@praneeth_54/agentdoctor 0.1.0-beta

package/dist/core/mcp/parse.js

@@ -0,0 +1,303 @@
+import path from "node:path";
+import { inspectRepoFile, pathExistsInsideRoot, tryParseJson } from "../../agents/inspect.js";
+import { isPathInsideRoot } from "../../utils/path.js";
+const FILESYSTEM_SERVER_HINTS = [
+    "server-filesystem",
+    "@modelcontextprotocol/server-filesystem",
+    "mcp-server-filesystem",
+];
+function isFilesystemServer(command, args) {
+    const haystack = [command ?? "", ...(args ?? [])].join(" ").toLowerCase();
+    return FILESYSTEM_SERVER_HINTS.some((hint) => haystack.includes(hint));
+}
+function extractFilesystemScopes(args) {
+    if (!args) {
+        return [];
+    }
+    const scopes = [];
+    for (const arg of args) {
+        if (arg.startsWith("-") ||
+            arg.startsWith("@") ||
+            arg.includes("://") ||
+            arg === "npx" ||
+            arg === "-y") {
+            continue;
+        }
+        // Path-like arguments
+        if (arg.startsWith("/") ||
+            arg.startsWith("~") ||
+            arg.startsWith("$") ||
+            arg.includes("/") ||
+            arg.includes("\\") ||
+            arg === "." ||
+            arg === "..") {
+            scopes.push(arg);
+        }
+    }
+    return scopes;
+}
+function envKeysOnly(env) {
+    if (!env || typeof env !== "object" || Array.isArray(env)) {
+        return undefined;
+    }
+    return Object.keys(env).sort();
+}
+function detectTransport(entry) {
+    const type = typeof entry.type === "string" ? entry.type.toLowerCase() : "";
+    if (type === "http" || type === "streamable-http") {
+        return "http";
+    }
+    if (type === "sse") {
+        return "sse";
+    }
+    if (type === "stdio" || entry.command) {
+        return "stdio";
+    }
+    if (entry.url) {
+        return "http";
+    }
+    return "unknown";
+}
+function parseMcpServersObject(data, sourceAgent, sourcePath) {
+    if (!data || typeof data !== "object" || Array.isArray(data)) {
+        return { servers: [], error: "Root value is not an object" };
+    }
+    const root = data;
+    const serversRaw = root.mcpServers;
+    if (serversRaw === undefined) {
+        return { servers: [] };
+    }
+    if (!serversRaw || typeof serversRaw !== "object" || Array.isArray(serversRaw)) {
+        return { servers: [], error: "mcpServers must be an object" };
+    }
+    const servers = [];
+    for (const [name, value] of Object.entries(serversRaw)) {
+        if (!value || typeof value !== "object" || Array.isArray(value)) {
+            servers.push({
+                name,
+                sourceAgent,
+                sourcePath,
+                transport: "unknown",
+                parseError: "Server entry is not an object",
+            });
+            continue;
+        }
+        const entry = value;
+        const command = typeof entry.command === "string" ? entry.command : undefined;
+        const args = Array.isArray(entry.args)
+            ? entry.args.filter((a) => typeof a === "string")
+            : undefined;
+        const url = typeof entry.url === "string" ? entry.url : undefined;
+        const envKeys = envKeysOnly(entry.env);
+        const filesystemScopes = isFilesystemServer(command, args)
+            ? extractFilesystemScopes(args)
+            : extractFilesystemScopes(args).filter((s) => s.startsWith("/") || s.startsWith("~"));
+        const server = {
+            name,
+            sourceAgent,
+            sourcePath,
+            transport: detectTransport(entry),
+        };
+        if (command !== undefined)
+            server.command = command;
+        if (args !== undefined)
+            server.args = args;
+        if (url !== undefined)
+            server.url = url;
+        if (envKeys !== undefined)
+            server.envKeys = envKeys;
+        if (filesystemScopes.length > 0)
+            server.filesystemScopes = filesystemScopes;
+        servers.push(server);
+    }
+    return { servers };
+}
+/**
+ * Minimal TOML extractor for Codex `[mcp_servers.<name>]` tables.
+ * Does not evaluate values beyond strings/arrays needed for command/args.
+ * Never captures env values — only env key names from `env = { KEY = ... }`.
+ */
+function parseCodexMcpToml(text, sourcePath) {
+    const servers = [];
+    const lines = text.split(/\r?\n/);
+    let current = null;
+    const flush = () => {
+        if (!current?.name) {
+            current = null;
+            return;
+        }
+        const server = {
+            name: current.name,
+            sourceAgent: "codex",
+            sourcePath,
+            transport: current.command ? "stdio" : current.url ? "http" : "unknown",
+        };
+        if (current.command)
+            server.command = current.command;
+        if (current.args)
+            server.args = current.args;
+        if (current.url)
+            server.url = current.url;
+        if (current.envKeys)
+            server.envKeys = current.envKeys;
+        if (current.filesystemScopes)
+            server.filesystemScopes = current.filesystemScopes;
+        servers.push(server);
+        current = null;
+    };
+    for (const rawLine of lines) {
+        const line = rawLine.trim();
+        if (!line || line.startsWith("#")) {
+            continue;
+        }
+        const header = line.match(/^\[mcp_servers\.([^\]]+)\]$/i);
