@m8i-51/shoal 0.1.19 → 0.1.21

package/framework/__tests__/cost.test.ts

@@ -19,6 +19,18 @@ describe("formatCostUSD", () => {
     expect(formatCostUSD(undefined)).toBe("—");
   });
 
+  it("0 は < $0.0001", () => {
+    expect(formatCostUSD(0)).toBe("< $0.0001");
+  });
+
+  it("負値は < $0.0001", () => {
+    expect(formatCostUSD(-1)).toBe("< $0.0001");
+  });
+
+  it("0.0001 ちょうどは 4 桁小数", () => {
+    expect(formatCostUSD(0.0001)).toBe("$0.0001");
+  });
+
   it("0.00005 未満は < $0.0001", () => {
     expect(formatCostUSD(0.000005)).toBe("< $0.0001");
   });

package/framework/__tests__/coverage.test.ts

@@ -8,7 +8,7 @@ vi.mock("path", async (importOriginal) => {
   return { ...actual, join: (...args: string[]) => args.join("/") };
 });
 
-import { computeWeightedSummary, updateCoverage, loadCoverage } from "../coverage";
+import { computeWeightedSummary, updateCoverage, loadCoverage, getLastRunPaths, getFindingHotspots } from "../coverage";
 import type { Coverage, RunCoverage } from "../coverage";
 
 const HALF_LIFE_DAYS = 7;
@@ -170,7 +170,7 @@ describe("computeWeightedSummary", () => {
 
   it("14日以内に同じレンズが複数 run に登場するとボーナスが乗る", () => {
     const now = Date.now();
-    // 同じ Accessibility レンズが2回登場 → bonus = 1 + (2-1)*0.5 = 1.5
+    // 同じ Accessibility レンズが2回登場 → bonus = 1 + (2-1)^3 * 0.005 = 1.005
     setupMockCoverage({
       entries: [
         makeEntry({
@@ -249,22 +249,29 @@ describe("computeWeightedSummary", () => {
   });
 
   it("MAX_ENTRIES を超えると最新30件に切り捨てる", () => {
-    const entries = Array.from({ length: 35 }, (_, i) =>
+    // 既に30件ある状態で updateCoverage を呼ぶと31件→30件にトリムされることを確認
+    const entries = Array.from({ length: 30 }, (_, i) =>
       makeEntry({
         runId: `run_${i}`,
-        timestamp: new Date(Date.now() - i * 1000).toISOString(),
+        timestamp: new Date(Date.now() - (30 - i) * 1000).toISOString(),
       })
     );
-    setupMockCoverage({ entries });
-    vi.mocked(fs.writeFileSync).mockImplementation(() => {});
-
-    // updateCoverage が 31件目を追加してトリムすることを確認
     vi.mocked(fs.existsSync).mockReturnValue(true);
     vi.mocked(fs.readFileSync).mockReturnValue(JSON.stringify({ entries }));
+    vi.mocked(fs.writeFileSync).mockImplementation(() => {});
+    vi.mocked(fs.mkdirSync).mockReturnValue(undefined);
 
-    // computeWeightedSummary は entries をそのまま使うだけなので、
-    // 35件あってもエラーにならないことを確認
-    expect(() => computeWeightedSummary()).not.toThrow();
+    updateCoverage("run_new", [], new Map());
+
+    const calls = vi.mocked(fs.writeFileSync).mock.calls;
+    const written = calls[calls.length - 1][1] as string;
+    const saved = JSON.parse(written) as Coverage;
+    // 30件 + 1件 → MAX_ENTRIES(30) に切り詰め
+    expect(saved.entries).toHaveLength(30);
+    // 最新のエントリーが含まれる
+    expect(saved.entries.some((e) => e.runId === "run_new")).toBe(true);
+    // 最も古いエントリーが除外される
+    expect(saved.entries.some((e) => e.runId === "run_0")).toBe(false);
   });
 });
 
