@nolans01/agent-validator 0.1.0

package/dist/index.js

@@ -0,0 +1,1804 @@
+// src/resolver.ts
+import path2 from "path";
+import fs from "fs";
+import { glob } from "glob";
+import { execa } from "execa";
+
+// src/detector.ts
+import path from "path";
+var EXTENSION_MAP = {
+  ".ts": "typescript",
+  ".tsx": "typescript",
+  ".js": "javascript",
+  ".jsx": "javascript",
+  ".mjs": "javascript",
+  ".cjs": "javascript",
+  ".py": "python",
+  ".rb": "ruby",
+  ".go": "go",
+  ".rs": "rust"
+};
+var SOURCE_EXTENSIONS = Object.keys(EXTENSION_MAP);
+function detectLanguage(filePath) {
+  const ext = path.extname(filePath).toLowerCase();
+  return EXTENSION_MAP[ext] ?? "unknown";
+}
+function detectPrimaryLanguage(files) {
+  const counts = /* @__PURE__ */ new Map();
+  for (const file of files) {
+    if (file.language === "unknown") continue;
+    counts.set(file.language, (counts.get(file.language) ?? 0) + 1);
+  }
+  let maxLang = "unknown";
+  let maxCount = 0;
+  for (const [lang, count] of counts) {
+    if (count > maxCount) {
+      maxCount = count;
+      maxLang = lang;
+    }
+  }
+  return maxLang;
+}
+
+// src/resolver.ts
+async function resolveFiles(options) {
+  let rawPaths;
+  switch (options.mode) {
+    case "diff":
+      rawPaths = await resolveDiff(options);
+      break;
+    case "files":
+      rawPaths = await resolveFileList(options);
+      break;
+    case "dir":
+      rawPaths = await resolveDirectory(options);
+      break;
+    case "scan":
+      rawPaths = await resolveDirectory({ ...options, targets: ["."] });
+      break;
+    default:
+      throw new Error(`Unknown mode: ${options.mode}`);
+  }
+  const sourceFiles = rawPaths.filter((p) => {
+    const ext = path2.extname(p).toLowerCase();
+    return SOURCE_EXTENSIONS.includes(ext);
+  });
+  return sourceFiles.map((p) => ({
+    path: path2.resolve(options.workdir, p),
+    relativePath: p,
+    language: detectLanguage(p)
+  }));
+}
+async function resolveDiff(options) {
+  const args = ["diff", "--name-only", "--diff-filter=ACMR"];
+  if (options.staged) {
+    args.push("--staged");
+  } else {
+    const base = options.base ?? "main";
+    const head = options.head ?? "HEAD";
+    args.push(`${base}...${head}`);
+  }
+  const result = await execa("git", args, { cwd: options.workdir });
+  return result.stdout.trim().split("\n").filter(Boolean);
+}
+async function resolveFileList(options) {
+  const targets = options.targets ?? [];
+  const resolved = [];
+  for (const target of targets) {
+    if (target.includes("*") || target.includes("?")) {
+      const matches = await glob(target, { cwd: options.workdir });
+      resolved.push(...matches);
+    } else {
+      const fullPath = path2.resolve(options.workdir, target);
+      if (fs.existsSync(fullPath)) {
+        resolved.push(target);
+      }
+    }
+  }
+  return resolved;
+}
+async function resolveDirectory(options) {
+  const dirs = options.targets ?? ["."];
+  const patterns = dirs.map((d) => `${d}/**/*`);
+  const defaultExclude = ["**/node_modules/**", "**/dist/**", "**/.git/**"];
+  const ignore = [...defaultExclude, ...options.exclude ?? []];
+  return glob(patterns, {
+    cwd: options.workdir,
+    nodir: true,
+    ignore
+  });
+}
+
+// src/adapters/tsc.ts
+import { execa as execa3 } from "execa";
+import fs2 from "fs";
+import path3 from "path";
+
+// src/adapters/base.ts
+import { execa as execa2 } from "execa";
+async function isBinaryAvailable(command) {
+  try {
+    await execa2(command, ["--version"]);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// src/adapters/tsc.ts
+var TSC_LINE_RE = /^(.+)\((\d+),(\d+)\): (error|warning) (TS\d+): (.+)$/;
+function resolveLocalBinary(name, workdir) {
+  const localPath = path3.join(workdir, "node_modules", ".bin", name);
+  return fs2.existsSync(localPath) ? localPath : void 0;
+}
+function buildTscArgs(config, tsconfigPath, hasTsconfig, files) {
+  const args = ["--noEmit", "--pretty", "false"];
+  if (hasTsconfig) {
+    args.push("--project", tsconfigPath);
+  } else {
+    if (config.strict) args.push("--strict");
+    args.push(...files);
+  }
+  return args;
+}
+function parseTscOutput(stdout, workdir, fileSet, hasTsconfig) {
+  const findings = [];
+  for (const line of stdout.split("\n")) {
+    const match = line.match(TSC_LINE_RE);
+    if (!match) continue;
+    const [, filePath, lineNum, , severity, code, message] = match;
+    const relativePath = filePath.startsWith("/") ? path3.relative(workdir, filePath) : filePath;
+    if (hasTsconfig && !fileSet.has(relativePath)) continue;
+    findings.push({
+      file: relativePath,
+      line: parseInt(lineNum, 10),
+      severity: severity === "error" ? "blocker" : "warning",
+      metric: "type_error",
+      message,
+      why: `TypeScript compiler error ${code}: the code will not compile.`,
+      suggestion: "Fix the type error to ensure type safety.",
+      metadata: { code, source: "tsc" }
+    });
+  }
+  return findings;
+}
+var TscAdapter = class {
+  name = "tsc";
+  supportedLanguages = ["typescript"];
+  async isAvailable(workdir) {
+    if (workdir && resolveLocalBinary("tsc", workdir)) return true;
+    return isBinaryAvailable("tsc");
+  }
+  async run(files, config) {
+    if (files.length === 0) return { findings: [] };
+    const tsconfigPath = config.tsconfigPath ? path3.resolve(config.workdir, config.tsconfigPath) : path3.join(config.workdir, "tsconfig.json");
+    const hasTsconfig = fs2.existsSync(tsconfigPath);
+    const args = buildTscArgs(config, tsconfigPath, hasTsconfig, files);
+    const binary = resolveLocalBinary("tsc", config.workdir) ?? "tsc";
+    const result = await execa3(binary, args, {
+      cwd: config.workdir,
+      reject: false
+    });
+    const stdout = result.stdout || "";
+    if (!stdout.trim()) return { findings: [] };
+    const fileSet = new Set(files);
+    return { findings: parseTscOutput(stdout, config.workdir, fileSet, hasTsconfig) };
+  }
+};
+
+// src/adapters/mypy.ts
+import { execa as execa4 } from "execa";
+var MYPY_LINE_RE = /^(.+):(\d+): (error|warning|note): (.+?)(?:\s+\[(.+)\])?$/;
+var MypyAdapter = class {
+  name = "mypy";
+  supportedLanguages = ["python"];
+  async isAvailable() {
+    return isBinaryAvailable("mypy");
+  }
+  async run(files, config) {
+    if (files.length === 0) return { findings: [] };
+    const args = ["--no-color-output", "--no-error-summary"];
+    if (config.strict) args.push("--strict");
+    args.push(...files);
+    const result = await execa4("mypy", args, {
+      cwd: config.workdir,
+      reject: false
+    });
+    const stdout = result.stdout || "";
+    if (!stdout.trim()) return { findings: [] };
+    const findings = [];
+    for (const line of stdout.split("\n")) {
+      const match = line.match(MYPY_LINE_RE);
+      if (!match) continue;
+      const [, filePath, lineNum, severity, message, code] = match;
+      findings.push({
+        file: filePath,
+        line: parseInt(lineNum, 10),
+        severity: mapMypySeverity(severity),
+        metric: "type_error",
+        message,
+        why: buildMypyWhy(severity, code),
+        suggestion: "Fix the type annotation or value to satisfy the type checker.",
