@fitsummehari/mergeguard 0.1.0

package/src/review.js

@@ -0,0 +1,137 @@
+import { loadConfig, normalizeConfig } from "./config.js";
+import { collectChangedFiles, repositoryInfo, repositoryRoot, resolveReviewScope } from "./git.js";
+import { buildRepositoryContext, contextForCandidate } from "./context.js";
+import { diffRegressionCandidates, patternCandidates, staticSignals } from "./detectors/patterns.js";
+import { repositoryAwareCandidates } from "./detectors/repository.js";
+import { verifyCandidates } from "./verifiers/index.js";
+import { dedupe, isAtLeastSeverity, matchesAnyGlob, severityRank } from "./utils.js";
+import { stripControlChars } from "./paths.js";
+import { VERSION } from "./version.js";
+
+/**
+ * Review a Git change set and return structured findings.
+ * @param {object} [options]
+ * @param {string} [options.cwd]
+ * @param {string} [options.base]
+ * @param {string} [options.head]
+ * @param {boolean} [options.staged]
+ * @param {boolean} [options.push]
+ * @returns {Promise<import("./types.js").ReviewResult>}
+ */
+export async function review(options = {}) {
+  const root = repositoryRoot(options.cwd || process.cwd());
+  const loaded = loadConfig(root, options.configPath);
+  const config = applyOverrides(loaded.config, options);
+  const scope = resolveReviewScope(root, options);
+  const changed = collectChangedFiles(root, scope, {
+    maxFiles: config.maxFiles,
+    includeUntracked: options.includeUntracked !== false,
+    ignore: config.ignore,
+  });
+  const files = changed.files;
+  const warnings = [...(loaded.warnings || [])];
+  if (changed.truncated) warnings.push(`${changed.totalFiles} files changed; only the first ${config.maxFiles} were analyzed.`);
+
+  const repoContext = buildRepositoryContext(root, files, config);
+  let candidates = [
+    ...patternCandidates(files, { maxCandidates: config.maxCandidates }),
+    ...diffRegressionCandidates(files),
+    ...repositoryAwareCandidates(repoContext, files),
+  ];
+  candidates = dedupeCandidates(candidates)
+    .filter((candidate) => config.categories[candidate.category] !== false)
+    .sort((a, b) => severityRank(a.severity) - severityRank(b.severity) || (b.reviewerConfidence || 0) - (a.reviewerConfidence || 0))
+    .slice(0, config.maxCandidates);
+
+  const verification = await verifyCandidates(
+    candidates,
+    (candidate) => contextForCandidate(repoContext, candidate, config),
+    config,
+    { onWarning: (warning) => warnings.push(warning) },
+  );
+  const findings = verification.findings.map(sanitizeFinding);
+  const summary = summarize(files, findings, changed.totalFiles, changed.ignoredFiles);
+  const blocking = findings.some((finding) => isAtLeastSeverity(finding.severity, config.failOn));
+  const info = repositoryInfo(root);
+  return {
+    version: VERSION,
+    passed: !blocking,
+    blocking,
+    failOn: config.failOn,
+    repository: { root, branch: info.branch, headSha: info.headSha, remoteUrl: info.remoteUrl, stack: repoContext.stack, languages: repoContext.languages },
+    scope: { mode: scope.mode, label: scope.label, baseRef: scope.baseRef, headRef: scope.headRef },
+    config: { path: loaded.path, failOn: config.failOn, confidence: config.confidence, verifier: config.verifier },
+    verifier: verification.provider,
+    findings,
+    signals: staticSignals(files),
+    summary,
+    warnings,
+    metadata: { filesReviewed: files.length, candidateCount: candidates.length, truncated: changed.truncated },
+  };
+}
+
+export async function reviewChangeSet({ root, files, scope = { mode: "synthetic", label: "provided change set" }, config: inputConfig = {}, repository = {} }) {
+  const config = normalizeConfig(inputConfig);
+  const filtered = files.filter((file) => !matchesAnyGlob(file.path, config.ignore));
+  const repoContext = buildRepositoryContext(root, filtered, config);
+  let candidates = [...patternCandidates(filtered, { maxCandidates: config.maxCandidates }), ...diffRegressionCandidates(filtered), ...repositoryAwareCandidates(repoContext, filtered)];
+  candidates = dedupeCandidates(candidates).filter((item) => config.categories[item.category] !== false).slice(0, config.maxCandidates);
+  const verification = await verifyCandidates(candidates, (candidate) => contextForCandidate(repoContext, candidate, config), config);
+  const findings = verification.findings.map(sanitizeFinding);
+  const blocking = findings.some((f) => isAtLeastSeverity(f.severity, config.failOn));
+  return {
+    version: VERSION,
+    passed: !blocking,
+    blocking,
+    failOn: config.failOn,
+    repository: { root, ...repository, stack: repoContext.stack, languages: repoContext.languages },
+    scope,
+    config: { failOn: config.failOn, confidence: config.confidence, verifier: config.verifier },
+    verifier: verification.provider,
+    findings,
+    signals: staticSignals(filtered),
+    summary: summarize(filtered, findings, files.length),
+    warnings: [],
+    metadata: { filesReviewed: filtered.length, candidateCount: candidates.length, truncated: false },
+  };
+}
+
+function applyOverrides(base, options) {
+  const config = structuredClone(base);
+  if (options.failOn) config.failOn = String(options.failOn).toLowerCase();
+  if (options.verifier) config.verifier = options.verifier === "deterministic" ? "offline" : options.verifier;
+  if (options.noAi) config.verifier = "offline";
+  if (Number.isFinite(options.confidence)) config.confidence = Number(options.confidence);
+  if (Number.isInteger(options.maxFiles) && options.maxFiles > 0) config.maxFiles = options.maxFiles;
+  if (Number.isInteger(options.maxCandidates) && options.maxCandidates > 0) config.maxCandidates = options.maxCandidates;
+  return config;
+}
+
+function dedupeCandidates(candidates) {
+  return dedupe(candidates, (item) => {
+    const detector = item.detector || item.title;
+    const family = /check-then-create|read-check-write|repo-no-unique-protection/.test(detector)
+      ? "concurrency-race"
+      : /auth-protection-removed|repo-sensitive-route-no-auth|allow-anonymous/.test(detector)
+        ? "authorization-boundary"
+        : detector;
+    return `${item.file}:${item.startLine || 0}:${family}`;
+  });
+}
+
+function summarize(files, findings, totalChangedFiles, ignoredFiles = 0) {
+  const summary = { filesReviewed: files.length, totalChangedFiles, ignoredFiles, findings: findings.length, critical: 0, high: 0, medium: 0, low: 0, info: 0 };
+  for (const finding of findings) summary[finding.severity]++;
+  return summary;
+}
+
+function sanitizeFinding(finding) {
+  return {
+    ...finding,
+    title: stripControlChars(finding.title),
+    description: stripControlChars(finding.description),
+    remediation: finding.remediation ? stripControlChars(finding.remediation) : finding.remediation,
+    file: stripControlChars(finding.file),
+    evidence: (finding.evidence || []).map((item) => stripControlChars(item)),
+  };
+}

