@praneeth_54/agentdoctor 2.0.0 → 2.1.0

package/dist/constants.d.ts

@@ -1,5 +1,5 @@
 import type { AgentId } from "./types/index.js";
-export declare const PACKAGE_VERSION = "2.0.0";
+export declare const PACKAGE_VERSION = "2.1.0";
 export declare const DEFAULT_MAX_FILE_SIZE_BYTES: number;
 /** Directories skipped during normal discovery (unless a rule needs them later). */
 export declare const DEFAULT_IGNORE_DIRECTORIES: Set<string>;

package/dist/constants.js

@@ -1,4 +1,4 @@
-export const PACKAGE_VERSION = "2.0.0";
+export const PACKAGE_VERSION = "2.1.0";
 export const DEFAULT_MAX_FILE_SIZE_BYTES = 2 * 1024 * 1024; // 2 MiB
 /** Directories skipped during normal discovery (unless a rule needs them later). */
 export const DEFAULT_IGNORE_DIRECTORIES = new Set([

package/dist/contracts/index.d.ts

@@ -105,7 +105,7 @@ export interface PolicyDecisionContract {
     inputClassification: string;
     evidence: EvidenceRef[];
     riskLevel: Severity;
-    executionStatus: "not-executed" | "executed" | "blocked-by-enforcement";
+    executionStatus: "not-executed" | "executed" | "blocked-by-enforcement" | "execution-failed";
     approvalStatus: "not-required" | "pending" | "approved" | "denied";
     timestamp: string;
 }

package/dist/contracts/index.js

@@ -5,9 +5,9 @@
 export const CONTRACTS_VERSION = "2.0.0-contracts";
 export const DEFAULT_FEATURE_FLAGS = {
     typescriptAst: true,
-    sqliteStorage: false,
+    sqliteStorage: true,
     teamMode: false,
-    enforcementRunner: false,
+    enforcementRunner: true,
     vectorSearch: false,
     architectureC4: true,
 };

package/dist/core/brain-product/init.js

@@ -201,8 +201,11 @@ export async function reviewProposal(options) {
             else {
                 content = `${statusLine}\n\n${content}`;
             }
-            // Drop stale "not approved" parenthetical if present after replacement edge cases
-            content = content.replace(/\s*\(not approved\)/g, "");
+            // Drop stale "not approved" parenthetical if present after replacement edge cases.
+            // Avoid /\s*(...)/g — polynomial ReDoS on uncontrolled proposal markdown.
+            if (content.includes("(not approved)")) {
+                content = content.split("(not approved)").join("");
+            }
             await atomicWriteTextFile(abs, content.endsWith("\n") ? content : `${content}\n`);
         }
     }

package/dist/core/secrets/scan.d.ts

@@ -1,10 +1,16 @@
+export type SecretSeverity = "critical" | "warning";
+/** Pattern match confidence — independent from severity impact rating. */
+export type SecretConfidence = "low" | "medium" | "high";
 export interface SecretFinding {
     file: string;
     line: number;
     ruleId: string;
     /** Always redacted — never contains the secret value */
     redactedSnippet: string;
-    severity: "critical" | "warning";
+    /** Impact if the match is a real secret — not the same as confidence. */
+    severity: SecretSeverity;
+    /** How confident the heuristic is that this match is a secret. */
+    confidence: SecretConfidence;
 }
 export interface SecretScanReport {
     root: string;

