@owasp-aghast/aghast 0.8.4 → 0.9.0-rc.1

package/dist/judge.js

@@ -0,0 +1,305 @@
+/**
+ * LLM judge stage: re-evaluates aggregated SecurityIssues after all checks have run.
+ * Annotates each issue with a verdict (true_positive / false_positive / uncertain),
+ * confidence, and rationale. Runs as a separate pipeline stage in runMultiScanWithCost.
+ */
+import { logProgress, logDebug, logWarn, createTimer } from './logging.js';
+import { withRetry, defaultIsRetryable, DEFAULT_RETRY, AgentTimeoutError } from './retry.js';
+import { BudgetExceededError } from './budget.js';
+import { preflightBudget, recordUsage } from './cost-tracker.js';
+import { mapWithConcurrency } from './concurrency.js';
+const TAG = 'judge';
+const DEFAULT_JUDGE_CONCURRENCY = 5;
+const DEFAULT_JUDGE_TIMEOUT_MS = 5 * 60 * 1000;
+/**
+ * Thrown by the internal timeout race when a judge provider call exceeds
+ * DEFAULT_JUDGE_TIMEOUT_MS. Module-private: callers distinguish it via
+ * `instanceof JudgeTimeoutError` inside this module only.
+ */
+class JudgeTimeoutError extends AgentTimeoutError {
+    constructor(timeoutSeconds) {
+        super(`Judge provider timed out after ${timeoutSeconds}s`);
+        // Deliberately does NOT override `name`: the retry classifier matches on
+        // `AgentTimeoutError` by name (so it survives a serialization boundary),
+        // and callers in this module distinguish it with `instanceof` anyway.
+    }
+}
+/**
+ * Parse a raw judge response into a JudgeVerdict.
+ * Returns undefined if the response is not parseable or lacks required fields.
+ */
+export function parseJudgeResponse(raw) {
+    const tryParse = (text) => {
+        try {
+            return JSON.parse(text);
+        }
+        catch {
+            return undefined;
+        }
+    };
+    let parsed = tryParse(raw);
+    if (parsed === undefined) {
+        const fence = raw.match(/```(?:json)?\s*([\s\S]*?)```/i);
+        if (fence?.[1])
+            parsed = tryParse(fence[1]);
+    }
+    if (parsed === undefined) {
+        const firstBrace = raw.indexOf('{');
+        const lastBrace = raw.lastIndexOf('}');
+        if (firstBrace !== -1 && lastBrace > firstBrace) {
+            parsed = tryParse(raw.slice(firstBrace, lastBrace + 1));
+        }
+    }
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
+        return undefined;
+    const obj = parsed;
+    const validVerdicts = ['true_positive', 'false_positive', 'uncertain'];
+    if (typeof obj.verdict !== 'string' || !validVerdicts.includes(obj.verdict))
+        return undefined;
+    if (typeof obj.confidence !== 'number' || obj.confidence < 0 || obj.confidence > 1)
+        return undefined;
+    if (typeof obj.rationale !== 'string')
+        return undefined;
+    return {
+        verdict: obj.verdict,
+        confidence: obj.confidence,
+        rationale: obj.rationale,
+    };
+}
+/** Build the judge prompt for a single issue. */
+function buildJudgePrompt(issue, checkInstructions) {
+    const lines = [];
+    lines.push('You are a security finding validator. Review the following reported security issue and determine if it is a genuine vulnerability (true positive), a false alarm (false positive), or uncertain.');
+    lines.push('');
+    lines.push('Respond with JSON only:');
+    lines.push('{ "verdict": "true_positive" | "false_positive" | "uncertain", "confidence": <0.0-1.0>, "rationale": "<brief explanation>" }');
+    lines.push('');
+    lines.push(`## Check: ${issue.checkName}`);
+    if (checkInstructions) {
+        lines.push('');
+        lines.push('### What this check looks for:');
+        lines.push(checkInstructions);
+    }
+    lines.push('');
+    lines.push('## Reported Finding');
+    lines.push(`File: ${issue.file}`);
+    lines.push(`Lines: ${issue.startLine}–${issue.endLine}`);
+    lines.push(`Description: ${issue.description}`);
+    if (issue.codeSnippet) {
+        lines.push('');
+        lines.push('### Code snippet:');
+        lines.push('```');
+        lines.push(issue.codeSnippet);
+        lines.push('```');
+    }
+    if (issue.dataFlow && issue.dataFlow.length > 0) {
+        lines.push('');
+        lines.push('### Data flow:');
+        for (const step of issue.dataFlow) {
+            lines.push(`  ${step.file}:${step.lineNumber} — ${step.label}`);
+        }
+    }
+    lines.push('');
+    lines.push('Is this a real security issue? Respond with JSON only.');
+    return lines.join('\n');
+}
+/**
+ * Run the judge stage over all collected issues.
