@harness-engineering/cli 1.25.4 → 1.25.6

package/dist/{chunk-MI6MA6OP.js → chunk-42ZZLMYD.js}

@@ -13,13 +13,13 @@ import {
   NODE_STABILITY,
   init_dist as init_dist2,
   queryTraceability
-} from "./chunk-K2SON7TI.js";
+} from "./chunk-RDQGCHKD.js";
 import {
   __esm,
   __export
 } from "./chunk-KFQGP6VL.js";
 
-// ../core/dist/chunk-QLTIBLN5.mjs
+// ../core/dist/chunk-UWAI34RR.mjs
 import { z } from "zod";
 import { createHash } from "crypto";
 import { minimatch } from "minimatch";
@@ -1734,8 +1734,8 @@ async function toHaveMaxDepDepth(received, maxDepth) {
   };
 }
 var ArchMetricCategorySchema, ViolationSchema, MetricResultSchema, CategoryBaselineSchema, ArchBaselineSchema, CategoryRegressionSchema, ArchDiffResultSchema, ThresholdConfigSchema, ArchConfigSchema, ConstraintRuleSchema, ViolationSnapshotSchema, ViolationHistorySchema, EmergenceConfidenceSchema, EmergentConstraintSuggestionSchema, EmergenceResultSchema, accessAsync, readFileAsync, EXTENSION_BY_LANG, CircularDepsCollector, TypeScriptParser, EXTENSION_MAP, parserCache, initialized, GRAMMAR_MAP, TOP_LEVEL_TYPES, METHOD_TYPES, IDENTIFIER_TYPES, NAME_EXTRACTORS, pythonStrategy, goStrategy, RUST_USE_ARG_TYPES, RUST_PUB_ITEM_TYPES, rustStrategy, JAVA_IMPORT_TYPES, JAVA_EXPORT_TYPES, javaStrategy, STRATEGIES, TreeSitterParser, ParserRegistry, defaultRegistry, LayerViolationCollector, ArchBaselineManager, DEFAULT_THRESHOLDS, FUNCTION_PATTERNS, DECISION_PATTERNS, ComplexityCollector, DEFAULT_THRESHOLDS2, CouplingCollector, ForbiddenImportCollector, ModuleSizeCollector, DepDepthCollector, defaultCollectors, archMatchers;
-var init_chunk_QLTIBLN5 = __esm({
-  "../core/dist/chunk-QLTIBLN5.mjs"() {
+var init_chunk_UWAI34RR = __esm({
+  "../core/dist/chunk-UWAI34RR.mjs"() {
     "use strict";
     init_dist();
     ArchMetricCategorySchema = z.enum([
@@ -2780,6 +2780,7 @@ var init_chunk_QLTIBLN5 = __esm({
 var dist_exports = {};
 __export(dist_exports, {
   AGENT_DESCRIPTORS: () => AGENT_DESCRIPTORS,
+  AGREEMENT_LINE_GAP: () => AGREEMENT_LINE_GAP,
   ARCHITECTURE_DESCRIPTOR: () => ARCHITECTURE_DESCRIPTOR,
   AdjustedForecastSchema: () => AdjustedForecastSchema,
   AgentActionEmitter: () => AgentActionEmitter,
@@ -2798,6 +2799,7 @@ __export(dist_exports, {
   CACHE_TTL_MS: () => CACHE_TTL_MS,
   CINotifier: () => CINotifier,
   COMPLIANCE_DESCRIPTOR: () => COMPLIANCE_DESCRIPTOR,
+  CORROBORATED_AGREEMENT: () => CORROBORATED_AGREEMENT,
   CategoryBaselineSchema: () => CategoryBaselineSchema,
   CategoryForecastSchema: () => CategoryForecastSchema,
   CategoryRegressionSchema: () => CategoryRegressionSchema,
@@ -2823,9 +2825,11 @@ __export(dist_exports, {
   DEFAULT_STREAM_INDEX: () => DEFAULT_STREAM_INDEX,
   DEFAULT_TOKEN_BUDGET: () => DEFAULT_TOKEN_BUDGET,
   DESTRUCTIVE_BASH: () => DESTRUCTIVE_BASH,
+  DOMAIN_BASELINES: () => DOMAIN_BASELINES,
   DepDepthCollector: () => DepDepthCollector,
   DirectionSchema: () => DirectionSchema,
   EMPTY_SUPPLY_CHAIN: () => EMPTY_SUPPLY_CHAIN,
+  EVIDENCE_SATURATION: () => EVIDENCE_SATURATION,
   EXTENSION_MAP: () => EXTENSION_MAP,
   EmergenceConfidenceSchema: () => EmergenceConfidenceSchema,
   EmergenceResultSchema: () => EmergenceResultSchema,
@@ -2835,6 +2839,7 @@ __export(dist_exports, {
   EntropyConfigSchema: () => EntropyConfigSchema,
   Err: () => Err,
   ExclusionSet: () => ExclusionSet,
+  FACTOR_WEIGHTS: () => FACTOR_WEIGHTS,
   FailureEntrySchema: () => FailureEntrySchema,
   FileSink: () => FileSink,
   FindingLifecycleSchema: () => FindingLifecycleSchema,
@@ -2872,6 +2877,7 @@ __export(dist_exports, {
   SECURITY_DESCRIPTOR: () => SECURITY_DESCRIPTOR,
   SESSION_SECTION_NAMES: () => SESSION_SECTION_NAMES,
   STALENESS_WARNING_DAYS: () => STALENESS_WARNING_DAYS,
+  STANDALONE_AGREEMENT: () => STANDALONE_AGREEMENT,
   STANDARD_COGNITIVE_MODES: () => STANDARD_COGNITIVE_MODES,
   STATUS_RANK: () => STATUS_RANK,
