@oculum/scanner 1.0.12 → 1.0.13

package/dist/validate/utils/context-extractor.js

@@ -0,0 +1,161 @@
+"use strict";
+/**
+ * Context Extractor
+ *
+ * Extracts only relevant regions of file content around findings,
+ * reducing token usage by ~40-60% for large files while preserving
+ * imports and sufficient context for AI validation.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.extractRelevantContext = extractRelevantContext;
+exports.mergeRanges = mergeRanges;
+const DEFAULT_CONFIG = {
+    padding: 30,
+    importLines: 15,
+    fullFileThreshold: 0.6,
+    smallFileThreshold: 100,
+};
+// ============================================================================
+// Main Function
+// ============================================================================
+/**
+ * Extract relevant context regions from file content around finding locations.
+ *
+ * Algorithm:
+ * 1. Small files (<=smallFileThreshold lines) -> send full content
+ * 2. Build ranges: imports (1-importLines) + padding around each finding
+ * 3. Merge overlapping/adjacent ranges
+ * 4. If merged coverage > fullFileThreshold of file -> send full content
+ * 5. Format with omission markers between gaps
+ *
+ * @param fileContent - The full file content as a string
+ * @param findingLineNumbers - 1-based line numbers of findings
+ * @param config - Optional extraction configuration overrides
+ * @returns Extracted context with metadata
+ */
+function extractRelevantContext(fileContent, findingLineNumbers, config) {
+    const cfg = { ...DEFAULT_CONFIG, ...config };
+    const lines = fileContent.split('\n');
+    const totalLines = lines.length;
+    // Small files: send full content
+    if (totalLines <= cfg.smallFileThreshold) {
+        return {
+            content: formatFullFile(lines),
+            isFullFile: true,
+            linesSent: totalLines,
+            totalLines,
+        };
+    }
+    // Empty findings: send imports only (shouldn't happen but handle gracefully)
+    if (findingLineNumbers.length === 0) {
+        return {
+            content: formatFullFile(lines),
+            isFullFile: true,
+            linesSent: totalLines,
+            totalLines,
+        };
+    }
+    // Build ranges: imports + padding around each finding
+    const ranges = [];
+    // Always include imports
+    if (cfg.importLines > 0) {
+        ranges.push({
+            start: 1,
+            end: Math.min(cfg.importLines, totalLines),
+        });
+    }
+    // Add padding around each finding
+    for (const lineNum of findingLineNumbers) {
+        ranges.push({
+            start: Math.max(1, lineNum - cfg.padding),
+            end: Math.min(totalLines, lineNum + cfg.padding),
+        });
+    }
+    // Merge overlapping/adjacent ranges
+    const merged = mergeRanges(ranges);
+    // Check coverage: if >60% of file is covered, send full
+    const coveredLines = merged.reduce((sum, r) => sum + (r.end - r.start + 1), 0);
+    if (coveredLines / totalLines > cfg.fullFileThreshold) {
+        return {
+            content: formatFullFile(lines),
+            isFullFile: true,
+            linesSent: totalLines,
+            totalLines,
+        };
+    }
+    // Format with omission markers
+    const content = formatScopedContent(lines, merged, totalLines);
+    return {
+        content,
+        isFullFile: false,
+        linesSent: coveredLines,
+        totalLines,
+    };
+}
+// ============================================================================
+// Helpers
+// ============================================================================
+/**
+ * Merge overlapping or adjacent line ranges.
+ * Sorts by start line, then merges any ranges that overlap or are adjacent.
+ */
+function mergeRanges(ranges) {
+    if (ranges.length === 0)
+        return [];
+    // Sort by start line
+    const sorted = [...ranges].sort((a, b) => a.start - b.start);
+    const merged = [{ ...sorted[0] }];
+    for (let i = 1; i < sorted.length; i++) {
+        const current = sorted[i];
+        const last = merged[merged.length - 1];
+        // Overlapping or adjacent (start <= last.end + 1)
+        if (current.start <= last.end + 1) {
+            last.end = Math.max(last.end, current.end);
+        }
+        else {
+            merged.push({ ...current });
+        }
+    }
+    return merged;
+}
+/**
+ * Format all lines with line numbers.
+ */
+function formatFullFile(lines) {
+    return lines
+        .map((line, i) => `${String(i + 1).padStart(4, ' ')} | ${line}`)
+        .join('\n');
+}
+/**
+ * Format scoped content with line numbers and omission markers between gaps.
+ */
+function formatScopedContent(lines, ranges, totalLines) {
+    const parts = [];
+    for (let i = 0; i < ranges.length; i++) {
+        const range = ranges[i];
+        // Add omission marker before this range (if there's a gap)
+        if (i === 0 && range.start > 1) {
+            parts.push(`[... ${range.start - 1} lines omitted (lines 1-${range.start - 1}) ...]`);
+        }
+        else if (i > 0) {
+            const prevEnd = ranges[i - 1].end;
+            const gapStart = prevEnd + 1;
+            const gapEnd = range.start - 1;
+            if (gapStart <= gapEnd) {
+                parts.push(`[... ${gapEnd - gapStart + 1} lines omitted (lines ${gapStart}-${gapEnd}) ...]`);
+            }
+        }
+        // Add the range lines with line numbers
+        for (let lineIdx = range.start - 1; lineIdx < range.end && lineIdx < lines.length; lineIdx++) {
+            parts.push(`${String(lineIdx + 1).padStart(4, ' ')} | ${lines[lineIdx]}`);
+        }
+    }
+    // Add trailing omission marker if needed
+    const lastRange = ranges[ranges.length - 1];
+    if (lastRange.end < totalLines) {
+        const gapStart = lastRange.end + 1;
+        parts.push(`[... ${totalLines - lastRange.end} lines omitted (lines ${gapStart}-${totalLines}) ...]`);
+    }
+    return parts.join('\n');
+}
+//# sourceMappingURL=context-extractor.js.map

