@oddessentials/odd-ai-reviewers 1.0.0

package/dist/agents/reviewdog.js

@@ -0,0 +1,259 @@
+/**
+ * Reviewdog Agent
+ *
+ * ROUTER MONOPOLY RULE COMPLIANCE (INVARIANTS.md #1):
+ * - This agent runs reviewdog in LOCAL mode only (-reporter=local)
+ * - NO GitHub tokens are passed to subprocess
+ * - Returns structured findings for router to post
+ * - Never posts directly to GitHub
+ */
+import { spawn, execFileSync } from 'child_process';
+import { createReadStream, writeFileSync, unlinkSync, existsSync } from 'fs';
+import { tmpdir } from 'os';
+import { join } from 'path';
+import { filterSafePaths } from './path-filter.js';
+import { AgentSuccess, AgentFailure, AgentSkipped } from './types.js';
+import { buildAgentEnv } from './security.js';
+import { generateFingerprint } from '../report/formats.js';
+/**
+ * Check if reviewdog binary is available
+ */
+export function isReviewdogAvailable() {
+    try {
+        execFileSync('reviewdog', ['--version'], { stdio: 'ignore', shell: false });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Check if semgrep binary is available
+ */
+export function isSemgrepAvailable() {
+    try {
+        execFileSync('semgrep', ['--version'], { stdio: 'ignore', shell: false });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Map semgrep severity to Finding severity
+ */
+export function mapSeverity(semgrepSeverity) {
+    switch (semgrepSeverity.toUpperCase()) {
+        case 'ERROR':
+            return 'error';
+        case 'WARNING':
+            return 'warning';
+        case 'INFO':
+        default:
+            return 'info';
+    }
+}
+/**
+ * Run semgrep and parse results into structured findings
+ * This is the primary path - no GitHub posting
+ */
+async function runSemgrepStructured(repoPath, filePaths, _env) {
+    // Filter paths for safe execution (defense-in-depth)
+    const { safePaths } = filterSafePaths(filePaths, 'reviewdog');
+    if (safePaths.length === 0) {
+        return { success: true, findings: [], error: 'No valid file paths to scan' };
+    }
+    // Run semgrep with JSON output - shell-free execution
+    let semgrepOutput;
+    try {
+        semgrepOutput = execFileSync('semgrep', ['scan', '--config=auto', '--json', ...safePaths], {
+            cwd: repoPath,
+            encoding: 'utf-8',
+            shell: false, // Critical: no shell interpretation
+            maxBuffer: 50 * 1024 * 1024,
+            timeout: 300000, // 5 minute timeout
+            env: _env, // Clean env, no tokens
+        });
+    }
+    catch (error) {
+        // Semgrep returns non-zero exit code when it finds issues
+        // The JSON output is still in stdout
+        if (error && typeof error === 'object' && 'stdout' in error) {
+            semgrepOutput = error.stdout;
+        }
+        else {
+            return {
+                success: false,
+                findings: [],
+                error: `Semgrep failed: ${error instanceof Error ? error.message : 'Unknown error'}`,
+            };
+        }
+    }
+    // Parse semgrep JSON output
+    let parsed;
+    try {
+        parsed = JSON.parse(semgrepOutput);
+    }
+    catch {
+        return {
+            success: false,
+            findings: [],
+            error: 'Failed to parse semgrep JSON output',
+        };
+    }
+    // Convert to structured findings
+    const findings = parsed.results.map((result) => {
+        const finding = {
+            severity: mapSeverity(result.extra.severity),
+            file: result.path,
+            line: result.start.line,
+            endLine: result.end.line,
+            message: result.extra.message,
+            ruleId: result.check_id,
+            sourceAgent: 'reviewdog',
+            suggestion: result.extra.fix,
+            metadata: result.extra.metadata,
+        };
+        // Generate stable fingerprint
+        finding.fingerprint = generateFingerprint(finding);
+        return finding;
+    });
+    return { success: true, findings };
+}
+/**
+ * Run reviewdog in local mode (for validation/format checking only)
+ * This does NOT post to GitHub - purely for local validation
+ */
+async function runReviewdogLocal(repoPath, semgrepJsonPath, cleanEnv) {
+    return new Promise((resolve) => {
+        // CRITICAL: -reporter=local means no GitHub posting
+        // No REVIEWDOG_GITHUB_API_TOKEN in environment
+        const reviewdog = spawn('reviewdog', ['-f=semgrep', '-reporter=local', '-fail-level=none'], {
+            cwd: repoPath,
+            env: cleanEnv, // Clean env, no tokens
+            stdio: ['pipe', 'pipe', 'pipe'],
+        });
+        const input = createReadStream(semgrepJsonPath);
+        if (reviewdog.stdin) {