+        metadata: { code: code ?? void 0, source: "mypy" }
+      });
+    }
+    return { findings };
+  }
+};
+function mapMypySeverity(level) {
+  switch (level) {
+    case "error":
+      return "blocker";
+    case "warning":
+      return "warning";
+    default:
+      return "info";
+  }
+}
+function buildMypyWhy(severity, code) {
+  const parts = [];
+  if (severity === "error") {
+    parts.push("mypy type error: the code has an incorrect type annotation or usage");
+  } else if (severity === "warning") {
+    parts.push("mypy warning: potential type issue detected");
+  } else {
+    parts.push("mypy note: additional type information");
+  }
+  if (code) parts.push(`[${code}]`);
+  return parts.join(" ");
+}
+
+// src/scorer.ts
+function calculateComplexityScore(input) {
+  if (input.totalFunctions === 0) return 100;
+  const violationCount = input.findings.length;
+  const cleanCount = Math.max(0, input.totalFunctions - violationCount);
+  return Math.round(cleanCount / input.totalFunctions * 100);
+}
+function deriveStatus(score, findings) {
+  const hasBlockers = findings.some((f) => f.severity === "blocker");
+  if (hasBlockers) return "fail";
+  if (score < 70) return "fail";
+  if (score < 85) return "warn";
+  return "pass";
+}
+function calculateSecurityScore(input) {
+  let score = 100;
+  for (const finding of input.findings) {
+    switch (finding.severity) {
+      case "blocker":
+        score -= 25;
+        break;
+      case "warning":
+        score -= 10;
+        break;
+      case "info":
+        score -= 3;
+        break;
+    }
+  }
+  return Math.max(0, score);
+}
+function calculateTypeSafetyScore(input) {
+  let score = 100;
+  for (const finding of input.findings) {
+    switch (finding.severity) {
+      case "blocker":
+        score -= 10;
+        break;
+      case "warning":
+        score -= 5;
+        break;
+      case "info":
+        score -= 2;
+        break;
+    }
+  }
+  return Math.max(0, score);
+}
+function calculateArchitectureScore(input) {
+  let score = 100;
+  for (const finding of input.findings) {
+    switch (finding.severity) {
+      case "blocker":
+        score -= 15;
+        break;
+      case "warning":
+        score -= 7;
+        break;
+      case "info":
+        score -= 3;
+        break;
+    }
+  }
+  return Math.max(0, score);
+}
+function calculateTestQualityScore(input) {
+  return Math.round(Math.max(0, Math.min(100, input.mutationScore)));
+}
+function overallStatus(results) {
+  if (results.some((r) => r.status === "fail")) return "fail";
+  if (results.some((r) => r.status === "warn")) return "warn";
+  return "pass";
+}
+
+// src/config/defaults.ts
+var DEFAULT_COMPLEXITY = {
+  cyclomatic: 10,
+  length: 40,
+  arguments: 4,
+  nesting: 3
+};
+var DEFAULT_SECURITY = {
+  semgrepRules: ["p/security-audit", "p/secrets"],
+  gitleaksEnabled: true
+};
+var DEFAULT_TYPE_SAFETY = {
+  strict: false,
+  mypyEnabled: true
+};
+var DEFAULT_JSCPD_EXCLUDE = [
+  "**/test/**",
+  "**/tests/**",
+  "**/__tests__/**",
+  "**/*.test.*",
+  "**/*.spec.*",
+  "**/docs/**",
+  "**/*.md",
+  "**/fixtures/**",
+  "**/mocks/**",
+  "**/node_modules/**",
+  "**/dist/**",
+  "**/vendor/**"
+];
+var DEFAULT_ARCHITECTURE = {
+  madgeEnabled: true,
+  jscpdEnabled: true,
+  knipEnabled: true
+};
+var DEFAULT_TEST_QUALITY = {
+  strykerEnabled: true,
+  mutmutEnabled: true,
+  mutantEnabled: true,
+  mutationScoreThreshold: 80,
+  timeout: 3e5,
+  maxSurvivorFindings: 5
+};
+
+// src/gates/shared.ts
+function toolMissingResult(gate, start, message, suggestion) {
+  return {
+    gate,
+    score: 0,
+    status: "skip",
+    duration_ms: Date.now() - start,
+    findings: [
+      {
+        file: "",
+        line: 0,
+        severity: "info",
+        metric: "tool_missing",
+        message,
+        why: `The ${gate} gate requires at least one tool to function.`,
+        suggestion
+      }
+    ]
+  };
+}
+
+// src/gates/type-safety.ts
+var TypeSafetyGate = class {
+  name = "type_safety";
+  tsc = new TscAdapter();
+  mypy = new MypyAdapter();
+  async run(ctx) {
+    const start = Date.now();
+    const config = ctx.config.typeSafety ?? DEFAULT_TYPE_SAFETY;
+    if (ctx.language === "typescript") {
+      return this.runTsc(ctx, config, start);
+    }
+    if (ctx.language === "python" && config.mypyEnabled) {
+      return this.runMypy(ctx, config, start);
+    }
+    const suggestion = ctx.language === "python" ? "Enable mypyEnabled in profile or install mypy: pip install mypy" : "No type checker supported for this language yet.";
+    return toolMissingResult(this.name, start, `No type checker available for language: ${ctx.language}`, suggestion);
+  }
+  getFiles(ctx, adapter) {
+    return ctx.files.filter((f) => adapter.supportedLanguages.includes(f.language)).map((f) => f.relativePath);
+  }
+  emptyResult(start) {
+    return { gate: this.name, score: 100, status: "pass", duration_ms: Date.now() - start, findings: [] };
+  }
+  async runTsc(ctx, config, start) {
+    const available = await this.tsc.isAvailable(ctx.workdir);
+    if (!available) {
+      return toolMissingResult(this.name, start, "tsc is not installed", "Install with: npm install -g typescript");
+    }
+    const files = this.getFiles(ctx, this.tsc);
+    if (files.length === 0) return this.emptyResult(start);
+    const adapterConfig = {
+      workdir: ctx.workdir,
+      thresholds: {},
+      strict: config.strict,
+      tsconfigPath: config.tsconfigPath
+    };
+    const result = await this.tsc.run(files, adapterConfig);
+    return this.buildResult(result.findings, start);
+  }
+  async runMypy(ctx, config, start) {
+    const available = await this.mypy.isAvailable();
+    if (!available) {
+      return toolMissingResult(this.name, start, "mypy is not installed", "Install with: pip install mypy");
+    }
+    const files = this.getFiles(ctx, this.mypy);
+    if (files.length === 0) return this.emptyResult(start);
+    const adapterConfig = {
+      workdir: ctx.workdir,
+      thresholds: {},
+      strict: config.strict
+    };
+    const result = await this.mypy.run(files, adapterConfig);
+    return this.buildResult(result.findings, start);
+  }
+  buildResult(findings, start) {
+    const score = calculateTypeSafetyScore({ findings });
+    const status = deriveStatus(score, findings);
+    return { gate: this.name, score, status, duration_ms: Date.now() - start, findings };
+  }
+};
+
+// src/adapters/lizard.ts
+import { execa as execa5 } from "execa";
+
+// src/utils.ts
+function chunk(arr, size) {
+  if (size <= 0) return [arr];
+  const chunks = [];
+  for (let i = 0; i < arr.length; i += size) {
+    chunks.push(arr.slice(i, i + size));
+  }
+  return chunks;
+}
+
+// src/adapters/lizard.ts
+var LizardAdapter = class {
+  name = "lizard";
+  supportedLanguages = [
+    "typescript",
+    "javascript",
+    "python",
+    "ruby",
+    "go",
+    "rust"
+  ];
+  async isAvailable() {
+    return isBinaryAvailable("lizard");
+  }
+  async run(files, config) {
+    if (files.length === 0) {
+      return { findings: [], totalFunctions: 0 };
+    }
+    const allFindings = [];
+    let totalFunctions = 0;
+    for (const batch of chunk(files, 50)) {
