@praneeth_54/agentdoctor 2.0.0 → 2.1.0

package/dist/enforcement/runner.js

@@ -1,46 +1,441 @@
 import { createHash, randomUUID } from "node:crypto";
 import { createHmac } from "node:crypto";
+import { execFile, spawn } from "node:child_process";
+import fs from "node:fs/promises";
+import path from "node:path";
+import { promisify } from "node:util";
+import { existsSync, realpathSync } from "node:fs";
 import { evaluateAgentAction, EVALUATE_ONLY } from "../platform/firewall/evaluate.js";
+import { resolveRepoRoot } from "../utils/path.js";
+import { PathEscapeError, assertInsideRepo } from "../security/paths.js";
+const execFileAsync = promisify(execFile);
+/**
+ * Resolve npm/npx to `node <cli.js>` on Windows so execFile(shell:false) does not
+ * hit ENOENT on the `npm` name or fail to spawn `.cmd` shims without a shell.
+ */
+function resolveNpmCliJs(cliFile) {
+    const candidates = [
+        path.join(path.dirname(process.execPath), "node_modules", "npm", "bin", cliFile),
+        path.join(path.dirname(process.execPath), "..", "lib", "node_modules", "npm", "bin", cliFile),
+    ];
+    for (const candidate of candidates) {
+        if (existsSync(candidate))
+            return candidate;
+    }
+    return null;
+}
+/**
+ * Map argv to a portable executable form for shell:false execution.
+ * Policy evaluation still uses the original human-facing argv/command string.
+ */
+export function resolveExecutableArgv(argv) {
+    if (argv.length === 0)
+        return argv;
+    const bin = argv[0];
+    if (process.platform === "win32" && (bin === "npm" || bin === "npx")) {
+        const cli = resolveNpmCliJs(bin === "npx" ? "npx-cli.js" : "npm-cli.js");
+        if (cli) {
+            return [process.execPath, cli, ...argv.slice(1)];
+        }
+        // Last resort: .cmd name (may still require shell on some hosts).
+        return [`${bin}.cmd`, ...argv.slice(1)];
+    }
+    return argv;
+}
+const DEFAULT_TIMEOUT_MS = 30_000;
+const DEFAULT_MAX_BUFFER = 1024 * 1024;
+const OUTPUT_TRUNCATE = 32_768;
+const ENV_ALLOWLIST = new Set([
+    "PATH",
+    "Path",
+    "NODE_ENV",
+    "HOME",
+    "USERPROFILE",
+    "LANG",
+    "SystemRoot",
+    "SYSTEMROOT",
+    "ComSpec",
+    "PATHEXT",
+]);
+/**
+ * Parse a command string into argv without invoking a shell.
+ * Supports simple double/single quotes; rejects unclosed quotes.
+ */
+export function parseArgv(command) {
+    const trimmed = command.trim();
+    if (!trimmed)
+        return [];
+    const args = [];
+    let current = "";
+    let quote = null;
+    for (let i = 0; i < trimmed.length; i += 1) {
+        const ch = trimmed[i];
+        if (quote) {
+            if (ch === quote) {
+                quote = null;
+            }
+            else {
+                current += ch;
+            }
+            continue;
+        }
+        if (ch === '"' || ch === "'") {
+            quote = ch;
+            continue;
+        }
+        if (/\s/.test(ch)) {
+            if (current.length > 0) {
+                args.push(current);
+                current = "";
+            }
+            continue;
+        }
+        current += ch;
+    }
+    if (quote) {
+        throw new Error("unclosed quote in command");
+    }
+    if (current.length > 0)
+        args.push(current);
+    return args;
+}
+export function buildAllowlistedEnv(source = process.env) {
+    const env = {};
+    for (const key of ENV_ALLOWLIST) {
+        const value = source[key];
+        if (typeof value === "string")
+            env[key] = value;
+    }
+    for (const [key, value] of Object.entries(source)) {
+        if (key.startsWith("AGENTDOCTOR_") && typeof value === "string") {
+            env[key] = value;
+        }
+    }
+    return env;
+}
+/**
+ * Reject path-like args that resolve outside the repository root.