+ * Mutates each issue in place by attaching a `judge` field.
+ * Returns the issues array (same reference, mutated).
+ */
+export async function runJudge(issues, checksById, repositoryPath, options, costTracker) {
+    if (issues.length === 0)
+        return issues;
+    const effectiveConcurrency = options.concurrency ?? DEFAULT_JUDGE_CONCURRENCY;
+    const judgeModel = options.model;
+    // Apply per-check model
+    options.provider.setModel?.(judgeModel);
+    logProgress(TAG, `Judging ${issues.length} issues (model: ${judgeModel}, concurrency: ${effectiveConcurrency})`);
+    const judgeTimer = createTimer();
+    const abortHandle = { aborted: false };
+    await mapWithConcurrency(issues, effectiveConcurrency, async (issue, _idx) => {
+        const checkEntry = checksById.get(issue.checkId);
+        // Per-check opt-out: skip if check.judge === false
+        if (checkEntry?.check.judge === false) {
+            logDebug(TAG, `Skipping issue from check "${issue.checkId}" (judge: false)`);
+            return;
+        }
+        const checkInstructions = checkEntry?.instructions;
+        const prompt = buildJudgePrompt(issue, checkInstructions);
+        try {
+            preflightBudget(costTracker);
+        }
+        catch (budgetErr) {
+            if (budgetErr instanceof BudgetExceededError) {
+                abortHandle.aborted = true;
+                abortHandle.reason = budgetErr;
+                throw budgetErr;
+            }
+            throw budgetErr;
+        }
+        logDebug(TAG, `Judging issue: ${issue.checkId} @ ${issue.file}:${issue.startLine}`);
+        try {
+            // Declared as a function so each retry gets a fresh timer — reusing a
+            // single handle across attempts would leave the first attempt's timeout
+            // armed and abort a later, healthy one. Mirrors `analyzeOnce` in the
+            // scan runner.
+            const judgeOnce = async () => {
+                let timeoutHandle;
+                return Promise.race([
+                    options.provider.executeCheck(prompt, repositoryPath, `[judge:${issue.checkId}]`),
+                    new Promise((_, reject) => {
+                        timeoutHandle = setTimeout(() => reject(new JudgeTimeoutError(DEFAULT_JUDGE_TIMEOUT_MS / 1000)), DEFAULT_JUDGE_TIMEOUT_MS);
+                    }),
+                ]).finally(() => {
+                    if (timeoutHandle)
+                        clearTimeout(timeoutHandle);
+                });
+            };
+            // The judge makes its own AI calls, and they are as prone to transient
+            // provider failure as check analysis is. Without this a dropped stream
+            // degraded the verdict to `uncertain`, which escalates the check to
+            // FLAG — turning a network blip into a flagged security finding.
+            const agentResponse = await withRetry(judgeOnce, {
+                ...DEFAULT_RETRY,
+                ...options.retry,
+                breaker: options.breaker,
+                label: `judge:${issue.checkId}`,
+                // Stop retrying the moment another worker has aborted the run
+                // (budget exceeded, or a fatal provider error).