+            input.pipe(reviewdog.stdin);
+        }
+        let stderr = '';
+        reviewdog.stderr?.on('data', (data) => {
+            stderr += data.toString();
+        });
+        reviewdog.once('close', (code) => {
+            if (code === 0 || code === 1) {
+                // Exit code 1 means findings were found, which is expected
+                resolve({ success: true });
+            }
+            else {
+                resolve({ success: false, error: `reviewdog exited with code ${code}: ${stderr}` });
+            }
+        });
+        reviewdog.once('error', (err) => {
+            resolve({ success: false, error: err.message });
+        });
+    });
+}
+export const reviewdogAgent = {
+    id: 'reviewdog',
+    name: 'Reviewdog',
+    usesLlm: false,
+    supports(file) {
+        // Reviewdog works with any file that semgrep supports
+        return file.status !== 'deleted';
+    },
+    async run(context) {
+        const startTime = Date.now();
+        // Check if semgrep is available (primary requirement)
+        if (!isSemgrepAvailable()) {
+            console.log('[reviewdog] Semgrep binary not found, skipping');
+            return AgentSkipped({
+                agentId: 'reviewdog',
+                reason: 'Semgrep binary not found',
+                metrics: {
+                    durationMs: Date.now() - startTime,
+                    filesProcessed: 0,
+                },
+            });
+        }
+        // Get file paths
+        const filePaths = context.files.filter((f) => this.supports(f)).map((f) => f.path);
+        if (filePaths.length === 0) {
+            return AgentSkipped({
+                agentId: 'reviewdog',
+                reason: 'No files to process',
+                metrics: {
+                    durationMs: Date.now() - startTime,
+                    filesProcessed: 0,
+                },
+            });
+        }
+        console.log(`[reviewdog] Processing ${filePaths.length} files via semgrep`);
+        // ROUTER MONOPOLY RULE: Strip ALL tokens from environment
+        // Agents must NOT have access to posting credentials
+        const cleanEnv = buildAgentEnv('reviewdog', context.env);
+        // Primary path: Run semgrep directly and parse structured output
+        const result = await runSemgrepStructured(context.repoPath, filePaths, cleanEnv);
+        if (!result.success) {
+            return AgentFailure({
+                agentId: 'reviewdog',
+                error: result.error ?? 'Unknown semgrep error',
+                failureStage: 'exec',
+                partialFindings: [],
+                metrics: {
+                    durationMs: Date.now() - startTime,
+                    filesProcessed: 0,
+                },
+            });
+        }
+        // Optional: If reviewdog is available, run it in local mode for validation
+        // This verifies the output format but does NOT post to GitHub
+        if (isReviewdogAvailable() && result.findings.length > 0) {
+            const tempFile = join(tmpdir(), `semgrep-${Date.now()}.json`);
+            try {
+                // Re-run semgrep to get raw JSON for reviewdog validation
+                // Use same safe paths from earlier filtering
+                const { safePaths: validationPaths } = filterSafePaths(filePaths, 'reviewdog');
+                const semgrepOutput = execFileSync('semgrep', ['scan', '--config=auto', '--json', ...validationPaths], {
+                    cwd: context.repoPath,
+                    encoding: 'utf-8',
+                    shell: false,
+                    maxBuffer: 50 * 1024 * 1024,
+                    timeout: 300000,
+                    env: cleanEnv,
+                });
+                writeFileSync(tempFile, semgrepOutput);
+                const validation = await runReviewdogLocal(context.repoPath, tempFile, cleanEnv);
+                if (!validation.success) {
+                    console.warn(`[reviewdog] Local validation warning: ${validation.error}`);
+                }
+            }
+            catch {
+                // Semgrep may throw on findings - ignore for validation
+            }
+            finally {
+                try {
+                    if (existsSync(tempFile)) {
+                        unlinkSync(tempFile);
+                    }
+                }
+                catch {
+                    // Ignore cleanup errors
+                }
+            }
+        }
+        console.log(`[reviewdog] Found ${result.findings.length} findings`);
+        // Return structured findings for router to post
+        // Router owns all GitHub API interactions per INVARIANTS.md #1
+        return AgentSuccess({
+            agentId: 'reviewdog',