+        if (header) {
+            flush();
+            const name = header[1];
+            current = name ? { name } : null;
+            continue;
+        }
+        if (!current) {
+            continue;
+        }
+        const commandMatch = line.match(/^command\s*=\s*"([^"]*)"/i);
+        if (commandMatch?.[1] !== undefined) {
+            current.command = commandMatch[1];
+            continue;
+        }
+        const urlMatch = line.match(/^url\s*=\s*"([^"]*)"/i);
+        if (urlMatch?.[1] !== undefined) {
+            current.url = urlMatch[1];
+            continue;
+        }
+        const argsMatch = line.match(/^args\s*=\s*\[(.*)\]/i);
+        if (argsMatch?.[1] !== undefined) {
+            const args = [...argsMatch[1].matchAll(/"([^"]*)"/g)].map((m) => m[1] ?? "");
+            current.args = args;
+            if (isFilesystemServer(current.command, args)) {
+                current.filesystemScopes = extractFilesystemScopes(args);
+            }
+            continue;
+        }
+        const envMatch = line.match(/^env\s*=\s*\{([^}]*)\}/i);
+        if (envMatch?.[1] !== undefined) {
+            const keys = [...envMatch[1].matchAll(/([A-Za-z_][A-Za-z0-9_]*)\s*=/g)].map((m) => m[1] ?? "");
+            current.envKeys = [...new Set(keys)].sort();
+        }
+    }
+    flush();
+    return { servers };
+}
+export async function parseProjectMcpConfigs(root, maxFileSizeBytes) {
+    const servers = [];
+    const diagnostics = [];
+    const jsonTargets = [
+        { relative: ".cursor/mcp.json", agent: "cursor" },
+        { relative: ".mcp.json", agent: "claude-code" },
+    ];
+    for (const target of jsonTargets) {
+        if (!(await pathExistsInsideRoot(root, target.relative))) {
+            continue;
+        }
+        const inspected = await inspectRepoFile(root, target.relative, maxFileSizeBytes);
+        if (!inspected.readable || inspected.text === null) {
+            diagnostics.push({
+                severity: "warning",
+                message: `MCP config could not be read: ${inspected.error ?? "unknown error"}`,
+                file: target.relative,
+            });
+            servers.push({
+                name: "(unreadable)",
+                sourceAgent: target.agent,
+                sourcePath: target.relative,
+                transport: "unknown",
+                parseError: inspected.error ?? "unreadable",
+            });
+            continue;
+        }
+        if (inspected.empty) {
+            diagnostics.push({
+                severity: "info",
+                message: `MCP config is empty`,
+                file: target.relative,
+            });
+            continue;
+        }
+        const parsedJson = tryParseJson(inspected.text);
+        if (!parsedJson.ok) {
+            diagnostics.push({
+                severity: "warning",
+                message: `MCP config could not be parsed: ${parsedJson.error}`,
+                file: target.relative,
+            });
+            servers.push({
+                name: "(malformed)",
+                sourceAgent: target.agent,
+                sourcePath: target.relative,
+                transport: "unknown",
+                parseError: parsedJson.error,
+            });
+            continue;
+        }
+        const parsed = parseMcpServersObject(parsedJson.data, target.agent, target.relative);
+        if (parsed.error) {
+            diagnostics.push({
+                severity: "warning",
+                message: parsed.error,
+                file: target.relative,
+            });
+        }
+        servers.push(...parsed.servers);
+    }
+    const codexConfig = ".codex/config.toml";
+    if (await pathExistsInsideRoot(root, codexConfig)) {
+        const inspected = await inspectRepoFile(root, codexConfig, maxFileSizeBytes);
+        if (inspected.readable && inspected.text) {
+            const parsed = parseCodexMcpToml(inspected.text, codexConfig);
+            servers.push(...parsed.servers);
+        }
+        else if (inspected.exists && inspected.error) {
+            diagnostics.push({
+                severity: "warning",
+                message: `Codex MCP config could not be read: ${inspected.error}`,
+                file: codexConfig,
+            });
+        }
+    }
+    return { servers, diagnostics };
+}
+/**
+ * Classify whether a filesystem scope string is overly broad relative to the repo.
+ * Does not follow or read the path.
+ */
+export function classifyFilesystemScope(scope, root) {
+    const trimmed = scope.trim();
+    if (!trimmed) {
+        return "unknown";
+    }
+    if (trimmed === "/" || trimmed === "~" || trimmed === "$HOME" || trimmed === "${HOME}") {
+        return "broad";
+    }
+    if (trimmed.startsWith("~/") || trimmed.startsWith("$HOME/") || trimmed.startsWith("${HOME}/")) {
+        return "broad";
+    }
+    if (trimmed === ".." || trimmed.startsWith("../")) {
+        return "outside";
+    }
+    if (path.isAbsolute(trimmed)) {
+        try {
+            if (!isPathInsideRoot(root, trimmed)) {
+                return "outside";
+            }
+            return "ok";
+        }
+        catch {
+            return "unknown";
+        }
+    }
+    // Relative paths are treated as repo-relative → ok
+    if (trimmed === "." || !trimmed.startsWith("..")) {
+        return "ok";
+    }
+    return "unknown";
+}