+                isRetryable: (err) => !abortHandle.aborted && defaultIsRetryable(err),
+            });
+            recordUsage(costTracker, agentResponse.tokenUsage, judgeModel);
+            const parsed = parseJudgeResponse(agentResponse.raw);
+            if (!parsed) {
+                logDebug(TAG, `Judge returned malformed response for ${issue.checkId}@${issue.file}:${issue.startLine}`);
+                issue.judge = {
+                    verdict: 'uncertain',
+                    confidence: 0,
+                    rationale: 'judge failed: malformed response',
+                    model: judgeModel,
+                    provider: options.providerName,
+                    tokenUsage: agentResponse.tokenUsage,
+                };
+                return;
+            }
+            // Apply minConfidence demotion: true_positive below threshold → uncertain
+            let { verdict, rationale } = parsed;
+            const { confidence } = parsed;
+            if (verdict === 'true_positive' &&
+                options.minConfidence !== undefined &&
+                confidence < options.minConfidence) {
+                logDebug(TAG, `Demoting true_positive to uncertain (confidence ${confidence} < minConfidence ${options.minConfidence})`);
+                verdict = 'uncertain';
+                rationale = `${rationale} [demoted: confidence ${confidence.toFixed(2)} < minConfidence ${options.minConfidence}]`;
+            }
+            issue.judge = {
+                verdict,
+                confidence,
+                rationale,
+                model: judgeModel,
+                provider: options.providerName,
+                tokenUsage: agentResponse.tokenUsage,
+            };
+            logDebug(TAG, `Judge verdict: ${verdict} (confidence: ${confidence}) for ${issue.checkId}@${issue.file}:${issue.startLine}`);
+        }
+        catch (err) {
+            if (err instanceof BudgetExceededError)
+                throw err;
+            const errorMsg = err instanceof Error ? err.message : String(err);
+            if (err instanceof JudgeTimeoutError) {
+                logWarn(TAG, `Judge timed out for ${issue.checkId}@${issue.file}:${issue.startLine} — token usage for this call was not recorded`);
+            }
+            logDebug(TAG, `Judge error for ${issue.checkId}: ${errorMsg}`);
+            issue.judge = {
+                verdict: 'uncertain',
+                confidence: 0,
+                rationale: `judge failed: ${errorMsg}`,
+                model: judgeModel,
+                provider: options.providerName,
+            };
+        }
+    }, abortHandle);
+    logProgress(TAG, `Judge stage completed in ${judgeTimer.elapsedStr()}`);
+    return issues;
+}
+/**
+ * Recompute per-check statuses and summary counts after the judge stage.
+ *
+ * Recomputation order (per issue 290 design):
+ * 1. Apply minConfidence demotion (already done in runJudge per-issue)
+ * 2. Drop false positives if dropFalsePositives is set
+ * 3. Escalate checks whose remaining issues are all uncertain → FLAG
+ * 4. Set flagSource on issues
+ * 5. Recompute summary counts
+ *
+ * Returns the filtered issues array and updated check summaries.
+ */
+export function applyJudgeResults(allIssues, allCheckSummaries, options) {
+    // Count judge verdicts across all judged issues
+    let judgedCount = 0;
+    let fpCount = 0;
+    let uncertainCount = 0;
+    // Step 1: Remove confirmed false positives if dropFalsePositives is set
+    let filteredIssues = allIssues;
+    if (options.dropFalsePositives) {
+        filteredIssues = allIssues.filter((issue) => {
+            if (!issue.judge)
+                return true; // No verdict: keep
+            if (issue.judge.verdict === 'false_positive')
+                return false; // Drop FP
+            return true;
+        });
+    }
+    // Count verdicts from allIssues (pre-filter) so that dropped FPs are included
+    // in judgedIssues and falsePositives regardless of dropFalsePositives.