package/src/types.js

@@ -0,0 +1,36 @@
+/**
+ * Public review contracts. The CLI is a wrapper around {@link review}.
+ *
+ * @typedef {"critical"|"high"|"medium"|"low"|"info"} Severity
+ * @typedef {"correctness"|"security"|"concurrency"|"database"|"authorization"|"tenant-isolation"|"reliability"|"performance"|"api"} Category
+ *
+ * @typedef {object} ChangedFile
+ * @property {string} path
+ * @property {"added"|"modified"|"deleted"|"renamed"} status
+ * @property {string} [patch]
+ * @property {string} [headContent]
+ * @property {string} [baseContent]
+ *
+ * @typedef {object} Finding
+ * @property {string} id
+ * @property {string} detector
+ * @property {Category} category
+ * @property {Severity} severity
+ * @property {string} title
+ * @property {string} description
+ * @property {string} file
+ * @property {number} [startLine]
+ * @property {string[]} [evidence]
+ * @property {string} [remediation]
+ * @property {number} confidence
+ *
+ * @typedef {object} ReviewResult
+ * @property {string} version
+ * @property {boolean} passed
+ * @property {boolean} blocking
+ * @property {Finding[]} findings
+ * @property {object} summary
+ * @property {object} metadata
+ */
+
+export {};