+      const result = await execa5("lizard", [...batch, "--csv"], {
+        cwd: config.workdir,
+        reject: false
+      });
+      const parsed = parseLizardCsv(result.stdout, config.thresholds);
+      allFindings.push(...parsed.findings);
+      totalFunctions += parsed.totalFunctions;
+    }
+    return { findings: allFindings, totalFunctions };
+  }
+};
+function parseCsvRow(fields) {
+  if (fields.length < 11) return null;
+  const ccn = parseInt(fields[1], 10);
+  if (isNaN(ccn)) return null;
+  return {
+    nloc: parseInt(fields[0], 10),
+    ccn,
+    params: parseInt(fields[3], 10),
+    file: fields[6],
+    func: fields[7],
+    start: parseInt(fields[9], 10),
+    end: parseInt(fields[10], 10)
+  };
+}
+function detectViolations(m, thresholds) {
+  const violations = [];
+  if (m.ccn > (thresholds.cyclomatic ?? 10)) violations.push("cyclomatic");
+  if (m.nloc > (thresholds.length ?? 40)) violations.push("length");
+  if (m.params > (thresholds.arguments ?? 4)) violations.push("arguments");
+  return violations;
+}
+function metricsToFinding(m, violations, thresholds) {
+  return {
+    file: m.file,
+    line: m.start,
+    end_line: m.end,
+    function: m.func,
+    severity: determineSeverity(m, thresholds),
+    metric: "complexity",
+    value: m.ccn,
+    threshold: thresholds.cyclomatic ?? 10,
+    message: buildMessage(m, violations, thresholds),
+    why: buildWhy(m, violations),
+    suggestion: buildSuggestion(violations),
+    metadata: { nloc: m.nloc, ccn: m.ccn, params: m.params, violations }
+  };
+}
+function parseLizardCsv(csv, thresholds) {
+  const lines = csv.trim().split("\n");
+  if (lines.length <= 1) return { findings: [], totalFunctions: 0 };
+  const findings = [];
+  let totalFunctions = 0;
+  for (const line of lines.slice(1)) {
+    const m = parseCsvRow(parseCSVLine(line));
+    if (!m) continue;
+    totalFunctions++;
+    const violations = detectViolations(m, thresholds);
+    if (violations.length === 0) continue;
+    findings.push(metricsToFinding(m, violations, thresholds));
+  }
+  return { findings, totalFunctions };
+}
+function determineSeverity(m, thresholds) {
+  const ccnRatio = m.ccn / (thresholds.cyclomatic ?? 10);
+  const nlocRatio = m.nloc / (thresholds.length ?? 40);
+  if (ccnRatio > 1.5 || nlocRatio > 1.5) return "blocker";
+  return "warning";
+}
+function buildMessage(m, violations, thresholds) {
+  const parts = [];
+  if (violations.includes("cyclomatic")) {
+    parts.push(`Cyclomatic: ${m.ccn} (max: ${thresholds.cyclomatic ?? 10})`);
+  }
+  if (violations.includes("length")) {
+    parts.push(`NLOC: ${m.nloc} (max: ${thresholds.length ?? 40})`);
+  }
+  if (violations.includes("arguments")) {
+    parts.push(`Params: ${m.params} (max: ${thresholds.arguments ?? 4})`);
+  }
+  return parts.join(" | ");
+}
+function buildWhy(m, violations) {
+  if (violations.includes("cyclomatic") && violations.includes("length")) {
+    return `${m.ccn} execution paths in ${m.nloc} lines. Difficult to test exhaustively and high risk of bugs on change.`;
+  }
+  if (violations.includes("cyclomatic")) {
+    return `${m.ccn} execution paths make this function hard to test and maintain.`;
+  }
+  if (violations.includes("length")) {
+    return `${m.nloc} lines suggests this function does more than one thing.`;
+  }
+  if (violations.includes("arguments")) {
+    return "Too many parameters indicates this function has too many responsibilities or needs a config object.";
+  }
+  return "Function exceeds complexity thresholds.";
+}
+function buildSuggestion(violations) {
+  if (violations.includes("cyclomatic") || violations.includes("length")) {
+    return "Extract into smaller, focused functions with single responsibility.";
+  }
+  if (violations.includes("arguments")) {
+    return "Group related parameters into an options/config object.";
+  }
+  return "Simplify this function.";
+}
+function parseCSVLine(line) {
+  const fields = [];
+  let current = "";
+  let inQuotes = false;
+  for (const char of line) {
+    if (char === '"') {
+      inQuotes = !inQuotes;
+    } else if (char === "," && !inQuotes) {
+      fields.push(current.trim());
+      current = "";
+    } else {
+      current += char;
+    }
+  }
+  fields.push(current.trim());
+  return fields;
+}
+
+// src/gates/complexity.ts
+var ComplexityGate = class {
+  name = "complexity";
+  adapter = new LizardAdapter();
+  async run(ctx) {
+    const start = Date.now();
+    const available = await this.adapter.isAvailable();
+    if (!available) {
+      return toolMissingResult(this.name, start, "lizard is not installed", "Install with: pip install lizard");
+    }
+    const supportedFiles = ctx.files.filter((f) => this.adapter.supportedLanguages.includes(f.language)).map((f) => f.relativePath);
+    if (supportedFiles.length === 0) {
+      return {
+        gate: this.name,
+        score: 100,
+        status: "pass",
+        duration_ms: Date.now() - start,
+        findings: []
+      };
+    }
+    const { findings, totalFunctions = 0 } = await this.adapter.run(supportedFiles, {
+      workdir: ctx.workdir,
+      thresholds: {
+        cyclomatic: ctx.config.complexity.cyclomatic,
+        length: ctx.config.complexity.length,
+        arguments: ctx.config.complexity.arguments
+      }
+    });
+    const score = calculateComplexityScore({ totalFunctions, findings });
+    const status = deriveStatus(score, findings);
+    const duration_ms = Date.now() - start;
+    return { gate: this.name, score, status, duration_ms, findings };
+  }
+};
+
+// src/adapters/semgrep.ts
+import { execa as execa6 } from "execa";
+var SemgrepAdapter = class {
+  name = "semgrep";
+  supportedLanguages = [
+    "typescript",
+    "javascript",
+    "python",
+    "ruby",
+    "go",
+    "rust"
+  ];
+  async isAvailable() {
+    return isBinaryAvailable("semgrep");
+  }
+  async run(files, config) {
+    if (files.length === 0) {
+      return { findings: [] };
+    }
+    const rules = config.rules ?? ["p/security-audit", "p/secrets"];
+    const allFindings = [];
+    for (const batch of chunk(files, 50)) {
+      const configArgs = rules.flatMap((r) => ["--config", r]);
+      const result = await execa6(
+        "semgrep",
+        [...configArgs, "--json", ...batch],
+        { cwd: config.workdir, reject: false }
+      );
+      if (result.stdout) {
+        const parsed = parseSemgrepJson(result.stdout);
+        allFindings.push(...parsed);
+      }
+    }
+    return { findings: allFindings };
+  }
+};
+function parseSemgrepJson(json) {
+  let output;
+  try {
+    output = JSON.parse(json);
+  } catch {
+    return [];
+  }
+  if (!output.results || !Array.isArray(output.results)) {
+    return [];
+  }
+  return output.results.map((r) => ({
+    file: r.path,
+    line: r.start.line,
+    end_line: r.end.line,
+    severity: mapSeverity(r.extra.severity),
+    metric: "security",
+    message: r.extra.message,
+    why: buildWhy2(r),
+    suggestion: r.extra.fix ?? void 0,
+    metadata: {
+      ruleId: r.check_id,
+      cwe: r.extra.metadata?.cwe,
+      owasp: r.extra.metadata?.owasp,
+      confidence: r.extra.metadata?.confidence,
+      source: "semgrep"
+    }
+  }));
+}
+function mapSeverity(severity) {
