@praneeth_54/agentdoctor 1.1.1 → 2.0.1

package/dist/platform/health/analyze.js

@@ -0,0 +1,192 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+import { createHash } from "node:crypto";
+import { resolveRepoRoot } from "../../utils/path.js";
+function fid(module, key) {
+    return `health_${createHash("sha1").update(`${module}:${key}`).digest("hex").slice(0, 12)}`;
+}
+/**
+ * Module B — Code health & risk (deterministic heuristics with evidence).
+ */
+export async function analyzeCodeHealth(rootInput, graph) {
+    const root = resolveRepoRoot(rootInput);
+    const findings = [];
+    const fileNodes = graph.nodes.filter((n) => n.kind === "file" || n.kind === "test");
+    for (const node of fileNodes.slice(0, 800)) {
+        if (!node.path)
+            continue;
+        const absolute = path.join(root, node.path);
+        let content;
+        let size;
+        try {
+            const handle = await fs.open(absolute, "r");
+            try {
+                const st = await handle.stat();
+                size = st.size;
+                if (size > 512 * 1024) {
+                    findings.push({
+                        id: fid("filesize", node.path),
+                        module: "code-health",
+                        severity: "medium",
+                        title: "Large source file",
+                        message: `${node.path} is ${size} bytes`,
+                        recommendation: "Split into smaller modules to reduce change risk",
+                        confidence: 0.9,
+                        evidence: [{ kind: "verified", path: node.path, detail: `sizeBytes=${size}` }],
+                    });
+                    continue;
+                }
+                if (!/\.(ts|tsx|js|jsx|py|go)$/i.test(node.path))
+                    continue;
+                content = await handle.readFile("utf8");
+            }
+            finally {
+                await handle.close();
+            }
+        }
+        catch {
+            continue;
+        }
+        const lines = content.split(/\r?\n/);
+        if (lines.length > 500) {
+            findings.push({
+                id: fid("loc", node.path),
+                module: "code-health",
+                severity: "medium",
+                title: "High line count",
+                message: `${node.path} has ${lines.length} lines`,
+                recommendation: "Consider modularization",
+                confidence: 0.85,
+                evidence: [{ kind: "verified", path: node.path, detail: `lines=${lines.length}` }],
+            });
+        }
+        let depth = 0;
+        let maxDepth = 0;
+        for (const line of lines) {
+            for (const ch of line) {
+                if (ch === "{" || ch === "(")
+                    depth += 1;
+                if (ch === "}" || ch === ")")
+                    depth = Math.max(0, depth - 1);
+                maxDepth = Math.max(maxDepth, depth);
+            }
+        }
+        if (maxDepth >= 8) {
+            findings.push({
+                id: fid("complexity", node.path),
+                module: "code-health",
+                severity: "high",
+                title: "High nesting / complexity heuristic",
+                message: `${node.path} nesting depth heuristic=${maxDepth}`,
+                recommendation: "Reduce nesting; extract helpers",
+                confidence: 0.55,
+                evidence: [
+                    {
+                        kind: "inferred",
+                        path: node.path,
+                        detail: `maxNesting=${maxDepth} (brace/paren heuristic, not full cyclomatic)`,
+                    },
+                ],
+                falsePositiveWarning: "Nesting depth is a proxy; verify with a language-aware analyzer",
+            });
+        }
+        if (/catch\s*\([^)]*\)\s*\{\s*\}/m.test(content) || /catch\s*\{\s*\}/m.test(content)) {