   SecurityCategorySnapshotSchema: () => SecurityCategorySnapshotSchema,
@@ -2908,6 +2914,7 @@ __export(dist_exports, {
   TrendResultSchema: () => TrendResultSchema,
   TruncationStrategy: () => TruncationStrategy,
   TypeScriptParser: () => TypeScriptParser,
+  VALIDATION_SCORES: () => VALIDATION_SCORES,
   VALID_SCOPES: () => VALID_SCOPES,
   VERSION: () => VERSION,
   ViolationHistoryManager: () => ViolationHistoryManager,
@@ -3320,6 +3327,7 @@ import * as fs35 from "fs";
 import * as path34 from "path";
 import * as fs37 from "fs";
 import * as path36 from "path";
+import { execFileSync as execFileSync2 } from "child_process";
 import * as fs36 from "fs";
 import * as path35 from "path";
 import * as crypto4 from "crypto";
@@ -8812,6 +8820,27 @@ async function loadBudgetedLearnings(projectPath, options) {
   }
   return Ok(budgeted);
 }
+function buildEntryFromFrontmatter(line, fm) {
+  const rootCauseMatch = line.match(/\[root_cause:([^\]]+)\]/);
+  const triedMatch = line.match(/\[tried:([^\]]+)\]/);
+  return {
+    hash: fm.hash,
+    tags: fm.tags,
+    summary: line,
+    fullText: "",
+    ...rootCauseMatch?.[1] ? { rootCause: rootCauseMatch[1] } : {},
+    ...triedMatch?.[1] ? { triedAndFailed: triedMatch[1].split(",").map((s) => s.trim()) } : {}
+  };
+}
+function buildEntryFromLine(line) {
+  const idx = extractIndexEntry(line);
+  return {
+    hash: idx.hash,
+    tags: idx.tags,
+    summary: line,
+    fullText: ""
+  };
+}
 async function loadIndexEntries(projectPath, skillName, stream, session) {
   try {
     const dirResult = await getStateDir(projectPath, stream, session);
@@ -8833,31 +8862,11 @@ async function loadIndexEntries(projectPath, skillName, stream, session) {
         pendingFrontmatter = fm;
         continue;
       }
-      const isDatedBullet = /^- \*\*\d{4}-\d{2}-\d{2}/.test(line);
-      const isHeading = /^## \d{4}-\d{2}-\d{2}/.test(line);
-      if (isDatedBullet || isHeading) {
-        if (pendingFrontmatter) {
-          const rootCauseMatch = line.match(/\[root_cause:([^\]]+)\]/);
-          const triedMatch = line.match(/\[tried:([^\]]+)\]/);
-          indexEntries.push({
-            hash: pendingFrontmatter.hash,
-            tags: pendingFrontmatter.tags,
-            summary: line,
-            fullText: "",
-            // Placeholder — full text not loaded in index mode
-            ...rootCauseMatch?.[1] ? { rootCause: rootCauseMatch[1] } : {},
-            ...triedMatch?.[1] ? { triedAndFailed: triedMatch[1].split(",").map((s) => s.trim()) } : {}
-          });
-          pendingFrontmatter = null;
-        } else {
-          const idx = extractIndexEntry(line);
-          indexEntries.push({
-            hash: idx.hash,
-            tags: idx.tags,
-            summary: line,
-            fullText: ""
-          });
-        }
+      const isEntryStart = /^- \*\*\d{4}-\d{2}-\d{2}/.test(line) || /^## \d{4}-\d{2}-\d{2}/.test(line);
+      if (isEntryStart) {
+        const entry = pendingFrontmatter ? buildEntryFromFrontmatter(line, pendingFrontmatter) : buildEntryFromLine(line);
+        indexEntries.push(entry);
+        pendingFrontmatter = null;
         currentBlock = [line];
       } else if (line.trim() !== "" && currentBlock.length > 0) {
         currentBlock.push(line);
@@ -11614,50 +11623,48 @@ function buildMergedTitle(a, b, domains) {
   const cleanTitle = primaryFinding.title.replace(/^\[.*?\]\s*/, "");
   return { title: `[${domainList}] ${cleanTitle}`, primaryFinding };
 }
+function setIfDefined(target, key, value) {
+  if (value !== void 0) target[key] = value;
+}
 function mergeSecurityFields(merged, primary, a, b) {
-  const cweId = primary.cweId ?? a.cweId ?? b.cweId;
-  const owaspCategory = primary.owaspCategory ?? a.owaspCategory ?? b.owaspCategory;
-  const confidence = primary.confidence ?? a.confidence ?? b.confidence;
-  const remediation = pickLongest(a.remediation, b.remediation);