+  switch (severity) {
+    case "ERROR":
+      return "blocker";
+    case "WARNING":
+      return "warning";
+    case "INFO":
+      return "info";
+    default:
+      return "warning";
+  }
+}
+function buildWhy2(result) {
+  const parts = [];
+  if (result.extra.metadata?.cwe?.length) {
+    parts.push(result.extra.metadata.cwe.join(", "));
+  }
+  if (result.extra.metadata?.owasp?.length) {
+    parts.push(result.extra.metadata.owasp.join(", "));
+  }
+  if (parts.length === 0) {
+    return `Security issue detected by rule ${result.check_id}.`;
+  }
+  return `${parts.join(" | ")}. Detected by rule ${result.check_id}.`;
+}
+
+// src/adapters/gitleaks.ts
+import { execa as execa7 } from "execa";
+var GitleaksAdapter = class {
+  name = "gitleaks";
+  supportedLanguages = [
+    "typescript",
+    "javascript",
+    "python",
+    "ruby",
+    "go",
+    "rust",
+    "unknown"
+  ];
+  async isAvailable() {
+    return isBinaryAvailable("gitleaks");
+  }
+  async run(files, config) {
+    const result = await execa7(
+      "gitleaks",
+      ["detect", "--source", config.workdir, "--no-git", "-f", "json", "--report-path", "/dev/stdout"],
+      { cwd: config.workdir, reject: false }
+    );
+    if (!result.stdout || result.stdout.trim() === "") {
+      return { findings: [] };
+    }
+    const allLeaks = parseGitleaksJson(result.stdout);
+    const fileSet = new Set(files);
+    const filtered = allLeaks.filter((f) => fileSet.has(f.file));
+    return { findings: filtered };
+  }
+};
+function parseGitleaksJson(json) {
+  let leaks;
+  try {
+    leaks = JSON.parse(json);
+  } catch {
+    return [];
+  }
+  if (!Array.isArray(leaks)) {
+    return [];
+  }
+  return leaks.map((leak) => ({
+    file: leak.File,
+    line: leak.StartLine,
+    end_line: leak.EndLine,
+    severity: "blocker",
+    metric: "security",
+    message: `Secret detected: ${leak.Description}`,
+    why: `Exposed secrets can lead to unauthorized access. Rule: ${leak.RuleID}.`,
+    suggestion: "Remove the secret and rotate the credential. Use environment variables or a secrets manager.",
+    metadata: {
+      ruleId: leak.RuleID,
+      entropy: leak.Entropy,
+      fingerprint: leak.Fingerprint,
+      source: "gitleaks"
+    }
+  }));
+}
+
+// src/gates/security.ts
+var SecurityGate = class {
+  name = "security";
+  semgrep = new SemgrepAdapter();
+  gitleaks = new GitleaksAdapter();
+  async run(ctx) {
+    const start = Date.now();
+    const securityConfig = ctx.config.security ?? DEFAULT_SECURITY;
+    const semgrepAvailable = await this.semgrep.isAvailable();
+    const gitleaksAvailable = securityConfig.gitleaksEnabled ? await this.gitleaks.isAvailable() : false;
+    if (!semgrepAvailable && !gitleaksAvailable) {
+      return toolMissingResult(this.name, start, "Neither semgrep nor gitleaks is installed", "Install with: pip install semgrep OR brew install gitleaks");
+    }
+    const allFindings = [];
+    if (semgrepAvailable) {
+      const supportedFiles = ctx.files.filter((f) => this.semgrep.supportedLanguages.includes(f.language)).map((f) => f.relativePath);
+      if (supportedFiles.length > 0) {
+        const semgrepConfig = {
+          workdir: ctx.workdir,
+          thresholds: {},
+          rules: securityConfig.semgrepRules
+        };
+        const result = await this.semgrep.run(supportedFiles, semgrepConfig);
+        allFindings.push(...result.findings);
+      }
+    }
+    if (gitleaksAvailable) {
+      const allFiles = ctx.files.map((f) => f.relativePath);
+      const result = await this.gitleaks.run(allFiles, {
+        workdir: ctx.workdir,
+        thresholds: {}
+      });
+      allFindings.push(...result.findings);
+    }
+    const score = calculateSecurityScore({ findings: allFindings });
+    const status = deriveStatus(score, allFindings);
+    const duration_ms = Date.now() - start;
+    return { gate: this.name, score, status, duration_ms, findings: allFindings };
+  }
+};
+
+// src/adapters/madge.ts
+import { execa as execa8 } from "execa";
+function parseCycles(stdout) {
+  if (!stdout.trim()) return null;
+  try {
+    const cycles = JSON.parse(stdout);
+    if (!Array.isArray(cycles) || cycles.length === 0) return null;
+    return cycles;
+  } catch {
+    return null;
+  }
+}
+function cycleToFinding(cycle) {
+  const cycleDesc = cycle.join(" \u2192 ") + " \u2192 " + cycle[0];
+  return {
+    file: cycle[0],
+    line: 0,
+    severity: "blocker",
+    metric: "circular_dependency",
+    message: `Circular dependency: ${cycleDesc}`,
+    why: "Circular dependencies make the code harder to test, refactor, and reason about.",
+    suggestion: "Break the cycle by extracting shared code into a separate module.",
+    metadata: { cycle, source: "madge" }
+  };
+}
+var MadgeAdapter = class {
+  name = "madge";
+  supportedLanguages = ["typescript", "javascript"];
+  async isAvailable() {
+    return isBinaryAvailable("madge");
+  }
+  async run(files, config) {
+    if (files.length === 0) return { findings: [] };
+    const result = await execa8("madge", ["--circular", "--json", config.workdir], {
+      cwd: config.workdir,
+      reject: false
+    });
+    const cycles = parseCycles(result.stdout || "");
+    if (!cycles) return { findings: [] };
+    const fileSet = new Set(files);
+    const findings = cycles.filter((cycle) => Array.isArray(cycle) && cycle.length > 0).filter((cycle) => cycle.some((f) => fileSet.has(f))).map(cycleToFinding);
+    return { findings };
+  }
+};
+
+// src/adapters/jscpd.ts
+import { execa as execa9 } from "execa";
+import fs3 from "fs";
+import os from "os";
+import path4 from "path";
+function buildArgs(config, tmpDir) {
+  const minLines = config.minLines ?? 5;
+  const minTokens = config.minTokens ?? 50;
+  const exclude = config.exclude ?? [];
+  const args = [
+    "--min-lines",
+    String(minLines),
+    "--min-tokens",
+    String(minTokens),
+    "--reporters",
+    "json",
+    "--silent",
+    "--output",
+    tmpDir
+  ];
+  for (const pattern of exclude) {
+    args.push("--ignore", pattern);
+  }
+  args.push(config.workdir);
+  return args;
+}
+function parseReport(reportPath) {
+  if (!fs3.existsSync(reportPath)) return null;
+  const raw = fs3.readFileSync(reportPath, "utf-8");
+  try {
+    const report = JSON.parse(raw);
+    if (!report.duplicates || !Array.isArray(report.duplicates)) return null;
+    return report;
+  } catch {
+    return null;
+  }
+}
+function cloneToFinding(clone, workdir) {
+  const firstRel = path4.relative(workdir, clone.firstFile.name);
+  const secondRel = path4.relative(workdir, clone.secondFile.name);
+  return {
+    file: firstRel,
+    line: clone.firstFile.startLoc.line,
+    end_line: clone.firstFile.endLoc.line,
+    severity: "warning",
+    metric: "code_duplication",
+    message: `${clone.lines} lines duplicated with ${secondRel}:${clone.secondFile.startLoc.line}`,
+    why: "Duplicated code increases maintenance burden and risk of inconsistent changes.",
+    suggestion: "Extract the duplicated logic into a shared function or module.",
+    metadata: {
+      lines: clone.lines,
+      tokens: clone.tokens,
+      secondFile: secondRel,
+      secondLine: clone.secondFile.startLoc.line,