@@ -311,3 +318,131 @@ describe("updateCoverage", () => {
     expect(saved.entries[0].byScenario["New employee task"]).toBe(1);
   });
 });
+
+describe("getLastRunPaths", () => {
+  it("エントリーがない場合は null を返す", () => {
+    vi.mocked(fs.existsSync).mockReturnValue(false);
+    expect(getLastRunPaths()).toBeNull();
+  });
+
+  it("最後のエントリーの visitedPaths と runId を返す", () => {
+    setupMockCoverage({
+      entries: [
+        makeEntry({ runId: "run_1", visitedPaths: ["/old"] }),
+        makeEntry({ runId: "run_2", visitedPaths: ["/a", "/b"] }),
+      ],
+    });
+    const result = getLastRunPaths();
+    expect(result).not.toBeNull();
+    expect(result!.runId).toBe("run_2");
+    expect(result!.visitedPaths).toEqual(["/a", "/b"]);
+  });
+
+  it("visitedPaths が undefined のエントリーは空配列を返す", () => {
+    vi.mocked(fs.existsSync).mockReturnValue(true);
+    vi.mocked(fs.readFileSync).mockReturnValue(
+      JSON.stringify({ entries: [{ ...makeEntry({ runId: "run_1" }), visitedPaths: undefined }] })
+    );
+    const result = getLastRunPaths();
+    expect(result!.visitedPaths).toEqual([]);
+  });
+});
+
+describe("getFindingHotspots", () => {
+  beforeEach(() => {
+    vi.mocked(fs.mkdirSync).mockReturnValue(undefined);
+    vi.mocked(fs.writeFileSync).mockReturnValue(undefined);
+  });
+
+  it("findings ディレクトリが存在しない場合は空配列を返す", () => {
+    vi.mocked(fs.existsSync).mockReturnValue(false);
+    expect(getFindingHotspots()).toEqual([]);
+  });
+
+  it("run_\\d+ パターン以外のディレクトリは無視する", () => {
+    vi.mocked(fs.existsSync).mockReturnValue(true);
+    vi.mocked(fs.readdirSync).mockReturnValue(
+      [".DS_Store", "run_abc", "tmp"] as unknown as ReturnType<typeof fs.readdirSync>
+    );
+    expect(getFindingHotspots()).toEqual([]);
+  });
+
+  it("複数 run の findings を同一パスで合算する", () => {
+    vi.mocked(fs.existsSync).mockReturnValue(true);
+    vi.mocked(fs.readdirSync)
+      .mockReturnValueOnce(["run_1", "run_2"] as unknown as ReturnType<typeof fs.readdirSync>)
+      .mockReturnValueOnce(["f1.json"] as unknown as ReturnType<typeof fs.readdirSync>)
+      .mockReturnValueOnce(["f2.json"] as unknown as ReturnType<typeof fs.readdirSync>);
+
+    const finding1 = { id: "f1", runId: "run_1", agentId: "a1", agentName: "Alice", role: "r", title: "Bug on /settings page", body: "Found at /settings/profile", category: "bug", timestamp: new Date().toISOString() };
+    const finding2 = { id: "f2", runId: "run_2", agentId: "a2", agentName: "Bob", role: "r", title: "UX issue on /settings", body: "The /settings layout is confusing", category: "ux", timestamp: new Date().toISOString() };
+
+    vi.mocked(fs.readFileSync)
+      .mockReturnValueOnce(JSON.stringify(finding1) as unknown as ReturnType<typeof fs.readFileSync>)
+      .mockReturnValueOnce(JSON.stringify(finding2) as unknown as ReturnType<typeof fs.readFileSync>);
+
+    const hotspots = getFindingHotspots();
+    const settings = hotspots.find((h) => h.pathPrefix === "/settings");
+    expect(settings).toBeDefined();
+    expect(settings!.totalFindings).toBe(2);
+    expect(settings!.categories["bug"]).toBe(1);
+    expect(settings!.categories["ux"]).toBe(1);
+  });
+
+  it("topN パラメータで件数を絞る", () => {
+    vi.mocked(fs.existsSync).mockReturnValue(true);
+    vi.mocked(fs.readdirSync)
+      .mockReturnValueOnce(["run_1"] as unknown as ReturnType<typeof fs.readdirSync>)