+            findings: result.findings,
+            metrics: {
+                durationMs: Date.now() - startTime,
+                filesProcessed: filePaths.length,
+            },
+        });
+    },
+};
+//# sourceMappingURL=reviewdog.js.map

package/dist/agents/reviewdog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reviewdog.js","sourceRoot":"","sources":["../../src/agents/reviewdog.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,KAAK,EAAE,YAAY,EAAqB,MAAM,eAAe,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAC7E,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC;AAC5B,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEnD,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAEtE,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAyB3D;;GAEG;AACH,MAAM,UAAU,oBAAoB;IAClC,IAAI,CAAC;QACH,YAAY,CAAC,WAAW,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5E,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB;IAChC,IAAI,CAAC;QACH,YAAY,CAAC,SAAS,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1E,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,eAAuB;IACjD,QAAQ,eAAe,CAAC,WAAW,EAAE,EAAE,CAAC;QACtC,KAAK,OAAO;YACV,OAAO,OAAO,CAAC;QACjB,KAAK,SAAS;YACZ,OAAO,SAAS,CAAC;QACnB,KAAK,MAAM,CAAC;QACZ;YACE,OAAO,MAAM,CAAC;IAClB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,oBAAoB,CACjC,QAAgB,EAChB,SAAmB,EACnB,IAA4B;IAE5B,qDAAqD;IACrD,MAAM,EAAE,SAAS,EAAE,GAAG,eAAe,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IAC9D,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC;IAC/E,CAAC;IAED,sDAAsD;IACtD,IAAI,aAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,aAAa,GAAG,YAAY,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,GAAG,SAAS,CAAC,EAAE;YACzF,GAAG,EAAE,QAAQ;YACb,QAAQ,EAAE,OAAO;YACjB,KAAK,EAAE,KAAK,EAAE,oCAAoC;YAClD,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;YAC3B,OAAO,EAAE,MAAM,EAAE,mBAAmB;YACpC,GAAG,EAAE,IAAI,EAAE,uBAAuB;SACnC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,0DAA0D;QAC1D,qCAAqC;QACrC,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,QAAQ,IAAI,KAAK,EAAE,CAAC;YAC5D,aAAa,GAAI,KAA4B,CAAC,MAAM,CAAC;QACvD,CAAC;aAAM,CAAC;YACN,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,QAAQ,EAAE,EAAE;gBACZ,KAAK,EAAE,mBAAmB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE;aACrF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,4BAA4B;IAC5B,IAAI,MAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAkB,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,OAAO,EAAE,KAAK;YACd,QAAQ,EAAE,EAAE;YACZ,KAAK,EAAE,qCAAqC;SAC7C,CAAC;IACJ,CAAC;IAED,iCAAiC;IACjC,MAAM,QAAQ,GAAc,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QACxD,MAAM,OAAO,GAAY;YACvB,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC;YAC5C,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI;YACvB,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI;YACxB,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO;YAC7B,MAAM,EAAE,MAAM,CAAC,QAAQ;YACvB,WAAW,EAAE,WAAW;YACxB,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG;YAC5B,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ;SAChC,CAAC;QAEF,8BAA8B;QAC9B,OAAO,CAAC,WAAW,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAEnD,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC,CAAC;IAEH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AACrC,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,iBAAiB,CAC9B,QAAgB,EAChB,eAAuB,EACvB,QAAgC;IAEhC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,oDAAoD;QACpD,+CAA+C;QAC/C,MAAM,SAAS,GAAiB,KAAK,CACnC,WAAW,EACX,CAAC,YAAY,EAAE,iBAAiB,EAAE,kBAAkB,CAAC,EACrD;YACE,GAAG,EAAE,QAAQ;YACb,GAAG,EAAE,QAAQ,EAAE,uBAAuB;YACtC,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SAChC,CACF,CAAC;QAEF,MAAM,KAAK,GAAG,gBAAgB,CAAC,eAAe,CAAC,CAAC;QAChD,IAAI,SAAS,CAAC,KAAK,EAAE,CAAC;YACpB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC;QAED,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YACpC,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC5B,CAAC,CAAC,CAAC;QAEH,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YAC/B,IAAI,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;gBAC7B,2DAA2D;gBAC3D,OAAO,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YAC7B,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,8BAA8B,IAAI,KAAK,MAAM,EAAE,EAAE,CAAC,CAAC;YACtF,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YAC9B,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAgB;IACzC,EAAE,EAAE,WAAW;IACf,IAAI,EAAE,WAAW;IACjB,OAAO,EAAE,KAAK;IAEd,QAAQ,CAAC,IAAc;QACrB,sDAAsD;QACtD,OAAO,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,OAAqB;QAC7B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,sDAAsD;QACtD,IAAI,CAAC,kBAAkB,EAAE,EAAE,CAAC;YAC1B,OAAO,CAAC,GAAG,CAAC,gDAAgD,CAAC,CAAC;YAC9D,OAAO,YAAY,CAAC;gBAClB,OAAO,EAAE,WAAW;gBACpB,MAAM,EAAE,0BAA0B;gBAClC,OAAO,EAAE;oBACP,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;oBAClC,cAAc,EAAE,CAAC;iBAClB;aACF,CAAC,CAAC;QACL,CAAC;QAED,iBAAiB;QACjB,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAEnF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,OAAO,YAAY,CAAC;gBAClB,OAAO,EAAE,WAAW;gBACpB,MAAM,EAAE,qBAAqB;gBAC7B,OAAO,EAAE;oBACP,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;oBAClC,cAAc,EAAE,CAAC;iBAClB;aACF,CAAC,CAAC;QACL,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,0BAA0B,SAAS,CAAC,MAAM,oBAAoB,CAAC,CAAC;QAE5E,0DAA0D;QAC1D,qDAAqD;QACrD,MAAM,QAAQ,GAAG,aAAa,CAAC,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QAEzD,iEAAiE;QACjE,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;QAEjF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,YAAY,CAAC;gBAClB,OAAO,EAAE,WAAW;gBACpB,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,uBAAuB;gBAC9C,YAAY,EAAE,MAAM;gBACpB,eAAe,EAAE,EAAE;gBACnB,OAAO,EAAE;oBACP,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;oBAClC,cAAc,EAAE,CAAC;iBAClB;aACF,CAAC,CAAC;QACL,CAAC;QAED,2EAA2E;QAC3E,8DAA8D;QAC9D,IAAI,oBAAoB,EAAE,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,WAAW,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAC9D,IAAI,CAAC;gBACH,0DAA0D;gBAC1D,6CAA6C;gBAC7C,MAAM,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,eAAe,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;gBAC/E,MAAM,aAAa,GAAG,YAAY,CAChC,SAAS,EACT,CAAC,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,GAAG,eAAe,CAAC,EACvD;oBACE,GAAG,EAAE,OAAO,CAAC,QAAQ;oBACrB,QAAQ,EAAE,OAAO;oBACjB,KAAK,EAAE,KAAK;oBACZ,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;oBAC3B,OAAO,EAAE,MAAM;oBACf,GAAG,EAAE,QAAQ;iBACd,CACF,CAAC;gBACF,aAAa,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;gBAEvC,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;gBACjF,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;oBACxB,OAAO,CAAC,IAAI,CAAC,yCAAyC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;gBAC5E,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,wDAAwD;YAC1D,CAAC;oBAAS,CAAC;gBACT,IAAI,CAAC;oBACH,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;wBACzB,UAAU,CAAC,QAAQ,CAAC,CAAC;oBACvB,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,wBAAwB;gBAC1B,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,qBAAqB,MAAM,CAAC,QAAQ,CAAC,MAAM,WAAW,CAAC,CAAC;QAEpE,gDAAgD;QAChD,+DAA+D;QAC/D,OAAO,YAAY,CAAC;YAClB,OAAO,EAAE,WAAW;YACpB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,OAAO,EAAE;gBACP,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;gBAClC,cAAc,EAAE,SAAS,CAAC,MAAM;aACjC;SACF,CAAC,CAAC;IACL,CAAC;CACF,CAAC"}

package/dist/agents/security.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Agent Security Module
+ *
+ * Provides security utilities for agent subprocess execution:
+ * - Token stripping (Router Monopoly Rule enforcement)
+ * - Network listener detection (CVE-2026-22812 mitigation)
+ *
+ * INVARIANTS ENFORCED:
+ * - No Direct Secrets to Agents (Invariant 7)
+ * - No Network Listeners in Agent Execution (Invariant 10)
+ */
+export type AgentId = 'semgrep' | 'reviewdog' | 'opencode' | 'pr_agent' | 'ai_semantic_review' | 'local_llm';
+/**
+ * Strip all posting tokens from environment variables.
+ * Returns a clean environment safe for agent subprocesses.
+ *
+ * SECURITY: This enforces the Router Monopoly Rule - agents must not have
+ * access to tokens that would allow them to post directly to GitHub/ADO.
+ */
+export declare function stripTokensFromEnv(env: Record<string, string | undefined>): Record<string, string>;
+export declare function buildRouterEnv(env: Record<string, string | undefined>): Record<string, string | undefined>;
+export declare function buildAgentEnv(agentId: AgentId, env: Record<string, string | undefined>): Record<string, string>;
+export declare function isKnownAgentId(agentId: string): agentId is AgentId;
+/**
+ * Check if a specific token exists in the environment.
+ * Used for testing that tokens were properly stripped.
+ */
+export declare function hasTokenInEnv(env: Record<string, string | undefined>): {
+    hasToken: boolean;
+    tokens: string[];
+};
+/**
+ * Validate that no process is listening on network ports.
+ * Used to detect if an agent has started an HTTP server (CVE mitigation).
+ *
+ * @param processName - Optional process name to filter by
+ * @returns Object indicating if the check passed and any error message
+ */
+export declare function validateNoListeningSockets(processName?: string): Promise<{
+    safe: boolean;
+    error?: string;
+    listeners?: string[];
+}>;
+/**
+ * Create a sanitized subprocess environment.
+ * Removes tokens and sets security-hardening variables.