+      source: "jscpd"
+    }
+  };
+}
+var JscpdAdapter = class {
+  name = "jscpd";
+  supportedLanguages = ["typescript", "javascript", "python", "ruby"];
+  async isAvailable() {
+    return isBinaryAvailable("jscpd");
+  }
+  async run(files, config) {
+    if (files.length === 0) return { findings: [] };
+    const jscpdConfig = config;
+    const tmpDir = fs3.mkdtempSync(path4.join(os.tmpdir(), "jscpd-"));
+    try {
+      const args = buildArgs(jscpdConfig, tmpDir);
+      await execa9("jscpd", args, { cwd: config.workdir, reject: false });
+      const report = parseReport(path4.join(tmpDir, "jscpd-report.json"));
+      if (!report) return { findings: [] };
+      const fileSet = new Set(files);
+      return {
+        findings: report.duplicates.filter((clone) => {
+          const firstRel = path4.relative(config.workdir, clone.firstFile.name);
+          const secondRel = path4.relative(config.workdir, clone.secondFile.name);
+          return fileSet.has(firstRel) || fileSet.has(secondRel);
+        }).map((clone) => cloneToFinding(clone, config.workdir))
+      };
+    } finally {
+      fs3.rmSync(tmpDir, { recursive: true, force: true });
+    }
+  }
+};
+
+// src/adapters/knip.ts
+import { execa as execa10 } from "execa";
+function collectUnusedFiles(report, fileSet) {
+  if (!report.files || !Array.isArray(report.files)) return [];
+  return report.files.filter((file) => fileSet.has(file)).map((file) => ({
+    file,
+    line: 0,
+    severity: "info",
+    metric: "dead_code",
+    message: `Unused file: ${file}`,
+    why: "Unused files add confusion and increase bundle/maintenance cost.",
+    suggestion: "Remove the file if it is no longer needed.",
+    metadata: { type: "file", source: "knip" }
+  }));
+}
+function exportToFinding(file, exp) {
+  return {
+    file,
+    line: exp.line ?? 0,
+    severity: "info",
+    metric: "unused_export",
+    message: `Unused export: ${exp.name}`,
+    why: "Unused exports indicate dead code that may confuse consumers.",
+    suggestion: `Remove the export or make '${exp.name}' internal.`,
+    metadata: { type: "export", exportName: exp.name, source: "knip" }
+  };
+}
+function typeToFinding(file, typ) {
+  return {
+    file,
+    line: typ.line ?? 0,
+    severity: "info",
+    metric: "unused_export",
+    message: `Unused exported type: ${typ.name}`,
+    why: "Unused type exports indicate dead code.",
+    suggestion: `Remove the type export '${typ.name}' if no longer needed.`,
+    metadata: { type: "type", exportName: typ.name, source: "knip" }
+  };
+}
+function collectUnusedExports(report, fileSet) {
+  if (!report.issues || !Array.isArray(report.issues)) return [];
+  const findings = [];
+  for (const issue of report.issues) {
+    if (!fileSet.has(issue.file)) continue;
+    if (issue.exports) findings.push(...issue.exports.map((e) => exportToFinding(issue.file, e)));
+    if (issue.types) findings.push(...issue.types.map((t) => typeToFinding(issue.file, t)));
+  }
+  return findings;
+}
+var KnipAdapter = class {
+  name = "knip";
+  supportedLanguages = ["typescript"];
+  async isAvailable() {
+    return isBinaryAvailable("knip");
+  }
+  async run(files, config) {
+    if (files.length === 0) return { findings: [] };
+    const result = await execa10("knip", ["--reporter", "json"], {
+      cwd: config.workdir,
+      reject: false
+    });
+    const stdout = result.stdout || "";
+    if (!stdout.trim()) return { findings: [] };
+    let report;
+    try {
+      report = JSON.parse(stdout);
+    } catch {
+      return { findings: [] };
+    }
+    const fileSet = new Set(files);
+    return {
+      findings: [
+        ...collectUnusedFiles(report, fileSet),
+        ...collectUnusedExports(report, fileSet)
+      ]
+    };
+  }
+};
+
+// src/gates/architecture.ts
+var ArchitectureGate = class {
+  name = "architecture";
+  madge = new MadgeAdapter();
+  jscpd = new JscpdAdapter();
+  knip = new KnipAdapter();
+  async run(ctx) {
+    const start = Date.now();
+    const config = ctx.config.architecture ?? DEFAULT_ARCHITECTURE;
+    const available = await this.checkAvailability(config, ctx);
+    if (!available.madge && !available.jscpd && !available.knip) {
+      return toolMissingResult(this.name, start, "No architecture tools available", "Install with: npm install -g madge jscpd knip");
+    }
+    const allFindings = await this.collectFindings(available, config, ctx);
+    const score = calculateArchitectureScore({ findings: allFindings });
+    const status = deriveStatus(score, allFindings);
+    return { gate: this.name, score, status, duration_ms: Date.now() - start, findings: allFindings };
+  }
+  async checkAvailability(config, ctx) {
+    const madgeApplicable = config.madgeEnabled && this.madge.supportedLanguages.includes(ctx.language);
+    const jscpdApplicable = config.jscpdEnabled;
+    const knipApplicable = config.knipEnabled && this.knip.supportedLanguages.includes(ctx.language);
+    return {
+      madge: madgeApplicable ? await this.madge.isAvailable() : false,
+      jscpd: jscpdApplicable ? await this.jscpd.isAvailable() : false,
+      knip: knipApplicable ? await this.knip.isAvailable() : false
+    };
+  }
+  async collectFindings(available, config, ctx) {
+    const allFindings = [];
+    if (available.madge) {
+      const findings = await this.runAdapter(this.madge, ctx, { workdir: ctx.workdir, thresholds: {} });
+      allFindings.push(...findings);
+    }
+    if (available.jscpd) {
+      const jscpdConfig = {
+        workdir: ctx.workdir,
+        thresholds: {},
+        minLines: config.jscpdMinLines,
+        minTokens: config.jscpdMinTokens,
+        exclude: config.jscpdExclude ?? DEFAULT_JSCPD_EXCLUDE
+      };
+      const findings = await this.runAdapter(this.jscpd, ctx, jscpdConfig);
+      allFindings.push(...findings);
+    }
+    if (available.knip) {
+      const findings = await this.runAdapter(this.knip, ctx, { workdir: ctx.workdir, thresholds: {} });
+      allFindings.push(...findings);
+    }
+    return allFindings;
+  }
+  async runAdapter(adapter, ctx, config) {
+    const files = ctx.files.filter((f) => adapter.supportedLanguages.includes(f.language)).map((f) => f.relativePath);
+    if (files.length === 0) return [];
+    const result = await adapter.run(files, config);
+    return result.findings;
+  }
+};
+
+// src/adapters/stryker.ts
+import { execa as execa11 } from "execa";
+import fs4 from "fs";
+import path5 from "path";
+
+// src/adapters/mutation-shared.ts
+function scoreSeverity(score) {
+  if (score < 40) return "blocker";
+  if (score < 70) return "warning";
+  return "info";
+}
+function buildScoreMessage(score, threshold, survived, total) {
+  return "Mutation score " + Math.round(score) + "% is below threshold " + threshold + "% (" + survived + " survived of " + total + ")";
+}
+function timeoutResult(tool, timeout) {
+  return {
+    findings: [{
+      file: "",
+      line: 0,
+      severity: "info",
+      metric: "mutation_timeout",
+      message: tool + " timed out after " + timeout + "ms",
+      why: "Mutation testing exceeded the configured timeout.",
+      suggestion: "Increase the timeout or reduce the number of files to mutate."