+      .mockReturnValueOnce(["f1.json", "f2.json", "f3.json"] as unknown as ReturnType<typeof fs.readdirSync>);
+
+    const makeFinding = (id: string, path: string) => ({ id, runId: "run_1", agentId: "a", agentName: "A", role: "r", title: `Issue on ${path}`, body: `Problem at ${path}`, category: "bug", timestamp: new Date().toISOString() });
+    vi.mocked(fs.readFileSync)
+      .mockReturnValueOnce(JSON.stringify(makeFinding("f1", "/alpha")) as unknown as ReturnType<typeof fs.readFileSync>)
+      .mockReturnValueOnce(JSON.stringify(makeFinding("f2", "/beta")) as unknown as ReturnType<typeof fs.readFileSync>)
+      .mockReturnValueOnce(JSON.stringify(makeFinding("f3", "/gamma")) as unknown as ReturnType<typeof fs.readFileSync>);
+
+    expect(getFindingHotspots(2)).toHaveLength(2);
+  });
+
+  it("壊れた JSON ファイルはスキップする", () => {
+    vi.mocked(fs.existsSync).mockReturnValue(true);
+    vi.mocked(fs.readdirSync)
+      .mockReturnValueOnce(["run_1"] as unknown as ReturnType<typeof fs.readdirSync>)
+      .mockReturnValueOnce(["bad.json"] as unknown as ReturnType<typeof fs.readdirSync>);
+    vi.mocked(fs.readFileSync).mockReturnValueOnce("invalid{{{" as unknown as ReturnType<typeof fs.readFileSync>);
+
+    expect(() => getFindingHotspots()).not.toThrow();
+    expect(getFindingHotspots()).toEqual([]);
+  });
+
+  it("パスが見つからない場合は / にフォールバックする", () => {
+    vi.mocked(fs.existsSync).mockReturnValue(true);
+    vi.mocked(fs.readdirSync)
+      .mockReturnValueOnce(["run_1"] as unknown as ReturnType<typeof fs.readdirSync>)
+      .mockReturnValueOnce(["f1.json"] as unknown as ReturnType<typeof fs.readdirSync>);
+    const finding = { id: "f1", runId: "run_1", agentId: "a", agentName: "A", role: "r", title: "Generic error", body: "Something went wrong", category: "bug", timestamp: new Date().toISOString() };
+    vi.mocked(fs.readFileSync).mockReturnValueOnce(JSON.stringify(finding) as unknown as ReturnType<typeof fs.readFileSync>);
+
+    const hotspots = getFindingHotspots();
+    expect(hotspots.some((h) => h.pathPrefix === "/")).toBe(true);
+  });
+
+  it("triage_result.json（timestamp/category を持たない集計ファイル）は無視する", () => {
+    vi.mocked(fs.existsSync).mockReturnValue(true);
+    vi.mocked(fs.readdirSync)
+      .mockReturnValueOnce(["run_1"] as unknown as ReturnType<typeof fs.readdirSync>)
+      .mockReturnValueOnce(["f1.json", "triage_result.json"] as unknown as ReturnType<typeof fs.readdirSync>);
+
+    const finding = { id: "f1", runId: "run_1", agentId: "a", agentName: "A", role: "r", title: "Bug on /settings", body: "broken at /settings", category: "bug", timestamp: new Date().toISOString() };
+    const triageResult = { runId: "run_1", completedAt: "x", issued: [], skipped: [], unprocessed: [] };
+    vi.mocked(fs.readFileSync)
+      .mockReturnValueOnce(JSON.stringify(finding) as unknown as ReturnType<typeof fs.readFileSync>)
+      .mockReturnValueOnce(JSON.stringify(triageResult) as unknown as ReturnType<typeof fs.readFileSync>);
+
+    const hotspots = getFindingHotspots();
+    const settings = hotspots.find((h) => h.pathPrefix === "/settings");
+    expect(settings?.totalFindings).toBe(1);
+    expect(settings?.categories).toEqual({ bug: 1 });
+    expect(Object.keys(settings?.categories ?? {})).not.toContain("undefined");
+  });
+});