+ */
+export declare function createSafeAgentEnv(baseEnv: Record<string, string | undefined>, allowedKeys?: string[]): Record<string, string>;
+//# sourceMappingURL=security.d.ts.map

package/dist/agents/security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../src/agents/security.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,MAAM,MAAM,OAAO,GACf,SAAS,GACT,WAAW,GACX,UAAU,GACV,UAAU,GACV,oBAAoB,GACpB,WAAW,CAAC;AAuIhB;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GACtC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAqBxB;AAiBD,wBAAgB,cAAc,CAC5B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GACtC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAEpC;AAED,wBAAgB,aAAa,CAC3B,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GACtC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAIxB;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,IAAI,OAAO,CAElE;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG;IACtE,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB,CAUA;AAED;;;;;;GAMG;AACH,wBAAsB,0BAA0B,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAC9E,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB,CAAC,CA+DD;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,EAC3C,WAAW,CAAC,EAAE,MAAM,EAAE,GACrB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAmCxB"}

package/dist/agents/security.js

@@ -0,0 +1,302 @@
+/**
+ * Agent Security Module
+ *
+ * Provides security utilities for agent subprocess execution:
+ * - Token stripping (Router Monopoly Rule enforcement)
+ * - Network listener detection (CVE-2026-22812 mitigation)
+ *
+ * INVARIANTS ENFORCED:
+ * - No Direct Secrets to Agents (Invariant 7)
+ * - No Network Listeners in Agent Execution (Invariant 10)
+ */
+import { execFileSync, execSync } from 'child_process';
+const COMMON_AGENT_ENV_ALLOWLIST = [
+    'PATH',
+    'HOME',
+    'TMPDIR',
+    'TMP',
+    'TEMP',
+    'LANG',
+    'LC_ALL',
+    'TERM',
+    'NO_COLOR',
+    'NODE_ENV',
+];
+const AGENT_ENV_ALLOWLIST = {
+    semgrep: [],
+    reviewdog: [],
+    opencode: ['OPENAI_API_KEY', 'ANTHROPIC_API_KEY', 'MODEL'],
+    pr_agent: [
+        'OPENAI_API_KEY',
+        'ANTHROPIC_API_KEY',
+        'AZURE_OPENAI_API_KEY',
+        'AZURE_OPENAI_ENDPOINT',
+        'AZURE_OPENAI_DEPLOYMENT',
+        'MODEL',
+    ],
+    ai_semantic_review: [
+        'OPENAI_API_KEY',
+        'ANTHROPIC_API_KEY',
+        'AZURE_OPENAI_API_KEY',
+        'AZURE_OPENAI_ENDPOINT',
+        'AZURE_OPENAI_DEPLOYMENT',
+        'MODEL',
+    ],
+    local_llm: [
+        'OLLAMA_BASE_URL',
+        'OLLAMA_MODEL',
+        'LOCAL_LLM_OPTIONAL',
+        'LOCAL_LLM_NUM_CTX',
+        'LOCAL_LLM_NUM_PREDICT',
+        'LOCAL_LLM_TIMEOUT',
+    ],
+};
+const ROUTER_ENV_ALLOWLIST = [
+    // GitHub CI context (router-only, NOT passed to agents)
+    'GITHUB_TOKEN',
+    'GITHUB_ACTOR',
+    'GITHUB_HEAD_REPO',
+    'GITHUB_REPOSITORY',
+    'GITHUB_EVENT_NAME',
+    'GITHUB_EVENT_PULL_REQUEST_DRAFT',
+    'GITHUB_REF',
+    'GITHUB_REF_NAME',
+    'GITHUB_BASE_REF',
+    'GITHUB_WORKSPACE',
+    'GITHUB_ACTIONS',
+    // Azure DevOps CI context (router-only, NOT passed to agents)
+    'SYSTEM_ACCESSTOKEN', // ADO pipeline token
+    'AZURE_DEVOPS_PAT', // PAT fallback for local testing/cross-org
+    'SYSTEM_TEAMFOUNDATIONCOLLECTIONURI',
+    'SYSTEM_TEAMPROJECT',
+    'BUILD_REPOSITORY_URI',
+    'BUILD_REPOSITORY_NAME',
+    'BUILD_SOURCEVERSION',
+    'BUILD_REASON',
+    'SYSTEM_PULLREQUEST_PULLREQUESTID',
+    'SYSTEM_PULLREQUEST_SOURCEBRANCH',
+    'SYSTEM_PULLREQUEST_TARGETBRANCH',
+    'SYSTEM_PULLREQUEST_SOURCEREPOSITORYURI',
+    'BUILD_REQUESTEDFOR',
+    'TF_BUILD',
+    // Cross-platform
+    'CI',
+    // System
+    'PATH',
+    'HOME',
+    'TMPDIR',
+    'TMP',
+    'TEMP',
+    'LANG',
+    'LC_ALL',
+    'TERM',
+    'NODE_ENV',
+    // AI Provider Keys (canonical only)
+    'OPENAI_API_KEY',
+    'ANTHROPIC_API_KEY',
+    'AZURE_OPENAI_API_KEY',
+    'AZURE_OPENAI_ENDPOINT',
+    'AZURE_OPENAI_DEPLOYMENT',
+    'OLLAMA_BASE_URL',
+    'OLLAMA_MODEL',
+    // Local LLM tuning
+    'LOCAL_LLM_OPTIONAL',
+    'LOCAL_LLM_NUM_CTX',
+    'LOCAL_LLM_NUM_PREDICT',
+    'LOCAL_LLM_TIMEOUT',
+    // Model selection (canonical)
+    'MODEL',
+];
+/**
+ * List of environment variable patterns that should be stripped from agent subprocesses.
