npm - @praneeth_54/agentdoctor - Versions diffs - 1.1.1 → 2.0.1 - Mend

@praneeth_54/agentdoctor 1.1.1 → 2.0.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (224) hide show

package/CHANGELOG.md +164 -7
package/README.md +263 -513
package/dist/agents/aider/adapter.d.ts +1 -0
package/dist/agents/aider/adapter.js +1 -0
package/dist/agents/aider/detector.d.ts +14 -0
package/dist/agents/aider/detector.js +120 -0
package/dist/agents/copilot/adapter.d.ts +1 -0
package/dist/agents/copilot/adapter.js +1 -0
package/dist/agents/copilot/detector.d.ts +13 -0
package/dist/agents/copilot/detector.js +113 -0
package/dist/agents/gemini/adapter.d.ts +1 -0
package/dist/agents/gemini/adapter.js +1 -0
package/dist/agents/gemini/detector.d.ts +13 -0
package/dist/agents/gemini/detector.js +151 -0
package/dist/agents/registry.js +13 -1
package/dist/agents/types.d.ts +1 -1
package/dist/agents/windsurf/adapter.d.ts +1 -0
package/dist/agents/windsurf/adapter.js +1 -0
package/dist/agents/windsurf/detector.d.ts +14 -0
package/dist/agents/windsurf/detector.js +119 -0
package/dist/architecture/c4.d.ts +22 -0
package/dist/architecture/c4.js +62 -0
package/dist/architecture/contract.d.ts +64 -0
package/dist/architecture/contract.js +373 -0
package/dist/assurance/change.d.ts +211 -0
package/dist/assurance/change.js +624 -0
package/dist/assurance/proof.d.ts +136 -0
package/dist/assurance/proof.js +338 -0
package/dist/auth/index.d.ts +81 -0
package/dist/auth/index.js +130 -0
package/dist/auth/rbac.d.ts +9 -0
package/dist/auth/rbac.js +26 -0
package/dist/cli/commands/architecture.d.ts +6 -0
package/dist/cli/commands/architecture.js +109 -0
package/dist/cli/commands/assurance.d.ts +67 -0
package/dist/cli/commands/assurance.js +210 -0
package/dist/cli/commands/brain.d.ts +12 -0
package/dist/cli/commands/brain.js +162 -0
package/dist/cli/commands/complete.d.ts +23 -0
package/dist/cli/commands/complete.js +232 -0
package/dist/cli/commands/explain.js +1 -1
package/dist/cli/commands/fix.js +22 -2
package/dist/cli/commands/mcp.d.ts +8 -0
package/dist/cli/commands/mcp.js +14 -0
package/dist/cli/commands/platform.d.ts +17 -0
package/dist/cli/commands/platform.js +195 -0
package/dist/cli/commands/policy-graph-run.d.ts +40 -0
package/dist/cli/commands/policy-graph-run.js +200 -0
package/dist/cli/commands/v2.d.ts +55 -0
package/dist/cli/commands/v2.js +278 -0
package/dist/cli/commands/workspace.d.ts +9 -0
package/dist/cli/commands/workspace.js +82 -0
package/dist/cli/program.js +1328 -3
package/dist/constants.d.ts +3 -2
package/dist/constants.js +5 -1
package/dist/contracts/adapters.d.ts +7 -0
package/dist/contracts/adapters.js +60 -0
package/dist/contracts/index.d.ts +162 -0
package/dist/contracts/index.js +18 -0
package/dist/core/baseline/store.d.ts +48 -0
package/dist/core/baseline/store.js +163 -0
package/dist/core/brain-cli/service.d.ts +26 -0
package/dist/core/brain-cli/service.js +175 -0
package/dist/core/brain-product/init.d.ts +45 -0
package/dist/core/brain-product/init.js +235 -0
package/dist/core/changes/analyze.d.ts +41 -0
package/dist/core/changes/analyze.js +223 -0
package/dist/core/context-health/analyze.d.ts +15 -0
package/dist/core/context-health/analyze.js +234 -0
package/dist/core/fix/apply.d.ts +21 -4
package/dist/core/fix/apply.js +118 -18
package/dist/core/fix/backup.d.ts +30 -0
package/dist/core/fix/backup.js +193 -0
package/dist/core/fix/plan.d.ts +6 -3
package/dist/core/fix/plan.js +113 -9
package/dist/core/fix/render.d.ts +2 -0
package/dist/core/fix/render.js +36 -21