package/framework/__tests__/cross-run-dedup.test.ts

@@ -0,0 +1,83 @@
+import { describe, it, expect } from "vitest";
+import { groupSimilarFindings, findCrossRunDuplicates } from "../cross-run-dedup";
+import type { Finding } from "../types";
+
+function mockFinding(overrides: Partial<Finding> = {}): Finding {
+  return {
+    id: "f1",
+    runId: "run_1",
+    agentId: "a1",
+    agentName: "Alice",
+    role: "tester",
+    title: "Untitled",
+    body: "",
+    category: "bug",
+    timestamp: new Date().toISOString(),
+    ...overrides,
+  };
+}
+
+describe("groupSimilarFindings", () => {
+  it("空配列 → 空配列", () => {
+    expect(groupSimilarFindings([])).toEqual([]);
+  });
+
+  it("似ていない finding は別クラスタになる", () => {
+    const a = mockFinding({ id: "a", title: "Login button broken", body: "clicking login does nothing" });
+    const b = mockFinding({ id: "b", title: "Dark mode toggle missing", body: "no way to switch themes" });
+    const clusters = groupSimilarFindings([a, b]);
+    expect(clusters).toHaveLength(2);
+  });
+
+  it("似ている finding は同じクラスタになる（run をまたいでも）", () => {
+    const a = mockFinding({
+      id: "a", runId: "run_1",
+      title: "Dashboard metric not accessible via API",
+      body: "The dashboard shows a metric card but there is no API endpoint to retrieve it.",
+    });
+    const b = mockFinding({
+      id: "b", runId: "run_2",
+      title: "Dashboard metrics not accessible via API",
+      body: "The dashboard metric card has no corresponding API endpoint to retrieve it.",
+    });
+    const clusters = groupSimilarFindings([a, b]);
+    expect(clusters).toHaveLength(1);
+    expect(clusters[0]).toHaveLength(2);
+  });
+
+  it("3件中2件が似ている → 2クラスタ（似ているペア + 単独1件）", () => {
+    const a = mockFinding({ id: "a", title: "Profile update API missing", body: "no endpoint to update profile" });
+    const b = mockFinding({ id: "b", title: "Profile update API is missing", body: "no endpoint exists to update the profile" });
+    const c = mockFinding({ id: "c", title: "Dark mode toggle missing", body: "no way to switch themes at all" });
+    const clusters = groupSimilarFindings([a, b, c]);
+    expect(clusters).toHaveLength(2);
+    const sizes = clusters.map((cl) => cl.length).sort();
+    expect(sizes).toEqual([1, 2]);
+  });
+
+  it("threshold を下げるとより緩く同一クラスタになる", () => {
+    const a = mockFinding({ id: "a", title: "Cannot export dashboard data", body: "no CSV export button" });
+    const b = mockFinding({ id: "b", title: "Missing budgeting dashboard", body: "no way to adjust project budget" });
+    const clustersStrict = groupSimilarFindings([a, b], 0.9);
+    const clustersLoose = groupSimilarFindings([a, b], 0.01);
+    expect(clustersStrict).toHaveLength(2);
+    expect(clustersLoose).toHaveLength(1);
+  });
+});
+
+describe("findCrossRunDuplicates", () => {
+  it("単独 finding しかない場合は空配列", () => {
+    const a = mockFinding({ id: "a", title: "Login button broken", body: "clicking login does nothing" });
+    const b = mockFinding({ id: "b", title: "Dark mode toggle missing", body: "no way to switch themes" });
+    expect(findCrossRunDuplicates([a, b])).toEqual([]);
+  });
+
+  it("2件以上のクラスタのみ返す", () => {
+    const a = mockFinding({ id: "a", runId: "run_1", title: "Dashboard metric not accessible via API", body: "no endpoint for the metric card" });
+    const b = mockFinding({ id: "b", runId: "run_2", title: "Dashboard metrics not accessible via API", body: "no endpoint for the metric card" });
+    const c = mockFinding({ id: "c", runId: "run_3", title: "Dark mode toggle missing", body: "no way to switch themes" });
+    const result = findCrossRunDuplicates([a, b, c]);
+    expect(result).toHaveLength(1);
+    expect(result[0].map((f) => f.runId).sort()).toEqual(["run_1", "run_2"]);
+  });
+});