package/dist/validate/utils/context-extractor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context-extractor.js","sourceRoot":"","sources":["../../../src/validate/utils/context-extractor.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;AA6DH,wDAuEC;AAUD,kCAqBC;AAhID,MAAM,cAAc,GAAqB;IACvC,OAAO,EAAE,EAAE;IACX,WAAW,EAAE,EAAE;IACf,iBAAiB,EAAE,GAAG;IACtB,kBAAkB,EAAE,GAAG;CACxB,CAAA;AAED,+EAA+E;AAC/E,gBAAgB;AAChB,+EAA+E;AAE/E;;;;;;;;;;;;;;GAcG;AACH,SAAgB,sBAAsB,CACpC,WAAmB,EACnB,kBAA4B,EAC5B,MAAkC;IAElC,MAAM,GAAG,GAAG,EAAE,GAAG,cAAc,EAAE,GAAG,MAAM,EAAE,CAAA;IAC5C,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACrC,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAA;IAE/B,iCAAiC;IACjC,IAAI,UAAU,IAAI,GAAG,CAAC,kBAAkB,EAAE,CAAC;QACzC,OAAO;YACL,OAAO,EAAE,cAAc,CAAC,KAAK,CAAC;YAC9B,UAAU,EAAE,IAAI;YAChB,SAAS,EAAE,UAAU;YACrB,UAAU;SACX,CAAA;IACH,CAAC;IAED,6EAA6E;IAC7E,IAAI,kBAAkB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpC,OAAO;YACL,OAAO,EAAE,cAAc,CAAC,KAAK,CAAC;YAC9B,UAAU,EAAE,IAAI;YAChB,SAAS,EAAE,UAAU;YACrB,UAAU;SACX,CAAA;IACH,CAAC;IAED,sDAAsD;IACtD,MAAM,MAAM,GAAgB,EAAE,CAAA;IAE9B,yBAAyB;IACzB,IAAI,GAAG,CAAC,WAAW,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,CAAC;YACR,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC;SAC3C,CAAC,CAAA;IACJ,CAAC;IAED,kCAAkC;IAClC,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;YACzC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;SACjD,CAAC,CAAA;IACJ,CAAC;IAED,oCAAoC;IACpC,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAA;IAElC,wDAAwD;IACxD,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;IAC9E,IAAI,YAAY,GAAG,UAAU,GAAG,GAAG,CAAC,iBAAiB,EAAE,CAAC;QACtD,OAAO;YACL,OAAO,EAAE,cAAc,CAAC,KAAK,CAAC;YAC9B,UAAU,EAAE,IAAI;YAChB,SAAS,EAAE,UAAU;YACrB,UAAU;SACX,CAAA;IACH,CAAC;IAED,+BAA+B;IAC/B,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,CAAA;IAE9D,OAAO;QACL,OAAO;QACP,UAAU,EAAE,KAAK;QACjB,SAAS,EAAE,YAAY;QACvB,UAAU;KACX,CAAA;AACH,CAAC;AAED,+EAA+E;AAC/E,UAAU;AACV,+EAA+E;AAE/E;;;GAGG;AACH,SAAgB,WAAW,CAAC,MAAmB;IAC7C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAA;IAElC,qBAAqB;IACrB,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAA;IAE5D,MAAM,MAAM,GAAgB,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IAE9C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,CAAA;QACzB,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;QAEtC,kDAAkD;QAClD,IAAI,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC;YAClC,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,CAAA;QAC5C,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC,CAAA;QAC7B,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;GAEG;AACH,SAAS,cAAc,CAAC,KAAe;IACrC,OAAO,KAAK;SACT,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;SAC/D,IAAI,CAAC,IAAI,CAAC,CAAA;AACf,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB,CAC1B,KAAe,EACf,MAAmB,EACnB,UAAkB;IAElB,MAAM,KAAK,GAAa,EAAE,CAAA;IAE1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAA;QAEvB,2DAA2D;QAC3D,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;YAC/B,KAAK,CAAC,IAAI,CAAC,QAAQ,KAAK,CAAC,KAAK,GAAG,CAAC,2BAA2B,KAAK,CAAC,KAAK,GAAG,CAAC,QAAQ,CAAC,CAAA;QACvF,CAAC;aAAM,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACjB,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAA;YACjC,MAAM,QAAQ,GAAG,OAAO,GAAG,CAAC,CAAA;YAC5B,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,GAAG,CAAC,CAAA;YAC9B,IAAI,QAAQ,IAAI,MAAM,EAAE,CAAC;gBACvB,KAAK,CAAC,IAAI,CAAC,QAAQ,MAAM,GAAG,QAAQ,GAAG,CAAC,yBAAyB,QAAQ,IAAI,MAAM,QAAQ,CAAC,CAAA;YAC9F,CAAC;QACH,CAAC;QAED,wCAAwC;QACxC,KAAK,IAAI,OAAO,GAAG,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,OAAO,GAAG,KAAK,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC;YAC7F,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QAC3E,CAAC;IACH,CAAC;IAED,yCAAyC;IACzC,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC3C,IAAI,SAAS,CAAC,GAAG,GAAG,UAAU,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,GAAG,CAAC,CAAA;QAClC,KAAK,CAAC,IAAI,CAAC,QAAQ,UAAU,GAAG,SAAS,CAAC,GAAG,yBAAyB,QAAQ,IAAI,UAAU,QAAQ,CAAC,CAAA;IACvG,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACzB,CAAC"}