package/dist/core/secrets/scan.js

@@ -1,26 +1,31 @@
 import fs from "node:fs/promises";
 import path from "node:path";
+import { readTextFile } from "../../utils/fs.js";
 import { resolveRepoRoot, toPosixRelative } from "../../utils/path.js";
 const SECRET_PATTERNS = [
     {
         id: "aws-access-key",
         re: /\bAKIA[0-9A-Z]{16}\b/g,
         severity: "critical",
+        confidence: "high",
     },
     {
         id: "generic-api-key",
         re: /\b(?:api[_-]?key|secret[_-]?key|access[_-]?token)\s*[:=]\s*['"]?[A-Za-z0-9_-]{16,}['"]?/gi,
         severity: "warning",
+        confidence: "medium",
     },
     {
         id: "private-key-header",
         re: /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/g,
         severity: "critical",
+        confidence: "high",
     },
     {
         id: "github-pat",
         re: /\bghp_[A-Za-z0-9]{36}\b/g,
         severity: "critical",
+        confidence: "high",
     },
 ];
 const SKIP_DIR = new Set([
@@ -123,16 +128,10 @@ export async function scanSecrets(options) {
         limitations.push(`Scan capped at ${maxFiles} files`);
     }
     for (const absolute of files) {
-        let content;
-        try {
-            const st = await fs.stat(absolute);
-            if (st.size > 512 * 1024)
-                continue;
-            content = await fs.readFile(absolute, "utf8");
-        }
-        catch {
+        // open+fstat+read via readTextFile — avoids exists/stat→read TOCTOU
+        const content = await readTextFile(absolute, 512 * 1024);
+        if (content === null)
             continue;
-        }
         const lines = content.split(/\r?\n/);
         const rel = toPosixRelative(root, absolute);
         for (let i = 0; i < lines.length; i += 1) {
@@ -147,6 +146,7 @@ export async function scanSecrets(options) {
                         ruleId: pattern.id,
                         redactedSnippet: redactMatch(line, match[0] ?? ""),
                         severity: pattern.severity,
+                        confidence: pattern.confidence,
                     });
                     if (findings.length >= 200) {
                         limitations.push("Finding cap reached (200)");

package/dist/coverage/cobertura.d.ts

@@ -0,0 +1,6 @@
+import { type NormalizedCoverage } from "./types.js";
+/**
+ * DOM-free Cobertura XML parser focused on class/@filename and line hits.
+ */
+export declare function parseCobertura(xml: string): NormalizedCoverage;
+export declare function isCoberturaXml(text: string): boolean;

package/dist/coverage/cobertura.js

@@ -0,0 +1,52 @@
+import { normalizeCoveragePath } from "./types.js";
+/**
+ * DOM-free Cobertura XML parser focused on class/@filename and line hits.
+ */
+export function parseCobertura(xml) {
+    const files = {};
+    const limitations = [
+        "Cobertura parser extracts class filename + line hits only (DOM-free regex)",
+        "No test→source mapping in standard Cobertura — test attribution is hybrid/heuristic",
+    ];
+    if (!xml.trim()) {
+        return { format: "cobertura", files, limitations: ["Empty Cobertura input", ...limitations] };
+    }
+    const classRe = /<class\b([^>]*)>([\s\S]*?)<\/class>/gi;
+    let classMatch;
+    while ((classMatch = classRe.exec(xml)) !== null) {
+        const attrs = classMatch[1] ?? "";
+        const body = classMatch[2] ?? "";
+        const filename = attrValue(attrs, "filename") ?? attrValue(attrs, "name") ?? "";
+        if (!filename)
+            continue;
+        const filePath = normalizeCoveragePath(filename);
+        const file = files[filePath] ?? {
+            path: filePath,
+            lines: {},
+            functions: [],
+        };
+        const lineRe = /<line\b([^>]*)\/?>/gi;
+        let lineMatch;
+        while ((lineMatch = lineRe.exec(body)) !== null) {
+            const lineAttrs = lineMatch[1] ?? "";
+            const number = Number(attrValue(lineAttrs, "number"));
+            const hits = Number(attrValue(lineAttrs, "hits") ?? "0");
+            if (!Number.isFinite(number))
+                continue;
+            file.lines[number] = Math.max(file.lines[number] ?? 0, Number.isFinite(hits) ? hits : 0);
+        }
+        files[filePath] = file;
+    }
+    return { format: "cobertura", files, limitations };
+}
+function attrValue(attrs, name) {
+    const re = new RegExp(`${name}\\s*=\\s*(["'])([\\s\\S]*?)\\1`, "i");
+    const m = attrs.match(re);
+    return m?.[2] ?? null;
+}
+export function isCoberturaXml(text) {
+    const sample = text.slice(0, 8000);
+    return (/<coverage\b/i.test(sample) ||
+        /<!DOCTYPE\s+coverage/i.test(sample) ||
+        (/<class\b/i.test(sample) && /<line\b/i.test(sample)));
+}