package/framework/__tests__/diary.test.ts

@@ -0,0 +1,155 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import * as fs from "fs";
+
+vi.mock("fs");
+vi.mock("path", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("path")>();
+  return { ...actual, join: (...args: string[]) => args.join("/"), dirname: (p: string) => p.split("/").slice(0, -1).join("/") };
+});
+
+const mockCreateMessage = vi.fn();
+vi.mock("../llm-client.js", () => ({
+  createLLMClient: vi.fn(() => ({
+    client: { createMessage: mockCreateMessage },
+    defaultModel: "mock-model",
+  })),
+}));
+
+import { generateDiary, getDiaryPath } from "../diary";
+
+const DIARY_TEXT = "# 探索日誌 — run_123\n冒険が始まった。";
+
+beforeEach(() => {
+  vi.mocked(fs.existsSync).mockReturnValue(false);
+  vi.mocked(fs.mkdirSync).mockReturnValue(undefined);
+  vi.mocked(fs.writeFileSync).mockReturnValue(undefined);
+  vi.mocked(fs.readdirSync).mockReturnValue([] as unknown as ReturnType<typeof fs.readdirSync>);
+  mockCreateMessage.mockClear();
+  mockCreateMessage.mockResolvedValue({
+    content: [{ type: "text", text: DIARY_TEXT }],
+  });
+});
+
+describe("getDiaryPath", () => {
+  it("run_\\d+ 形式 + ファイル存在 → パスを返す", () => {
+    vi.mocked(fs.existsSync).mockReturnValue(true);
+    const result = getDiaryPath("run_123");
+    expect(result).not.toBeNull();
+    expect(result).toContain("run_123");
+  });
+
+  it("run_\\d+ 形式だがファイルなし → null", () => {
+    vi.mocked(fs.existsSync).mockReturnValue(false);
+    expect(getDiaryPath("run_123")).toBeNull();
+  });
+
+  it("不正な runId（英字）→ null", () => {
+    expect(getDiaryPath("run_abc")).toBeNull();
+  });
+
+  it("パストラバーサル試みは null", () => {
+    expect(getDiaryPath("../etc/passwd")).toBeNull();
+    expect(getDiaryPath("run_123/../../../etc")).toBeNull();
+  });
+});
+
+describe("generateDiary", () => {
+  it("生成されたテキストを返す", async () => {
+    const result = await generateDiary("run_123", []);
+    expect(result).toBe(DIARY_TEXT);
+  });
+
+  it("生成テキストをファイルに書き込む", async () => {
+    await generateDiary("run_123", []);
+    expect(fs.writeFileSync).toHaveBeenCalled();
+    const [, content] = vi.mocked(fs.writeFileSync).mock.calls[0];
+    expect(content).toBe(DIARY_TEXT);
+  });
+
+  it("ファイル書き込み前にディレクトリを作成する", async () => {
+    await generateDiary("run_123", []);
+    expect(fs.mkdirSync).toHaveBeenCalledWith(expect.any(String), { recursive: true });
+  });
+
+  it("findings がない場合はプロンプトに「発見なし」を含める", async () => {
+    vi.mocked(fs.existsSync).mockReturnValue(false);
+    await generateDiary("run_123", []);
+    const [params] = mockCreateMessage.mock.calls[0];
+    const userContent = (params.messages[0].content as string);
+    expect(userContent).toContain("発見なし");
+  });
+
+  it("findings がある場合はタイトルをプロンプトに含める", async () => {
+    vi.mocked(fs.existsSync).mockReturnValue(true);
+    vi.mocked(fs.readdirSync).mockReturnValue(["f1.json"] as unknown as ReturnType<typeof fs.readdirSync>);
+    const finding = { id: "f1", runId: "run_123", agentId: "a", agentName: "A", role: "r", title: "Login is broken", body: "", category: "bug", timestamp: new Date().toISOString() };
+    vi.mocked(fs.readFileSync).mockReturnValue(JSON.stringify(finding) as unknown as ReturnType<typeof fs.readFileSync>);