+    for (const issue of allIssues) {
+        if (issue.judge) {
+            judgedCount++;
+            if (issue.judge.verdict === 'false_positive')
+                fpCount++;
+            if (issue.judge.verdict === 'uncertain')
+                uncertainCount++;
+        }
+    }
+    // Step 2: Group remaining issues by checkId
+    const issuesByCheck = new Map();
+    for (const issue of filteredIssues) {
+        const existing = issuesByCheck.get(issue.checkId);
+        if (existing) {
+            existing.push(issue);
+        }
+        else {
+            issuesByCheck.set(issue.checkId, [issue]);
+        }
+    }
+    // Step 3: Recompute per-check status based on remaining issues
+    for (const summary of allCheckSummaries) {
+        const checkIssues = issuesByCheck.get(summary.checkId) ?? [];
+        // Restore any check that was FAIL but lost all its issues to FP drops → PASS
+        if (summary.status === 'FAIL' && checkIssues.length === 0 && options.dropFalsePositives) {
+            summary.status = 'PASS';
+            summary.issuesFound = 0;
+        }
+        else if (summary.status === 'FAIL' && checkIssues.length > 0) {
+            // Check if all remaining issues are uncertain → escalate to FLAG
+            const allUncertain = checkIssues.every((i) => i.judge && i.judge.verdict === 'uncertain');
+            if (allUncertain) {
+                summary.status = 'FLAG';
+                summary.issuesFound = checkIssues.length;
+                // Attach flagSource: "judge" to each uncertain issue
+                for (const issue of checkIssues) {
+                    // Decision #9: flagSource:"check" wins if already set
+                    if (!issue.flagSource) {
+                        issue.flagSource = 'judge';
+                    }
+                }
+            }
+            else {
+                summary.issuesFound = checkIssues.length;
+            }
+        }
+    }
+    return { filteredIssues, judgedIssues: judgedCount, falsePositives: fpCount, uncertainJudgements: uncertainCount };
+}
+//# sourceMappingURL=judge.js.map

package/dist/judge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"judge.js","sourceRoot":"","sources":["../src/judge.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3E,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,aAAa,EAAE,iBAAiB,EAA0C,MAAM,YAAY,CAAC;AACrI,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAwB,eAAe,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACvF,OAAO,EAAoB,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAExE,MAAM,GAAG,GAAG,OAAO,CAAC;AACpB,MAAM,yBAAyB,GAAG,CAAC,CAAC;AACpC,MAAM,wBAAwB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAE/C;;;;GAIG;AACH,MAAM,iBAAkB,SAAQ,iBAAiB;IAC/C,YAAY,cAAsB;QAChC,KAAK,CAAC,kCAAkC,cAAc,GAAG,CAAC,CAAC;QAC3D,yEAAyE;QACzE,yEAAyE;QACzE,sEAAsE;IACxE,CAAC;CACF;AAuBD;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAW,EAAE;QACzC,IAAI,CAAC;YAAC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,SAAS,CAAC;QAAC,CAAC;IAC9D,CAAC,CAAC;IAEF,IAAI,MAAM,GAAY,QAAQ,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACzD,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC;YAAE,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpC,MAAM,SAAS,GAAG,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,UAAU,KAAK,CAAC,CAAC,IAAI,SAAS,GAAG,UAAU,EAAE,CAAC;YAChD,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IAED,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IACrF,MAAM,GAAG,GAAG,MAAiC,CAAC;IAE9C,MAAM,aAAa,GAAG,CAAC,eAAe,EAAE,gBAAgB,EAAE,WAAW,CAAC,CAAC;IACvE,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