package/dist/validate/utils/index.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Utility Functions Index
+ *
+ * Re-exports all utility functions from the anthropic module.
+ */
+export { normalizePathForComparison, findMatchingFilePath, getLanguageFromPath, } from './path-helpers';
+export { makeAnthropicRequestWithRetry, makeOpenAIRequestWithRetry, } from './retry';
+export { parseAIResponse, parseValidationResponse, parseMultiFileValidationResponse, applyValidationResults, validateSeverity, validateCategory, getLineContent, } from './response-parser';
+export { extractRelevantContext, mergeRanges, } from './context-extractor';
+export type { LineRange, ExtractedContext, ExtractionConfig, } from './context-extractor';
+//# sourceMappingURL=index.d.ts.map

package/dist/validate/utils/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/validate/utils/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,0BAA0B,EAC1B,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,gBAAgB,CAAA;AAEvB,OAAO,EACL,6BAA6B,EAC7B,0BAA0B,GAC3B,MAAM,SAAS,CAAA;AAEhB,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,gCAAgC,EAChC,sBAAsB,EACtB,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,GACf,MAAM,mBAAmB,CAAA;AAE1B,OAAO,EACL,sBAAsB,EACtB,WAAW,GACZ,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EACV,SAAS,EACT,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,qBAAqB,CAAA"}