+
+    await generateDiary("run_123", []);
+    const [params] = mockCreateMessage.mock.calls[0];
+    expect(params.messages[0].content).toContain("Login is broken");
+  });
+
+  it("triage_result.json（timestamp を持たない集計ファイル）はプロンプトに混ぜない", async () => {
+    vi.mocked(fs.existsSync).mockReturnValue(true);
+    vi.mocked(fs.readdirSync).mockReturnValue(["f1.json", "triage_result.json"] as unknown as ReturnType<typeof fs.readdirSync>);
+    const finding = { id: "f1", runId: "run_123", agentId: "a", agentName: "A", role: "r", title: "Login is broken", body: "", category: "bug", timestamp: new Date().toISOString() };
+    const triageResult = { runId: "run_123", completedAt: "x", issued: [], skipped: [], unprocessed: [] };
+    vi.mocked(fs.readFileSync).mockImplementation((p: unknown) => {
+      const path = String(p);
+      if (path.endsWith("triage_result.json")) return JSON.stringify(triageResult) as unknown as ReturnType<typeof fs.readFileSync>;
+      return JSON.stringify(finding) as unknown as ReturnType<typeof fs.readFileSync>;
+    });
+
+    await generateDiary("run_123", []);
+    const [params] = mockCreateMessage.mock.calls[0];
+    expect(params.messages[0].content).not.toContain("undefined");
+  });
+
+  it("ログが空の場合はプロンプトに「イベントログなし」を含める", async () => {
+    await generateDiary("run_123", []);
+    const [params] = mockCreateMessage.mock.calls[0];
+    expect(params.messages[0].content).toContain("イベントログなし");
+  });
+
+  it("navigate 行は最大 25 件まで抽出する", async () => {
+    const lines = Array.from({ length: 30 }, (_, i) => `  → navigate({"path":"/page${i}"})`);
+    await generateDiary("run_123", lines);
+    const [params] = mockCreateMessage.mock.calls[0];
+    const content: string = params.messages[0].content;
+    const navCount = (content.match(/navigate/g) ?? []).length;
+    expect(navCount).toBeLessThanOrEqual(25);
+  });
+
+  it("agent start/done 行はすべて抽出する", async () => {
+    const lines = [
+      "[explorer] Alice start",
+      "[browser] Bob start",
+      "[explorer] Alice done",
+    ];
+    await generateDiary("run_123", lines);
+    const [params] = mockCreateMessage.mock.calls[0];
+    const content: string = params.messages[0].content;
+    expect(content).toContain("[explorer] Alice start");
+    expect(content).toContain("[browser] Bob start");
+    expect(content).toContain("[explorer] Alice done");
+  });
+
+  it("finding 発見ログは抽出される", async () => {
+    const lines = ['  → [findings] saved: "Login page crashes" (bug)'];
+    await generateDiary("run_123", lines);
+    const [params] = mockCreateMessage.mock.calls[0];
+    expect(params.messages[0].content).toContain("[findings] saved");
+  });
+
+  it("navigate 行が 100 文字超えると切り詰められる", async () => {
+    const longPath = "/very/long/path/" + "a".repeat(200);
+    const lines = [`  → navigate({"path":"${longPath}"})`];
+    await generateDiary("run_123", lines);
+    const [params] = mockCreateMessage.mock.calls[0];
+    const content: string = params.messages[0].content;
+    const lines2 = content.split("\n");
+    const navLine = lines2.find((l) => l.includes("navigate"));
+    expect(navLine!.length).toBeLessThanOrEqual(103); // 100 + "…"
+  });
+});