+ * These are tokens that would allow agents to post to GitHub/ADO directly.
+ */
+const TOKEN_PATTERNS = [
+    // GitHub tokens
+    'GITHUB_TOKEN',
+    'GH_TOKEN',
+    'GITHUB_PAT',
+    'GH_PAT',
+    // Azure DevOps tokens
+    'AZURE_DEVOPS_PAT',
+    'ADO_TOKEN',
+    'SYSTEM_ACCESSTOKEN',
+    // Generic posting tokens
+    'REVIEWDOG_GITHUB_API_TOKEN',
+    // Any variable containing TOKEN (case-insensitive)
+    /^.*_TOKEN$/i,
+    /^.*_PAT$/i,
+];
+/**
+ * Check if an environment variable name matches a token pattern
+ */
+function isTokenVariable(name) {
+    return TOKEN_PATTERNS.some((pattern) => {
+        if (typeof pattern === 'string') {
+            return name === pattern;
+        }
+        return pattern.test(name);
+    });
+}
+/**
+ * Strip all posting tokens from environment variables.
+ * Returns a clean environment safe for agent subprocesses.
+ *
+ * SECURITY: This enforces the Router Monopoly Rule - agents must not have
+ * access to tokens that would allow them to post directly to GitHub/ADO.
+ */
+export function stripTokensFromEnv(env) {
+    const clean = {};
+    const stripped = [];
+    for (const [key, value] of Object.entries(env)) {
+        if (value === undefined)
+            continue;
+        if (isTokenVariable(key)) {
+            stripped.push(key);
+        }
+        else {
+            clean[key] = value;
+        }
+    }
+    if (stripped.length > 0) {
+        console.log(`[security] Stripped ${stripped.length} tokens from agent environment: ${stripped.join(', ')}`);
+    }
+    return clean;
+}
+function pickEnv(env, allowlist) {
+    const picked = {};
+    for (const key of allowlist) {
+        if (env[key] !== undefined) {
+            picked[key] = env[key];
+        }
+    }
+    return picked;
+}
+export function buildRouterEnv(env) {
+    return pickEnv(env, ROUTER_ENV_ALLOWLIST);
+}
+export function buildAgentEnv(agentId, env) {
+    const allowlist = new Set([...COMMON_AGENT_ENV_ALLOWLIST, ...AGENT_ENV_ALLOWLIST[agentId]]);
+    const picked = pickEnv(env, [...allowlist]);
+    return createSafeAgentEnv(picked, Object.keys(picked));
+}
+export function isKnownAgentId(agentId) {
+    return Object.prototype.hasOwnProperty.call(AGENT_ENV_ALLOWLIST, agentId);
+}
+/**
+ * Check if a specific token exists in the environment.
+ * Used for testing that tokens were properly stripped.
+ */
+export function hasTokenInEnv(env) {
+    const tokens = [];
+    for (const key of Object.keys(env)) {
+        if (env[key] !== undefined && isTokenVariable(key)) {
+            tokens.push(key);
+        }
+    }
+    return { hasToken: tokens.length > 0, tokens };
+}
+/**
+ * Validate that no process is listening on network ports.
+ * Used to detect if an agent has started an HTTP server (CVE mitigation).
+ *
+ * @param processName - Optional process name to filter by
+ * @returns Object indicating if the check passed and any error message
+ */
+export async function validateNoListeningSockets(processName) {
+    try {
+        try {
+            // Use 'which' instead of 'command -v' because command is a shell builtin
+            // and execSync doesn't use a shell by default
+            execSync('which lsof', { encoding: 'utf-8', stdio: 'ignore', timeout: 2000 });
+        }
+        catch {
+            return { safe: false, error: 'Listener detection unavailable: lsof not installed' };
+        }
+        // Use lsof to find listening TCP sockets
+        // -i TCP -sTCP:LISTEN shows only listening TCP connections
+        // -n -P prevents hostname and port name resolution for speed
+        let output = '';
+        try {
+            output = execFileSync('lsof', ['-i', 'TCP', '-sTCP:LISTEN', '-n', '-P'], {
+                encoding: 'utf-8',
+                timeout: 5000,
+                stdio: ['pipe', 'pipe', 'ignore'], // ignore stderr
+            });
+        }
+        catch {
+            // lsof returns non-zero if no listeners found, which is fine
+            output = '';
+        }
+        if (!output.trim()) {
+            return { safe: true };
+        }
+        // Parse lsof output
+        const lines = output.trim().split('\n');
+        const listeners = [];
+        for (const line of lines.slice(1)) {
+            // Skip header line
+            const parts = line.split(/\s+/);
+            const command = parts[0] ?? '';
+            const pid = parts[1] ?? '';
+            const name = parts[8] ?? '';
+            // If processName specified, only flag matching processes
+            if (processName && !command.toLowerCase().includes(processName.toLowerCase())) {
+                continue;
+            }
+            listeners.push(`${command}(${pid}) listening on ${name}`);
+        }
+        if (listeners.length > 0) {
+            return {
+                safe: false,
+                error: `Detected ${listeners.length} listening socket(s): ${listeners.join('; ')}`,
+                listeners,
+            };
+        }
+        return { safe: true };
+    }
+    catch (error) {
+        return {
+            safe: false,
+            error: `Listener detection failed: ${error instanceof Error ? error.message : 'Unknown error'}`,
+        };
+    }
+}
+/**
+ * Create a sanitized subprocess environment.