9F,IAAI,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,IAAI,GAAG,CAAC,UAAU,GAAG,CAAC,IAAI,GAAG,CAAC,UAAU,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACrG,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAExD,OAAO;QACL,OAAO,EAAE,GAAG,CAAC,OAAkC;QAC/C,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,SAAS,EAAE,GAAG,CAAC,SAAS;KACzB,CAAC;AACJ,CAAC;AAED,iDAAiD;AACjD,SAAS,gBAAgB,CAAC,KAAoB,EAAE,iBAAqC;IACnF,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,kMAAkM,CAAC,CAAC;IAC/M,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACtC,KAAK,CAAC,IAAI,CAAC,8HAA8H,CAAC,CAAC;IAC3I,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,aAAa,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;IAE3C,IAAI,iBAAiB,EAAE,CAAC;QACtB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;QAC7C,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IAClC,KAAK,CAAC,IAAI,CAAC,SAAS,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAClC,KAAK,CAAC,IAAI,CAAC,UAAU,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACzD,KAAK,CAAC,IAAI,CAAC,gBAAgB,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;IAEhD,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACtB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAChC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpB,CAAC;IAED,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YAClC,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;IACrE,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,MAAuB,EACvB,UAAyF,EACzF,cAAsB,EACtB,OAAqB,EACrB,WAA4B;IAE5B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IAEvC,MAAM,oBAAoB,GAAG,OAAO,CAAC,WAAW,IAAI,yBAAyB,CAAC;IAC9E,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC;IAEjC,wBAAwB;IACxB,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,UAAU,CAAC,CAAC;IAExC,WAAW,CAAC,GAAG,EAAE,WAAW,MAAM,CAAC,MAAM,mBAAmB,UAAU,kBAAkB,oBAAoB,GAAG,CAAC,CAAC;IACjH,MAAM,UAAU,GAAG,WAAW,EAAE,CAAC;IAEjC,MAAM,WAAW,GAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAEpD,MAAM,kBAAkB,CACtB,MAAM,EACN,oBAAoB,EACpB,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACpB,MAAM,UAAU,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAEjD,mDAAmD;QACnD,IAAI,UAAU,EAAE,KAAK,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;YACtC,QAAQ,CAAC,GAAG,EAAE,8BAA8B,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;YAC7E,OAAO;QACT,CAAC;QAED,MAAM,iBAAiB,GAAG,UAAU,EAAE,YAAY,CAAC;QACnD,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;QAE1D,IAAI,CAAC;YACH,eAAe,CAAC,WAAW,CAAC,CAAC;QAC/B,CAAC;QAAC,OAAO,SAAS,EAAE,CAAC;YACnB,IAAI,SAAS,YAAY,mBAAmB,EAAE,CAAC;gBAC7C,WAAW,CAAC,OAAO,GAAG,IAAI,CAAC;gBAC3B,WAAW,CAAC,MAAM,GAAG,SAAS,CAAC;gBAC/B,MAAM,SAAS,CAAC;YAClB,CAAC;YACD,MAAM,SAAS,CAAC;QAClB,CAAC;QAED,QAAQ,CAAC,GAAG,EAAE,kBAAkB,KAAK,CAAC,OAAO,MAAM,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;QAEpF,IAAI,CAAC;YACH,sEAAsE;YACtE,wEAAwE;YACxE,qEAAqE;YACrE,eAAe;YACf,MAAM,SAAS,GAAG,KAAK,IAA4B,EAAE;gBACnD,IAAI,aAAyC,CAAC;gBAC9C,OAAO,OAAO,CAAC,IAAI,CAAC;oBAClB,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,MAAM,EAAE,cAAc,EAAE,UAAU,KAAK,CAAC,OAAO,GAAG,CAAC;oBACjF,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;wBAC/B,aAAa,GAAG,UAAU,CACxB,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,iBAAiB,CAAC,wBAAwB,GAAG,IAAI,CAAC,CAAC,EACpE,wBAAwB,CACzB,CAAC;oBACJ,CAAC,CAAC;iBACH,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;oBACd,IAAI,aAAa;wBAAE,YAAY,CAAC,aAAa,CAAC,CAAC;gBACjD,CAAC,CAAC,CAAC;YACL,CAAC,CAAC;YAEF,uEAAuE;YACvE,uEAAuE;YACvE,oEAAoE;YACpE,iEAAiE;YACjE,MAAM,aAAa,GAAG,MAAM,SAAS,CAAC,SAAS,EAAE;gBAC/C,GAAG,aAAa;gBAChB,GAAG,OAAO,CAAC,KAAK;gBAChB,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,KAAK,EAAE,SAAS,KAAK,CAAC,OAAO,EAAE;gBAC/B,8DAA8D;gBAC9D,gDAAgD;gBAChD,WAAW,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,OAAO,IAAI,kBAAkB,CAAC,GAAG,CAAC;aACtE,CAAC,CAAC;YAEH,WAAW,CAAC,WAAW,EAAE,aAAa,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;YAE/D,MAAM,MAAM,GAAG,kBAAkB,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;YACrD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,QAAQ,CAAC,GAAG,EAAE,yCAAyC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;gBACzG,KAAK,CAAC,KAAK,GAAG;oBACZ,OAAO,EAAE,WAAW;oBACpB,UAAU,EAAE,CAAC;oBACb,SAAS,EAAE,kCAAkC;oBAC7C,KAAK,EAAE,UAAU;oBACjB,QAAQ,EAAE,OAAO,CAAC,YAAY;oBAC9B,UAAU,EAAE,aAAa,CAAC,UAAU;iBACrC,CAAC;gBACF,OAAO;YACT,CAAC;YAED,0EAA0E;YAC1E,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;YACpC,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC;YAC9B,IACE,OAAO,KAAK,eAAe;gBAC3B,OAAO,CAAC,aAAa,KAAK,SAAS;gBACnC,UAAU,GAAG,OAAO,CAAC,aAAa,EAClC,CAAC;gBACD,QAAQ,CAAC,GAAG,EAAE,mDAAmD,UAAU,oBAAoB,OAAO,CAAC,aAAa,GAAG,CAAC,CAAC;gBACzH,OAAO,GAAG,WAAW,CAAC;gBACtB,SAAS,GAAG,GAAG,SAAS,yBAAyB,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,oBAAoB,OAAO,CAAC,aAAa,GAAG,CAAC;YACrH,CAAC;YAED,KAAK,CAAC,KAAK,GAAG;gBACZ,OAAO;gBACP,UAAU;gBACV,SAAS;gBACT,KAAK,EAAE,UAAU;gBACjB,QAAQ,EAAE,OAAO,CAAC,YAAY;gBAC9B,UAAU,EAAE,aAAa,CAAC,UAAU;aACrC,CAAC;YACF,QAAQ,CAAC,GAAG,EAAE,kBAAkB,OAAO,iBAAiB,UAAU,SAAS,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;QAC/H,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,mBAAmB;gBAAE,MAAM,GAAG,CAAC;YAClD,MAAM,QAAQ,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAClE,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;gBACrC,OAAO,CAAC,GAAG,EAAE,uBAAuB,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,SAAS,+CAA+C,CAAC,CAAC;YACrI,CAAC;YACD,QAAQ,CAAC,GAAG,EAAE,mBAAmB,KAAK,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC,CAAC;YAC/D,KAAK,CAAC,KAAK,GAAG;gBACZ,OAAO,EAAE,WAAW;gBACpB,UAAU,EAAE,CAAC;gBACb,SAAS,EAAE,iBAAiB,QAAQ,EAAE;gBACtC,KAAK,EAAE,UAAU;gBACjB,QAAQ,EAAE,OAAO,CAAC,YAAY;aAC/B,CAAC;QACJ,CAAC;IACH,CAAC,EACD,WAAW,CACZ,CAAC;IAEF,WAAW,CAAC,GAAG,EAAE,4BAA4B,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACxE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,iBAAiB,CAC/B,SAA0B,EAC1B,iBAA+D,EAC/D,OAAiD;IAOjD,gDAAgD;IAChD,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,cAAc,GAAG,CAAC,CAAC;IAEvB,wEAAwE;IACxE,IAAI,cAAc,GAAG,SAAS,CAAC;IAC/B,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;QAC/B,cAAc,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;YAC1C,IAAI,CAAC,KAAK,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC,CAAC,mBAAmB;YAClD,IAAI,KAAK,CAAC,KAAK,CAAC,OAAO,KAAK,gBAAgB;gBAAE,OAAO,KAAK,CAAC,CAAC,UAAU;YACtE,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAED,8EAA8E;IAC9E,uEAAuE;IACvE,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;QAC9B,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAChB,WAAW,EAAE,CAAC;YACd,IAAI,KAAK,CAAC,KAAK,CAAC,OAAO,KAAK,gBAAgB;gBAAE,OAAO,EAAE,CAAC;YACxD,IAAI,KAAK,CAAC,KAAK,CAAC,OAAO,KAAK,WAAW;gBAAE,cAAc,EAAE,CAAC;QAC5D,CAAC;IACH,CAAC;IAED,4CAA4C;IAC5C,MAAM,aAAa,GAAG,IAAI,GAAG,EAA2B,CAAC;IACzD,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;QACnC,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAClD,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;aAAM,CAAC;YACN,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAED,+DAA+D;IAC/D,KAAK,MAAM,OAAO,IAAI,iBAAiB,EAAE,CAAC;QACxC,MAAM,WAAW,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAE7D,6EAA6E;QAC7E,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;YACxF,