package/dist/coverage/istanbul.d.ts

@@ -0,0 +1,7 @@
+import { type NormalizedCoverage } from "./types.js";
+/**
+ * Istanbul / nyc / vitest coverage JSON (coverage-final.json style).
+ * Accepts a JSON string or already-parsed object.
+ * Supports optional testMap / coveredByTests when present.
+ */
+export declare function parseIstanbul(input: string | object): NormalizedCoverage;

package/dist/coverage/istanbul.js

@@ -0,0 +1,134 @@
+import { normalizeCoveragePath } from "./types.js";
+function asRecord(value) {
+    if (value && typeof value === "object" && !Array.isArray(value)) {
+        return value;
+    }
+    return null;
+}
+function looksLikeFileRecord(value) {
+    const rec = asRecord(value);
+    if (!rec)
+        return false;
+    return ("statementMap" in rec ||
+        "s" in rec ||
+        "fnMap" in rec ||
+        "f" in rec ||
+        typeof rec.path === "string");
+}
+function extractTests(rec) {
+    const fromMeta = rec.meta?.tests ?? rec.meta?.coveredByTests ?? [];
+    const direct = rec.coveredByTests ?? rec.tests ?? [];
+    return [...new Set([...fromMeta, ...direct].map(normalizeCoveragePath).filter(Boolean))].sort();
+}
+function collectTestMap(root) {
+    const raw = root.testMap ?? root.tests;
+    const map = asRecord(raw);
+    if (!map)
+        return undefined;
+    const out = {};
+    for (const [testPath, sources] of Object.entries(map)) {
+        if (!Array.isArray(sources))
+            continue;
+        const files = sources
+            .filter((s) => typeof s === "string")
+            .map(normalizeCoveragePath);
+        if (files.length)
+            out[normalizeCoveragePath(testPath)] = [...new Set(files)].sort();
+    }
+    return Object.keys(out).length ? out : undefined;
+}
+/**
+ * Istanbul / nyc / vitest coverage JSON (coverage-final.json style).
+ * Accepts a JSON string or already-parsed object.
+ * Supports optional testMap / coveredByTests when present.
+ */
+export function parseIstanbul(input) {
+    let root;
+    if (typeof input === "string") {
+        try {
+            root = JSON.parse(input);
+        }
+        catch (error) {
+            throw new Error(`Invalid Istanbul JSON: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    else if (input && typeof input === "object" && !Array.isArray(input)) {
+        root = input;
+    }
+    else {
+        throw new Error("Invalid Istanbul JSON: expected object or JSON string");
+    }
+    const candidate = asRecord(root.coverageMap) ?? asRecord(root.result) ?? asRecord(root.coverage) ?? root;
+    const files = {};
+    const limitations = [
+        "Istanbul statement/branch maps vary by version; line hits taken from s/statementMap when present",
+    ];
+    for (const [key, value] of Object.entries(candidate)) {
+        if (key === "testMap" || key === "tests" || key === "meta")
+            continue;
+        if (!looksLikeFileRecord(value))
+            continue;
+        const pathKey = normalizeCoveragePath(typeof value.path === "string" ? value.path : key.replace(/^.*:/, ""));
+        if (!pathKey)
+            continue;
+        const prev = files[pathKey];
+        const file = {
+            path: pathKey,
+            lines: { ...(prev?.lines ?? {}) },
+            functions: [...(prev?.functions ?? [])],
+            ...(prev?.coveredByTests ? { coveredByTests: [...prev.coveredByTests] } : {}),
+        };
+        const statementMap = value.statementMap ?? {};
+        const statements = value.s ?? {};
+        for (const [id, hits] of Object.entries(statements)) {
+            const loc = statementMap[id];
+            const line = loc?.start?.line ?? loc?.end?.line;
+            if (typeof line !== "number" || !Number.isFinite(hits))
+                continue;
+            file.lines[line] = Math.max(file.lines[line] ?? 0, Number(hits));
+        }
+        const fnMap = value.fnMap ?? {};
+        const fnHits = value.f ?? {};
+        for (const [id, hits] of Object.entries(fnHits)) {
+            const meta = fnMap[id];
+            const name = meta?.name || `fn_${id}`;
+            const line = meta?.decl?.start?.line ?? meta?.line ?? 0;
+            const existing = file.functions.find((f) => f.name === name);
+            if (existing) {
+                existing.hits = Math.max(existing.hits, Number(hits) || 0);
+                if (!existing.line && line)
+                    existing.line = line;
+            }
+            else {
+                file.functions.push({ name, line, hits: Number(hits) || 0 });
+            }
+        }
+        const tests = extractTests(value);
+        if (tests.length) {
+            file.coveredByTests = [...new Set([...(file.coveredByTests ?? []), ...tests])].sort();
+        }
+        files[pathKey] = file;
+    }
+    let testToFiles = collectTestMap(root) ?? collectTestMap(candidate);
+    for (const [source, cov] of Object.entries(files)) {
+        for (const test of cov.coveredByTests ?? []) {
+            testToFiles ??= {};
+            const list = testToFiles[test] ?? [];
+            if (!list.includes(source))
+                list.push(source);
+            testToFiles[test] = list.sort();
+        }
+    }
+    if (!testToFiles) {
+        limitations.push("Istanbul JSON had no test→source map — test attribution falls back to heuristics");
+    }
+    else {
+        limitations.push("Istanbul test→source map used where present");
+    }
+    return {
+        format: "istanbul",
+        files,
+        ...(testToFiles ? { testToFiles } : {}),
+        limitations,
+    };
+}