package/dist/core/fix/run.js +5 -1
package/dist/core/fix/safe-target.d.ts +14 -0
package/dist/core/fix/safe-target.js +81 -0
package/dist/core/fix/types.d.ts +12 -1
package/dist/core/fix/types.js +2 -0
package/dist/core/fix/writers/claude-settings.js +3 -1
package/dist/core/fix/writers/codex-config.d.ts +3 -0
package/dist/core/fix/writers/codex-config.js +24 -3
package/dist/core/fix/writers/cursorignore.js +3 -1
package/dist/core/fix/writers/simple-ignore.d.ts +16 -0
package/dist/core/fix/writers/simple-ignore.js +68 -0
package/dist/core/monorepo/detect.d.ts +13 -0
package/dist/core/monorepo/detect.js +121 -0
package/dist/core/rules/build-context.js +22 -3
package/dist/core/rules/context/generated-directory.js +11 -1
package/dist/core/rules/context/large-instruction-file.js +6 -0
package/dist/core/rules/context/large-log-file.js +16 -1
package/dist/core/rules/ignore.d.ts +11 -1
package/dist/core/rules/ignore.js +22 -1
package/dist/core/rules/instructions/empty-instructions.js +7 -0
package/dist/core/rules/security/env-file-exposure.js +23 -2
package/dist/core/rules/security/private-key-file.js +1 -1
package/dist/core/scanner/scan.js +1 -1
package/dist/core/schemas/validate.d.ts +6 -0
package/dist/core/schemas/validate.js +62 -0
package/dist/core/scoring/compute-scores.d.ts +1 -1
package/dist/core/scoring/compute-scores.js +5 -1
package/dist/core/scoring/placeholder.d.ts +1 -1
package/dist/core/scoring/placeholder.js +5 -1
package/dist/core/secrets/scan.d.ts +29 -0
package/dist/core/secrets/scan.js +172 -0
package/dist/coverage/cobertura.d.ts +6 -0
package/dist/coverage/cobertura.js +52 -0
package/dist/coverage/istanbul.d.ts +7 -0
package/dist/coverage/istanbul.js +134 -0
package/dist/coverage/lcov.d.ts +7 -0
package/dist/coverage/lcov.js +59 -0
package/dist/coverage/load.d.ts +9 -0
package/dist/coverage/load.js +39 -0
package/dist/coverage/types.d.ts +23 -0
package/dist/coverage/types.js +5 -0
package/dist/dashboard/server.d.ts +24 -0
package/dist/dashboard/server.js +402 -0
package/dist/enforcement/runner.d.ts +67 -0
package/dist/enforcement/runner.js +460 -0
package/dist/index.d.ts +34 -0
package/dist/index.js +25 -0
package/dist/integrations/github/pr-analyze.d.ts +28 -0
package/dist/integrations/github/pr-analyze.js +98 -0
package/dist/integrations/local-ai/provider.d.ts +45 -0
package/dist/integrations/local-ai/provider.js +104 -0
package/dist/intelligence/git/analyze.d.ts +34 -0
package/dist/intelligence/git/analyze.js +136 -0
package/dist/intelligence/graph/build.d.ts +15 -0
package/dist/intelligence/graph/build.js +259 -0
package/dist/intelligence/graph/incremental.d.ts +68 -0
package/dist/intelligence/graph/incremental.js +234 -0
package/dist/intelligence/resolve/imports.d.ts +36 -0
package/dist/intelligence/resolve/imports.js +245 -0
package/dist/knowledge/store.d.ts +25 -0
package/dist/knowledge/store.js +91 -0
package/dist/languages/go.d.ts +9 -0
package/dist/languages/go.js +45 -0
package/dist/languages/index.d.ts +11 -0
package/dist/languages/index.js +76 -0
package/dist/languages/php.d.ts +7 -0
package/dist/languages/php.js +193 -0
package/dist/languages/python.d.ts +7 -0
package/dist/languages/python.js +150 -0
package/dist/languages/types.d.ts +42 -0
package/dist/languages/types.js +26 -0
package/dist/languages/typescript.d.ts +3 -0
package/dist/languages/typescript.js +95 -0
package/dist/mcp/agentdoctor/server.d.ts +16 -0
package/dist/mcp/agentdoctor/server.js +67 -0
package/dist/mcp/brain/session.js +7 -7