package/dist/core/mcp/types.d.ts

@@ -0,0 +1,33 @@
+import type { AgentId } from "../../types/index.js";
+/**
+ * Parsed MCP server configuration from repository-scoped files only.
+ * Never stores environment variable values — keys only.
+ *
+ * Official project-level sources verified:
+ * - Cursor: `.cursor/mcp.json` (`mcpServers`) — cursor.com MCP docs / community + Cursor MCP UI
+ * - Claude Code: `.mcp.json` (`mcpServers`) — https://code.claude.com/docs/en/mcp
+ * - Codex: `.codex/config.toml` `[mcp_servers.*]` — https://developers.openai.com/codex/mcp
+ */
+export type McpTransport = "stdio" | "http" | "sse" | "unknown";
+export interface McpServerConfig {
+    name: string;
+    sourceAgent: AgentId;
+    sourcePath: string;
+    transport: McpTransport;
+    command?: string;
+    args?: string[];
+    url?: string;
+    /** Environment variable NAMES only — never values. */
+    envKeys?: string[];
+    /** Path-like arguments that may indicate filesystem scope. */
+    filesystemScopes?: string[];
+    parseError?: string;
+}
+export interface McpParseResult {
+    servers: McpServerConfig[];
+    diagnostics: Array<{
+        severity: "warning" | "error" | "info";
+        message: string;
+        file?: string;
+    }>;
+}

package/dist/core/mcp/types.js

@@ -0,0 +1 @@
+export {};

package/dist/core/rules/build-context.d.ts

@@ -0,0 +1,10 @@
+import type { AgentDetectionResult } from "../../agents/types.js";
+import type { DiscoveryResult, RepositoryInfo } from "../../types/index.js";
+import type { RuleContext } from "./types.js";
+export declare function buildRuleContext(options: {
+    root: string;
+    repository: RepositoryInfo;
+    discovery: DiscoveryResult;
+    agents: AgentDetectionResult[];
+    maxFileSizeBytes: number;
+}): Promise<RuleContext>;