package/dist/validate/utils/index.js

@@ -0,0 +1,27 @@
+"use strict";
+/**
+ * Utility Functions Index
+ *
+ * Re-exports all utility functions from the anthropic module.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.mergeRanges = exports.extractRelevantContext = exports.getLineContent = exports.validateCategory = exports.validateSeverity = exports.applyValidationResults = exports.parseMultiFileValidationResponse = exports.parseValidationResponse = exports.parseAIResponse = exports.makeOpenAIRequestWithRetry = exports.makeAnthropicRequestWithRetry = exports.getLanguageFromPath = exports.findMatchingFilePath = exports.normalizePathForComparison = void 0;
+var path_helpers_1 = require("./path-helpers");
+Object.defineProperty(exports, "normalizePathForComparison", { enumerable: true, get: function () { return path_helpers_1.normalizePathForComparison; } });
+Object.defineProperty(exports, "findMatchingFilePath", { enumerable: true, get: function () { return path_helpers_1.findMatchingFilePath; } });
+Object.defineProperty(exports, "getLanguageFromPath", { enumerable: true, get: function () { return path_helpers_1.getLanguageFromPath; } });
+var retry_1 = require("./retry");
+Object.defineProperty(exports, "makeAnthropicRequestWithRetry", { enumerable: true, get: function () { return retry_1.makeAnthropicRequestWithRetry; } });
+Object.defineProperty(exports, "makeOpenAIRequestWithRetry", { enumerable: true, get: function () { return retry_1.makeOpenAIRequestWithRetry; } });
+var response_parser_1 = require("./response-parser");
+Object.defineProperty(exports, "parseAIResponse", { enumerable: true, get: function () { return response_parser_1.parseAIResponse; } });
+Object.defineProperty(exports, "parseValidationResponse", { enumerable: true, get: function () { return response_parser_1.parseValidationResponse; } });
+Object.defineProperty(exports, "parseMultiFileValidationResponse", { enumerable: true, get: function () { return response_parser_1.parseMultiFileValidationResponse; } });
+Object.defineProperty(exports, "applyValidationResults", { enumerable: true, get: function () { return response_parser_1.applyValidationResults; } });
+Object.defineProperty(exports, "validateSeverity", { enumerable: true, get: function () { return response_parser_1.validateSeverity; } });
+Object.defineProperty(exports, "validateCategory", { enumerable: true, get: function () { return response_parser_1.validateCategory; } });
+Object.defineProperty(exports, "getLineContent", { enumerable: true, get: function () { return response_parser_1.getLineContent; } });
+var context_extractor_1 = require("./context-extractor");
+Object.defineProperty(exports, "extractRelevantContext", { enumerable: true, get: function () { return context_extractor_1.extractRelevantContext; } });
+Object.defineProperty(exports, "mergeRanges", { enumerable: true, get: function () { return context_extractor_1.mergeRanges; } });
+//# sourceMappingURL=index.js.map

package/dist/validate/utils/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/validate/utils/index.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAEH,+CAIuB;AAHrB,0HAAA,0BAA0B,OAAA;AAC1B,oHAAA,oBAAoB,OAAA;AACpB,mHAAA,mBAAmB,OAAA;AAGrB,iCAGgB;AAFd,sHAAA,6BAA6B,OAAA;AAC7B,mHAAA,0BAA0B,OAAA;AAG5B,qDAQ0B;AAPxB,kHAAA,eAAe,OAAA;AACf,0HAAA,uBAAuB,OAAA;AACvB,mIAAA,gCAAgC,OAAA;AAChC,yHAAA,sBAAsB,OAAA;AACtB,mHAAA,gBAAgB,OAAA;AAChB,mHAAA,gBAAgB,OAAA;AAChB,iHAAA,cAAc,OAAA;AAGhB,yDAG4B;AAF1B,2HAAA,sBAAsB,OAAA;AACtB,gHAAA,WAAW,OAAA"}

package/dist/validate/utils/path-helpers.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Path Normalization Helpers
+ *
+ * Functions for normalizing and matching file paths in AI responses.
+ * AI models may return paths in different formats than expected.
+ */
+/**
+ * Normalize a file path for comparison purposes.
+ * Handles common variations: ./src/file.ts, src/file.ts, /src/file.ts
+ */
+export declare function normalizePathForComparison(path: string): string;
+/**
+ * Find a matching file path from expected paths, handling path format variations.
+ * AI responses may use different path formats than what we sent.
+ */
+export declare function findMatchingFilePath(responsePath: string, expectedPaths: string[]): string | null;
+/**
+ * Get language identifier from file path extension
+ */
+export declare function getLanguageFromPath(path: string): string;
+//# sourceMappingURL=path-helpers.d.ts.map

package/dist/validate/utils/path-helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-helpers.d.ts","sourceRoot":"","sources":["../../../src/validate/utils/path-helpers.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAK/D;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,IAAI,CAsBjG;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAkBxD"}