package/dist/mcp/intelligence/handlers.d.ts +16 -0
package/dist/mcp/intelligence/handlers.js +364 -0
package/dist/mcp/intelligence/path-safety.d.ts +9 -0
package/dist/mcp/intelligence/path-safety.js +63 -0
package/dist/mcp/intelligence/registry.d.ts +8 -0
package/dist/mcp/intelligence/registry.js +228 -0
package/dist/ops/health.d.ts +18 -0
package/dist/ops/health.js +51 -0
package/dist/platform/ai-quality/analyze.d.ts +9 -0
package/dist/platform/ai-quality/analyze.js +65 -0
package/dist/platform/architecture/drift.d.ts +17 -0
package/dist/platform/architecture/drift.js +74 -0
package/dist/platform/auth/local.d.ts +15 -0
package/dist/platform/auth/local.js +58 -0
package/dist/platform/context-security/analyze.d.ts +6 -0
package/dist/platform/context-security/analyze.js +97 -0
package/dist/platform/firewall/evaluate.d.ts +57 -0
package/dist/platform/firewall/evaluate.js +359 -0
package/dist/platform/graph/build.d.ts +6 -0
package/dist/platform/graph/build.js +189 -0
package/dist/platform/health/analyze.d.ts +7 -0
package/dist/platform/health/analyze.js +192 -0
package/dist/platform/index.d.ts +27 -0
package/dist/platform/index.js +89 -0
package/dist/platform/knowledge/analyze.d.ts +20 -0
package/dist/platform/knowledge/analyze.js +96 -0
package/dist/platform/provenance/build.d.ts +44 -0
package/dist/platform/provenance/build.js +65 -0
package/dist/platform/readiness/scorecard.d.ts +5 -0
package/dist/platform/readiness/scorecard.js +98 -0
package/dist/platform/refactor/impact.d.ts +20 -0
package/dist/platform/refactor/impact.js +60 -0
package/dist/platform/reports/export.d.ts +12 -0
package/dist/platform/reports/export.js +92 -0
package/dist/platform/security/redact.d.ts +15 -0
package/dist/platform/security/redact.js +87 -0
package/dist/platform/sessions/store.d.ts +32 -0
package/dist/platform/sessions/store.js +97 -0
package/dist/platform/store.d.ts +6 -0
package/dist/platform/store.js +57 -0
package/dist/platform/test-impact/analyze.d.ts +50 -0
package/dist/platform/test-impact/analyze.js +350 -0
package/dist/platform/time-machine/compare.d.ts +17 -0
package/dist/platform/time-machine/compare.js +62 -0
package/dist/platform/tokens/plan.d.ts +28 -0
package/dist/platform/tokens/plan.js +108 -0
package/dist/platform/types.d.ts +120 -0
package/dist/platform/types.js +5 -0
package/dist/plugins/runtime.d.ts +36 -0
package/dist/plugins/runtime.js +101 -0
package/dist/plugins/sdk.d.ts +29 -0
package/dist/plugins/sdk.js +114 -0
package/dist/policy/compose.d.ts +34 -0
package/dist/policy/compose.js +118 -0
package/dist/policy/packs.d.ts +9 -0
package/dist/policy/packs.js +91 -0
package/dist/reporters/terminal/report.js +38 -5
package/dist/security/paths.d.ts +21 -0
package/dist/security/paths.js +105 -0
package/dist/storage/postgres.d.ts +26 -0
package/dist/storage/postgres.js +90 -0
package/dist/storage/provider.d.ts +30 -0
package/dist/storage/provider.js +109 -0
package/dist/storage/sqlite.d.ts +33 -0
package/dist/storage/sqlite.js +77 -0
package/dist/team/auth.d.ts +35 -0
package/dist/team/auth.js +70 -0
package/dist/types/index.d.ts +5 -1
package/dist/workspace/index.d.ts +69 -0
package/dist/workspace/index.js +220 -0
package/package.json +15 -5

package/dist/dashboard/server.js ADDED Viewed

@@ -0,0 +1,402 @@
+import http from "node:http";
+import fs from "node:fs/promises";
+import path from "node:path";
+import { getBrainStatus } from "../core/brain-cli/service.js";
+import { listFixAudits } from "../core/fix/backup.js";
+import { listNamedBaselines } from "../core/baseline/store.js";