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC;YACxB,OAAO,CAAC,WAAW,GAAG,CAAC,CAAC;QAC1B,CAAC;aAAM,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/D,iEAAiE;YACjE,MAAM,YAAY,GAAG,WAAW,CAAC,KAAK,CACpC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,KAAK,WAAW,CAClD,CAAC;YACF,IAAI,YAAY,EAAE,CAAC;gBACjB,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC;gBACxB,OAAO,CAAC,WAAW,GAAG,WAAW,CAAC,MAAM,CAAC;gBACzC,qDAAqD;gBACrD,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;oBAChC,sDAAsD;oBACtD,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;wBACtB,KAAK,CAAC,UAAU,GAAG,OAAO,CAAC;oBAC7B,CAAC;gBACH,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,WAAW,GAAG,WAAW,CAAC,MAAM,CAAC;YAC3C,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,CAAC;AACrH,CAAC"}

package/dist/mock-agent-provider.d.ts

@@ -9,9 +9,12 @@ export declare class MockAgentProvider implements AgentProvider {
     private rawResponse;
     private model;
     private tokenUsage;
+    /** Remaining calls that should fail before the mock starts succeeding. */
+    private failuresRemaining;
     constructor(options: {
         rawResponse: string;
         tokenUsage?: TokenUsage;
+        failTimes?: number;
     });
     initialize(_config: ProviderConfig): Promise<void>;
     executeCheck(_instructions: string, _repositoryPath: string, _logPrefix?: string, _options?: {

package/dist/mock-agent-provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mock-agent-provider.d.ts","sourceRoot":"","sources":["../src/mock-agent-provider.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE3F,qBAAa,iBAAkB,YAAW,aAAa;IACrD,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,KAAK,CAAkB;IAC/B,OAAO,CAAC,UAAU,CAAyB;gBAE/B,OAAO,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,UAAU,CAAA;KAAE;IAK/D,UAAU,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAIlD,YAAY,CAChB,aAAa,EAAE,MAAM,EACrB,eAAe,EAAE,MAAM,EACvB,UAAU,CAAC,EAAE,MAAM,EACnB,QAAQ,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAC/B,OAAO,CAAC,aAAa,CAAC;IAWnB,cAAc,IAAI,OAAO,CAAC,OAAO,CAAC;IAIxC,YAAY,IAAI,MAAM;IAItB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;CAI9B"}
+{"version":3,"file":"mock-agent-provider.d.ts","sourceRoot":"","sources":["../src/mock-agent-provider.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE3F,qBAAa,iBAAkB,YAAW,aAAa;IACrD,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,KAAK,CAAkB;IAC/B,OAAO,CAAC,UAAU,CAAyB;IAC3C,0EAA0E;IAC1E,OAAO,CAAC,iBAAiB,CAAS;gBAEtB,OAAO,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,UAAU,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE;IAMnF,UAAU,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAIlD,YAAY,CAChB,aAAa,EAAE,MAAM,EACrB,eAAe,EAAE,MAAM,EACvB,UAAU,CAAC,EAAE,MAAM,EACnB,QAAQ,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAC/B,OAAO,CAAC,aAAa,CAAC;IAyBnB,cAAc,IAAI,OAAO,CAAC,OAAO,CAAC;IAIxC,YAAY,IAAI,MAAM;IAItB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;CAI9B"}

package/dist/mock-agent-provider.js

@@ -8,14 +8,27 @@ export class MockAgentProvider {
     rawResponse;
     model = 'mock';
     tokenUsage;
+    /** Remaining calls that should fail before the mock starts succeeding. */
+    failuresRemaining;
     constructor(options) {
         this.rawResponse = options.rawResponse;
         this.tokenUsage = options.tokenUsage;
+        this.failuresRemaining = options.failTimes ?? 0;
     }
     async initialize(_config) {
         // No-op
     }
     async executeCheck(_instructions, _repositoryPath, _logPrefix, _options) {
+        // Test hook: fail the first N calls with a retryable error, then succeed.