+    }],
+    mutationScore: 0,
+    timedOut: true
+  };
+}
+function fileScoreFinding(input) {
+  return {
+    file: input.file,
+    line: 0,
+    severity: scoreSeverity(input.score),
+    metric: "mutation_score",
+    value: Math.round(input.score),
+    threshold: input.threshold,
+    message: buildScoreMessage(input.score, input.threshold, input.survived, input.total),
+    why: "A low mutation score means tests do not detect code changes, indicating weak or missing test coverage.",
+    suggestion: "Add or improve tests for this file to kill surviving mutants.",
+    metadata: { killed: input.killed, survived: input.survived, source: input.source }
+  };
+}
+
+// src/adapters/stryker.ts
+function calculateFileScore(mutants) {
+  let killed = 0;
+  let survived = 0;
+  let noCoverage = 0;
+  let timeout = 0;
+  let invalid = 0;
+  for (const m of mutants) {
+    switch (m.status) {
+      case "Killed":
+        killed++;
+        break;
+      case "Survived":
+        survived++;
+        break;
+      case "NoCoverage":
+        noCoverage++;
+        break;
+      case "Timeout":
+        timeout++;
+        break;
+      case "CompileError":
+      case "RuntimeError":
+        invalid++;
+        break;
+    }
+  }
+  const total = mutants.length - invalid;
+  const score = total > 0 ? (killed + timeout) / total * 100 : 100;
+  return { killed, survived, noCoverage, timeout, total, score };
+}
+function scoreSeverity2(score) {
+  if (score < 40) return "blocker";
+  if (score < 70) return "warning";
+  return "info";
+}
+function buildScoreMessage2(score, threshold, survived, noCoverage) {
+  return "Mutation score " + Math.round(score) + "% is below threshold " + threshold + "% (" + survived + " survived, " + noCoverage + " no coverage)";
+}
+function fileScoreToFinding(fileScore, threshold) {
+  const severity = scoreSeverity2(fileScore.score);
+  return {
+    file: fileScore.file,
+    line: 0,
+    severity,
+    metric: "mutation_score",
+    value: Math.round(fileScore.score),
+    threshold,
+    message: buildScoreMessage2(fileScore.score, threshold, fileScore.survived, fileScore.noCoverage),
+    why: "A low mutation score means tests do not detect code changes, indicating weak or missing test coverage.",
+    suggestion: "Add or improve tests for this file to kill surviving mutants.",
+    metadata: { killed: fileScore.killed, survived: fileScore.survived, noCoverage: fileScore.noCoverage, source: "stryker" }
+  };
+}
+function formatMutantMessage(mutant) {
+  const base = "Surviving mutant: " + mutant.mutatorName;
+  return mutant.replacement ? base + " \u2192 " + mutant.replacement : base;
+}
+function survivorToFinding(file, mutant) {
+  return {
+    file,
+    line: mutant.location.start.line,
+    end_line: mutant.location.end.line,
+    severity: "info",
+    metric: "surviving_mutant",
+    message: formatMutantMessage(mutant),
+    why: "No test detects this code change, meaning this logic path is not properly verified.",
+    suggestion: "Add a test that would fail if this mutation were applied.",
+    metadata: { mutatorName: mutant.mutatorName, status: mutant.status, source: "stryker" }
+  };
+}
+function findReportPath(workdir) {
+  const candidates = [
+    path5.join(workdir, "reports", "mutation", "mutation.json"),
+    path5.join(workdir, "reports", "mutation.json")
+  ];
+  return candidates.find((p) => fs4.existsSync(p));
+}
+function readReport(workdir) {
+  const reportPath = findReportPath(workdir);
+  if (!reportPath) return null;
+  try {
+    const raw = fs4.readFileSync(reportPath, "utf-8");
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}
+function processReport(report, files, threshold, maxSurvivorFindings) {
+  const fileSet = new Set(files);
+  const findings = [];
+  let totalKilled = 0;
+  let totalValid = 0;
+  for (const [filePath, fileResult] of Object.entries(report.files)) {
+    if (!fileSet.has(filePath)) continue;
+    const stats = calculateFileScore(fileResult.mutants);
+    totalKilled += stats.killed + stats.timeout;
+    totalValid += stats.total;
+    if (stats.score < threshold) {
+      const fileScore = { file: filePath, ...stats };
+      findings.push(fileScoreToFinding(fileScore, threshold));
+      const survivors = fileResult.mutants.filter((m) => m.status === "Survived" || m.status === "NoCoverage").slice(0, maxSurvivorFindings);
+      findings.push(...survivors.map((m) => survivorToFinding(filePath, m)));
+    }
+  }
+  const mutationScore = totalValid > 0 ? totalKilled / totalValid * 100 : 100;
+  return { findings, mutationScore };
+}
+var StrykerAdapter = class {
+  name = "stryker";
+  supportedLanguages = ["typescript", "javascript"];
+  async isAvailable(workdir) {
+    if (workdir) {
+      const localBin = path5.join(workdir, "node_modules", ".bin", "stryker");
+      if (fs4.existsSync(localBin)) return true;
+    }
+    return await isBinaryAvailable("stryker");
+  }
+  async run(files, config) {
+    if (files.length === 0) return { findings: [], mutationScore: 100 };
+    const timeout = config.timeout ?? 3e5;
+    const timedOut = await this.executeStryker(files, config, timeout);
+    if (timedOut) return timeoutResult("Stryker", timeout);
+    const report = readReport(config.workdir);
+    if (!report) return { findings: [], mutationScore: 100 };
+    return processReport(report, files, config.mutationScoreThreshold ?? 80, config.maxSurvivorFindings ?? 5);
+  }
+  async executeStryker(files, config, timeout) {
+    const mutatePattern = files.join(",");
+    const args = ["run", "--reporters", "json", "--mutate", mutatePattern];
+    const useNpx = fs4.existsSync(path5.join(config.workdir, "node_modules", ".bin", "stryker"));
+    const command = useNpx ? "npx" : "stryker";
+    const execArgs = useNpx ? ["stryker", ...args] : args;
+    const result = await execa11(command, execArgs, {
+      cwd: config.workdir,
+      reject: false,
+      timeout
+    });
+    return !!result.timedOut;
+  }
+};
+
+// src/adapters/mutmut.ts
+import { execa as execa12 } from "execa";
+function matchToResult(match) {
+  const classname = match[1];
+  const name = match[2];
+  const closingType = match[3];
+  const body = match[4] ?? "";
+  const isSelfClosing = closingType.trim().startsWith("/");
+  const survived = !isSelfClosing && body.includes("<failure");
+  const file = classname.replace(/\./g, "/") + ".py";
+  const lineMatch = name.match(/line\s+(\d+)/i) ?? name.match(/mutant\s+(\d+)/i);
+  const line = lineMatch ? parseInt(lineMatch[1], 10) : void 0;
+  return { file, name, status: survived ? "survived" : "killed", line };
+}
+function parseJunitXml(xml) {
+  const results = [];
+  const testcaseRe = /<testcase\s+classname="([^"]*)"[^>]*?name="([^"]*)"[^>]*?(\/\s*>|>([\s\S]*?)<\/testcase>)/g;
+  let match;
+  while ((match = testcaseRe.exec(xml)) !== null) {
+    results.push(matchToResult(match));
+  }
+  return results;
+}
+function groupByFile(results) {
+  const groups = /* @__PURE__ */ new Map();
+  for (const r of results) {
+    const group = groups.get(r.file) ?? { killed: 0, survived: 0, survivors: [] };
+    if (r.status === "killed") {
+      group.killed++;
+    } else {
+      group.survived++;
+      group.survivors.push(r);
+    }
+    groups.set(r.file, group);
+  }
+  const fileStats = /* @__PURE__ */ new Map();
+  for (const [file, g] of groups) {
+    const total = g.killed + g.survived;
+    const score = total > 0 ? g.killed / total * 100 : 100;
+    fileStats.set(file, { killed: g.killed, survived: g.survived, total, score, survivors: g.survivors });
+  }
+  return fileStats;
+}
+function fileStatsToFindings(file, stats, threshold, maxSurvivorFindings) {
+  const findings = [fileScoreFinding({ file, score: stats.score, threshold, survived: stats.survived, total: stats.total, killed: stats.killed, source: "mutmut" })];
+  for (const survivor of stats.survivors.slice(0, maxSurvivorFindings)) {
+    findings.push({
+      file,
+      line: survivor.line ?? 0,
+      severity: "info",
+      metric: "surviving_mutant",
+      message: "Surviving mutant: " + survivor.name,
+      why: "No test detects this code change, meaning this logic path is not properly verified.",
+      suggestion: "Add a test that would fail if this mutation were applied.",
+      metadata: { mutantName: survivor.name, source: "mutmut" }
+    });
+  }
+  return findings;
+}
+var MutmutAdapter = class {
+  name = "mutmut";
+  supportedLanguages = ["python"];
+  async isAvailable() {
+    return isBinaryAvailable("mutmut");
+  }
+  async run(files, config) {
+    if (files.length === 0) return { findings: [], mutationScore: 100 };
+    const timeout = config.timeout ?? 3e5;
+    const xml = await this.executeMutmut(files, config, timeout);
+    if (xml === null) return timeoutResult("mutmut", timeout);
+    if (!xml.trim()) return { findings: [], mutationScore: 100 };
+    return this.processXml(xml, files, config.mutationScoreThreshold ?? 80, config.maxSurvivorFindings ?? 5);
+  }
+  async executeMutmut(files, config, timeout) {
+    const pathsToMutate = files.join(",");