package/dist/validate/utils/path-helpers.js

@@ -0,0 +1,69 @@
+"use strict";
+/**
+ * Path Normalization Helpers
+ *
+ * Functions for normalizing and matching file paths in AI responses.
+ * AI models may return paths in different formats than expected.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.normalizePathForComparison = normalizePathForComparison;
+exports.findMatchingFilePath = findMatchingFilePath;
+exports.getLanguageFromPath = getLanguageFromPath;
+/**
+ * Normalize a file path for comparison purposes.
+ * Handles common variations: ./src/file.ts, src/file.ts, /src/file.ts
+ */
+function normalizePathForComparison(path) {
+    return path
+        .replace(/^\.\//, '') // Remove leading ./
+        .replace(/^\//, '') // Remove leading /
+        .replace(/\\/g, '/'); // Normalize Windows backslashes
+}
+/**
+ * Find a matching file path from expected paths, handling path format variations.
+ * AI responses may use different path formats than what we sent.
+ */
+function findMatchingFilePath(responsePath, expectedPaths) {
+    // Exact match first
+    if (expectedPaths.includes(responsePath))
+        return responsePath;
+    // Normalized match
+    const normalized = normalizePathForComparison(responsePath);
+    for (const expected of expectedPaths) {
+        if (normalizePathForComparison(expected) === normalized) {
+            console.log(`[AI Validation] Path fuzzy matched: "${responsePath}" -> "${expected}"`);
+            return expected;
+        }
+    }
+    // Basename match (only if unique) - handles cases like "file.ts" matching "src/api/file.ts"
+    const basename = responsePath.split('/').pop() || responsePath;
+    const matches = expectedPaths.filter(p => (p.split('/').pop() || p) === basename);
+    if (matches.length === 1) {
+        console.log(`[AI Validation] Path basename matched: "${responsePath}" -> "${matches[0]}"`);
+        return matches[0];
+    }
+    return null;
+}
+/**
+ * Get language identifier from file path extension
+ */
+function getLanguageFromPath(path) {
+    const ext = path.split('.').pop()?.toLowerCase();
+    const langMap = {
+        ts: 'typescript',
+        tsx: 'tsx',
+        js: 'javascript',
+        jsx: 'jsx',
+        py: 'python',
+        rb: 'ruby',
+        go: 'go',
+        java: 'java',
+        php: 'php',
+        cs: 'csharp',
+        json: 'json',
+        yaml: 'yaml',
+        yml: 'yaml',
+    };
+    return langMap[ext || ''] || ext || 'text';
+}
+//# sourceMappingURL=path-helpers.js.map

package/dist/validate/utils/path-helpers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-helpers.js","sourceRoot":"","sources":["../../../src/validate/utils/path-helpers.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;AAMH,gEAKC;AAMD,oDAsBC;AAKD,kDAkBC;AA5DD;;;GAGG;AACH,SAAgB,0BAA0B,CAAC,IAAY;IACrD,OAAO,IAAI;SACR,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAE,oBAAoB;SAC1C,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAI,mBAAmB;SACzC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA,CAAG,gCAAgC;AAC3D,CAAC;AAED;;;GAGG;AACH,SAAgB,oBAAoB,CAAC,YAAoB,EAAE,aAAuB;IAChF,oBAAoB;IACpB,IAAI,aAAa,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,YAAY,CAAA;IAE7D,mBAAmB;IACnB,MAAM,UAAU,GAAG,0BAA0B,CAAC,YAAY,CAAC,CAAA;IAC3D,KAAK,MAAM,QAAQ,IAAI,aAAa,EAAE,CAAC;QACrC,IAAI,0BAA0B,CAAC,QAAQ,CAAC,KAAK,UAAU,EAAE,CAAC;YACxD,OAAO,CAAC,GAAG,CAAC,wCAAwC,YAAY,SAAS,QAAQ,GAAG,CAAC,CAAA;YACrF,OAAO,QAAQ,CAAA;QACjB,CAAC;IACH,CAAC;IAED,4FAA4F;IAC5F,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,YAAY,CAAA;IAC9D,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAA;IACjF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,2CAA2C,YAAY,SAAS,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QAC1F,OAAO,OAAO,CAAC,CAAC,CAAC,CAAA;IACnB,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;GAEG;AACH,SAAgB,mBAAmB,CAAC,IAAY;IAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,CAAA;IAChD,MAAM,OAAO,GAA2B;QACtC,EAAE,EAAE,YAAY;QAChB,GAAG,EAAE,KAAK;QACV,EAAE,EAAE,YAAY;QAChB,GAAG,EAAE,KAAK;QACV,EAAE,EAAE,QAAQ;QACZ,EAAE,EAAE,MAAM;QACV,EAAE,EAAE,IAAI;QACR,IAAI,EAAE,MAAM;QACZ,GAAG,EAAE,KAAK;QACV,EAAE,EAAE,QAAQ;QACZ,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,MAAM;QACZ,GAAG,EAAE,MAAM;KACZ,CAAA;IACD,OAAO,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC,IAAI,GAAG,IAAI,MAAM,CAAA;AAC5C,CAAC"}