package/dist/core/rules/build-context.js

@@ -0,0 +1,31 @@
+import { parseProjectMcpConfigs } from "../mcp/parse.js";
+import { createIgnoreIndex, parseIgnoreFile } from "./ignore.js";
+import { TextCache } from "./text-cache.js";
+export async function buildRuleContext(options) {
+    const textCache = new TextCache(options.root, options.maxFileSizeBytes);
+    const gitignore = await textCache.read(".gitignore");
+    const cursorignore = await textCache.read(".cursorignore");
+    const ignore = createIgnoreIndex({
+        gitignorePatterns: gitignore.text ? parseIgnoreFile(gitignore.text) : [],
+        cursorignorePatterns: cursorignore.text ? parseIgnoreFile(cursorignore.text) : [],
+    });
+    const mcp = await parseProjectMcpConfigs(options.root, options.maxFileSizeBytes);
+    const instructionPaths = new Set();
+    for (const agent of options.agents) {
+        for (const file of agent.configFiles) {
+            instructionPaths.add(file.relativePath);
+        }
+    }
+    const instructionFiles = options.discovery.files.filter((f) => instructionPaths.has(f.relativePath));
+    return {
+        root: options.root,
+        repository: options.repository,
+        discovery: options.discovery,
+        agents: options.agents,
+        ignore,
+        mcpServers: mcp.servers,
+        textCache,
+        maxFileSizeBytes: options.maxFileSizeBytes,
+        instructionFiles,
+    };
+}

package/dist/core/rules/context/generated-directory.d.ts

@@ -0,0 +1,2 @@
+import type { RuleDefinition } from "../types.js";
+export declare const generatedDirectoryRule: RuleDefinition;

package/dist/core/rules/context/generated-directory.js

@@ -0,0 +1,89 @@
+/** Directories commonly generated/build-related. vendor/ is ecosystem-aware. */
+const GENERATED = [
+    { name: "dist", label: "build output" },
+    { name: "build", label: "build output" },
+    { name: "coverage", label: "test coverage" },
+    { name: ".next", label: "Next.js build cache" },
+    { name: ".nuxt", label: "Nuxt build cache" },
+    { name: ".svelte-kit", label: "SvelteKit build output" },
+    { name: ".dart_tool", label: "Dart tooling cache" },
+    { name: "target", label: "Rust/Java build output" },
+];
+export const generatedDirectoryRule = {
+    id: "context/generated-directory",
+    title: "Generated directory may enter agent context",
+    description: "Notes common generated directories present in the tree when agent exclusion is unclear.",
+    category: "context",
+    severity: "info",
+    fixability: "safe",
+    rationale: "Generated artifacts are usually low-value context and can be large.",
+    recommendation: "Ensure generated directories are listed in .gitignore and agent ignore configuration where applicable.",
+    async check(context) {
+        const findings = [];
+        const skipped = new Set(context.discovery.directoriesSkipped.map((d) => d.split("/")[0] ?? d));
+        // directoriesSkipped stores relative paths like "dist" or "packages/app/dist"
+        const present = new Set();
+        for (const dir of context.discovery.directoriesSkipped) {
+            const top = dir.split("/")[0] ?? dir;
+            present.add(top);
+            present.add(dir);
+        }
+        void skipped;
+        const affected = context.agents.filter((a) => a.configured || a.detected).map((a) => a.id);
+        if (affected.length === 0) {
+            return [];
+        }
+        for (const entry of GENERATED) {
+            const found = present.has(entry.name) ||
+                [...present].some((p) => p === entry.name || p.endsWith(`/${entry.name}`));
+            if (!found) {
+                continue;
+            }
+            // If .gitignore or .cursorignore already exclude it, skip (already appropriately excluded)
+            const samplePath = `${entry.name}/`;
+            const excluded = context.ignore.matchesGitignore(samplePath) ||
+                context.ignore.matchesGitignore(entry.name) ||
+                context.ignore.matchesCursorignore(samplePath) ||
+                context.ignore.matchesCursorignore(entry.name);
+            if (excluded) {
+                continue;
+            }
+            // Discovery already skips these dirs by default — absence from ignore files is still useful info
+            // when agents are configured. Keep severity info.
+            findings.push({
+                ruleId: "context/generated-directory",
+                category: "context",
+                severity: "info",
+                title: "Generated directory may enter agent context",
+                message: `${entry.name}/ (${entry.label}) is present and no project ignore pattern was detected`,
+                whyItMatters: "Generated directories are usually low-value for coding agents and can bloat indexing/context when not excluded.",
+                recommendation: `Add ${entry.name}/ to .gitignore and, for Cursor, .cursorignore if you need agent-specific exclusion beyond gitignore.`,
+                affectedAgents: affected,
+                evidence: { path: entry.name },
+                fixability: "safe",
+            });
+        }
+        // vendor/ — only flag for non-PHP/Composer ecosystems
+        if ((present.has("vendor") ||
+            [...present].some((p) => p === "vendor" || p.endsWith("/vendor"))) &&
+            context.repository.primaryPackageManager !== "composer" &&
+            context.repository.primaryLanguage !== "php") {
+            const excluded = context.ignore.matchesGitignore("vendor/") || context.ignore.matchesCursorignore("vendor/");
+            if (!excluded) {
+                findings.push({
+                    ruleId: "context/generated-directory",
+                    category: "context",
+                    severity: "info",
+                    title: "Generated directory may enter agent context",
+                    message: "vendor/ is present outside a PHP/Composer project and no ignore pattern was detected",
+                    whyItMatters: "In non-PHP projects, vendor/ is often third-party or generated content that adds noise to agent context.",
+                    recommendation: "Confirm whether vendor/ should be ignored for git and AI tooling.",
+                    affectedAgents: affected,
+                    evidence: { path: "vendor" },
+                    fixability: "safe",
+                });
+            }
+        }
+        return findings;
+    },
+};