package/src/utils.js

@@ -0,0 +1,183 @@
+import { createHash } from "node:crypto";
+import { existsSync, readFileSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+
+export const SEVERITIES = ["critical", "high", "medium", "low", "info"];
+export const CATEGORIES = [
+  "correctness",
+  "security",
+  "concurrency",
+  "database",
+  "authorization",
+  "tenant-isolation",
+  "reliability",
+  "performance",
+  "api",
+];
+
+export function stableId(parts) {
+  const text = Array.isArray(parts) ? parts.join("|") : String(parts);
+  return createHash("sha1").update(text).digest("hex").slice(0, 16);
+}
+
+export function clamp01(value) {
+  const n = Number(value);
+  if (!Number.isFinite(n)) return 0;
+  return Math.max(0, Math.min(1, n));
+}
+
+export function severityRank(severity) {
+  const index = SEVERITIES.indexOf(severity);
+  return index === -1 ? 99 : index;
+}
+
+export function isAtLeastSeverity(severity, threshold) {
+  if (!threshold || threshold === "none") return false;
+  return severityRank(severity) <= severityRank(threshold);
+}
+
+export function findUp(filename, start = process.cwd()) {
+  let current = resolve(start);
+  for (;;) {
+    const candidate = resolve(current, filename);
+    if (existsSync(candidate)) return candidate;
+    const parent = dirname(current);
+    if (parent === current) return undefined;
+    current = parent;
+  }
+}
+
+export function readText(path, maxBytes = 1_500_000) {
+  try {
+    const buffer = readFileSync(path);
+    if (buffer.includes(0)) return undefined;
+    return buffer.subarray(0, maxBytes).toString("utf8");
+  } catch {
+    return undefined;
+  }
+}
+
+export function normalizePath(path) {
+  return path.replaceAll("\\", "/").replace(/^\.\//, "");
+}
+
+export function globToRegExp(glob) {
+  const normalized = normalizePath(glob);
+  let source = "";
+  for (let i = 0; i < normalized.length; i++) {
+    const char = normalized[i];
+    if (char === "*") {
+      if (normalized[i + 1] === "*") {
+        i++;
+        if (normalized[i + 1] === "/") {
+          i++;
+          source += "(?:.*/)?";
+        } else source += ".*";
+      } else source += "[^/]*";
+    } else if (char === "?") source += "[^/]";
+    else source += char.replace(/[\\^$+?.()|{}[\]]/g, "\\$&");
+  }
+  return new RegExp(`^${source}$`);
+}
+
+export function matchesAnyGlob(path, globs = []) {
+  const normalized = normalizePath(path);
+  return globs.some((glob) => {
+    try {
+      return globToRegExp(glob).test(normalized);
+    } catch {
+      return false;
+    }
+  });
+}
+
+export function truncate(text, max = 800) {
+  if (!text) return "";
+  return text.length <= max ? text : `${text.slice(0, max - 1)}…`;
+}
+
+export function dedupe(items, keyFn) {
+  const map = new Map();
+  for (const item of items) {
+    const key = keyFn(item);
+    const existing = map.get(key);
+    if (!existing || (item.confidence ?? item.reviewerConfidence ?? 0) > (existing.confidence ?? existing.reviewerConfidence ?? 0)) {
+      map.set(key, item);
+    }
+  }
+  return [...map.values()];
+}
+
+export function parseScalar(raw) {
+  const value = raw.trim();
+  if (!value) return {};
+  if ((value.startsWith('"') && value.endsWith('"')) || (value.startsWith("'") && value.endsWith("'"))) return value.slice(1, -1);
+  if (value === "true") return true;
+  if (value === "false") return false;
+  if (value === "null" || value === "~") return null;
+  if (/^-?\d+(?:\.\d+)?$/.test(value)) return Number(value);
+  if (value.startsWith("[") && value.endsWith("]")) {
+    return value.slice(1, -1).split(",").map((x) => parseScalar(x)).filter((x) => x !== "");
+  }
+  return value;
+}
+
+export function parseSimpleYaml(text) {
+  const root = {};
+  const stack = [{ indent: -1, value: root }];
+  const lines = text.replace(/\t/g, "  ").split(/\r?\n/);
+  for (let index = 0; index < lines.length; index++) {
+    const original = lines[index];
+    const noComment = stripYamlComment(original);
+    if (!noComment.trim()) continue;
+    const indent = noComment.match(/^ */)[0].length;
+    const content = noComment.trim();
+    while (stack.length > 1 && indent <= stack.at(-1).indent) stack.pop();
+    const parent = stack.at(-1).value;
+    if (content.startsWith("- ")) {
+      if (!Array.isArray(parent)) throw new Error(`Unsupported YAML list placement at line ${index + 1}`);
+      parent.push(parseScalar(content.slice(2)));
+      continue;
+    }
+    const colon = content.indexOf(":");
+    if (colon < 1) throw new Error(`Invalid YAML at line ${index + 1}`);
+    const key = content.slice(0, colon).trim();
+    const rest = content.slice(colon + 1).trim();
+    if (rest) {
+      parent[key] = parseScalar(rest);
+      continue;
+    }
+    const next = nextMeaningful(lines, index + 1);
+    const child = next && next.indent > indent && next.content.startsWith("- ") ? [] : {};
+    parent[key] = child;
+    stack.push({ indent, value: child });
+  }
+  return root;
+}
+
+function nextMeaningful(lines, start) {
+  for (let i = start; i < lines.length; i++) {
+    const line = stripYamlComment(lines[i]).replace(/\t/g, "  ");
+    if (!line.trim()) continue;
+    return { indent: line.match(/^ */)[0].length, content: line.trim() };
+  }
+  return undefined;
+}
+
+function stripYamlComment(line) {
+  let quote = null;
+  for (let i = 0; i < line.length; i++) {
+    const char = line[i];
+    if ((char === '"' || char === "'") && line[i - 1] !== "\\") quote = quote === char ? null : quote || char;
+    if (char === "#" && !quote) return line.slice(0, i);
+  }
+  return line;
+}
+
+export function pathLineSnippet(content, line, radius = 2) {
+  if (!content || !line) return undefined;
+  const lines = content.split(/\r?\n/);
+  const start = Math.max(0, line - 1 - radius);
+  const end = Math.min(lines.length, line + radius);
+  return lines.slice(start, end).map((value, i) => `${String(start + i + 1).padStart(5)} | ${value}`).join("\n");
+}