package/framework/__tests__/page-cache.test.ts

@@ -0,0 +1,106 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import * as fs from "fs";
+
+vi.mock("fs");
+vi.mock("path", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("path")>();
+  return { ...actual, join: (...args: string[]) => args.join("/") };
+});
+
+import { loadPageHashes, updatePageHashes, hashContent } from "../page-cache";
+
+beforeEach(() => {
+  vi.mocked(fs.existsSync).mockReturnValue(false);
+  vi.mocked(fs.mkdirSync).mockReturnValue(undefined);
+  vi.mocked(fs.writeFileSync).mockReturnValue(undefined);
+});
+
+describe("hashContent", () => {
+  it("同じ文字列は常に同じハッシュを返す", () => {
+    expect(hashContent("hello")).toBe(hashContent("hello"));
+  });
+
+  it("異なる文字列は異なるハッシュを返す", () => {
+    expect(hashContent("hello")).not.toBe(hashContent("world"));
+  });
+
+  it("空文字列も一意のハッシュを返す", () => {
+    const h = hashContent("");
+    expect(typeof h).toBe("string");
+    expect(h.length).toBeGreaterThan(0);
+  });
+
+  it("16文字に切り詰められる", () => {
+    expect(hashContent("any content").length).toBe(16);
+  });
+});
+
+describe("loadPageHashes", () => {
+  it("キャッシュファイルがない場合は空オブジェクトを返す", () => {
+    vi.mocked(fs.existsSync).mockReturnValue(false);
+    expect(loadPageHashes("localhost:3000")).toEqual({});
+  });
+
+  it("キャッシュファイルがある場合はパースして返す", () => {
+    const data = { "/home": "abc123", "/about": "def456" };
+    vi.mocked(fs.existsSync).mockReturnValue(true);
+    vi.mocked(fs.readFileSync).mockReturnValue(JSON.stringify(data) as unknown as ReturnType<typeof fs.readFileSync>);
+    expect(loadPageHashes("localhost:3000")).toEqual(data);
+  });
+
+  it("壊れた JSON は空オブジェクトを返す（例外を投げない）", () => {
+    vi.mocked(fs.existsSync).mockReturnValue(true);
+    vi.mocked(fs.readFileSync).mockReturnValue("not valid json{{{" as unknown as ReturnType<typeof fs.readFileSync>);
+    expect(() => loadPageHashes("localhost:3000")).not.toThrow();
+    expect(loadPageHashes("localhost:3000")).toEqual({});
+  });
+
+  it("ホスト名の特殊文字（: や /）はファイルパスで - に変換される", () => {
+    vi.mocked(fs.existsSync).mockReturnValue(true);
+    vi.mocked(fs.readFileSync).mockReturnValue("{}" as unknown as ReturnType<typeof fs.readFileSync>);
+    loadPageHashes("localhost:3000");
+    const checkedPath = vi.mocked(fs.existsSync).mock.calls[0][0] as string;
+    expect(checkedPath).not.toContain(":");
+    expect(checkedPath).toContain("localhost-3000");
+  });
+});
+
+describe("updatePageHashes", () => {
+  it("空の updates を渡すと書き込みをしない", () => {
+    updatePageHashes("localhost:3000", {});
+    expect(fs.mkdirSync).not.toHaveBeenCalled();
+    expect(fs.writeFileSync).not.toHaveBeenCalled();
+  });
+
+  it("既存データと新データをマージして書き込む", () => {
+    const existing = { "/home": "old_hash", "/about": "about_hash" };
+    vi.mocked(fs.existsSync).mockReturnValue(true);
+    vi.mocked(fs.readFileSync).mockReturnValue(JSON.stringify(existing) as unknown as ReturnType<typeof fs.readFileSync>);
+
+    updatePageHashes("localhost:3000", { "/home": "new_hash", "/contact": "contact_hash" });
+
+    const written = JSON.parse(vi.mocked(fs.writeFileSync).mock.calls[0][1] as string);
+    expect(written["/home"]).toBe("new_hash");       // 上書き
+    expect(written["/about"]).toBe("about_hash");    // 既存を保持
+    expect(written["/contact"]).toBe("contact_hash"); // 新規追加
+  });
+
+  it("複数回呼ぶと蓄積される", () => {
+    vi.mocked(fs.existsSync).mockReturnValue(false);
+
+    updatePageHashes("localhost:3000", { "/a": "hash_a" });
+    // 2回目: 1回目の書き込み内容を既存として読み込む
+    vi.mocked(fs.existsSync).mockReturnValue(true);
+    vi.mocked(fs.readFileSync).mockReturnValue(JSON.stringify({ "/a": "hash_a" }) as unknown as ReturnType<typeof fs.readFileSync>);
+    updatePageHashes("localhost:3000", { "/b": "hash_b" });
+
+    const lastWrite = JSON.parse(vi.mocked(fs.writeFileSync).mock.calls.at(-1)![1] as string);
+    expect(lastWrite["/a"]).toBe("hash_a");
+    expect(lastWrite["/b"]).toBe("hash_b");
+  });
+
+  it("書き込み前にディレクトリを作成する", () => {
+    updatePageHashes("localhost:3000", { "/x": "hash_x" });
+    expect(fs.mkdirSync).toHaveBeenCalledWith(expect.any(String), { recursive: true });
+  });
+});

package/framework/__tests__/report.test.ts

@@ -126,6 +126,14 @@ describe("generateReport", () => {
     expect(html).toContain("<script>");
   });
 