+  setIfDefined(merged, "cweId", primary.cweId ?? a.cweId ?? b.cweId);
+  setIfDefined(
+    merged,
+    "owaspCategory",
+    primary.owaspCategory ?? a.owaspCategory ?? b.owaspCategory
+  );
+  setIfDefined(merged, "confidence", primary.confidence ?? a.confidence ?? b.confidence);
+  setIfDefined(merged, "remediation", pickLongest(a.remediation, b.remediation));
   const mergedRefs = [.../* @__PURE__ */ new Set([...a.references ?? [], ...b.references ?? []])];
-  if (cweId !== void 0) merged.cweId = cweId;
-  if (owaspCategory !== void 0) merged.owaspCategory = owaspCategory;
-  if (confidence !== void 0) merged.confidence = confidence;
-  if (remediation !== void 0) merged.remediation = remediation;
   if (mergedRefs.length > 0) merged.references = mergedRefs;
 }
+function pickHigherRank(aVal, bVal, rankMap) {
+  return (rankMap[aVal] ?? 0) >= (rankMap[bVal] ?? 0) ? aVal : bVal;
+}
+function mergedLineRange(a, b) {
+  return [Math.min(a[0], b[0]), Math.max(a[1], b[1])];
+}
+function mergeTrustScore(a, b) {
+  const max = Math.max(a.trustScore ?? 0, b.trustScore ?? 0);
+  return max > 0 ? max : void 0;
+}
 function mergeFindings(a, b) {
-  const highestSeverity = SEVERITY_RANK[a.severity] >= SEVERITY_RANK[b.severity] ? a.severity : b.severity;
-  const highestValidatedBy = (VALIDATED_BY_RANK[a.validatedBy] ?? 0) >= (VALIDATED_BY_RANK[b.validatedBy] ?? 0) ? a.validatedBy : b.validatedBy;
-  const longestRationale = a.rationale.length >= b.rationale.length ? a.rationale : b.rationale;
-  const evidenceSet = /* @__PURE__ */ new Set([...a.evidence, ...b.evidence]);
-  const lineRange = [
-    Math.min(a.lineRange[0], b.lineRange[0]),
-    Math.max(a.lineRange[1], b.lineRange[1])
-  ];
   const domains = /* @__PURE__ */ new Set([a.domain, b.domain]);
-  const suggestion = pickLongest(a.suggestion, b.suggestion);
   const { title, primaryFinding } = buildMergedTitle(a, b, domains);
   const merged = {
     id: primaryFinding.id,
     file: a.file,
-    lineRange,
+    lineRange: mergedLineRange(a.lineRange, b.lineRange),
     domain: primaryFinding.domain,
-    severity: highestSeverity,
+    severity: pickHigherRank(a.severity, b.severity, SEVERITY_RANK),
     title,
-    rationale: longestRationale,
-    evidence: [...evidenceSet],
-    validatedBy: highestValidatedBy
+    rationale: a.rationale.length >= b.rationale.length ? a.rationale : b.rationale,
+    evidence: [.../* @__PURE__ */ new Set([...a.evidence, ...b.evidence])],
+    validatedBy: pickHigherRank(a.validatedBy, b.validatedBy, VALIDATED_BY_RANK)
   };
-  if (suggestion !== void 0) {
-    merged.suggestion = suggestion;
-  }
+  setIfDefined(merged, "suggestion", pickLongest(a.suggestion, b.suggestion));
+  setIfDefined(merged, "trustScore", mergeTrustScore(a, b));
   mergeSecurityFields(merged, primaryFinding, a, b);
-  const trustA = a.trustScore ?? 0;
-  const trustB = b.trustScore ?? 0;
-  if (trustA > 0 || trustB > 0) {
-    merged.trustScore = Math.max(trustA, trustB);
-  }
   return merged;
 }
 function deduplicateFindings(options) {
@@ -12004,14 +12011,15 @@ function findCorroboratedIds(findings) {
   }
   return corroborated;
 }
-function computeTrustScores(findings) {
+function computeTrustScores(findings, options) {
   if (findings.length === 0) return [];
   const corroboratedIds = findCorroboratedIds(findings);
+  const domainAccuracy = options?.domainAccuracy;
   return findings.map((finding) => {
     const validationFactor = VALIDATION_SCORES[finding.validatedBy];
     const evidenceFactor = Math.min(1, finding.evidence.length / EVIDENCE_SATURATION);
     const agreementFactor = corroboratedIds.has(finding.id) ? CORROBORATED_AGREEMENT : STANDALONE_AGREEMENT;
-    const historicalFactor = DOMAIN_BASELINES[finding.domain];
+    const historicalFactor = domainAccuracy?.[finding.domain] ?? DOMAIN_BASELINES[finding.domain];