+            findings.push({
+                id: fid("empty-catch", node.path),
+                module: "code-health",
+                severity: "medium",
+                title: "Empty catch block",
+                message: `${node.path} contains an empty catch`,
+                recommendation: "Log or handle errors explicitly",
+                confidence: 0.7,
+                evidence: [{ kind: "inferred", path: node.path, detail: "empty catch pattern" }],
+            });
+        }
+    }
+    // Circular import heuristic among relative edges (file→file via resolved relative specs)
+    const fileByPath = new Map(graph.nodes
+        .filter((n) => n.path && (n.kind === "file" || n.kind === "test"))
+        .map((n) => [n.path, n.id]));
+    const adj = new Map();
+    for (const edge of graph.edges.filter((e) => e.kind === "imports" && e.evidence === "verified")) {
+        const from = edge.from;
+        const toNode = graph.nodes.find((n) => n.id === edge.to);
+        const spec = typeof toNode?.meta?.specifier === "string" ? toNode.meta.specifier : toNode?.label;
+        if (!spec || typeof spec !== "string" || !spec.startsWith("."))
+            continue;
+        const fromPath = graph.nodes.find((n) => n.id === from)?.path;
+        if (!fromPath)
+            continue;
+        const resolvedRel = path.posix.normalize(path.posix.join(path.posix.dirname(fromPath), spec));
+        const candidates = [
+            resolvedRel,
+            `${resolvedRel}.ts`,
+            `${resolvedRel}.js`,
+            `${resolvedRel}/index.ts`,
+        ];
+        for (const cand of candidates) {
+            const toId = fileByPath.get(cand);
+            if (toId) {
+                if (!adj.has(from))
+                    adj.set(from, new Set());
+                adj.get(from).add(toId);
+                break;
+            }
+        }
+    }
+    const visiting = new Set();
+    const visited = new Set();
+    const reportCycle = (stack) => {
+        const paths = stack
+            .map((id) => graph.nodes.find((n) => n.id === id)?.path)
+            .filter(Boolean)
+            .join(" -> ");
+        findings.push({
+            id: fid("cycle", stack.join("|")),
+            module: "code-health",
+            severity: "high",
+            title: "Possible circular import",
+            message: paths || stack.join(" -> "),
+            recommendation: "Break the cycle with inversion of control or a shared module",
+            confidence: 0.5,
+            evidence: [{ kind: "inferred", detail: `cycleLen=${stack.length}` }],
+            falsePositiveWarning: "Relative import resolution is heuristic; confirm with a bundler/graph tool",
+        });
+    };
+    const dfs = (node, stack) => {
+        if (visiting.has(node)) {
+            const idx = stack.indexOf(node);
+            if (idx >= 0)
+                reportCycle(stack.slice(idx));
+            return;
+        }
+        if (visited.has(node))
+            return;
+        visiting.add(node);
+        stack.push(node);
+        for (const next of adj.get(node) ?? [])
+            dfs(next, stack);
+        stack.pop();
+        visiting.delete(node);
+        visited.add(node);
+    };
+    for (const node of adj.keys())
+        dfs(node, []);
+    findings.sort((a, b) => a.id.localeCompare(b.id));
+    return findings;
+}
+export function scoreFileRisk(findings, filePath) {
+    const related = findings.filter((f) => f.evidence.some((e) => e.path === filePath));
+    let score = 0;
+    for (const f of related) {
+        if (f.severity === "critical")
+            score += 40;
+        else if (f.severity === "high")
+            score += 25;
+        else if (f.severity === "medium")
+            score += 12;
+        else
+            score += 4;
+    }
+    return Math.min(100, score);
+}