package/dist/coverage/lcov.d.ts

@@ -0,0 +1,7 @@
+import { type NormalizedCoverage } from "./types.js";
+/**
+ * Parse LCOV text into NormalizedCoverage.
+ * LCOV records source line/function hits only — no test→source map.
+ */
+export declare function parseLcov(text: string): NormalizedCoverage;
+export declare function isLcovText(text: string): boolean;

package/dist/coverage/lcov.js

@@ -0,0 +1,59 @@
+import { normalizeCoveragePath } from "./types.js";
+/**
+ * Parse LCOV text into NormalizedCoverage.
+ * LCOV records source line/function hits only — no test→source map.
+ */
+export function parseLcov(text) {
+    const files = {};
+    let current = null;
+    const limitations = [
+        "LCOV provides source line/function hits only — no test→source mapping",
+        "Test recommendation with LCOV uses hybrid naming/graph heuristics for test attribution",
+    ];
+    for (const raw of text.split(/\r?\n/)) {
+        const line = raw.trimEnd();
+        if (line.startsWith("SF:")) {
+            const p = normalizeCoveragePath(line.slice(3).trim());
+            current = { path: p, lines: {}, functions: [] };
+            files[p] = current;
+        }
+        else if (line.startsWith("DA:") && current) {
+            const [ln, hits] = line.slice(3).split(",");
+            const n = Number(ln);
+            const h = Number(hits);
+            if (Number.isFinite(n) && Number.isFinite(h))
+                current.lines[n] = h;
+        }
+        else if (line.startsWith("FN:") && current) {
+            const body = line.slice(3);
+            const comma = body.indexOf(",");
+            if (comma < 0)
+                continue;
+            const n = Number(body.slice(0, comma));
+            const name = body.slice(comma + 1).trim();
+            if (Number.isFinite(n) && name) {
+                current.functions.push({ name, line: n, hits: 0 });
+            }
+        }
+        else if (line.startsWith("FNDA:") && current) {
+            const body = line.slice(5);
+            const comma = body.indexOf(",");
+            if (comma < 0)
+                continue;
+            const h = Number(body.slice(0, comma));
+            const name = body.slice(comma + 1).trim();
+            const fn = current.functions.find((f) => f.name === name);
+            if (fn && Number.isFinite(h))
+                fn.hits = h;
+        }
+        else if (line === "end_of_record") {
+            current = null;
+        }
+    }
+    return { format: "lcov", files, limitations };
+}
+export function isLcovText(text) {
+    const sample = text.slice(0, 4000);
+    return (/(^|\n)SF:/.test(sample) &&
+        (/(^|\n)DA:/.test(sample) || /(^|\n)end_of_record/.test(sample) || /(^|\n)TN:/.test(sample)));
+}