     const raw = FACTOR_WEIGHTS.validation * validationFactor + FACTOR_WEIGHTS.evidence * evidenceFactor + FACTOR_WEIGHTS.agreement * agreementFactor + FACTOR_WEIGHTS.historical * historicalFactor;
     const trustScore = Math.round(raw * 100);
     return { ...finding, trustScore };
@@ -12255,7 +12263,8 @@ async function runReviewPipeline(options) {
     checkDepsOutput,
     config = {},
     commitHistory,
-    sessionSlug
+    sessionSlug,
+    domainAccuracy
   } = options;
   if (flags.ci && prMetadata) {
     const eligibility = checkEligibility(prMetadata, true);
@@ -12375,7 +12384,10 @@ async function runReviewPipeline(options) {
     projectRoot,
     fileContents
   });
-  const scoredFindings = computeTrustScores(validatedFindings);
+  const scoredFindings = computeTrustScores(
+    validatedFindings,
+    domainAccuracy ? { domainAccuracy } : void 0
+  );
   let evidenceCoverage;
   if (sessionSlug) {
     try {
@@ -13849,23 +13861,54 @@ function getOrCreateInstallId(projectRoot) {
   fs36.writeFileSync(installIdFile, id, { encoding: "utf-8", mode: 384 });
   return id;
 }
-function readIdentity(projectRoot) {
-  const filePath = path36.join(projectRoot, ".harness", "telemetry.json");
+function parseIdentityFromTelemetryFile(filePath) {
+  const identity = {};
   try {
     const raw = fs37.readFileSync(filePath, "utf-8");
     const parsed = JSON.parse(raw);
-    if (parsed && typeof parsed === "object" && parsed.identity) {
-      const { project, team, alias } = parsed.identity;
-      const identity = {};
-      if (typeof project === "string") identity.project = project;
-      if (typeof team === "string") identity.team = team;
-      if (typeof alias === "string") identity.alias = alias;
-      return identity;
-    }
-    return {};
+    const src = parsed?.identity;
+    if (!src || typeof src !== "object") return identity;
+    if (typeof src.project === "string") identity.project = src.project;
+    if (typeof src.team === "string") identity.team = src.team;
+    if (typeof src.alias === "string") identity.alias = src.alias;
   } catch {
-    return {};
   }
+  return identity;
+}
+function readProjectNameFallback(configPath) {
+  try {
+    const raw = fs37.readFileSync(configPath, "utf-8");
+    const config = JSON.parse(raw);
+    return typeof config?.name === "string" ? config.name : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function readGitAliasFallback(cwd) {
+  try {
+    const gitName = execFileSync2("git", ["config", "user.name"], {
+      cwd,
+      encoding: "utf-8",
+      timeout: 2e3,
+      stdio: ["pipe", "pipe", "pipe"]
+    }).trim();
+    return gitName || void 0;
+  } catch {
+    return void 0;
+  }
+}
+function readIdentity(projectRoot) {
+  const filePath = path36.join(projectRoot, ".harness", "telemetry.json");
+  const identity = parseIdentityFromTelemetryFile(filePath);
+  if (!identity.project) {
+    const fallbackProject = readProjectNameFallback(path36.join(projectRoot, "harness.config.json"));
+    if (fallbackProject) identity.project = fallbackProject;
+  }
+  if (!identity.alias) {
+    const fallbackAlias = readGitAliasFallback(projectRoot);
+    if (fallbackAlias) identity.alias = fallbackAlias;
+  }
+  return identity;
 }
 function resolveConsent(projectRoot, config) {
   if (process.env.DO_NOT_TRACK === "1") return { allowed: false };
@@ -13887,7 +13930,7 @@ function collectEvents(projectRoot, consent) {
   return records.map(
     (record) => ({
       event: "skill_invocation",
-      distinctId,
+      distinct_id: distinctId,
       timestamp: record.startedAt,
       properties: {
         installId,
@@ -13928,10 +13971,10 @@ async function send(events, apiKey) {
     }
   }
 }