package/src/verifiers/index.js

@@ -0,0 +1,48 @@
+import { stableId, clamp01 } from "../utils.js";
+import { offlineVerify } from "./offline.js";
+import { detectLaya, verifyWithLaya } from "./laya.js";
+import { verifyWithJev } from "./jev.js";
+
+export function resolveVerifier(config = {}) {
+  const configured = config.verifier === "deterministic" ? "offline" : (config.verifier || "offline");
+  if (configured === "auto") {
+    const laya = detectLaya(config);
+    return {
+      configured: "auto",
+      effective: laya.available ? "laya" : "offline",
+      reason: laya.available ? "Laya is installed" : "Laya is not installed",
+    };
+  }
+  return { configured, effective: configured, reason: "explicit configuration" };
+}
+
+export async function verifyCandidates(candidates, contextFor, config, { onWarning } = {}) {
+  const items = candidates.map((candidate) => ({ candidate, context: contextFor(candidate) }));
+  let verifications;
+  const resolved = resolveVerifier(config);
+  let provider = resolved.effective;
+
+  if (provider === "laya") {
+    try { verifications = verifyWithLaya(items, config); }
+    catch (error) {
+      if (config.verifier === "laya") throw error;
+      onWarning?.(`Laya unavailable; falling back to deterministic verification (${error.message})`);
+      provider = "offline";
+    }
+  }
+  if (provider === "jev") verifications = await verifyWithJev(items, config);
+  if (!verifications) verifications = items.map(({candidate,context}) => offlineVerify(candidate,context,config));
+
+  const findings=[];
+  for(let i=0;i<candidates.length;i++){
+    const candidate=candidates[i], verification=verifications[i];
+    if(verification.verdict!=="report") continue;
+    const confidence=clamp01((candidate.reviewerConfidence??.6)*.34+verification.plausible*.24+verification.reachable*.12+(1-verification.existingProtection)*.10+verification.worthReporting*.20);
+    findings.push({...candidate,id:candidate.id||stableId([candidate.file,candidate.detector||candidate.title,String(candidate.startLine||0)]),confidence:Number(confidence.toFixed(3)),verification});
+  }
+  findings.sort((a,b)=>severityScore(b.severity)-severityScore(a.severity)||b.confidence-a.confidence);
+  return { findings, provider };
+}
+
+function severityScore(s){return {critical:5,high:4,medium:3,low:2,info:1}[s]||0;}
+export { detectLaya, detectPython, LAYA_MISSING_MESSAGE } from "./laya.js";