+        // Lets CLI-level tests prove that a transient provider failure is retried
+        // and the scan still completes, which cannot be observed from unit tests of
+        // withRetry alone. The error carries a 503 status so it is classified
+        // retryable by the real classifier rather than a test-only special case.
+        if (this.failuresRemaining > 0) {
+            this.failuresRemaining--;
+            const err = Object.assign(new Error('Mock transient provider failure (AGHAST_MOCK_FAIL_TIMES)'), { status: 503 });
+            throw err;
+        }
         const response = {
             raw: this.rawResponse,
             parsed: undefined,

package/dist/mock-agent-provider.js.map

@@ -1 +1 @@
-{"version":3,"file":"mock-agent-provider.js","sourceRoot":"","sources":["../src/mock-agent-provider.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,MAAM,OAAO,iBAAiB;IACpB,WAAW,CAAS;IACpB,KAAK,GAAW,MAAM,CAAC;IACvB,UAAU,CAAyB;IAE3C,YAAY,OAAyD;QACnE,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,OAAuB;QACtC,QAAQ;IACV,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,aAAqB,EACrB,eAAuB,EACvB,UAAmB,EACnB,QAAgC;QAEhC,MAAM,QAAQ,GAAkB;YAC9B,GAAG,EAAE,IAAI,CAAC,WAAW;YACrB,MAAM,EAAE,SAAS;SAClB,CAAC;QACF,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,QAAQ,CAAC,UAAU,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QAC/C,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,YAAY;QACV,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED,QAAQ,CAAC,KAAa;QACpB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;CAEF"}
+{"version":3,"file":"mock-agent-provider.js","sourceRoot":"","sources":["../src/mock-agent-provider.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,MAAM,OAAO,iBAAiB;IACpB,WAAW,CAAS;IACpB,KAAK,GAAW,MAAM,CAAC;IACvB,UAAU,CAAyB;IAC3C,0EAA0E;IAClE,iBAAiB,CAAS;IAElC,YAAY,OAA6E;QACvF,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,SAAS,IAAI,CAAC,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,OAAuB;QACtC,QAAQ;IACV,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,aAAqB,EACrB,eAAuB,EACvB,UAAmB,EACnB,QAAgC;QAEhC,0EAA0E;QAC1E,0EAA0E;QAC1E,4EAA4E;QAC5E,sEAAsE;QACtE,yEAAyE;QACzE,IAAI,IAAI,CAAC,iBAAiB,GAAG,CAAC,EAAE,CAAC;YAC/B,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CACvB,IAAI,KAAK,CAAC,0DAA0D,CAAC,EACrE,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;YACF,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,MAAM,QAAQ,GAAkB;YAC9B,GAAG,EAAE,IAAI,CAAC,WAAW;YACrB,MAAM,EAAE,SAAS;SAClB,CAAC;QACF,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,QAAQ,CAAC,UAAU,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QAC/C,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,YAAY;QACV,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED,QAAQ,CAAC,KAAa;QACpB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;CAEF"}

package/dist/new-check.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"new-check.d.ts","sourceRoot":"","sources":["../src/new-check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AA4gBH,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsG/D"}
+{"version":3,"file":"new-check.d.ts","sourceRoot":"","sources":["../src/new-check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AA80BH,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAyH/D"}