-var VALID_TYPES, CONVENTIONAL_PATTERN, DEFAULT_AGNIX_TIMEOUT_MS, HARNESS_AGNIX_DISABLE, HARNESS_AGNIX_BIN, CLAUDE_MD_WARN_BYTES, CLAUDE_MD_ERROR_BYTES, CONTEXT_FILES, MIN_DESCRIPTION_LENGTH, SETTINGS_PATHS, KNOWN_HOOK_EVENTS, MCP_SETTINGS_FILES, REQUIRED_SECTIONS, SETTINGS_FILES, KNOWN_AGNIX_TOOLS, DEFAULT_SECTIONS, DEFAULT_RATIOS, NODE_TYPE_TO_CATEGORY, SECTION_LEVEL_MAP, DEFAULT_LEVEL, DEFAULT_BUDGET, DEFAULT_LOADER_CONFIG, LEVEL_FRACTIONS, PHASE_PRIORITIES, ManifestSchema, BundleConstraintsSchema, BundleSchema, ContributionsSchema, LockfilePackageSchema, LockfileSchema, SharableLayerSchema, SharableForbiddenImportSchema, SharableBoundaryConfigSchema, SharableSecurityRulesSchema, VALID_SCOPES, LINE_PATTERN, START_PATTERN, END_PATTERN, CODE_BLOCK_LANGUAGES, DEFAULT_DRIFT_CONFIG, FILE_TYPES, EXPORT_TYPES, CONVENTION_DESCRIPTIONS, RULE_CHECKERS, EntropyAnalyzer, readFile42, writeFile32, unlink22, mkdir22, copyFile2, DEFAULT_FIX_CONFIG, EXPORT_TYPE_KEYWORD, ALWAYS_UNSAFE_TYPES, idCounter, DEAD_CODE_FIX_ACTIONS, MustExportRuleSchema, MustExportDefaultRuleSchema, NoExportRuleSchema, MustImportRuleSchema, NoImportRuleSchema, NamingRuleSchema, MaxExportsRuleSchema, MaxLinesRuleSchema, RequireJSDocRuleSchema, RuleSchema, ConfigPatternSchema, PatternConfigSchema, DriftConfigSchema, DeadCodeConfigSchema, EntropyConfigSchema, BaselineManager, BenchmarkRunner, RegressionDetector, SKIP_DIRS, SOURCE_EXTENSIONS, FUNCTION_DECL_RE, CONST_DECL_RE, CriticalPathResolver, NoOpTelemetryAdapter, NoOpExecutor, ConsoleSink, feedbackConfig, ChecklistBuilder, AgentActionEmitter, globalEmitter, FileSink, NoOpSink, CategorySnapshotSchema, TimelineSnapshotSchema, TimelineFileSchema, TrendLineSchema, TrendResultSchema, DEFAULT_STABILITY_THRESHOLDS, ALL_CATEGORIES, TimelineManager, ConfidenceTierSchema, RegressionResultSchema, DirectionSchema, CategoryForecastSchema, SpecImpactSignalsSchema, SpecImpactEstimateSchema, ContributingFeatureSchema, AdjustedForecastSchema, PredictionWarningSchema, StabilityForecastSchema, PredictionResultSchema, PredictionOptionsSchema, VALID_STATUSES, EM_DASH, VALID_PRIORITIES, ALL_CATEGORIES2, DIRECTION_THRESHOLD, PredictionEngine, DEFAULT_COEFFICIENTS, SpecImpactEstimator, EMPTY_HISTORY, ViolationHistoryManager, NORMALIZERS, MAX_SAMPLES, DEFAULT_WINDOW_WEEKS, DEFAULT_MIN_OCCURRENCES, FailureEntrySchema, HandoffSchema, GateCheckSchema, GateResultSchema, GateConfigSchema, HarnessStateSchema, DEFAULT_STATE, StreamInfoSchema, StreamIndexSchema, DEFAULT_STREAM_INDEX, HARNESS_DIR, STATE_FILE, LEARNINGS_FILE, FAILURES_FILE, HANDOFF_FILE, GATE_CONFIG_FILE, INDEX_FILE, SESSIONS_DIR, SESSION_INDEX_FILE, SUMMARY_FILE, SESSION_STATE_FILE, ARCHIVE_DIR, CONTENT_HASHES_FILE, EVENTS_FILE, STREAMS_DIR, STREAM_NAME_REGEX, branchCache, BRANCH_CACHE_TTL_MS, STATE_FILES, MAX_CACHE_ENTRIES, learningsCacheMap, WEIGHTS, PROMOTABLE_OUTCOMES, failuresCacheMap, FAILURE_LINE_REGEX, SAFE_GATE_COMMAND, SkillEventSchema, knownHashesCache, EVENT_FORMATTERS, RuleRegistry, DEFAULT_SECURITY_CONFIG, RuleOverrideSchema, SecurityConfigSchema, secretRules, injectionRules, xssRules, cryptoRules, pathTraversalRules, networkRules, deserializationRules, agentConfigRules, mcpRules, insecureDefaultsRules, sharpEdgesRules, nodeRules, expressRules, reactRules, goRules, SecurityScanner, hiddenUnicodePatterns, reRolingPatterns, permissionEscalationPatterns, encodedPayloadPatterns, indirectInjectionPatterns, contextManipulationPatterns, socialEngineeringPatterns, suspiciousPatterns, ALL_PATTERNS, DESTRUCTIVE_BASH, TAINT_DURATION_MS, DEFAULT_SESSION_ID, SecurityCategorySnapshotSchema, SupplyChainSnapshotSchema, SecurityTimelineSnapshotSchema, FindingLifecycleSchema, SecurityTimelineFileSchema, DirectionSchema2, SecurityTrendLineSchema, TrendAttributionSchema, SecurityTrendResultSchema, TimeToFixStatsSchema, TimeToFixResultSchema, EMPTY_SUPPLY_CHAIN, SecurityTimelineManager, ALL_CHECKS, STATUS_ICONS, CINotifier, ExclusionSet, PREFIX_PATTERNS, TEST_FILE_PATTERN, MD_FILE_PATTERN, ALL_DOMAINS, SECURITY_PATTERNS, SEVERITY_RANK, SEVERITY_ORDER, SEVERITY_LABELS, VALIDATED_BY_RANK, COMPLIANCE_DESCRIPTOR, EXPORT_RE, BUG_DETECTION_DESCRIPTOR, SECURITY_DESCRIPTOR, EVAL_PATTERN, SECRET_PATTERNS, SQL_CONCAT_PATTERN, SHELL_EXEC_PATTERN, ARCHITECTURE_DESCRIPTOR, LARGE_FILE_THRESHOLD, VIOLATION_FILE_RE, LEARNINGS_DESCRIPTOR, RELEVANCE_THRESHOLD, AGENT_DESCRIPTORS, AGENT_RUNNERS, DOWNGRADE_MAP, DEFAULT_PROVIDER_TIERS, SMALL_SUGGESTION_LINE_LIMIT, FILE_LINE_RANGE_PATTERN, FILE_LINE_PATTERN, FILE_ONLY_PATTERN, VALIDATION_SCORES, DOMAIN_BASELINES, FACTOR_WEIGHTS, EVIDENCE_SATURATION, CORROBORATED_AGREEMENT, STANDALONE_AGREEMENT, AGREEMENT_LINE_GAP, SECURITY_SENSITIVE_PATH, MIGRATION_PATH, TEST_PATH, CONFIG_PATH, STAGE_DOMAINS, EM_DASH2, STATUS_RANK, RETRY_DEFAULTS, GitHubIssuesSyncAdapter, syncMutex, PRIORITY_RANK, POSITION_WEIGHT, DEPENDENTS_WEIGHT, AFFINITY_WEIGHT, InteractionTypeSchema, QuestionSchema, ConfirmationSchema, TransitionSchema, EmitInteractionInputSchema, ProjectScanner, SHELL_TEMPLATE, STYLES, SCRIPTS, MockLLMService, llmService, ContentPipeline, BlueprintGenerator, TOKENS_PER_MILLION, fallback_default, LITELLM_PRICING_URL, CACHE_TTL_MS, STALENESS_WARNING_DAYS, MICRODOLLARS_PER_DOLLAR, TOKENS_PER_MILLION2, StructuralStrategy, DEFAULT_TOKEN_BUDGET, CHARS_PER_TOKEN, TRUNCATION_MARKER, TruncationStrategy, CompactionPipeline, STABILITY_LOOKUP, TIER_ORDER, AnthropicCacheAdapter, TIER_ORDER2, OpenAICacheAdapter, TIER_ORDER3, CACHED_CONTENT_MARKER, GeminiCacheAdapter, VERSION, POSTHOG_BATCH_URL, MAX_ATTEMPTS, TIMEOUT_MS;
+var VALID_TYPES, CONVENTIONAL_PATTERN, DEFAULT_AGNIX_TIMEOUT_MS, HARNESS_AGNIX_DISABLE, HARNESS_AGNIX_BIN, CLAUDE_MD_WARN_BYTES, CLAUDE_MD_ERROR_BYTES, CONTEXT_FILES, MIN_DESCRIPTION_LENGTH, SETTINGS_PATHS, KNOWN_HOOK_EVENTS, MCP_SETTINGS_FILES, REQUIRED_SECTIONS, SETTINGS_FILES, KNOWN_AGNIX_TOOLS, DEFAULT_SECTIONS, DEFAULT_RATIOS, NODE_TYPE_TO_CATEGORY, SECTION_LEVEL_MAP, DEFAULT_LEVEL, DEFAULT_BUDGET, DEFAULT_LOADER_CONFIG, LEVEL_FRACTIONS, PHASE_PRIORITIES, ManifestSchema, BundleConstraintsSchema, BundleSchema, ContributionsSchema, LockfilePackageSchema, LockfileSchema, SharableLayerSchema, SharableForbiddenImportSchema, SharableBoundaryConfigSchema, SharableSecurityRulesSchema, VALID_SCOPES, LINE_PATTERN, START_PATTERN, END_PATTERN, CODE_BLOCK_LANGUAGES, DEFAULT_DRIFT_CONFIG, FILE_TYPES, EXPORT_TYPES, CONVENTION_DESCRIPTIONS, RULE_CHECKERS, EntropyAnalyzer, readFile42, writeFile32, unlink22, mkdir22, copyFile2, DEFAULT_FIX_CONFIG, EXPORT_TYPE_KEYWORD, ALWAYS_UNSAFE_TYPES, idCounter, DEAD_CODE_FIX_ACTIONS, MustExportRuleSchema, MustExportDefaultRuleSchema, NoExportRuleSchema, MustImportRuleSchema, NoImportRuleSchema, NamingRuleSchema, MaxExportsRuleSchema, MaxLinesRuleSchema, RequireJSDocRuleSchema, RuleSchema, ConfigPatternSchema, PatternConfigSchema, DriftConfigSchema, DeadCodeConfigSchema, EntropyConfigSchema, BaselineManager, BenchmarkRunner, RegressionDetector, SKIP_DIRS, SOURCE_EXTENSIONS, FUNCTION_DECL_RE, CONST_DECL_RE, CriticalPathResolver, NoOpTelemetryAdapter, NoOpExecutor, ConsoleSink, feedbackConfig, ChecklistBuilder, AgentActionEmitter, globalEmitter, FileSink, NoOpSink, CategorySnapshotSchema, TimelineSnapshotSchema, TimelineFileSchema, TrendLineSchema, TrendResultSchema, DEFAULT_STABILITY_THRESHOLDS, ALL_CATEGORIES, TimelineManager, ConfidenceTierSchema, RegressionResultSchema, DirectionSchema, CategoryForecastSchema, SpecImpactSignalsSchema, SpecImpactEstimateSchema, ContributingFeatureSchema, AdjustedForecastSchema, PredictionWarningSchema, StabilityForecastSchema, PredictionResultSchema, PredictionOptionsSchema, VALID_STATUSES, EM_DASH, VALID_PRIORITIES, ALL_CATEGORIES2, DIRECTION_THRESHOLD, PredictionEngine, DEFAULT_COEFFICIENTS, SpecImpactEstimator, EMPTY_HISTORY, ViolationHistoryManager, NORMALIZERS, MAX_SAMPLES, DEFAULT_WINDOW_WEEKS, DEFAULT_MIN_OCCURRENCES, FailureEntrySchema, HandoffSchema, GateCheckSchema, GateResultSchema, GateConfigSchema, HarnessStateSchema, DEFAULT_STATE, StreamInfoSchema, StreamIndexSchema, DEFAULT_STREAM_INDEX, HARNESS_DIR, STATE_FILE