+import { detectMonorepo } from "../core/monorepo/detect.js";
+import { scan } from "../core/scanner/scan.js";
+import { resolveRepoRoot } from "../utils/path.js";
+import { agentRegistry } from "../agents/registry.js";
+import { listSessions } from "../platform/sessions/store.js";
+import { platformDir, readJsonIfExists } from "../platform/store.js";
+import { canAccess, loadLocalAuthConfig, resolveRole } from "../platform/auth/local.js";
+import { EVALUATE_ONLY } from "../platform/firewall/evaluate.js";
+import { redactSecrets, sanitizeFindingsForExport } from "../platform/security/redact.js";
+import { buildIntelligenceGraph } from "../intelligence/graph/build.js";
+import { analyzeGitIntelligence } from "../intelligence/git/analyze.js";
+import { buildC4Views } from "../architecture/c4.js";
+import { listKnowledge } from "../knowledge/store.js";
+import { CONTRACTS_VERSION } from "../contracts/index.js";
+import { collectOpsHealth } from "../ops/health.js";
+import { listPolicyPacks } from "../policy/packs.js";
+import { sanitizeForOutput } from "../utils/path.js";
+function safeJsonError(error) {
+    const raw = error instanceof Error ? error.message : String(error);
+    const { text } = redactSecrets(sanitizeForOutput(raw));
+    return text.slice(0, 240);
+}
+function pathnameLooksHostile(pathname) {
+    const lower = pathname.toLowerCase();
+    const decoded = (() => {
+        try {
+            return decodeURIComponent(pathname);
+        }
+        catch {
+            return pathname;
+        }
+    })();
+    return (pathname.includes("\0") ||
+        decoded.includes("\0") ||
+        pathname.includes("..") ||
+        decoded.includes("..") ||
+        lower.includes("%2e%2e") ||
+        lower.includes("%2e.") ||
+        lower.includes(".%2e") ||
+        pathname.includes("\\") ||
+        decoded.includes("\\"));
+}
+function redactGraphSamples(nodes) {
+    return nodes.map((n) => {
+        const next = { ...n };
+        if (typeof next.label === "string") {
+            next.label = redactSecrets(next.label).text;
+        }
+        if (typeof next.path === "string") {
+            next.path = redactSecrets(next.path).text;
+        }
+        return next;
+    });
+}
+export function isLoopbackHost(host) {
+    const normalized = host.trim().toLowerCase();
+    return (normalized === "127.0.0.1" ||
+        normalized === "::1" ||
+        normalized === "localhost" ||
+        normalized === "0:0:0:0:0:0:0:1");
+}
+function htmlPage() {
+    return `<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1" />
+  <title>AgentDoctor Dashboard</title>
+  <style>
+    :root { --bg:#0f1419; --fg:#e7ecf1; --muted:#9aa7b5; --accent:#3d9cfd; --card:#1a222c; }
+    * { box-sizing: border-box; }
+    body { margin:0; font-family: ui-sans-serif, system-ui, sans-serif; background:var(--bg); color:var(--fg); }
+    header { padding:1.25rem 1.5rem; border-bottom:1px solid #243040; }
+    h1 { margin:0; font-size:1.25rem; letter-spacing:0.02em; }
+    p { color:var(--muted); margin:0.35rem 0 0; }
+    main { padding:1.5rem; display:grid; gap:1rem; max-width:1100px; margin:0 auto; }
+    section { background:var(--card); border-radius:10px; padding:1rem 1.1rem; }
+    h2 { margin:0 0 0.75rem; font-size:1rem; }
+    pre { white-space:pre-wrap; word-break:break-word; font-size:0.85rem; color:#d5dde6; }
+    .muted { color:var(--muted); }
+    a { color:var(--accent); }