package/dist/coverage/load.d.ts

@@ -0,0 +1,9 @@
+import type { NormalizedCoverage } from "./types.js";
+export type { NormalizedCoverage, CoverageFormat, CoverageFile } from "./types.js";
+export { parseLcov } from "./lcov.js";
+export { parseIstanbul } from "./istanbul.js";
+export { parseCobertura } from "./cobertura.js";
+/**
+ * Load coverage from a file path, auto-detecting format by extension then content.
+ */
+export declare function loadCoverage(coveragePath: string): Promise<NormalizedCoverage>;

package/dist/coverage/load.js

@@ -0,0 +1,39 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+import { isCoberturaXml, parseCobertura } from "./cobertura.js";
+import { parseIstanbul } from "./istanbul.js";
+import { isLcovText, parseLcov } from "./lcov.js";
+export { parseLcov } from "./lcov.js";
+export { parseIstanbul } from "./istanbul.js";
+export { parseCobertura } from "./cobertura.js";
+/**
+ * Load coverage from a file path, auto-detecting format by extension then content.
+ */
+export async function loadCoverage(coveragePath) {
+    const abs = path.resolve(coveragePath);
+    let text;
+    try {
+        text = await fs.readFile(abs, "utf8");
+    }
+    catch (error) {
+        throw new Error(`Unable to read coverage file: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    if (!text.trim()) {
+        throw new Error("Coverage file is empty");
+    }
+    const base = path.basename(abs).toLowerCase();
+    const ext = path.extname(abs).toLowerCase();
+    if (ext === ".lcov" || base === "lcov.info" || base.endsWith(".info") || isLcovText(text)) {
+        if (text.includes("SF:") || isLcovText(text))
+            return parseLcov(text);
+    }
+    if (ext === ".xml" || base.includes("cobertura") || isCoberturaXml(text)) {
+        return parseCobertura(text);
+    }
+    if (ext === ".json" || text.trimStart().startsWith("{")) {
+        return parseIstanbul(text);
+    }
+    if (text.includes("end_of_record"))
+        return parseLcov(text);
+    return parseIstanbul(text);
+}

package/dist/coverage/types.d.ts

@@ -0,0 +1,23 @@
+export type CoverageFormat = "lcov" | "istanbul" | "cobertura";
+export interface CoverageFunction {
+    name: string;
+    line: number;
+    hits: number;
+}
+export interface CoverageFile {
+    path: string;
+    lines: Record<number, number>;
+    functions: CoverageFunction[];
+    /** Optional test files known to cover this source (when format provides it). */
+    coveredByTests?: string[];
+}
+export interface NormalizedCoverage {
+    format: CoverageFormat;
+    files: Record<string, CoverageFile>;
+    /** Optional reverse map test → source files when available. */
+    testToFiles?: Record<string, string[]>;
+    limitations: string[];
+}
+export declare function normalizeCoveragePath(p: string): string;
+/** @deprecated use normalizeCoveragePath */
+export declare const normalizePath: typeof normalizeCoveragePath;

package/dist/coverage/types.js

@@ -0,0 +1,5 @@
+export function normalizeCoveragePath(p) {
+    return p.replace(/\\/g, "/").replace(/^\.\//, "");
+}
+/** @deprecated use normalizeCoveragePath */
+export const normalizePath = normalizeCoveragePath;

package/dist/dashboard/server.d.ts

@@ -1,3 +1,4 @@
+import type { ModelProvider } from "../ai/types.js";
 export interface DashboardServerOptions {
     root: string;
     host?: string;
@@ -6,9 +7,14 @@ export interface DashboardServerOptions {
     readOnly?: boolean;
     /**
      * Unsafe opt-in to bind outside loopback. Not an enterprise security boundary.
-     * Local ?user= role selection remains spoofable.
+     * Query ?user= is a localDevIdentityHint only; role elevation requires AGENTDOCTOR_ALLOW_LOCAL_IDENTITY_HINT=1.
      */
     allowNonLoopback?: boolean;
+    /**
+     * Optional provider override (tests). Production uses loadAiConfig().
+     * When unset and provider resolves to none, /api/chat fails closed.
+     */
+    chatProvider?: ModelProvider;
 }
 export declare function isLoopbackHost(host: string): boolean;
 /**