package/src/verifiers/jev.js

@@ -0,0 +1,75 @@
+import { verificationQuestions, IMPACT_LABELS } from "./questions.js";
+import { clamp01 } from "../utils.js";
+
+export async function verifyWithJev(items, config) {
+  const key = process.env.TYPESAFE_API_KEY || process.env.JEV_API_KEY;
+  if (!key) throw new Error("Jev verifier selected but TYPESAFE_API_KEY or JEV_API_KEY is not set.");
+  const timeoutMs = Number(process.env.MERGEGUARD_JEV_TIMEOUT_MS || 30_000);
+  const out = [];
+  for (const { candidate, context } of items) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    let response;
+    try {
+      response = await fetch(config.jev.url, {
+        method: "POST",
+        headers: { Authorization: `Bearer ${key}`, "Content-Type": "application/json" },
+        body: JSON.stringify({ model: config.jev.model, state: context, questions: verificationQuestions }),
+        signal: controller.signal,
+      });
+    } catch (error) {
+      if (error?.name === "AbortError") throw new Error(`Jev verification timed out after ${timeoutMs}ms`);
+      throw new Error("Jev verification request failed");
+    } finally {
+      clearTimeout(timer);
+    }
+    if (!response.ok) throw new Error(`Jev verification failed with HTTP ${response.status}`);
+    let json;
+    try {
+      json = await response.json();
+    } catch {
+      throw new Error("Jev verification returned invalid JSON");
+    }
+    out.push(normalize(candidate, json.answers || {}, config));
+  }
+  return out;
+}
+
+function normalize(candidate, answers, config) {
+  const noul = (key, fallback) => typeof answers[key]?.noul === "number" ? answers[key].noul : fallback;
+  const plausible = noul("plausible", candidate.reviewerConfidence ?? 0.6);
+  const reachable = noul("reachable", 0.68);
+  const existingProtection = noul("protected", 0.2);
+  const worthReporting = noul("report", candidate.reviewerConfidence ?? 0.6);
+  const impact = scoreTo01(answers.severe, candidate.severity);
+  const strength = plausible * 0.31 + reachable * 0.18 + impact * 0.12 + (1 - existingProtection) * 0.14 + worthReporting * 0.25;
+  return {
+    plausible: r(plausible),
+    reachable: r(reachable),
+    impact: r(impact),
+    existingProtection: r(existingProtection),
+    worthReporting: r(worthReporting),
+    strength: r(strength),
+    verdict: strength >= config.confidence ? "report" : "suppress",
+    provider: "jev",
+  };
+}
+
+function scoreTo01(answer, severity) {
+  if (typeof answer?.score === "number") return answer.score > 1 ? Math.min(1, answer.score / 4) : clamp01(answer.score);
+  if (answer?.choice) return IMPACT_LABELS[answer.choice] ?? 0.55;
+  if (answer?.probabilities && typeof answer.probabilities === "object") {
+    let sum = 0;
+    let total = 0;
+    for (const [label, probability] of Object.entries(answer.probabilities)) {
+      if (Object.hasOwn(IMPACT_LABELS, label) && typeof probability === "number") {
+        sum += IMPACT_LABELS[label] * probability;
+        total += probability;
+      }
+    }
+    if (total) return sum / total;
+  }
+  return { critical: 1, high: 0.8, medium: 0.55, low: 0.3, info: 0.15 }[severity] ?? 0.55;
+}
+
+function r(value) { return Number(clamp01(value).toFixed(3)); }