+    .notice { border-left:3px solid var(--accent); padding-left:0.75rem; margin-top:0.75rem; }
+  </style>
+</head>
+<body>
+  <header>
+    <h1>AgentDoctor 2.0</h1>
+    <p>Local read-only dashboard — Safety + Brain + intelligence. No cloud writes.</p>
+    <p class="notice muted">Action Policy Evaluator is evaluate-only. Query ?user= is a localDevIdentityHint only (not authentication). Team local-dev auth is separate and not SSO. OIDC JWT validation is a library path — full browser OAuth redirect is experimental.</p>
+  </header>
+  <main>
+    <nav aria-label="Views" style="display:flex;flex-wrap:wrap;gap:0.75rem;font-size:0.9rem">
+      <a href="#overview">Overview</a>
+      <a href="#scan">Safety scan</a>
+      <a href="#platform">Platform</a>
+      <a href="#brain">Brain</a>
+      <a href="#graph">Graph</a>
+      <a href="#knowledge">Knowledge</a>
+      <a href="#meta">Audit / baselines</a>
+    </nav>
+    <section id="overview">
+      <h2>Overview</h2>
+      <pre id="status" class="muted">Loading…</pre>
+    </section>
+    <section id="scan">
+      <h2>Safety scan</h2>
+      <pre id="scanBody" class="muted">Loading…</pre>
+    </section>
+    <section id="platform">
+      <h2>Platform snapshot (incl. test-impact)</h2>
+      <pre id="platformBody" class="muted">Loading…</pre>
+    </section>
+    <section id="brain">
+      <h2>Project Brain</h2>
+      <pre id="brainBody" class="muted">Loading…</pre>
+    </section>
+    <section id="graph">
+      <h2>Intelligence graph / git / C4</h2>
+      <pre id="graphBody" class="muted">Loading…</pre>
+    </section>
+    <section id="knowledge">
+      <h2>Governed knowledge</h2>
+      <pre id="knowledgeBody" class="muted">Loading…</pre>
+    </section>
+    <section id="meta">
+      <h2>Safe Fix audit / baselines / sessions</h2>
+      <pre id="metaBody" class="muted">Loading…</pre>
+    </section>
+  </main>
+  <script>
+    async function load() {
+      const [status, scan, brain, meta, platform, graph, knowledge] = await Promise.all([
+        fetch('/api/status').then(r => r.json()),
+        fetch('/api/scan').then(r => r.json()),
+        fetch('/api/brain').then(r => r.json()),
+        fetch('/api/meta').then(r => r.json()),
+        fetch('/api/platform').then(r => r.json()),
+        fetch('/api/v2/graph').then(r => r.json()),
+        fetch('/api/v2/knowledge').then(r => r.json()),
+      ]);
+      document.getElementById('status').textContent = JSON.stringify(status, null, 2);
+      document.getElementById('scanBody').textContent = JSON.stringify(scan, null, 2);
+      document.getElementById('brainBody').textContent = JSON.stringify(brain, null, 2);
+      document.getElementById('metaBody').textContent = JSON.stringify(meta, null, 2);
+      document.getElementById('platformBody').textContent = JSON.stringify(platform, null, 2);
+      document.getElementById('graphBody').textContent = JSON.stringify(graph, null, 2);
+      document.getElementById('knowledgeBody').textContent = JSON.stringify(knowledge, null, 2);
+    }
+    load().catch(err => {
+      document.getElementById('status').textContent = String(err);
+    });
+  </script>
+</body>
+</html>`;
+}
+function sendJson(res, status, body) {
+    const payload = JSON.stringify(body, null, 2);
+    res.writeHead(status, {
+        "Content-Type": "application/json; charset=utf-8",
+        "Cache-Control": "no-store",
+    });
+    res.end(payload);
+}
+/**
+ * Local read-only HTTP dashboard. Never applies Safe Fix or mutates the repo.
