3
+ export interface ReviewInput {
4
+ content: string;
5
+ kind: 'spec' | 'pr-diff' | 'file-batch';
6
+ context?: {
7
+ spec?: string;
8
+ plan?: string;
9
+ stack?: string;
10
+ cwd?: string;
11
+ gitSummary?: string;
12
+ designSchema?: string;
13
+ };
14
+ }
15
+ export interface ReviewOutput {
16
+ findings: Finding[];
17
+ rawOutput: string;
18
+ usage?: {
19
+ input: number;
20
+ output: number;
21
+ costUSD?: number;
22
+ };
23
+ }
24
+ export interface ReviewEngine extends AdapterBase {
25
+ review(input: ReviewInput): Promise<ReviewOutput>;
26
+ estimateTokens(content: string): number;
27
+ }
28
+ //# sourceMappingURL=types.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/adapters/review-engine/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,8BAA8B,CAAC;AAE5D,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,YAAY,CAAC;IACxC,OAAO,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACtH;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7D;AAED,MAAM,WAAW,YAAa,SAAQ,WAAW;IAC/C,MAAM,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAClD,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;CACzC"}
@@ -0,0 +1,12 @@
1
+ export type CommitState = 'pending' | 'success' | 'failure' | 'error';
2
+ export interface CommitStatusOptions {
3
+ sha: string;
4
+ state: CommitState;
5
+ description?: string;
6
+ context?: string;
7
+ targetUrl?: string;
8
+ cwd?: string;
9
+ }
10
+ export declare function resolveCommitSha(cwd: string, envSha?: string): string | null;
11
+ export declare function postCommitStatus(opts: CommitStatusOptions): boolean;
12
+ //# sourceMappingURL=commit-status.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"commit-status.d.ts","sourceRoot":"","sources":["../../../../src/adapters/vcs-host/commit-status.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,OAAO,CAAC;AAEtE,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,WAAW,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAMD,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAI5E;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAenE"}
@@ -0,0 +1,4 @@
1
+ import type { VcsHost } from './types.ts';
2
+ export declare const githubAdapter: VcsHost;
3
+ export default githubAdapter;
4
+ //# sourceMappingURL=github.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"github.d.ts","sourceRoot":"","sources":["../../../../src/adapters/vcs-host/github.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAA+D,MAAM,YAAY,CAAC;AAEvG,eAAO,MAAM,aAAa,EAAE,OAqE3B,CAAC;AAEF,eAAe,aAAa,CAAC"}
@@ -0,0 +1,42 @@
1
+ import type { AdapterBase } from '../base.ts';
2
+ export interface GenericComment {
3
+ id: string | number;
4
+ author: string;
5
+ body: string;
6
+ path?: string;
7
+ line?: number;
8
+ url?: string;
9
+ }
10
+ export interface PrMetadata {
11
+ title: string;
12
+ body: string;
13
+ files: string[];
14
+ headSha: string;
15
+ baseRef: string;
16
+ headRef: string;
17
+ }
18
+ export interface CreatePrOptions {
19
+ title: string;
20
+ body: string;
21
+ base: string;
22
+ head: string;
23
+ draft?: boolean;
24
+ idempotencyKey?: string;
25
+ }
26
+ export interface CreatePrResult {
27
+ number: number;
28
+ url: string;
29
+ alreadyExisted: boolean;
30
+ }
31
+ export interface VcsHost extends AdapterBase {
32
+ getPrDiff(pr: number | string): Promise<string>;
33
+ getPrMetadata(pr: number | string): Promise<PrMetadata>;
34
+ postComment(pr: number | string, body: string, idempotencyKey?: string): Promise<void>;
35
+ getReviewComments(pr: number | string): Promise<GenericComment[]>;
36
+ replyToComment(pr: number | string, commentId: string | number, body: string, idempotencyKey?: string): Promise<void>;
37
+ createPr(opts: CreatePrOptions): Promise<CreatePrResult>;
38
+ push(branch: string, opts?: {
39
+ setUpstream?: boolean;
40
+ }): Promise<void>;
41
+ }
42
+ //# sourceMappingURL=types.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/adapters/vcs-host/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,cAAc,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,OAAQ,SAAQ,WAAW;IAC1C,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAChD,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACxD,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvF,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAClE,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtH,QAAQ,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACzD,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACvE"}
@@ -0,0 +1,47 @@
1
+ /**
2
+ * Resolves the canonical package root directory from the perspective of any
3
+ * source file in the package. Robust under both source (`src/cli/foo.ts` →
4
+ * `<root>`) and compiled (`dist/src/cli/foo.js` → `<root>`) layouts.
5
+ *
6
+ * Background: every site that hardcoded `path.resolve(dirname(fileURLToPath(...)), '..', '..')`
7
+ * worked when called from the source layout but resolved one level shallow under
8
+ * the compiled output (landing in `dist/` instead of the package root). The
9
+ * real-world soak against `npx @delegance/claude-autopilot@alpha init` surfaced
10
+ * this — `init` couldn't find `presets/<name>/guardrail.config.yaml` because it
11
+ * was looking at `dist/presets/...` (which doesn't exist; presets ship at the
12
+ * package root).