package/src/verifiers/laya.js

@@ -0,0 +1,131 @@
+import { spawnSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import { verificationQuestions, IMPACT_LABELS } from "./questions.js";
+import { clamp01 } from "../utils.js";
+
+const bridgePath = fileURLToPath(new URL("../../scripts/laya_bridge.py", import.meta.url));
+
+export const LAYA_MISSING_MESSAGE = `Laya verification was requested but Laya is not installed.
+
+Install:
+  python -m pip install laya
+
+Then verify:
+  mergeguard doctor
+
+Or use:
+  mergeguard review --verifier offline`;
+
+export function detectPython(config = { laya: {} }) {
+  for (const spec of pythonCommands(config)) {
+    const check = spawnSync(spec.command, [...spec.prefix, "--version"], {
+      encoding: "utf8",
+      timeout: 5000,
+      windowsHide: true,
+    });
+    const text = `${check.stdout || ""}${check.stderr || ""}`.trim();
+    if (check.status === 0 && /python/i.test(text)) {
+      return { available: true, command: spec.command, prefix: spec.prefix, version: text.split("\n")[0] };
+    }
+  }
+  return { available: false };
+}
+
+export function detectLaya(config = { laya: {} }) {
+  for (const spec of pythonCommands(config)) {
+    const check = spawnSync(spec.command, [...spec.prefix, "-c", "import laya; print(getattr(laya, '__version__', 'installed'))"], {
+      encoding: "utf8",
+      timeout: 8000,
+      windowsHide: true,
+    });
+    if (check.status === 0) return { available: true, command: spec.command, prefix: spec.prefix, version: (check.stdout || "").trim() || "installed" };
+  }
+  return { available: false };
+}
+
+export function verifyWithLaya(items, config) {
+  const detected = detectLaya(config);
+  if (!detected.available) {
+    throw new Error(LAYA_MISSING_MESSAGE);
+  }
+  const payload = {
+    model: config.laya?.model || null,
+    max_len: config.laya?.maxLen || 4096,
+    questions: verificationQuestions,
+    items: items.map(({ candidate, context }) => ({ id: candidate.id, state: context })),
+  };
+  const timeout = Number(process.env.MERGEGUARD_LAYA_TIMEOUT_MS || 180_000);
+  const result = spawnSync(detected.command, [...detected.prefix, bridgePath], {
+    input: JSON.stringify(payload),
+    encoding: "utf8",
+    maxBuffer: 32 * 1024 * 1024,
+    timeout,
+    windowsHide: true,
+  });
+  if (result.error?.code === "ETIMEDOUT" || result.signal === "SIGTERM") {
+    throw new Error(`Laya verification timed out after ${timeout}ms`);
+  }
+  if (result.status !== 0) {
+    const detail = truncateMessage(result.stderr || result.stdout || result.error?.message || "unknown error");
+    throw new Error(`Laya verification failed: ${detail}`);
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse((result.stdout || "").trim());
+  } catch {
+    throw new Error(`Laya returned invalid JSON: ${truncateMessage(result.stdout)}`);
+  }
+  const byId = new Map((parsed.items || []).map((item) => [item.id, item]));
+  return items.map(({ candidate }) => normalizeLaya(candidate, byId.get(candidate.id)?.answers || {}, config));
+}
+
+function normalizeLaya(candidate, answers, config) {
+  const noul = (key, fallback) => typeof answers[key]?.noul === "number" ? answers[key].noul : fallback;
+  const plausible = noul("plausible", candidate.reviewerConfidence ?? 0.6);
+  const reachable = noul("reachable", 0.68);
+  const existingProtection = noul("protected", 0.2);
+  const worthReporting = noul("report", candidate.reviewerConfidence ?? 0.6);
+  const impact = scoreTo01(answers.severe, candidate.severity);
+  const strength = plausible * 0.31 + reachable * 0.18 + impact * 0.12 + (1 - existingProtection) * 0.14 + worthReporting * 0.25;
+  return {
+    plausible: round(plausible),
+    reachable: round(reachable),
+    impact: round(impact),
+    existingProtection: round(existingProtection),
+    worthReporting: round(worthReporting),
+    strength: round(strength),
+    verdict: strength >= config.confidence ? "report" : "suppress",
+    provider: "laya",
+  };
+}
+
+function scoreTo01(answer, severity) {
+  if (typeof answer?.score === "number") return answer.score > 1 ? Math.min(1, answer.score / 4) : clamp01(answer.score);
+  if (answer?.choice) return IMPACT_LABELS[answer.choice] ?? 0.55;
+  if (answer?.probabilities && typeof answer.probabilities === "object") {
+    let sum = 0;
+    let total = 0;
+    for (const [label, probability] of Object.entries(answer.probabilities)) {
+      if (Object.hasOwn(IMPACT_LABELS, label) && typeof probability === "number") {
+        sum += IMPACT_LABELS[label] * probability;
+        total += probability;
+      }
+    }
+    if (total) return sum / total;
+  }
+  return { critical: 1, high: 0.8, medium: 0.55, low: 0.3, info: 0.15 }[severity] ?? 0.55;
+}
+
+function pythonCommands(config) {
+  const explicit = config?.laya?.python || process.env.MERGEGUARD_PYTHON;
+  if (explicit) return [{ command: explicit, prefix: [] }];
+  return process.platform === "win32"
+    ? [{ command: "py", prefix: ["-3"] }, { command: "python", prefix: [] }]
+    : [{ command: "python3", prefix: [] }, { command: "python", prefix: [] }];
+}
+
+function round(value) { return Number(clamp01(value).toFixed(3)); }
+
+function truncateMessage(text) {
+  return String(text || "").replace(/\s+/g, " ").trim().slice(0, 400);
+}