, LEARNINGS_FILE, FAILURES_FILE, HANDOFF_FILE, GATE_CONFIG_FILE, INDEX_FILE, SESSIONS_DIR, SESSION_INDEX_FILE, SUMMARY_FILE, SESSION_STATE_FILE, ARCHIVE_DIR, CONTENT_HASHES_FILE, EVENTS_FILE, STREAMS_DIR, STREAM_NAME_REGEX, branchCache, BRANCH_CACHE_TTL_MS, STATE_FILES, MAX_CACHE_ENTRIES, learningsCacheMap, WEIGHTS, PROMOTABLE_OUTCOMES, failuresCacheMap, FAILURE_LINE_REGEX, SAFE_GATE_COMMAND, SkillEventSchema, knownHashesCache, EVENT_FORMATTERS, RuleRegistry, DEFAULT_SECURITY_CONFIG, RuleOverrideSchema, SecurityConfigSchema, secretRules, injectionRules, xssRules, cryptoRules, pathTraversalRules, networkRules, deserializationRules, agentConfigRules, mcpRules, insecureDefaultsRules, sharpEdgesRules, nodeRules, expressRules, reactRules, goRules, SecurityScanner, hiddenUnicodePatterns, reRolingPatterns, permissionEscalationPatterns, encodedPayloadPatterns, indirectInjectionPatterns, contextManipulationPatterns, socialEngineeringPatterns, suspiciousPatterns, ALL_PATTERNS, DESTRUCTIVE_BASH, TAINT_DURATION_MS, DEFAULT_SESSION_ID, SecurityCategorySnapshotSchema, SupplyChainSnapshotSchema, SecurityTimelineSnapshotSchema, FindingLifecycleSchema, SecurityTimelineFileSchema, DirectionSchema2, SecurityTrendLineSchema, TrendAttributionSchema, SecurityTrendResultSchema, TimeToFixStatsSchema, TimeToFixResultSchema, EMPTY_SUPPLY_CHAIN, SecurityTimelineManager, ALL_CHECKS, STATUS_ICONS, CINotifier, ExclusionSet, PREFIX_PATTERNS, TEST_FILE_PATTERN, MD_FILE_PATTERN, ALL_DOMAINS, SECURITY_PATTERNS, SEVERITY_RANK, SEVERITY_ORDER, SEVERITY_LABELS, VALIDATED_BY_RANK, VALIDATION_SCORES, DOMAIN_BASELINES, FACTOR_WEIGHTS, EVIDENCE_SATURATION, CORROBORATED_AGREEMENT, STANDALONE_AGREEMENT, AGREEMENT_LINE_GAP, COMPLIANCE_DESCRIPTOR, EXPORT_RE, BUG_DETECTION_DESCRIPTOR, SECURITY_DESCRIPTOR, EVAL_PATTERN, SECRET_PATTERNS, SQL_CONCAT_PATTERN, SHELL_EXEC_PATTERN, ARCHITECTURE_DESCRIPTOR, LARGE_FILE_THRESHOLD, VIOLATION_FILE_RE, LEARNINGS_DESCRIPTOR, RELEVANCE_THRESHOLD, AGENT_DESCRIPTORS, AGENT_RUNNERS, DOWNGRADE_MAP, DEFAULT_PROVIDER_TIERS, SMALL_SUGGESTION_LINE_LIMIT, FILE_LINE_RANGE_PATTERN, FILE_LINE_PATTERN, FILE_ONLY_PATTERN, SECURITY_SENSITIVE_PATH, MIGRATION_PATH, TEST_PATH, CONFIG_PATH, STAGE_DOMAINS, EM_DASH2, STATUS_RANK, RETRY_DEFAULTS, GitHubIssuesSyncAdapter, syncMutex, PRIORITY_RANK, POSITION_WEIGHT, DEPENDENTS_WEIGHT, AFFINITY_WEIGHT, InteractionTypeSchema, QuestionSchema, ConfirmationSchema, TransitionSchema, EmitInteractionInputSchema, ProjectScanner, SHELL_TEMPLATE, STYLES, SCRIPTS, MockLLMService, llmService, ContentPipeline, BlueprintGenerator, TOKENS_PER_MILLION, fallback_default, LITELLM_PRICING_URL, CACHE_TTL_MS, STALENESS_WARNING_DAYS, MICRODOLLARS_PER_DOLLAR, TOKENS_PER_MILLION2, StructuralStrategy, DEFAULT_TOKEN_BUDGET, CHARS_PER_TOKEN, TRUNCATION_MARKER, TruncationStrategy, CompactionPipeline, STABILITY_LOOKUP, TIER_ORDER, AnthropicCacheAdapter, TIER_ORDER2, OpenAICacheAdapter, TIER_ORDER3, CACHED_CONTENT_MARKER, GeminiCacheAdapter, VERSION, POSTHOG_BATCH_URL, MAX_ATTEMPTS, TIMEOUT_MS;
 var init_dist3 = __esm({
   "../core/dist/index.mjs"() {
-    init_chunk_QLTIBLN5();
+    init_chunk_UWAI34RR();
     init_dist();
     init_dist();
     init_dist();
@@ -17527,7 +17570,7 @@ var init_dist3 = __esm({
       info: 0,
       total: 0
     };
-    SecurityTimelineManager = class {
+    SecurityTimelineManager = class _SecurityTimelineManager {
       rootDir;
       timelinePath;
       constructor(rootDir) {
@@ -17799,6 +17842,11 @@ var init_dist3 = __esm({
           }
         }
       }
+      static SEVERITY_COUNT_KEY = {
+        error: "errorCount",
+        warning: "warningCount",
+        info: "infoCount"
+      };
       aggregateByCategory(findings) {
         const result = {};
         for (const finding of findings) {
@@ -17812,9 +17860,8 @@ var init_dist3 = __esm({
           }
           const cat = result[finding.category];
           cat.findingCount++;