package/dist/validate/utils/response-parser.d.ts

@@ -0,0 +1,40 @@
+/**
+ * AI Response Parsing Utilities
+ *
+ * Functions for parsing validation responses from AI models.
+ */
+import type { VulnerabilitySeverity, VulnerabilityCategory, Vulnerability } from '../../shared/types';
+import type { ValidationResult, AIFinding } from '../types';
+/**
+ * Parse AI response for single file validation
+ */
+export declare function parseAIResponse(response: string): AIFinding[];
+/**
+ * Parse single-file validation response
+ */
+export declare function parseValidationResponse(response: string): ValidationResult[];
+/**
+ * Parse multi-file validation response (Phase 2)
+ * Returns a map of file path -> validation results
+ */
+export declare function parseMultiFileValidationResponse(response: string, expectedFiles: string[]): Map<string, ValidationResult[]>;
+/**
+ * Apply validation results to findings
+ */
+export declare function applyValidationResults(findings: Vulnerability[], validationResults: ValidationResult[]): {
+    processed: Vulnerability[];
+    dismissedCount: number;
+};
+/**
+ * Validate severity value from AI response
+ */
+export declare function validateSeverity(severity: string): VulnerabilitySeverity;
+/**
+ * Validate category value from AI response
+ */
+export declare function validateCategory(category: string): VulnerabilityCategory;
+/**
+ * Get line content from file content by line number
+ */
+export declare function getLineContent(content: string, lineNumber: number): string;
+//# sourceMappingURL=response-parser.d.ts.map

package/dist/validate/utils/response-parser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"response-parser.d.ts","sourceRoot":"","sources":["../../../src/validate/utils/response-parser.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,aAAa,EAAoB,MAAM,oBAAoB,CAAA;AACvH,OAAO,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,UAAU,CAAA;AAwD3D;;GAEG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAAE,CAiC7D;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,gBAAgB,EAAE,CAkC5E;AAED;;;GAGG;AACH,wBAAgB,gCAAgC,CAC9C,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,EAAE,GACtB,GAAG,CAAC,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAqEjC;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,aAAa,EAAE,EACzB,iBAAiB,EAAE,gBAAgB,EAAE,GACpC;IAAE,SAAS,EAAE,aAAa,EAAE,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,CA8DxD;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,qBAAqB,CAKxE;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,qBAAqB,CAaxE;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAG1E"}