+  it("finding の body が HTML エスケープされる", () => {
+    const finding = makeFinding({ body: 'Click <a href="javascript:void(0)" onclick="steal()">here</a>' });
+    generateReport(makeRunLog(), [finding], emptyTriage, makeProductSpec(), [], new Map());
+    const html = getSavedHtml();
+    expect(html).not.toContain("<a href=");
+    expect(html).toContain("&lt;a href=");
+  });
+
   it("issued finding に → Issue バッジが付く", () => {
     const finding = makeFinding({ id: "f1" });
     const triage: TriageResult = { issued: ["f1"], skipped: [], unprocessed: [], issuesCreated: 1 };

package/framework/coverage.ts

@@ -214,7 +214,7 @@ export interface FindingHotspot {
 
 function extractPath(finding: Finding): string {
   const text = `${finding.title} ${finding.body}`;
-  const m = text.match(/\b(\/[a-zA-Z0-9_/-]{2,})/);
+  const m = text.match(/(\/[a-zA-Z0-9_][a-zA-Z0-9_/-]*)/);
   if (!m) return "/";
   const segments = m[1].split("/").filter(Boolean);
   return segments.length > 0 ? `/${segments[0]}` : "/";
@@ -231,9 +231,10 @@ export function getFindingHotspots(topN = 12): FindingHotspot[] {
     const dir = path.join(base, runDir);
     try {
       for (const file of fs.readdirSync(dir)) {
-        if (!file.endsWith(".json")) continue;
+        if (!file.endsWith(".json") || file === "triage_result.json") continue;
         try {
           const f: Finding = JSON.parse(fs.readFileSync(path.join(dir, file), "utf-8"));
+          if (typeof f.category !== "string") continue;
           const p = extractPath(f);
           const entry = counts.get(p) ?? { total: 0, categories: {} };
           entry.total++;

package/framework/cross-run-dedup.ts

@@ -0,0 +1,43 @@
+import type { Finding } from "./types";
+
+function tokenize(text: string): Set<string> {
+  return new Set(text.toLowerCase().match(/[a-z0-9]+/g) ?? []);
+}
+
+function jaccard(a: Set<string>, b: Set<string>): number {
+  const intersection = [...a].filter((x) => b.has(x)).length;
+  const union = new Set([...a, ...b]).size;
+  return union === 0 ? 0 : intersection / union;
+}
+
+/**
+ * タイトル+本文の単語集合の Jaccard 係数で finding をクラスタリングする。
+ * triage は同一 run 内の重複しか除去しないため、run をまたいで
+ * 繰り返し報告されている問題を見つけるための補助。
+ */
+export function groupSimilarFindings(findings: Finding[], threshold = 0.3): Finding[][] {
+  const tokensByIndex = findings.map((f) => tokenize(`${f.title} ${f.body}`));
+  const seen = new Set<number>();
+  const clusters: Finding[][] = [];
+
+  for (let i = 0; i < findings.length; i++) {
+    if (seen.has(i)) continue;
+    const clusterIndices = [i];
+    for (let j = i + 1; j < findings.length; j++) {
+      if (seen.has(j)) continue;
+      if (jaccard(tokensByIndex[i], tokensByIndex[j]) >= threshold) {
+        clusterIndices.push(j);
+        seen.add(j);
+      }
+    }
+    seen.add(i);
+    clusters.push(clusterIndices.map((idx) => findings[idx]));
+  }
+
+  return clusters;
+}
+
+/** 2件以上で構成されるクラスタ（= run をまたいだ重複候補）のみ返す */
+export function findCrossRunDuplicates(findings: Finding[], threshold = 0.3): Finding[][] {
+  return groupSimilarFindings(findings, threshold).filter((cluster) => cluster.length > 1);
+}

package/framework/diary.ts

@@ -8,9 +8,11 @@ function loadFindings(runId: string): Finding[] {
   if (!fs.existsSync(dir)) return [];
   const out: Finding[] = [];
   for (const file of fs.readdirSync(dir)) {
-    if (!file.endsWith(".json")) continue;
+    if (!file.endsWith(".json") || file === "triage_result.json") continue;
     try {
-      out.push(JSON.parse(fs.readFileSync(path.join(dir, file), "utf-8")));
+      const f: Finding = JSON.parse(fs.readFileSync(path.join(dir, file), "utf-8"));
+      if (typeof f.timestamp !== "string") continue;
+      out.push(f);
     } catch { /* skip */ }
   }
   return out;