-          if (finding.severity === "error") cat.errorCount++;
-          else if (finding.severity === "warning") cat.warningCount++;
-          else cat.infoCount++;
+          const key = _SecurityTimelineManager.SEVERITY_COUNT_KEY[finding.severity] ?? "infoCount";
+          cat[key]++;
         }
         return result;
       }
@@ -17842,26 +17889,23 @@ var init_dist3 = __esm({
         return { current, previous, delta, direction };
       }
       computeAttribution(first, last) {
-        const attribution = [];
         const allCategories = /* @__PURE__ */ new Set([
           ...Object.keys(first.byCategory),
           ...Object.keys(last.byCategory)
         ]);
+        const results = [];
         for (const category of allCategories) {
-          const prevCount = first.byCategory[category]?.findingCount ?? 0;
-          const currCount = last.byCategory[category]?.findingCount ?? 0;
-          const delta = currCount - prevCount;
-          if (delta === 0) continue;
-          const direction = delta < 0 ? "improving" : "declining";
-          const sign = delta > 0 ? "+" : "";
-          attribution.push({
-            category,
-            delta,
-            direction,
-            description: `${sign}${delta} ${category} findings`
-          });
+          const attr = this.categoryAttribution(category, first.byCategory, last.byCategory);
+          if (attr) results.push(attr);
         }
-        return attribution;
+        return results;
+      }
+      categoryAttribution(category, prev, curr) {
+        const delta = (curr[category]?.findingCount ?? 0) - (prev[category]?.findingCount ?? 0);
+        if (delta === 0) return null;
+        const direction = delta < 0 ? "improving" : "declining";
+        const sign = delta > 0 ? "+" : "";
+        return { category, delta, direction, description: `${sign}${delta} ${category} findings` };
       }
       computeStats(values) {
         if (values.length === 0) {
@@ -18020,6 +18064,28 @@ var init_dist3 = __esm({
       heuristic: 1,
       graph: 2
     };
+    VALIDATION_SCORES = {
+      mechanical: 1,
+      graph: 0.8,
+      heuristic: 0.5
+    };
+    DOMAIN_BASELINES = {
+      security: 0.7,
+      bug: 0.6,
+      architecture: 0.65,
+      compliance: 0.75,
+      learnings: 0.5
+    };
+    FACTOR_WEIGHTS = {
+      validation: 0.35,
+      evidence: 0.3,
+      agreement: 0.15,
+      historical: 0.2
+    };
+    EVIDENCE_SATURATION = 3;
+    CORROBORATED_AGREEMENT = 1;
+    STANDALONE_AGREEMENT = 0.5;
+    AGREEMENT_LINE_GAP = 3;
     COMPLIANCE_DESCRIPTOR = {
       domain: "compliance",
       tier: "standard",
@@ -18133,28 +18199,6 @@ var init_dist3 = __esm({
     FILE_LINE_RANGE_PATTERN = /^([\w./@-]+\.\w+):(\d+)-(\d+)/;
     FILE_LINE_PATTERN = /^([\w./@-]+\.\w+):(\d+)/;
     FILE_ONLY_PATTERN = /^([\w./@-]+\.\w+)\s/;
-    VALIDATION_SCORES = {
-      mechanical: 1,
-      graph: 0.8,
-      heuristic: 0.5
-    };
-    DOMAIN_BASELINES = {
-      security: 0.7,
-      bug: 0.6,
-      architecture: 0.65,
-      compliance: 0.75,
-      learnings: 0.5
-    };
-    FACTOR_WEIGHTS = {
-      validation: 0.35,
-      evidence: 0.3,
-      agreement: 0.15,
-      historical: 0.2
-    };
-    EVIDENCE_SATURATION = 3;
-    CORROBORATED_AGREEMENT = 1;
-    STANDALONE_AGREEMENT = 0.5;
-    AGREEMENT_LINE_GAP = 3;
     SECURITY_SENSITIVE_PATH = /(auth|crypto|secret|token|password|session|permission)/i;
     MIGRATION_PATH = /(migration|schema|db\/|database\/)/i;
     TEST_PATH = /\.(test|spec)\.(ts|tsx|js|jsx|mts|cts)$/;
@@ -19235,6 +19279,13 @@ export {
   buildExclusionSet,
   detectChangeType,
   scopeContext,
+  VALIDATION_SCORES,
+  DOMAIN_BASELINES,
+  FACTOR_WEIGHTS,
+  EVIDENCE_SATURATION,
+  CORROBORATED_AGREEMENT,
+  STANDALONE_AGREEMENT,
+  AGREEMENT_LINE_GAP,
   COMPLIANCE_DESCRIPTOR,
   runComplianceAgent,
   BUG_DETECTION_DESCRIPTOR,