+ * Defaults to loopback binding; non-loopback requires explicit allowNonLoopback.
+ */
+export async function startDashboardServer(options) {
+    const root = resolveRepoRoot(options.root);
+    const host = options.host ?? "127.0.0.1";
+    const port = options.port ?? 8787;
+    if (!isLoopbackHost(host) && options.allowNonLoopback !== true) {
+        throw new Error(`Refusing to bind dashboard to non-loopback host "${host}". Pass allowNonLoopback / --allow-non-loopback to override (unsafe; not an enterprise security boundary).`);
+    }
+    const server = http.createServer(async (req, res) => {
+        try {
+            const rawUrl = req.url ?? "/";
+            if (pathnameLooksHostile(rawUrl.split("?")[0] ?? rawUrl)) {
+                sendJson(res, 400, { error: "invalid path" });
+                return;
+            }
+            const url = new URL(rawUrl, `http://${host}:${port}`);
+            if (req.method !== "GET") {
+                sendJson(res, 405, { error: "read-only dashboard; GET only" });
+                return;
+            }
+            if (pathnameLooksHostile(url.pathname)) {
+                sendJson(res, 400, { error: "invalid path" });
+                return;
+            }
+            if (url.pathname === "/" || url.pathname === "/index.html") {
+                res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+                res.end(htmlPage());
+                return;
+            }
+            if (url.pathname === "/api/status") {
+                const mono = await detectMonorepo(root);
+                const health = await collectOpsHealth(root);
+                sendJson(res, 200, {
+                    root,
+                    readOnly: true,
+                    host,
+                    loopbackOnly: isLoopbackHost(host),
+                    contractsVersion: CONTRACTS_VERSION,
+                    roleNote: "Query ?user= is a localDevIdentityHint only — not authentication. Privileged role elevation requires AGENTDOCTOR_ALLOW_LOCAL_IDENTITY_HINT=1",
+                    actionPolicyNote: EVALUATE_ONLY,
+                    adapters: agentRegistry.map((a) => a.id),
+                    policyPacks: listPolicyPacks(),
+                    ops: health,
+                    monorepo: {
+                        isMonorepo: mono.isMonorepo,
+                        tool: mono.tool,
+                        packages: mono.packages.length,
+                    },
+                });
+                return;
+            }
+            if (url.pathname === "/api/scan") {
+                const result = await scan({ cwd: root });
+                sendJson(res, 200, {
+                    summary: result.summary,
+                    scores: result.scores,
+                    findingCount: result.findings.length,
+                    findings: result.findings.slice(0, 50).map((f) => ({
+                        id: f.id,
+                        ruleId: f.ruleId,
+                        severity: f.severity,
+                        title: f.title,
+                        path: f.evidence?.path ?? null,
+                    })),
+                });
+                return;
+            }
+            if (url.pathname === "/api/brain") {
+                sendJson(res, 200, await getBrainStatus(root));
+                return;
+            }
+            if (url.pathname === "/api/meta") {
+                const audits = await listFixAudits(root);
+                const baselines = await listNamedBaselines(root);
+                const sessions = await listSessions(root);
+                sendJson(res, 200, {
+                    fixAudits: audits.slice(0, 20).map((a) => ({
+                        id: a.id,
+                        mode: a.mode,
+                        createdAt: a.createdAt,
+                        entryCount: a.entries.length,
+                    })),
+                    baselines,
+                    sessions: sessions.slice(0, 50),
+                });
+                return;
+            }
+            if (url.pathname === "/api/platform") {
+                const auth = await loadLocalAuthConfig(root);
+                const identityHint = url.searchParams.get("user");
+                const allowLocalHint = process.env.AGENTDOCTOR_ALLOW_LOCAL_IDENTITY_HINT === "1";
+                // Default: deny privileged elevation. ?user= is a label only unless opt-in env is set.