package/dist/core/rules/context/large-instruction-file.d.ts

@@ -0,0 +1,2 @@
+import type { RuleDefinition } from "../types.js";
+export declare const largeInstructionFileRule: RuleDefinition;

package/dist/core/rules/context/large-instruction-file.js

@@ -0,0 +1,56 @@
+import { THRESHOLDS } from "../thresholds.js";
+const INSTRUCTION_KINDS = new Set([
+    "cursor-rule-mdc",
+    "cursor-legacy-cursorrules",
+    "agents-md",
+    "agents-override-md",
+    "claude-md",
+    "claude-local-md",
+    "claude-rule-md",
+]);
+export const largeInstructionFileRule = {
+    id: "context/large-instruction-file",
+    title: "Large instruction file",
+    description: "Flags unusually large AI instruction files that may inflate repeated context.",
+    category: "context",
+    severity: "warning",
+    fixability: "review",
+    rationale: "Large instruction files consume context on every session and can bury the most important guidance.",
+    recommendation: "Split into focused rule files, move rare procedures to docs/skills, and keep always-on instructions concise.",
+    async check(context) {
+        const findings = [];
+        const seen = new Set();
+        for (const agent of context.agents) {
+            for (const file of agent.configFiles) {
+                if (!INSTRUCTION_KINDS.has(file.kind)) {
+                    continue;
+                }
+                if (seen.has(file.relativePath)) {
+                    continue;
+                }
+                seen.add(file.relativePath);
+                if (file.sizeBytes < THRESHOLDS.instructionInfoBytes) {
+                    continue;
+                }
+                const severity = file.sizeBytes >= THRESHOLDS.instructionWarningBytes ? "warning" : "info";
+                const kb = (file.sizeBytes / 1024).toFixed(0);
+                const affected = context.agents
+                    .filter((a) => a.configPaths.includes(file.relativePath))
+                    .map((a) => a.id);
+                findings.push({
+                    ruleId: "context/large-instruction-file",
+                    category: "context",
+                    severity,
+                    title: "Large instruction file",
+                    message: `${file.relativePath} is ${kb} KB`,
+                    whyItMatters: "Large instruction files may increase repeated context usage and make important instructions harder to prioritize. Exact token impact is not measured.",
+                    recommendation: "Keep always-loaded instructions lean; split specialized guidance into scoped rules or linked docs.",
+                    affectedAgents: affected.length > 0 ? affected : agent.id === "cursor" ? ["cursor"] : [agent.id],
+                    evidence: { path: file.relativePath, detail: `${file.sizeBytes} bytes` },
+                    fixability: "review",
+                });
+            }
+        }
+        return findings;
+    },
+};

package/dist/core/rules/context/large-log-file.d.ts

@@ -0,0 +1,2 @@
+import type { RuleDefinition } from "../types.js";
+export declare const largeLogFileRule: RuleDefinition;