package/dist/platform/index.d.ts

@@ -0,0 +1,27 @@
+import { analyzeKnowledgeGovernance } from "./knowledge/analyze.js";
+import { type TestImpactReport } from "./test-impact/analyze.js";
+import type { PlatformSnapshot } from "./types.js";
+export interface PlatformScanResult {
+    snapshot: PlatformSnapshot;
+    reportPaths: Record<string, string>;
+    testImpact: TestImpactReport;
+    knowledge: Awaited<ReturnType<typeof analyzeKnowledgeGovernance>>;
+}
+/**
+ * Orchestrate AgentDoctor 2.0 local platform scan (Modules A–O subset).
+ */
+export declare function runPlatformScan(rootInput: string): Promise<PlatformScanResult>;
+export * from "./types.js";
+export { buildRepositoryGraph } from "./graph/build.js";
+export { evaluateAgentAction, loadFirewallPolicy, validateFirewallPolicy, EVALUATE_ONLY, } from "./firewall/evaluate.js";
+export { createSession, appendSessionEvent, endSession, loadSession, listSessions, exportSessionMarkdown, } from "./sessions/store.js";
+export { buildProvenance, saveProvenance } from "./provenance/build.js";
+export { planContext } from "./tokens/plan.js";
+export { analyzeRenameImpact } from "./refactor/impact.js";
+export { compareCommits, listRecentCommits } from "./time-machine/compare.js";
+export { canAccess, resolveRole, loadLocalAuthConfig } from "./auth/local.js";
+export { analyzeTestImpact, persistTestImpactReport, formatTestImpactHuman, } from "./test-impact/analyze.js";
+export { redactSecrets, redactEvidenceDetail, sanitizeFindingsForExport, SECRET_REDACTION_MARKER, } from "./security/redact.js";
+export { analyzeKnowledgeGovernance } from "./knowledge/analyze.js";
+export { analyzeContextSecurity } from "./context-security/analyze.js";
+export { exportReports } from "./reports/export.js";

package/dist/platform/index.js

@@ -0,0 +1,89 @@
+import { buildRepositoryGraph } from "./graph/build.js";
+import { analyzeCodeHealth } from "./health/analyze.js";
+import { analyzeContextSecurity } from "./context-security/analyze.js";
+import { analyzeKnowledgeGovernance } from "./knowledge/analyze.js";
+import { analyzeArchitectureDrift } from "./architecture/drift.js";
+import { analyzeAiChangeQuality } from "./ai-quality/analyze.js";
+import { analyzeTestImpact, persistTestImpactReport, } from "./test-impact/analyze.js";
+import { buildReadinessScorecard } from "./readiness/scorecard.js";
+import { exportReports } from "./reports/export.js";
+import { ensurePlatformDir, writeJsonArtifact } from "./store.js";
+import { ensureAuthConfig } from "./auth/local.js";
+import { loadFirewallPolicy } from "./firewall/evaluate.js";
+import { sanitizeFindingsForExport } from "./security/redact.js";
+import { resolveRepoRoot } from "../utils/path.js";
+function toTestImpactSnapshot(report) {
+    return {
+        gitAvailable: report.gitAvailable,
+        mode: report.mode,
+        changedFiles: report.changedFiles,
+        recommendedTests: report.recommendedTests,
+        relatedModules: report.relatedModules,
+        missingTestWarnings: report.missingTestWarnings,
+        uncoveredAreas: report.uncoveredAreas,
+        skipRisk: report.skipRisk,
+        coverage: report.coverage,