+                let role = auth.defaultRole;
+                const localDevIdentityHint = identityHint && identityHint.trim() ? identityHint.trim() : null;
+                if (localDevIdentityHint && allowLocalHint) {
+                    role = resolveRole(auth, localDevIdentityHint);
+                }
+                if (!canAccess(role, "read-findings")) {
+                    sendJson(res, 403, {
+                        error: "forbidden",
+                        localDevIdentityHint,
+                        notice: "?user= is not authentication; privileged ops denied without AGENTDOCTOR_ALLOW_LOCAL_IDENTITY_HINT=1",
+                    });
+                    return;
+                }
+                const snapshot = await readJsonIfExists(path.join(platformDir(root), "snapshots", "latest.json"));
+                const canExport = canAccess(role, "export-reports");
+                const safeFindings = snapshot
+                    ? sanitizeFindingsForExport(snapshot.findings).slice(0, 30)
+                    : [];
+                sendJson(res, 200, {
+                    role,
+                    localDevIdentityHint,
+                    localIdentityHintElevated: Boolean(localDevIdentityHint && allowLocalHint),
+                    hasSnapshot: snapshot !== null,
+                    findingCount: snapshot?.findings.length ?? 0,
+                    graphNodes: snapshot?.graph.nodes.length ?? 0,
+                    readiness: snapshot?.readiness.categories ?? [],
+                    testImpact: snapshot?.testImpact
+                        ? {
+                            gitAvailable: snapshot.testImpact.gitAvailable,
+                            changedFiles: snapshot.testImpact.changedFiles.length,
+                            recommendedTests: snapshot.testImpact.recommendedTests.length,
+                            missingTestWarnings: snapshot.testImpact.missingTestWarnings.length,
+                            relatedModules: snapshot.testImpact.relatedModules,
+                            skipRisk: snapshot.testImpact.skipRisk,
+                            sampleRecommended: canExport
+                                ? snapshot.testImpact.recommendedTests.slice(0, 20)
+                                : [],
+                            sampleMissing: canExport
+                                ? snapshot.testImpact.missingTestWarnings.slice(0, 10)
+                                : [],
+                        }
+                        : null,
+                    limitations: [
+                        ...(snapshot?.limitations ?? [
+                            "No platform snapshot yet — run: agentdoctor platform scan",
+                        ]),
+                        "?user= is localDevIdentityHint only — not authentication",
+                        allowLocalHint
+                            ? "AGENTDOCTOR_ALLOW_LOCAL_IDENTITY_HINT=1 enabled — hint may elevate local roles (still not SSO)"
+                            : "Privileged role elevation from ?user= denied unless AGENTDOCTOR_ALLOW_LOCAL_IDENTITY_HINT=1",
+                        EVALUATE_ONLY,
+                    ],
+                    sampleFindings: canExport
+                        ? safeFindings.map((f) => ({
+                            id: f.id,
+                            module: f.module,
+                            severity: f.severity,
+                            title: f.title,
+                        }))
+                        : [],
+                });
+                return;
+            }
+            if (url.pathname === "/api/v2/graph") {
+                const graph = await buildIntelligenceGraph({ root, mode: "auto" });
+                sendJson(res, 200, {
+                    contractsVersion: CONTRACTS_VERSION,
+                    builder: graph.builder,
+                    nodeCount: graph.nodes.length,
+                    edgeCount: graph.edges.length,
+                    sampleNodes: redactGraphSamples(graph.nodes.slice(0, 40)),
+                    sampleEdges: graph.edges.slice(0, 40),
+                    limitations: graph.limitations,
+                });
+                return;
+            }
+            if (url.pathname === "/api/v2/health") {
+                sendJson(res, 200, await analyzeGitIntelligence(root));
+                return;
+            }
+            if (url.pathname === "/api/v2/c4") {
+                const graph = await buildIntelligenceGraph({ root, mode: "auto" });
+                sendJson(res, 200, {
+                    views: buildC4Views(graph),