package/dist/validate/utils/response-parser.js

@@ -0,0 +1,286 @@
+"use strict";
+/**
+ * AI Response Parsing Utilities
+ *
+ * Functions for parsing validation responses from AI models.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseAIResponse = parseAIResponse;
+exports.parseValidationResponse = parseValidationResponse;
+exports.parseMultiFileValidationResponse = parseMultiFileValidationResponse;
+exports.applyValidationResults = applyValidationResults;
+exports.validateSeverity = validateSeverity;
+exports.validateCategory = validateCategory;
+exports.getLineContent = getLineContent;
+const path_helpers_1 = require("./path-helpers");
+/**
+ * Extract the first top-level JSON array from text.
+ * The model may include prose before/after the JSON.
+ */
+function extractTopLevelArray(text) {
+    const startIndex = text.indexOf('[');
+    if (startIndex === -1)
+        return null;
+    let depth = 0;
+    let inString = false;
+    let stringChar = null;
+    let escape = false;
+    for (let i = startIndex; i < text.length; i++) {
+        const ch = text[i];
+        if (inString) {
+            if (escape) {
+                escape = false;
+                continue;
+            }
+            if (ch === '\\') {
+                escape = true;
+                continue;
+            }
+            if (stringChar && ch === stringChar) {
+                inString = false;
+                stringChar = null;
+            }
+            continue;
+        }
+        if (ch === '"' || ch === "'") {
+            inString = true;
+            stringChar = ch;
+            continue;
+        }
+        if (ch === '[') {
+            depth++;
+        }
+        else if (ch === ']') {
+            depth--;
+            if (depth === 0) {
+                return text.slice(startIndex, i + 1);
+            }
+        }
+    }
+    return null;
+}
+/**
+ * Parse AI response for single file validation
+ */
+function parseAIResponse(response) {
+    try {
+        // Try to extract JSON from the response
+        const jsonMatch = response.match(/\[[\s\S]*\]/);
+        if (!jsonMatch) {
+            return [];
+        }
+        const parsed = JSON.parse(jsonMatch[0]);
+        // Validate the structure
+        if (!Array.isArray(parsed)) {
+            return [];
+        }
+        return parsed.filter(item => typeof item.lineNumber === 'number' &&
+            typeof item.severity === 'string' &&
+            typeof item.category === 'string' &&
+            typeof item.title === 'string' &&
+            typeof item.description === 'string').map(item => ({
+            lineNumber: item.lineNumber,
+            severity: validateSeverity(item.severity),
+            category: validateCategory(item.category),
+            title: item.title,
+            description: item.description,
+            suggestedFix: item.suggestedFix || 'Review and fix the security issue',
+        }));
+    }
+    catch (error) {
+        console.error('Failed to parse AI response:', error);
+        return [];
+    }
+}
+/**
+ * Parse single-file validation response
+ */
+function parseValidationResponse(response) {
+    try {
+        const jsonSlice = extractTopLevelArray(response);
+        if (!jsonSlice)
+            return [];
+        const parsed = JSON.parse(jsonSlice);
+        if (!Array.isArray(parsed))
+            return [];
+        return parsed
+            .filter(item => typeof item.index === 'number' &&
+            typeof item.keep === 'boolean')
+            .map(item => {
+            // Normalize notes field: prefer new 'notes', fallback to legacy 'reason' or 'validationNotes'
+            const notes = item.notes || item.validationNotes || item.reason || undefined;
+            return {
+                index: item.index,
+                keep: item.keep,
+                notes,
+                adjustedSeverity: item.adjustedSeverity || null,
+                // Keep legacy fields for backward compatibility
+                reason: item.reason,
+                validationNotes: item.validationNotes,
+                // Actionable output fields (PRO-82)
+                impact: item.impact || undefined,
+                fixSuggestion: item.fixSuggestion || undefined,
+            };
+        });
+    }
+    catch (error) {
+        console.error('Failed to parse validation response:', error);
+        return [];
+    }
+}
+/**
+ * Parse multi-file validation response (Phase 2)
+ * Returns a map of file path -> validation results
+ */
+function parseMultiFileValidationResponse(response, expectedFiles) {
+    const resultMap = new Map();
+    try {
+        const jsonSlice = extractTopLevelArray(response);
+        if (!jsonSlice) {
+            console.error('[AI Validation] Multi-file: No JSON array found in response');
+            return resultMap;
+        }
+        const parsed = JSON.parse(jsonSlice);
+        if (!Array.isArray(parsed)) {
+            console.error('[AI Validation] Multi-file: Parsed result is not an array');
+            return resultMap;
+        }
+        // Process each file's results
+        for (const fileResult of parsed) {
+            if (!fileResult.file || !Array.isArray(fileResult.validations)) {
+                console.warn('[AI Validation] Multi-file: Invalid file result structure, skipping');
+                continue;
+            }
+            // Use path normalization to match AI response paths to expected paths
+            const responsePath = fileResult.file;
+            const matchedPath = (0, path_helpers_1.findMatchingFilePath)(responsePath, expectedFiles);
+            if (!matchedPath) {