+        limitations: report.limitations,
+    };
+}
+/**
+ * Orchestrate AgentDoctor 2.0 local platform scan (Modules A–O subset).
+ */
+export async function runPlatformScan(rootInput) {
+    const root = resolveRepoRoot(rootInput);
+    await ensurePlatformDir(root);
+    await ensureAuthConfig(root);
+    await loadFirewallPolicy(root);
+    const graph = await buildRepositoryGraph(root);
+    const health = await analyzeCodeHealth(root, graph);
+    const ctxsec = await analyzeContextSecurity(root);
+    const knowledge = await analyzeKnowledgeGovernance(root);
+    const drift = await analyzeArchitectureDrift(root, graph);
+    const aiq = await analyzeAiChangeQuality({ root, aiAssisted: "unknown" });
+    const testImpact = await analyzeTestImpact(root);
+    const findings = sanitizeFindingsForExport([
+        ...health,
+        ...ctxsec,
+        ...knowledge.findings,
+        ...drift,
+        ...aiq,
+    ]).sort((a, b) => a.id.localeCompare(b.id));
+    const readiness = await buildReadinessScorecard(root, findings);
+    const testImpactSnapshot = toTestImpactSnapshot(testImpact);
+    const snapshot = {
+        version: "2.0",
+        root,
+        generatedAt: new Date().toISOString(),
+        graph,
+        findings,
+        readiness,
+        testImpact: testImpactSnapshot,
+        limitations: [
+            ...graph.limitations,
+            ...knowledge.limitations,
+            ...readiness.limitations,
+            ...testImpact.limitations,
+            "Action Policy Evaluator is evaluate-only — no commands executed and no agents intercepted",
+            "Local ?user= roles are not authentication; cloud SSO/RBAC are out of scope",
+        ],
+    };
+    await writeJsonArtifact(root, `snapshots/latest.json`, snapshot);
+    const testImpactPath = await persistTestImpactReport(root, testImpact);
+    const reportPaths = await exportReports({ root, findings, readiness, snapshot });
+    reportPaths.testImpact = testImpactPath;
+    return { snapshot, reportPaths, testImpact, knowledge };
+}
+export * from "./types.js";
+export { buildRepositoryGraph } from "./graph/build.js";
+export { evaluateAgentAction, loadFirewallPolicy, validateFirewallPolicy, EVALUATE_ONLY, } from "./firewall/evaluate.js";
+export { createSession, appendSessionEvent, endSession, loadSession, listSessions, exportSessionMarkdown, } from "./sessions/store.js";
+export { buildProvenance, saveProvenance } from "./provenance/build.js";
+export { planContext } from "./tokens/plan.js";
+export { analyzeRenameImpact } from "./refactor/impact.js";
+export { compareCommits, listRecentCommits } from "./time-machine/compare.js";
+export { canAccess, resolveRole, loadLocalAuthConfig } from "./auth/local.js";
+export { analyzeTestImpact, persistTestImpactReport, formatTestImpactHuman, } from "./test-impact/analyze.js";
+export { redactSecrets, redactEvidenceDetail, sanitizeFindingsForExport, SECRET_REDACTION_MARKER, } from "./security/redact.js";
+export { analyzeKnowledgeGovernance } from "./knowledge/analyze.js";
+export { analyzeContextSecurity } from "./context-security/analyze.js";
+export { exportReports } from "./reports/export.js";