+                    label: "Inferred/proposed — not approved architecture facts",
+                });
+                return;
+            }
+            if (url.pathname === "/api/v2/knowledge") {
+                const records = await listKnowledge(root);
+                sendJson(res, 200, {
+                    count: records.length,
+                    records: records.slice(0, 100).map((r) => ({
+                        id: r.id,
+                        title: r.title,
+                        status: r.status,
+                        version: r.version,
+                    })),
+                });
+                return;
+            }
+            if (url.pathname === "/api/v2/projects" || url.pathname === "/api/v2/workspaces") {
+                sendJson(res, 200, {
+                    mode: "local-single-repo",
+                    root,
+                    notice: "Multi-repo workspaces are partially implemented (storage abstraction). Cloud org workspaces unsupported.",
+                });
+                return;
+            }
+            sendJson(res, 404, { error: "not found" });
+        }
+        catch (error) {
+            sendJson(res, 500, { error: safeJsonError(error) });
+        }
+    });
+    await new Promise((resolve, reject) => {
+        server.listen(port, host, () => resolve());
+        server.on("error", reject);
+    });
+    const address = server.address();
+    const boundPort = typeof address === "object" && address && typeof address.port === "number"
+        ? address.port
+        : port;
+    return {
+        host,
+        port: boundPort,
+        close: async () => new Promise((resolve, reject) => {
+            server.close((err) => (err ? reject(err) : resolve()));
+        }),
+    };
+}
+/** Write a static snapshot HTML for offline viewing (optional helper). */
+export async function writeDashboardSnapshot(rootInput, outputPath) {
+    const absolute = path.resolve(outputPath);
+    await fs.mkdir(path.dirname(absolute), { recursive: true });
+    await fs.writeFile(absolute, htmlPage(), "utf8");
+    return absolute;
+}

package/dist/enforcement/runner.d.ts ADDED Viewed

@@ -0,0 +1,67 @@
+import type { PolicyDecisionContract } from "../contracts/index.js";
+export type ExecutionStatus = "executed" | "blocked-by-enforcement" | "not-executed" | "execution-failed";
+export interface EnforcementResult {
+    decision: PolicyDecisionContract;
+    enforced: boolean;
+    notice: string;
+    stdout?: string;
+    stderr?: string;
+    exitCode?: number | null;
+    durationMs?: number;
+}
+/**
+ * Parse a command string into argv without invoking a shell.
+ * Supports simple double/single quotes; rejects unclosed quotes.
+ */
+export declare function parseArgv(command: string): string[];
+export declare function buildAllowlistedEnv(source?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+/**
+ * Reject path-like args that resolve outside the repository root.
+ */
+export declare function assertArgsInsideRoot(args: string[], root: string): void;
+/**
+ * AgentDoctor-controlled command runner.
+ * Executes only when executeIfAllowed===true AND policy decision===allow.
+ * Default path uses shell:false with argv parsing (no shell metacharacters).
+ */
+export declare function runControlledCommand(options: {
+    root: string;
+    command?: string;
+    argv?: string[];
+    failClosed?: boolean;
+    /** When true, execute only if policy allows. */
+    executeIfAllowed?: boolean;
+    /** Explicit high-risk shell mode — requires policy allow as well. */
+    useShell?: boolean;
+    timeoutMs?: number;
+    maxBuffer?: number;
+}): Promise<EnforcementResult>;
+/** Append-only tamper-evident audit chain (HMAC over previous hash). */
+export declare function appendAuditChain(previousHash: string | null, record: unknown, secret?: string): {
+    hash: string;
+    payload: string;
+};
+export declare function auditRecordId(parts: string): string;
+/**
+ * Explain what the controlled runner would do for a command (evaluate-only).
+ * Does not execute.
+ */
+export declare function explainControlledRun(options: {
+    root: string;
+    command?: string;
+    argv?: string[];
+    failClosed?: boolean;
+    useShell?: boolean;
+}): Promise<{
+    command: string;
+    argv: string[];
+    useShell: boolean;
+    decision: string;
+    reason: string;
+    policyId: string | null;
+    riskLevel: string;
+    wouldExecute: boolean;
+    executionResult: "not-executed";
+    notice: string;
+    meaning: string;
+}>;