13
+ *
14
+ * This helper walks up from the caller's `import.meta.url` looking for the
15
+ * `@delegance/claude-autopilot` package.json. Both source and compiled callers
16
+ * land in the same place.
17
+ */
18
+ /**
19
+ * Walks up from the caller's location looking for the package.json that
20
+ * declares `name === '@delegance/claude-autopilot'`. Returns the directory
21
+ * containing that package.json, or null if not found within `maxDepth` levels.
22
+ */
23
+ export declare function findPackageRoot(callerImportMetaUrl: string, maxDepth?: number): string | null;
24
+ /**
25
+ * Throws a clear error if the package root can't be located. Use at sites that
26
+ * absolutely require the root (e.g. preset config lookup).
27
+ */
28
+ export declare function requirePackageRoot(callerImportMetaUrl: string): string;
29
+ /**
30
+ * Resolve a sibling-module path for dynamic `import()` that works under both
31
+ * source (caller is `.ts`) and compiled (caller is `.js`) layouts.
32
+ *
33
+ * Background: `import('./rules/foo.ts')` and `import('./review-engine/auto.ts')`
34
+ * are dynamic-import string literals — TS's `rewriteRelativeImportExtensions`
35
+ * only rewrites STATIC imports, leaving these string refs as `.ts` post-compile.
36
+ * Under compiled output, the actual module is `.js`, so the import fails with
37
+ * `Failed to import adapter from .../auto.ts`.
38
+ *
39
+ * This helper detects whether the caller is itself compiled (`.js`/`.mjs`) and
40
+ * rewrites the ref's extension to match.
41
+ *
42
+ * @param ref Sibling-module ref ending in `.ts` (e.g. `./review-engine/auto.ts`).
43
+ * @param callerImportMetaUrl Caller's `import.meta.url`.
44
+ * @returns Absolute filesystem path suitable for `import()`.
45
+ */
46
+ export declare function resolveSiblingModule(ref: string, callerImportMetaUrl: string): string;
47
+ //# sourceMappingURL=_pkg-root.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"_pkg-root.d.ts","sourceRoot":"","sources":["../../../src/cli/_pkg-root.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAQH;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,mBAAmB,EAAE,MAAM,EAAE,QAAQ,SAAK,GAAG,MAAM,GAAG,IAAI,CAiBzF;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,mBAAmB,EAAE,MAAM,GAAG,MAAM,CAStE;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,GAAG,MAAM,CAIrF"}
@@ -0,0 +1,3 @@
1
+ export declare function buildAutoregressArgs(args: string[]): string[];
2
+ export declare function runAutoregress(args: string[]): number;
3
+ //# sourceMappingURL=autoregress-bridge.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"autoregress-bridge.d.ts","sourceRoot":"","sources":["../../../src/cli/autoregress-bridge.ts"],"names":[],"mappings":"AAUA,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAI7D;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CAarD"}
@@ -0,0 +1,7 @@
1
+ export interface BaselineCommandOptions {
2
+ cwd?: string;
3
+ note?: string;
4
+ baselinePath?: string;
5
+ }
6
+ export declare function runBaseline(sub: string, options?: BaselineCommandOptions): Promise<number>;
7
+ //# sourceMappingURL=baseline.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"baseline.d.ts","sourceRoot":"","sources":["../../../src/cli/baseline.ts"],"names":[],"mappings":"AAcA,MAAM,WAAW,sBAAsB;IACrC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,wBAAsB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,sBAA2B,GAAG,OAAO,CAAC,MAAM,CAAC,CAyFpG"}
@@ -0,0 +1,23 @@
1
+ export interface CiCommandOptions {
2
+ cwd?: string;
3
+ configPath?: string;
4
+ base?: string;
5
+ postComments?: boolean;
6
+ sarifOutput?: string;
7
+ diff?: boolean;
8
+ inlineComments?: boolean;
9
+ newOnly?: boolean;
10
+ failOn?: 'critical' | 'warning' | 'note' | 'none';
11
+ }
12
+ /**
13
+ * `guardrail ci` — opinionated single-command CI entrypoint.
14
+ *
15
+ * Defaults:
16
+ * base GITHUB_BASE_REF → HEAD~1
17
+ * output guardrail.sarif
18
+ * post-comments true
19
+ * fail-on critical (or policy.failOn from config)
20
+ * new-only false (or policy.newOnly from config)
21
+ */
22
+ export declare function runCi(options?: CiCommandOptions): Promise<number>;
23
+ //# sourceMappingURL=ci.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"ci.d.ts","sourceRoot":"","sources":["../../../src/cli/ci.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,gBAAgB;IAC/B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,UAAU,GAAG,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC;CACnD;AAED;;;;;;;;;GASG;AACH,wBAAsB,KAAK,CAAC,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAAC,MAAM,CAAC,CAoB3E"}
@@ -0,0 +1,2 @@
1
+ export declare function runCosts(cwd?: string): Promise<number>;
2
+ //# sourceMappingURL=costs.d.ts.map