package/dist/core/rules/context/large-log-file.js

@@ -0,0 +1,45 @@
+import { THRESHOLDS } from "../thresholds.js";
+const LOG_LIKE = /\.(log|out|dump)$/i;
+const HEAVY_NAME = /(^|\/)(debug|trace|coverage-final|chrome-devtools|heapdump)/i;
+export const largeLogFileRule = {
+    id: "context/large-log-file",
+    title: "Large log or dump file in repository",
+    description: "Detects large log/dump files that may unnecessarily enter agent context.",
+    category: "context",
+    severity: "info",
+    fixability: "safe",
+    rationale: "Large logs add noise and can push useful source code out of the context window.",
+    recommendation: "Delete or ignore large logs; add them to .gitignore and agent ignore files.",
+    async check(context) {
+        const findings = [];
+        const affected = context.agents.filter((a) => a.configured || a.detected).map((a) => a.id);
+        for (const file of context.discovery.files) {
+            const base = file.relativePath.split("/").pop() ?? file.relativePath;
+            const looksLog = LOG_LIKE.test(base) || HEAVY_NAME.test(file.relativePath);
+            if (!looksLog) {
+                continue;
+            }
+            if (file.sizeBytes < THRESHOLDS.largeLogBytes) {
+                continue;
+            }
+            // Skip if clearly ignored for Cursor and no other agents configured
+            if (context.ignore.matchesGitignore(file.relativePath) ||
+                context.ignore.matchesCursorignore(file.relativePath)) {
+                continue;
+            }
+            findings.push({
+                ruleId: "context/large-log-file",
+                category: "context",
+                severity: "info",
+                title: "Large log or dump file in repository",
+                message: `${file.relativePath} is ${(file.sizeBytes / 1024).toFixed(0)} KB`,
+                whyItMatters: "Large logs and dumps rarely help coding agents and can crowd out useful source context.",
+                recommendation: "Remove or ignore this file for both git and AI agent tooling.",
+                affectedAgents: affected.length > 0 ? affected : ["cursor", "claude-code", "codex"],
+                evidence: { path: file.relativePath, detail: `${file.sizeBytes} bytes` },
+                fixability: "safe",
+            });
+        }
+        return findings;
+    },
+};

package/dist/core/rules/dedupe.d.ts

@@ -0,0 +1,13 @@
+import type { Finding } from "../../types/index.js";
+import type { FindingDraft } from "./types.js";
+/**
+ * Merge findings that share the same rule + evidence path into one finding
+ * with unioned affected agents. Distinct problems are not merged.
+ */
+export declare function dedupeFindings(drafts: FindingDraft[]): Finding[];
+export declare function summarizeFindings(findings: Finding[]): {
+    critical: number;
+    warning: number;
+    info: number;
+    total: number;
+};

package/dist/core/rules/dedupe.js

@@ -0,0 +1,53 @@
+import { finalizeFinding } from "./types.js";
+/**
+ * Merge findings that share the same rule + evidence path into one finding
+ * with unioned affected agents. Distinct problems are not merged.
+ */
+export function dedupeFindings(drafts) {
+    const map = new Map();
+    for (const draft of drafts) {
+        const pathKey = (draft.evidence?.path ?? "repo").replace(/\\/g, "/");
+        const detailKey = (draft.evidence?.detail ?? "").replace(/\\/g, "/");
+        const key = `${draft.ruleId}::${pathKey}::${detailKey}::${draft.title}`;
+        const existing = map.get(key);
+        if (!existing) {
+            const next = {
+                ...draft,
+                affectedAgents: [...draft.affectedAgents],
+            };
+            if (draft.evidence) {
+                next.evidence = { ...draft.evidence };
+            }
+            map.set(key, next);
+            continue;
+        }
+        existing.affectedAgents = [
+            ...new Set([...existing.affectedAgents, ...draft.affectedAgents]),
+        ].sort();
+        // Prefer higher severity if somehow duplicated with different severities
+        const rank = { critical: 3, warning: 2, info: 1 };
+        if (rank[draft.severity] > rank[existing.severity]) {
+            existing.severity = draft.severity;
+            existing.message = draft.message;
+            existing.whyItMatters = draft.whyItMatters;
+            if (draft.recommendation !== undefined) {
+                existing.recommendation = draft.recommendation;
+            }
+        }
+    }
+    return [...map.values()].map(finalizeFinding).sort((a, b) => {
+        const severityRank = { critical: 0, warning: 1, info: 2 };
+        const sev = severityRank[a.severity] - severityRank[b.severity];
+        if (sev !== 0)
+            return sev;
+        return a.id.localeCompare(b.id);
+    });
+}
+export function summarizeFindings(findings) {
+    return {
+        critical: findings.filter((f) => f.severity === "critical").length,
+        warning: findings.filter((f) => f.severity === "warning").length,
+        info: findings.filter((f) => f.severity === "info").length,
+        total: findings.length,
+    };
+}