package/dist/platform/knowledge/analyze.d.ts

@@ -0,0 +1,20 @@
+import type { PlatformFinding } from "../types.js";
+export interface KnowledgeSource {
+    id: string;
+    path: string;
+    sourceType: "readme" | "docs" | "agent-instructions" | "other";
+    mtime: string;
+    sizeBytes: number;
+    trustLevel: "high" | "medium" | "low" | "unverified";
+    owner: string | null;
+}
+export interface KnowledgeReport {
+    root: string;
+    sources: KnowledgeSource[];
+    findings: PlatformFinding[];
+    limitations: string[];
+}
+/**
+ * Module G — Knowledge governance MVP.
+ */
+export declare function analyzeKnowledgeGovernance(rootInput: string): Promise<KnowledgeReport>;

package/dist/platform/knowledge/analyze.js

@@ -0,0 +1,96 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+import { createHash } from "node:crypto";
+import { resolveRepoRoot, toPosixRelative } from "../../utils/path.js";
+/**
+ * Module G — Knowledge governance MVP.
+ */
+export async function analyzeKnowledgeGovernance(rootInput) {
+    const root = resolveRepoRoot(rootInput);
+    const sources = [];
+    const findings = [];
+    const docs = [];
+    async function consider(rel, sourceType) {
+        const absolute = path.join(root, rel);
+        try {
+            const st = await fs.stat(absolute);
+            if (!st.isFile())
+                return;
+            const id = `know_${createHash("sha1").update(rel).digest("hex").slice(0, 10)}`;
+            const ageDays = (Date.now() - st.mtimeMs) / (86400 * 1000);
+            const trust = sourceType === "readme" ? "medium" : ageDays > 365 ? "low" : "unverified";
+            sources.push({
+                id,
+                path: rel,
+                sourceType,
+                mtime: st.mtime.toISOString(),
+                sizeBytes: st.size,
+                trustLevel: trust,
+                owner: null,
+            });
+            docs.push(rel);
+            if (ageDays > 365) {
+                findings.push({
+                    id: `know_stale_${id}`,
+                    module: "knowledge",
+                    severity: "low",
+                    title: "Stale documentation",
+                    message: `${rel} last modified ${Math.floor(ageDays)} days ago`,
+                    recommendation: "Review for accuracy against current code",
+                    confidence: 0.8,
+                    evidence: [{ kind: "verified", path: rel, detail: `mtime=${st.mtime.toISOString()}` }],
+                });
+            }
+            if (st.size === 0) {
+                findings.push({
+                    id: `know_empty_${id}`,
+                    module: "knowledge",
+                    severity: "medium",
+                    title: "Empty documentation file",
+                    message: rel,
+                    recommendation: "Fill or remove empty docs",
+                    confidence: 1,
+                    evidence: [{ kind: "verified", path: rel, detail: "size=0" }],
+                });
+            }
+        }
+        catch {
+            // missing
+        }
+    }
+    await consider("README.md", "readme");
+    await consider("AGENTS.md", "agent-instructions");
+    await consider("CLAUDE.md", "agent-instructions");
+    await consider("docs/README.md", "docs");
+    try {
+        const docsDir = path.join(root, "docs");
+        const entries = await fs.readdir(docsDir);
+        for (const e of entries.filter((x) => x.endsWith(".md")).slice(0, 40)) {
+            await consider(toPosixRelative(root, path.join(docsDir, e)), "docs");
+        }
+    }
+    catch {
+        // optional
+    }
+    if (sources.filter((s) => s.owner === null).length === sources.length && sources.length > 0) {
+        findings.push({
+            id: "know_no_owners",
+            module: "knowledge",
+            severity: "info",
+            title: "No documentation owners detected",
+            message: "CODEOWNERS/MAINTAINERS not linked to knowledge sources in this MVP",
+            recommendation: "Add CODEOWNERS entries for docs/",
+            confidence: 0.6,
+            evidence: [{ kind: "unknown", detail: "owner metadata unavailable" }],
+        });
+    }
+    return {
+        root,
+        sources: sources.sort((a, b) => a.path.localeCompare(b.path)),
+        findings: findings.sort((a, b) => a.id.localeCompare(b.id)),
+        limitations: [
+            "Contradiction detection between docs and code is limited in this MVP",
+            "Ownership requires CODEOWNERS integration (extension point)",
+        ],
+    };
+}

package/dist/platform/provenance/build.d.ts

@@ -0,0 +1,44 @@
+import type { EvidenceKind } from "../types.js";
+export interface ProvenanceRecord {
+    id: string;
+    repository: string;
+    branch: string | null;
+    commit: string | null;
+    pullRequest: string | null;
+    file: string;
+    lineRange?: {
+        start: number;
+        end: number;
+    };
+    agent: string | null;
+    model: string | null;
+    taskRef: string | null;
+    toolCalls: string[];
+    testsExecuted: string[];
+    reviewer: string | null;
+    approvalStatus: "unknown" | "approved" | "pending" | "rejected";
+    risk: string;
+    fields: Record<string, {
+        value: string | null;
+        kind: EvidenceKind;
+    }>;
+    chain: string[];
+}
+/**
+ * Module E — AI change provenance.
+ * Never fabricates missing metadata; marks unknown explicitly.
+ */
+export declare function buildProvenance(options: {
+    root: string;
+    file: string;
+    agent?: string;
+    model?: string;
+    taskRef?: string;
+    toolCalls?: string[];
+    testsExecuted?: string[];
+    reviewer?: string;
+    approvalStatus?: ProvenanceRecord["approvalStatus"];
+    lineStart?: number;
+    lineEnd?: number;
+}): ProvenanceRecord;
+export declare function saveProvenance(root: string, record: ProvenanceRecord): Promise<string>;