+    const runResult = await execa12("mutmut", ["run", `--paths-to-mutate=${pathsToMutate}`, "--CI", "--no-progress"], {
+      cwd: config.workdir,
+      reject: false,
+      timeout
+    });
+    if (runResult.timedOut) return null;
+    const xmlResult = await execa12("mutmut", ["junitxml"], {
+      cwd: config.workdir,
+      reject: false
+    });
+    return xmlResult.stdout || "";
+  }
+  processXml(xml, files, threshold, maxSurvivorFindings) {
+    const mutantResults = parseJunitXml(xml);
+    if (mutantResults.length === 0) return { findings: [], mutationScore: 100 };
+    const fileStatsMap = groupByFile(mutantResults);
+    const fileSet = new Set(files);
+    const findings = [];
+    let totalKilled = 0;
+    let totalMutants = 0;
+    for (const [file, stats] of fileStatsMap) {
+      if (!fileSet.has(file)) continue;
+      totalKilled += stats.killed;
+      totalMutants += stats.total;
+      if (stats.score < threshold) {
+        findings.push(...fileStatsToFindings(file, stats, threshold, maxSurvivorFindings));
+      }
+    }
+    const mutationScore = totalMutants > 0 ? totalKilled / totalMutants * 100 : 100;
+    return { findings, mutationScore };
+  }
+};
+
+// src/adapters/mutant.ts
+import { execa as execa13 } from "execa";
+var RESULT_LINE_RE = /^(alive|killed|timeout):(.+):(.+):(\d+)/;
+var COVERAGE_RE = /Coverage:\s+([\d.]+)%/;
+function parseOutput(stdout) {
+  const entries = [];
+  let overallScore = null;
+  for (const line of stdout.split("\n")) {
+    const resultMatch = RESULT_LINE_RE.exec(line);
+    if (resultMatch) {
+      entries.push({
+        status: resultMatch[1],
+        subject: resultMatch[2],
+        file: resultMatch[3],
+        line: parseInt(resultMatch[4], 10)
+      });
+      continue;
+    }
+    const coverageMatch = COVERAGE_RE.exec(line);
+    if (coverageMatch) {
+      overallScore = parseFloat(coverageMatch[1]);
+    }
+  }
+  return { entries, overallScore };
+}
+function groupByFile2(entries) {
+  const groups = /* @__PURE__ */ new Map();
+  for (const entry of entries) {
+    const group = groups.get(entry.file) ?? { killed: 0, survived: 0, timeout: 0, survivors: [] };
+    switch (entry.status) {
+      case "killed":
+        group.killed++;
+        break;
+      case "alive":
+        group.survived++;
+        group.survivors.push(entry);
+        break;
+      case "timeout":
+        group.timeout++;
+        break;
+    }
+    groups.set(entry.file, group);
+  }
+  const fileStats = /* @__PURE__ */ new Map();
+  for (const [file, g] of groups) {
+    const total = g.killed + g.survived + g.timeout;
+    const score = total > 0 ? (g.killed + g.timeout) / total * 100 : 100;
+    fileStats.set(file, { killed: g.killed, survived: g.survived, timeout: g.timeout, total, score, survivors: g.survivors });
+  }
+  return fileStats;
+}
+function fileStatsToFinding(file, stats, threshold) {
+  return fileScoreFinding({ file, score: stats.score, threshold, survived: stats.survived, total: stats.total, killed: stats.killed, source: "mutant" });
+}
+function survivorToFinding2(entry) {
+  return {
+    file: entry.file,
+    line: entry.line,
+    severity: "info",
+    metric: "surviving_mutant",
+    message: "Surviving mutant in " + entry.subject,
+    why: "No test detects this code change, meaning this logic path is not properly verified.",
+    suggestion: "Add a test that would fail if this mutation were applied.",
+    metadata: { subject: entry.subject, source: "mutant" }
+  };
+}
+function processEntries(opts) {
+  const fileStatsMap = groupByFile2(opts.entries);
+  const fileSet = new Set(opts.files);
+  const findings = [];
+  let totalKilled = 0;
+  let totalMutants = 0;
+  for (const [file, stats] of fileStatsMap) {
+    if (!fileSet.has(file)) continue;
+    totalKilled += stats.killed + stats.timeout;
+    totalMutants += stats.total;
+    if (stats.score < opts.threshold) {
+      findings.push(fileStatsToFinding(file, stats, opts.threshold));
+      findings.push(...stats.survivors.slice(0, opts.maxSurvivorFindings).map(survivorToFinding2));
+    }
+  }
+  const mutationScore = opts.overallScore ?? (totalMutants > 0 ? totalKilled / totalMutants * 100 : 100);
+  return { findings, mutationScore };
+}
+var MutantAdapter = class {
+  name = "mutant";
+  supportedLanguages = ["ruby"];
+  async isAvailable() {
+    return isBinaryAvailable("mutant");
+  }
+  async run(files, config) {
+    if (files.length === 0) return { findings: [], mutationScore: 100 };
+    const timeout = config.timeout ?? 3e5;
+    const threshold = config.mutationScoreThreshold ?? 80;
+    const maxSurvivorFindings = config.maxSurvivorFindings ?? 5;
+    const stdout = await this.executeMutant(config.workdir, timeout);
+    if (stdout === null) return timeoutResult("mutant", timeout);
+    if (!stdout.trim()) return { findings: [], mutationScore: 100 };
+    const { entries, overallScore } = parseOutput(stdout);
+    if (entries.length === 0 && overallScore === null) return { findings: [], mutationScore: 100 };
+    return processEntries({ entries, overallScore, files, threshold, maxSurvivorFindings });
+  }
+  async executeMutant(workdir, timeout) {
+    const result = await execa13("mutant", ["run", "--include", "lib", "--use", "rspec"], {
+      cwd: workdir,
+      reject: false,
+      timeout
+    });
+    if (result.timedOut) return null;
+    return result.stdout || "";
+  }
+};
+
+// src/gates/test-quality.ts
+var TestQualityGate = class {
+  name = "test_quality";
+  stryker = new StrykerAdapter();
+  mutmut = new MutmutAdapter();
+  mutant = new MutantAdapter();
+  async run(ctx) {
+    const start = Date.now();
+    const config = ctx.config.testQuality ?? DEFAULT_TEST_QUALITY;
+    const available = await this.checkAvailability(config, ctx);
+    if (!available.stryker && !available.mutmut && !available.mutant) {
+      return toolMissingResult(this.name, start, "No mutation testing tools available", "Install: npm i -D @stryker-mutator/core | pip install mutmut | gem install mutant");
+    }
+    const { findings, mutationScore } = await this.collectFindings(available, config, ctx);
+    const score = calculateTestQualityScore({ mutationScore });
+    const status = deriveStatus(score, findings);
+    return { gate: this.name, score, status, duration_ms: Date.now() - start, findings };
+  }
+  async checkAvailability(config, ctx) {
+    const tsOrJs = ctx.language === "typescript" || ctx.language === "javascript";
+    const isPython = ctx.language === "python";
+    const isRuby = ctx.language === "ruby";
+    return {
+      stryker: config.strykerEnabled && tsOrJs ? await this.stryker.isAvailable(ctx.workdir) : false,
+      mutmut: config.mutmutEnabled && isPython ? await this.mutmut.isAvailable() : false,
+      mutant: config.mutantEnabled && isRuby ? await this.mutant.isAvailable() : false
+    };
+  }
+  async collectFindings(available, config, ctx) {
+    const allFindings = [];
+    let totalScore = 0;
+    let adapterCount = 0;
+    const adapters = [
+      { available: available.stryker, adapter: this.stryker },
+      { available: available.mutmut, adapter: this.mutmut },
+      { available: available.mutant, adapter: this.mutant }
+    ];
+    for (const { available: isAvail, adapter } of adapters) {
+      if (!isAvail) continue;
+      const result = await this.runAdapter(adapter, ctx, config);
+      if (result) {
+        allFindings.push(...result.findings);
+        if (!result.timedOut) {
+          totalScore += result.mutationScore;
+          adapterCount++;
+        }
+      }
+    }
+    const mutationScore = adapterCount > 0 ? totalScore / adapterCount : 100;
+    return { findings: allFindings, mutationScore };
+  }
+  async runAdapter(adapter, ctx, config) {
+    const files = ctx.files.filter((f) => adapter.supportedLanguages.includes(f.language)).map((f) => f.relativePath);
+    if (files.length === 0) return null;
+    return adapter.run(files, {
+      workdir: ctx.workdir,
+      thresholds: {},
+      timeout: config.timeout,
+      mutationScoreThreshold: config.mutationScoreThreshold,
+      maxSurvivorFindings: config.maxSurvivorFindings
+    });
+  }
+};
+
+// src/gates/index.ts
+var GATE_REGISTRY = /* @__PURE__ */ new Map();
+function registerGate(gate) {
+  GATE_REGISTRY.set(gate.name, gate);
+}
+function getGate(name) {
+  return GATE_REGISTRY.get(name);
+}
+function getAllGateNames() {
+  return Array.from(GATE_REGISTRY.keys());
+}
+registerGate(new TypeSafetyGate());
+registerGate(new ComplexityGate());
+registerGate(new SecurityGate());
+registerGate(new ArchitectureGate());
+registerGate(new TestQualityGate());
+
+// src/runner.ts
+async function runGates(ctx, gateNames) {
+  const results = [];
+  for (const name of gateNames) {
+    const gate = getGate(name);
+    if (!gate) {
+      results.push({
+        gate: name,
+        score: 0,
+        status: "skip",
+        duration_ms: 0,
+        findings: [
+          {
+            file: "",
+            line: 0,
+            severity: "info",
+            metric: "gate_not_found",
+            message: `Gate "${name}" is not implemented yet.`,
+            why: "This gate has not been registered."