package/src/verifiers/offline.js

@@ -0,0 +1,42 @@
+import { clamp01 } from "../utils.js";
+
+const IMPACT = { critical: 1, high: 0.8, medium: 0.55, low: 0.3, info: 0.15 };
+
+export function offlineVerify(candidate, context, config) {
+  let plausible = candidate.reviewerConfidence ?? 0.6;
+  let reachable = 0.68;
+  let existingProtection = 0.12;
+  let worthReporting = plausible;
+  const protection = context?.repository?.protections || {};
+  const filesText = (context?.files || []).map((file) => file.content).join("\n");
+
+  if (/check-then-create|read-check-write/.test(candidate.detector || "")) {
+    if (protection.uniqueness && /@unique|unique\s*:\s*true|UNIQUE|UniqueConstraint|unique_together/i.test(filesText)) existingProtection = Math.max(existingProtection, 0.68);
+    if (protection.transaction && /transaction|\$transaction|atomic|BeginTransaction|@Transactional/i.test(filesText)) existingProtection = Math.max(existingProtection, 0.58);
+    reachable = 0.78;
+  }
+  if (/multiple-writes|transaction-boundary-removed/.test(candidate.detector || "")) {
+    if (/\$transaction|transaction\.atomic|@Transactional|BeginTransaction|BEGIN\s+TRANSACTION/i.test(filesText)) existingProtection = Math.max(existingProtection, 0.78);
+  }
+  if (candidate.category === "authorization") {
+    if (/APP_GUARD|global.*guard|UseAuthentication|UseAuthorization/i.test(filesText) && !/removed|bypass|anonymous/i.test(candidate.title)) existingProtection = Math.max(existingProtection, 0.65);
+    reachable = 0.76;
+  }
+  if (candidate.category === "tenant-isolation") reachable = 0.82;
+  if (/tls-disabled|unbounded-delete|unsafe-sql|dynamic-eval|tenant-filter-removed|uniqueness-removed/.test(candidate.detector || "")) {
+    plausible = Math.max(plausible, 0.9);
+    worthReporting = Math.max(worthReporting, 0.9);
+    reachable = Math.max(reachable, 0.75);
+    existingProtection = Math.min(existingProtection, 0.15);
+  }
+  if (/hardcoded-localhost|unbounded-parallelism|blocking-index|floating-promise|cors-wildcard/.test(candidate.detector || "")) worthReporting *= 0.78;
+
+  const impact = IMPACT[candidate.severity] ?? 0.55;
+  const strength = plausible * 0.31 + reachable * 0.18 + impact * 0.12 + (1 - existingProtection) * 0.14 + worthReporting * 0.25;
+  const verdict = strength >= config.confidence ? "report" : "suppress";
+  return {
+    plausible: round(plausible), reachable: round(reachable), impact: round(impact), existingProtection: round(existingProtection), worthReporting: round(worthReporting), strength: round(clamp01(strength)), verdict, provider: "offline",
+  };
+}
+
+function round(value) { return Number(clamp01(value).toFixed(3)); }