package/dist/platform/provenance/build.js

@@ -0,0 +1,65 @@
+import { createHash, randomUUID } from "node:crypto";
+import { spawnSync } from "node:child_process";
+import { writeJsonArtifact } from "../store.js";
+import { resolveRepoRoot } from "../../utils/path.js";
+function git(root, args) {
+    const r = spawnSync("git", args, { cwd: root, encoding: "utf8" });
+    return r.status === 0 ? r.stdout.trim() : null;
+}
+/**
+ * Module E — AI change provenance.
+ * Never fabricates missing metadata; marks unknown explicitly.
+ */
+export function buildProvenance(options) {
+    const root = resolveRepoRoot(options.root);
+    const commit = git(root, ["rev-parse", "HEAD"]);
+    const branch = git(root, ["rev-parse", "--abbrev-ref", "HEAD"]);
+    const field = (value, kind) => ({
+        value: value ?? null,
+        kind: value ? kind : "unknown",
+    });
+    const record = {
+        id: `prov_${createHash("sha1")
+            .update(`${options.file}:${commit ?? randomUUID()}`)
+            .digest("hex")
+            .slice(0, 12)}`,
+        repository: root,
+        branch,
+        commit,
+        pullRequest: null,
+        file: options.file,
+        agent: options.agent ?? null,
+        model: options.model ?? null,
+        taskRef: options.taskRef ?? null,
+        toolCalls: options.toolCalls ?? [],
+        testsExecuted: options.testsExecuted ?? [],
+        reviewer: options.reviewer ?? null,
+        approvalStatus: options.approvalStatus ?? "unknown",
+        risk: "unknown",
+        fields: {
+            repository: field(root, "verified"),
+            branch: field(branch, "verified"),
+            commit: field(commit, "verified"),
+            pullRequest: field(null, "unknown"),
+            agent: field(options.agent ?? null, options.agent ? "inferred" : "unknown"),
+            model: field(options.model ?? null, options.model ? "inferred" : "unknown"),
+            reviewer: field(options.reviewer ?? null, options.reviewer ? "verified" : "unknown"),
+        },
+        chain: [
+            "Request",
+            options.agent ? "Agent" : "Agent(unknown)",
+            "Tool calls",
+            "Files changed",
+            options.testsExecuted?.length ? "Tests" : "Tests(unknown)",
+            options.reviewer ? "Review" : "Review(unknown)",
+            commit ? "Commit" : "Commit(unknown)",
+        ],
+    };
+    if (options.lineStart !== undefined && options.lineEnd !== undefined) {
+        record.lineRange = { start: options.lineStart, end: options.lineEnd };
+    }
+    return record;
+}
+export async function saveProvenance(root, record) {
+    return writeJsonArtifact(root, `provenance/${record.id}.json`, record);
+}

package/dist/platform/readiness/scorecard.d.ts

@@ -0,0 +1,5 @@
+import type { PlatformFinding, ReadinessReport } from "../types.js";
+/**
+ * Module N — Agent readiness scorecard (evidence-backed categories).
+ */
+export declare function buildReadinessScorecard(rootInput: string, extraFindings?: PlatformFinding[]): Promise<ReadinessReport>;