+          }
+        ]
+      });
+      continue;
+    }
+    const result = await gate.run(ctx);
+    results.push(result);
+    if (result.status === "fail") break;
+  }
+  return results;
+}
+
+// src/config/profiles.ts
+var PROFILES = {
+  default: {
+    name: "default",
+    complexity: DEFAULT_COMPLEXITY,
+    security: DEFAULT_SECURITY,
+    typeSafety: DEFAULT_TYPE_SAFETY,
+    architecture: DEFAULT_ARCHITECTURE,
+    testQuality: DEFAULT_TEST_QUALITY
+  },
+  critical: {
+    name: "critical",
+    complexity: {
+      cyclomatic: 6,
+      length: 30,
+      arguments: 3,
+      nesting: 2
+    },
+    security: {
+      semgrepRules: ["p/security-audit", "p/secrets", "p/owasp-top-ten"],
+      gitleaksEnabled: true
+    },
+    typeSafety: {
+      strict: true,
+      mypyEnabled: true
+    },
+    architecture: {
+      madgeEnabled: true,
+      jscpdEnabled: true,
+      knipEnabled: true,
+      jscpdMinLines: 3,
+      jscpdMinTokens: 30
+    },
+    testQuality: {
+      strykerEnabled: true,
+      mutmutEnabled: true,
+      mutantEnabled: true,
+      mutationScoreThreshold: 90,
+      timeout: 6e5,
+      maxSurvivorFindings: 10
+    }
+  },
+  prototype: {
+    name: "prototype",
+    complexity: {
+      cyclomatic: 15,
+      length: 60,
+      arguments: 6,
+      nesting: 4
+    },
+    security: {
+      semgrepRules: ["p/security-audit"],
+      gitleaksEnabled: false
+    },
+    typeSafety: {
+      strict: false,
+      mypyEnabled: false
+    },
+    architecture: {
+      madgeEnabled: false,
+      jscpdEnabled: false,
+      knipEnabled: false
+    },
+    testQuality: {
+      strykerEnabled: false,
+      mutmutEnabled: false,
+      mutantEnabled: false,
+      mutationScoreThreshold: 60,
+      timeout: 12e4,
+      maxSurvivorFindings: 3
+    }
+  }
+};
+function getProfile(name) {
+  const profile = PROFILES[name];
+  if (!profile) {
+    throw new Error(`Unknown profile: ${name}. Available: ${Object.keys(PROFILES).join(", ")}`);
+  }
+  return profile;
+}
+
+// src/reporter.ts
+import chalk from "chalk";
+function reportText(results, meta) {
+  const lines = [];
+  lines.push(chalk.bold("=== VALIDATOR REPORT ==="));
+  lines.push(`Files analyzed: ${meta.filesAnalyzed} (mode: ${meta.mode})`);
+  lines.push("");
+  for (const result of results) {
+    const icon = statusIcon(result.status);
+    const score = `${result.score}%`.padStart(4);
+    const duration = `(${(result.duration_ms / 1e3).toFixed(1)}s)`;
+    lines.push(`${icon} ${result.gate.padEnd(20)} ${score}  ${duration}`);
+  }
+  const allFindings = results.flatMap((r) => r.findings);
+  if (allFindings.length > 0) {
+    lines.push("");
+    lines.push(chalk.bold("--- FINDINGS ---"));
+    lines.push("");
+    for (const f of allFindings) {
+      const sev = f.severity === "blocker" ? chalk.red("[BLOCKER]") : f.severity === "warning" ? chalk.yellow("[WARNING]") : chalk.blue("[INFO]");
+      const loc = f.function ? `${f.file}:${f.line} \u2014 ${f.function}` : `${f.file}:${f.line}`;
+      lines.push(`${sev} ${loc}`);
+      lines.push(`  ${f.message}`);
+      if (f.why) lines.push(`  ${chalk.dim("Why:")} ${f.why}`);
+      if (f.suggestion) lines.push(`  ${chalk.dim("Fix:")} ${f.suggestion}`);
+      lines.push("");
+    }
+  }
+  const overall = overallStatus(results);
+  const blockerCount = allFindings.filter((f) => f.severity === "blocker").length;
+  const warnCount = allFindings.filter((f) => f.severity === "warning").length;
+  lines.push(
+    `RESULT: ${overall.toUpperCase()} (${blockerCount} blockers, ${warnCount} warnings)`
+  );
+  return lines.join("\n");
+}
+function reportJson(results, meta) {
+  const allFindings = results.flatMap((r) => r.findings);
+  const report = {
+    version: "0.1.0",
+    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+    mode: meta.mode,
+    files_analyzed: meta.filesAnalyzed,
+    overall: {
+      status: overallStatus(results),
+      blocked_by: results.filter((r) => r.status === "fail").map((r) => r.gate),
+      total_findings: allFindings.length,
+      blockers: allFindings.filter((f) => f.severity === "blocker").length,
+      warnings: allFindings.filter((f) => f.severity === "warning").length
+    },
+    gates: Object.fromEntries(results.map((r) => [r.gate, r]))
+  };
+  return JSON.stringify(report, null, 2);
+}
+function statusIcon(status) {
+  switch (status) {
+    case "pass":
+      return chalk.green("[PASS]");
+    case "fail":
+      return chalk.red("[FAIL]");
+    case "warn":
+      return chalk.yellow("[WARN]");
+    case "skip":
+      return chalk.gray("[SKIP]");
+    default:
+      return "[????]";
+  }
+}
+
+// src/index.ts
+async function validate(options) {
+  const workdir = options.workdir ?? process.cwd();
+  const profile = getProfile(options.profile ?? "default");
+  const gateNames = options.gates ?? getAllGateNames();
+  const files = await resolveFiles({
+    mode: options.mode,
+    targets: options.targets,
+    base: options.base,
+    head: options.head,
+    staged: options.staged,
+    workdir
+  });
+  const language = detectPrimaryLanguage(files);
+  const results = await runGates({ files, config: profile, workdir, language }, gateNames);
+  const allFindings = results.flatMap((r) => r.findings);
+  return {
+    status: overallStatus(results),
+    gates: results,
+    filesAnalyzed: files.length,
+    blockers: allFindings.filter((f) => f.severity === "blocker").length,
+    warnings: allFindings.filter((f) => f.severity === "warning").length
+  };
+}
+function formatReport(report, format = "text", mode = "scan") {
+  const meta = { mode, filesAnalyzed: report.filesAnalyzed };
+  return format === "json" ? reportJson(report.gates, meta) : reportText(report.gates, meta);
+}
+export {
+  formatReport,
+  validate
+};
+//# sourceMappingURL=index.js.map