+ * Removes tokens and sets security-hardening variables.
+ */
+export function createSafeAgentEnv(baseEnv, allowedKeys) {
+    // Start with stripped environment
+    const clean = stripTokensFromEnv(baseEnv);
+    // Add security-hardening defaults
+    const safeEnv = {
+        // Preserve PATH for subprocess execution
+        PATH: clean['PATH'] ?? '/usr/local/bin:/usr/bin:/bin',
+        // Preserve locale settings
+        LANG: clean['LANG'] ?? 'en_US.UTF-8',
+        LC_ALL: clean['LC_ALL'] ?? 'en_US.UTF-8',
+        // Disable color output for consistent parsing
+        NO_COLOR: '1',
+        // PEP 540 UTF-8 Mode: Forces Python to use UTF-8 for all I/O, preventing
+        // Windows cp1252 encoding crashes in Python-based tools (Semgrep, etc.).
+        // Harmless no-op for non-Python subprocesses - the env var is simply ignored.
+        // We intentionally override any user-provided value as a safety invariant.
+        // See: https://peps.python.org/pep-0540/
+        PYTHONUTF8: '1',
+        // Set HOME for tools that need it
+        HOME: clean['HOME'] ?? '/tmp',
+        // Preserve TERM for proper output handling
+        TERM: clean['TERM'] ?? 'dumb',
+    };
+    // Add allowed keys from original environment
+    if (allowedKeys) {
+        for (const key of allowedKeys) {
+            if (clean[key] !== undefined) {
+                safeEnv[key] = clean[key];
+            }
+        }
+    }
+    return safeEnv;
+}
+//# sourceMappingURL=security.js.map

package/dist/agents/security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.js","sourceRoot":"","sources":["../../src/agents/security.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAUvD,MAAM,0BAA0B,GAAG;IACjC,MAAM;IACN,MAAM;IACN,QAAQ;IACR,KAAK;IACL,MAAM;IACN,MAAM;IACN,QAAQ;IACR,MAAM;IACN,UAAU;IACV,UAAU;CACX,CAAC;AAEF,MAAM,mBAAmB,GAA8B;IACrD,OAAO,EAAE,EAAE;IACX,SAAS,EAAE,EAAE;IACb,QAAQ,EAAE,CAAC,gBAAgB,EAAE,mBAAmB,EAAE,OAAO,CAAC;IAC1D,QAAQ,EAAE;QACR,gBAAgB;QAChB,mBAAmB;QACnB,sBAAsB;QACtB,uBAAuB;QACvB,yBAAyB;QACzB,OAAO;KACR;IACD,kBAAkB,EAAE;QAClB,gBAAgB;QAChB,mBAAmB;QACnB,sBAAsB;QACtB,uBAAuB;QACvB,yBAAyB;QACzB,OAAO;KACR;IACD,SAAS,EAAE;QACT,iBAAiB;QACjB,cAAc;QACd,oBAAoB;QACpB,mBAAmB;QACnB,uBAAuB;QACvB,mBAAmB;KACpB;CACF,CAAC;AAEF,MAAM,oBAAoB,GAAG;IAC3B,wDAAwD;IACxD,cAAc;IACd,cAAc;IACd,kBAAkB;IAClB,mBAAmB;IACnB,mBAAmB;IACnB,iCAAiC;IACjC,YAAY;IACZ,iBAAiB;IACjB,iBAAiB;IACjB,kBAAkB;IAClB,gBAAgB;IAChB,8DAA8D;IAC9D,oBAAoB,EAAE,qBAAqB;IAC3C,kBAAkB,EAAE,2CAA2C;IAC/D,oCAAoC;IACpC,oBAAoB;IACpB,sBAAsB;IACtB,uBAAuB;IACvB,qBAAqB;IACrB,cAAc;IACd,kCAAkC;IAClC,iCAAiC;IACjC,iCAAiC;IACjC,wCAAwC;IACxC,oBAAoB;IACpB,UAAU;IACV,iBAAiB;IACjB,IAAI;IACJ,SAAS;IACT,MAAM;IACN,MAAM;IACN,QAAQ;IACR,KAAK;IACL,MAAM;IACN,MAAM;IACN,QAAQ;IACR,MAAM;IACN,UAAU;IACV,oCAAoC;IACpC,gBAAgB;IAChB,mBAAmB;IACnB,sBAAsB;IACtB,uBAAuB;IACvB,yBAAyB;IACzB,iBAAiB;IACjB,cAAc;IACd,mBAAmB;IACnB,oBAAoB;IACpB,mBAAmB;IACnB,uBAAuB;IACvB,mBAAmB;IACnB,8BAA8B;IAC9B,OAAO;CACR,CAAC;AAEF;;;GAGG;AACH,MAAM,cAAc,GAAG;IACrB,gBAAgB;IAChB,cAAc;IACd,UAAU;IACV,YAAY;IACZ,QAAQ;IACR,sBAAsB;IACtB,kBAAkB;IAClB,WAAW;IACX,oBAAoB;IACpB,yBAAyB;IACzB,4BAA4B;IAC5B,mDAAmD;IACnD,aAAa;IACb,WAAW;CACZ,CAAC;AAEF;;GAEG;AACH,SAAS,eAAe,CAAC,IAAY;IACnC,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;QACrC,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAChC,OAAO,IAAI,KAAK,OAAO,CAAC;QAC1B,CAAC;QACD,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAChC,GAAuC;IAEvC,MAAM,KAAK,GAA2B,EAAE,CAAC;IACzC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAElC,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACrB,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,CACT,uBAAuB,QAAQ,CAAC,MAAM,mCAAmC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC/F,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,OAAO,CACd,GAAuC,EACvC,SAAmB;IAEnB,MAAM,MAAM,GAAuC,EAAE,CAAC;IAEtD,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,GAAuC;IAEvC,OAAO,OAAO,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,OAAgB,EAChB,GAAuC;IAEvC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,0BAA0B,EAAE,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC5F,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC;IAC5C,OAAO,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;AAC5E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,GAAuC;IAInE,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,SAAS,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;YACnD,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;AACjD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,WAAoB;IAKnE,IAAI,CAAC;QACH,IAAI,CAAC;YACH,yEAAyE;YACzE,8CAA8C;YAC9C,QAAQ,CAAC,YAAY,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAChF,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,oDAAoD,EAAE,CAAC;QACtF,CAAC;QAED,yCAAyC;QACzC,2DAA2D;QAC3D,6DAA6D;QAC7D,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE;gBACvE,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,IAAI;gBACb,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,gBAAgB;aACpD,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,6DAA6D;YAC7D,MAAM,GAAG,EAAE,CAAC;QACd,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;YACnB,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACxB,CAAC;QAED,oBAAoB;QACpB,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,SAAS,GAAa,EAAE,CAAC;QAE/B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YAClC,mBAAmB;YACnB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAChC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC/B,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC3B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAE5B,yDAAyD;YACzD,IAAI,WAAW,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;gBAC9E,SAAS;YACX,CAAC;YAED,SAAS,CAAC,IAAI,CAAC,GAAG,OAAO,IAAI,GAAG,kBAAkB,IAAI,EAAE,CAAC,CAAC;QAC5D,CAAC;QAED,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,OAAO;gBACL,IAAI,EAAE,KAAK;gBACX,KAAK,EAAE,YAAY,SAAS,CAAC,MAAM,yBAAyB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBAClF,SAAS;aACV,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACxB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,IAAI,EAAE,KAAK;YACX,KAAK,EAAE,8BAA8B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE;SAChG,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAA2C,EAC3C,WAAsB;IAEtB,kCAAkC;IAClC,MAAM,KAAK,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAE1C,kCAAkC;IAClC,MAAM,OAAO,GAA2B;QACtC,yCAAyC;QACzC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,8BAA8B;QACrD,2BAA2B;QAC3B,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,aAAa;QACpC,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,aAAa;QACxC,8CAA8C;QAC9C,QAAQ,EAAE,GAAG;QACb,yEAAyE;QACzE,yEAAyE;QACzE,8EAA8E;QAC9E,2EAA2E;QAC3E,yCAAyC;QACzC,UAAU,EAAE,GAAG;QACf,kCAAkC;QAClC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,MAAM;QAC7B,2CAA2C;QAC3C,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,MAAM;KAC9B,CAAC;IAEF,6CAA6C;IAC7C,IAAI,WAAW,EAAE,CAAC;QAChB,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;YAC9B,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,SAAS,EAAE,CAAC;gBAC7B,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/agents/semgrep.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Semgrep Agent
+ * Static analysis using Semgrep for security and bug patterns
+ */
+import type { ReviewAgent, Severity } from './types.js';
+export declare const semgrepAgent: ReviewAgent;
+export declare function mapSeverity(semgrepSeverity: string): Severity;
+//# sourceMappingURL=semgrep.d.ts.map

package/dist/agents/semgrep.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"semgrep.d.ts","sourceRoot":"","sources":["../../src/agents/semgrep.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAsC,QAAQ,EAAE,MAAM,YAAY,CAAC;AAgD5F,eAAO,MAAM,YAAY,EAAE,WAwI1B,CAAC;AAEF,wBAAgB,WAAW,CAAC,eAAe,EAAE,MAAM,GAAG,QAAQ,CAS7D"}