package/dist/platform/readiness/scorecard.js

@@ -0,0 +1,98 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+import { scan } from "../../core/scanner/scan.js";
+import { resolveRepoRoot } from "../../utils/path.js";
+/**
+ * Module N — Agent readiness scorecard (evidence-backed categories).
+ */
+export async function buildReadinessScorecard(rootInput, extraFindings = []) {
+    const root = resolveRepoRoot(rootInput);
+    const result = await scan({ cwd: root });
+    const categories = [];
+    const hasReadme = await exists(path.join(root, "README.md"));
+    categories.push({
+        id: "documentation",
+        title: "Documentation quality",
+        score: hasReadme ? 70 : 30,
+        evidence: [
+            {
+                kind: hasReadme ? "verified" : "unknown",
+                path: "README.md",
+                detail: hasReadme ? "README present" : "README missing",
+            },
+        ],
+        gaps: hasReadme ? [] : ["Add a README with agent setup guidance"],
+        recommendations: ["Keep AGENTS.md/CLAUDE.md aligned with Safety scan findings"],
+    });
+    const hasTests = (await exists(path.join(root, "tests"))) || (await exists(path.join(root, "test")));
+    categories.push({
+        id: "tests",
+        title: "Test quality",
+        score: hasTests ? 75 : 25,
+        evidence: [
+            {
+                kind: hasTests ? "verified" : "unknown",
+                detail: hasTests ? "tests/ or test/ directory present" : "no tests directory",
+            },
+        ],
+        gaps: hasTests ? [] : ["Add automated tests before enabling autonomous agents"],
+        recommendations: ["Wire CI to fail on critical Safety findings"],
+    });
+    const securityFindings = result.findings.filter((f) => f.category === "security");
+    const secScore = Math.max(0, 100 - securityFindings.length * 15);
+    categories.push({
+        id: "security",
+        title: "Security controls",
+        score: secScore,
+        evidence: securityFindings.slice(0, 5).map((f) => {
+            const ref = {
+                kind: "verified",
+                detail: f.title,
+            };
+            if (f.evidence?.path)
+                ref.path = f.evidence.path;
+            return ref;
+        }),
+        gaps: securityFindings.map((f) => f.title),
+        recommendations: ["Run agentdoctor secrets --json for opt-in content hygiene"],
+    });
+    const criticalExtra = extraFindings.filter((f) => f.severity === "critical" || f.severity === "high");
+    categories.push({
+        id: "agent-policies",
+        title: "Agent policies & context security",
+        score: Math.max(0, 100 - criticalExtra.length * 20),
+        evidence: criticalExtra.slice(0, 5).map((f) => {
+            const ref = {
+                kind: "inferred",
+                detail: f.title,
+            };
+            if (f.evidence[0]?.path)
+                ref.path = f.evidence[0].path;
+            return ref;
+        }),
+        gaps: criticalExtra.map((f) => f.title),
+        recommendations: [
+            "Configure .agentdoctor/platform/firewall-policy.json (Action Policy Evaluator)",
+        ],
+    });
+    const overallNote = "Scores are category evidence summaries — not a single unexplained rating. " +
+        "Improve gaps before expanding agent autonomy.";
+    return {
+        root,
+        categories,
+        overallNote,
+        limitations: [
+            "CI/CD maturity and observability are only partially assessed in this MVP",
+            "Ownership metadata requires CODEOWNERS for higher confidence",
+        ],
+    };
+}
+async function exists(p) {
+    try {
+        await fs.access(p);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}

package/dist/platform/refactor/impact.d.ts

@@ -0,0 +1,20 @@
+import type { RepositoryGraph } from "../types.js";
+export interface RefactorImpact {
+    root: string;
+    symbol: string;
+    affectedFiles: string[];
+    dependencyPaths: string[];
+    risk: "low" | "medium" | "high";
+    requiredTests: string[];
+    breakingChangeRisk: string;
+    limitations: string[];
+}
+/**
+ * Module K — Graph-aware refactoring analysis (rename impact MVP).
+ * Does not apply refactors.
+ */
+export declare function analyzeRenameImpact(options: {
+    root: string;
+    symbol: string;
+    graph: RepositoryGraph;
+}): Promise<RefactorImpact>;