+                console.warn(`[AI Validation] Multi-file: Could not match path "${responsePath}" to any expected file`);
+                continue;
+            }
+            const validations = fileResult.validations
+                .filter((item) => typeof item.index === 'number' &&
+                typeof item.keep === 'boolean')
+                .map((item) => {
+                // Normalize notes field: prefer new 'notes', fallback to legacy 'reason' or 'validationNotes'
+                const notes = item.notes || item.validationNotes || item.reason || undefined;
+                return {
+                    index: item.index,
+                    keep: item.keep,
+                    notes,
+                    adjustedSeverity: item.adjustedSeverity || null,
+                    // Keep legacy fields for backward compatibility
+                    reason: item.reason,
+                    validationNotes: item.validationNotes,
+                    // Actionable output fields (PRO-82)
+                    impact: item.impact || undefined,
+                    fixSuggestion: item.fixSuggestion || undefined,
+                };
+            });
+            resultMap.set(matchedPath, validations);
+        }
+        // Log any files that weren't in the response (these will be REJECTED by default)
+        const missingFiles = expectedFiles.filter(f => !resultMap.has(f));
+        if (missingFiles.length > 0) {
+            console.warn(`[AI Validation] Multi-file: Missing ${missingFiles.length} files from response: ${missingFiles.join(', ')}`);
+        }
+    }
+    catch (error) {
+        console.error('[AI Validation] Multi-file: Failed to parse response:', error);
+    }
+    return resultMap;
+}
+/**
+ * Apply validation results to findings
+ */
+function applyValidationResults(findings, validationResults) {
+    const processed = [];
+    let dismissedCount = 0;
+    for (let i = 0; i < findings.length; i++) {
+        const finding = findings[i];
+        const validation = validationResults.find(v => v.index === i);
+        if (!validation) {
+            // No validation result - REJECT by default (conservative approach)
+            // If AI doesn't explicitly validate a finding, assume it's a false positive
+            console.warn(`[AI Validation] No result for finding ${i}: ${finding.title} - REJECTING`);
+            dismissedCount++;
+            continue; // Don't add to processed - finding is removed
+        }
+        if (validation.keep) {
+            // Keep the finding
+            const adjustedFinding = {
+                ...finding,
+                validatedByAI: true,
+                confidence: 'high',
+            };
+            // Extract notes from optimized or legacy format
+            const validationNotes = validation.notes || validation.validationNotes || validation.reason || undefined;
+            if (validation.adjustedSeverity && validation.adjustedSeverity !== finding.severity) {
+                // Severity was adjusted
+                adjustedFinding.originalSeverity = finding.severity;
+                adjustedFinding.severity = validation.adjustedSeverity;
+                adjustedFinding.validationStatus = 'downgraded';
+                adjustedFinding.validationNotes = validationNotes || 'Severity adjusted by AI validation';
+            }
+            else {
+                // Confirmed at original severity
+                adjustedFinding.validationStatus = 'confirmed';
+                adjustedFinding.validationNotes = validationNotes;
+            }
+            // Apply AI-generated actionable fields (PRO-82)
+            if (validation.impact) {
+                adjustedFinding.impact = validation.impact;
+                adjustedFinding.aiEnhanced = true;
+            }
+            if (validation.fixSuggestion) {
+                // AI-generated fix becomes the primary fix step
+                adjustedFinding.fixSteps = [validation.fixSuggestion];
+                adjustedFinding.aiEnhanced = true;
+            }
+            processed.push(adjustedFinding);
+        }
+        else {
+            // Finding was dismissed - only log in debug mode to reduce noise
+            if (process.env.DEBUG || process.env.OCULUM_DEBUG) {
+                console.log(`[AI Validation] Rejected: ${finding.title} at ${finding.filePath}:${finding.lineNumber}`);
+            }
+            dismissedCount++;
+            // Don't add to processed - finding is removed
+        }
+    }
+    return { processed, dismissedCount };
+}
+/**
+ * Validate severity value from AI response
+ */
+function validateSeverity(severity) {
+    const valid = ['critical', 'high', 'medium', 'low', 'info'];
+    return valid.includes(severity)
+        ? severity
+        : 'medium';
+}
+/**
+ * Validate category value from AI response
+ */
+function validateCategory(category) {
+    const valid = [
+        'sql_injection', 'xss', 'command_injection', 'missing_auth',
+        'dangerous_function', 'hardcoded_secret', 'high_entropy_string',
+        'sensitive_variable', 'security_bypass', 'insecure_config',
+        'suspicious_package', 'cors_misconfiguration', 'root_container',
+        'weak_crypto', 'sensitive_url', 'ai_pattern', 'dangerous_file',
+        'data_exposure', // For logging/exposing sensitive data
+        'ai_skill_injection',
+    ];
+    return valid.includes(category)
+        ? category
+        : 'dangerous_function';
+}
+/**
+ * Get line content from file content by line number
+ */
+function getLineContent(content, lineNumber) {
+    const lines = content.split('\n');
+    return lines[lineNumber - 1]?.trim() || '';
+}
+//# sourceMappingURL=response-parser.js.map