+ */
+export function assertArgsInsideRoot(args, root) {
+    for (const arg of args) {
+        if (arg.startsWith("-"))
+            continue;
+        const looksLikePath = arg.includes("..") || arg.includes("/") || arg.includes("\\") || path.isAbsolute(arg);
+        if (!looksLikePath)
+            continue;
+        try {
+            assertInsideRepo(root, arg);
+        }
+        catch (error) {
+            if (error instanceof PathEscapeError) {
+                throw new Error("path escape rejected");
+            }
+            throw new Error("path escape rejected");
+        }
+    }
+}
+function truncate(text, max = OUTPUT_TRUNCATE) {
+    if (text.length <= max)
+        return text;
+    return `${text.slice(0, max)}\n…[truncated ${text.length - max} chars]`;
+}
+function resolveRealRoot(rootInput) {
+    const resolved = resolveRepoRoot(rootInput);
+    try {
+        return realpathSync(resolved);
+    }
+    catch {
+        return resolved;
+    }
+}
+async function appendExecutionAudit(root, record) {
+    const auditPath = path.join(root, ".agentdoctor", "audit", "execution.jsonl");
+    await fs.mkdir(path.dirname(auditPath), { recursive: true });
+    let previousHash = null;
+    try {
+        const existing = await fs.readFile(auditPath, "utf8");
+        const lines = existing.trim().split("\n").filter(Boolean);
+        const last = lines[lines.length - 1];
+        if (last) {
+            const parsed = JSON.parse(last);
+            previousHash = typeof parsed.hash === "string" ? parsed.hash : null;
+        }
+    }
+    catch {
+        previousHash = null;
+    }
+    const { hash, payload } = appendAuditChain(previousHash, record);
+    const line = `${JSON.stringify({ hash, previousHash, record: JSON.parse(payload) })}\n`;
+    await fs.appendFile(auditPath, line, "utf8");
+}
+async function executeArgv(options) {
+    const start = Date.now();
+    const env = buildAllowlistedEnv();
+    const cwd = options.root;
+    if (options.useShell) {
+        const command = options.argv.join(" ");
+        return await new Promise((resolve) => {
+            const child = spawn(command, {
+                cwd,
+                env,
+                shell: true,
+                windowsHide: true,
+            });
+            let stdout = "";
+            let stderr = "";
+            let settled = false;
+            const timer = setTimeout(() => {
+                child.kill("SIGKILL");
+                if (!settled) {
+                    settled = true;
+                    resolve({
+                        stdout: truncate(stdout),
+                        stderr: truncate(stderr || "timeout"),
+                        exitCode: null,
+                        durationMs: Date.now() - start,
+                        failed: true,
+                        error: `timeout after ${options.timeoutMs}ms`,
+                    });
+                }
+            }, options.timeoutMs);
+            child.stdout?.on("data", (chunk) => {
+                stdout += chunk.toString("utf8");
+                if (stdout.length > options.maxBuffer) {
+                    child.kill("SIGKILL");
+                }
+            });
+            child.stderr?.on("data", (chunk) => {
+                stderr += chunk.toString("utf8");
+                if (stderr.length > options.maxBuffer) {
+                    child.kill("SIGKILL");
+                }
+            });
+            child.on("error", (err) => {
+                if (settled)
+                    return;
+                settled = true;
+                clearTimeout(timer);
+                resolve({
+                    stdout: truncate(stdout),
+                    stderr: truncate(stderr),
+                    exitCode: null,
+                    durationMs: Date.now() - start,
+                    failed: true,
+                    error: err.message,
+                });
+            });
+            child.on("close", (code) => {
+                if (settled)
+                    return;
+                settled = true;
+                clearTimeout(timer);
+                resolve({
+                    stdout: truncate(stdout),
+                    stderr: truncate(stderr),
+                    exitCode: code,
+                    durationMs: Date.now() - start,
+                    failed: code !== 0,
+                });
+            });
+        });
+    }
+    const resolved = resolveExecutableArgv(options.argv);
+    const [file, ...args] = resolved;
+    if (!file) {
+        return {
+            stdout: "",
+            stderr: "empty command",
+            exitCode: null,
+            durationMs: Date.now() - start,
+            failed: true,
+            error: "empty command",
+        };
+    }
+    // Windows .cmd shims cannot be execFile'd with shell:false; use shell only then.
+    const needsWindowsCmdShell = process.platform === "win32" && /\.(cmd|bat)$/i.test(file);
+    try {
+        const result = await execFileAsync(file, args, {
+            cwd,
+            env,
+            timeout: options.timeoutMs,
+            maxBuffer: options.maxBuffer,
+            windowsHide: true,
+            shell: needsWindowsCmdShell,
+        });
+        return {
+            stdout: truncate(typeof result.stdout === "string" ? result.stdout : String(result.stdout)),
+            stderr: truncate(typeof result.stderr === "string" ? result.stderr : String(result.stderr)),
+            exitCode: 0,
+            durationMs: Date.now() - start,
+            failed: false,
+        };
+    }
+    catch (error) {
+        const err = error;
+        const exitCode = typeof err.code === "number" ? err.code : null;
+        return {
+            stdout: truncate(typeof err.stdout === "string" ? err.stdout : err.stdout ? String(err.stdout) : ""),
+            stderr: truncate(typeof err.stderr === "string" ? err.stderr : err.stderr ? String(err.stderr) : ""),
+            exitCode,
+            durationMs: Date.now() - start,
+            failed: true,
+            error: err.killed
+                ? `timeout after ${options.timeoutMs}ms`
+                : (err.message ?? "execution failed"),
+        };
+    }
+}
 /**
  * AgentDoctor-controlled command runner.
- * Only this boundary can mark execution as blocked-by-enforcement when it refuses to run.
+ * Executes only when executeIfAllowed===true AND policy decision===allow.
+ * Default path uses shell:false with argv parsing (no shell metacharacters).
  */
 export async function runControlledCommand(options) {
+    const root = resolveRealRoot(options.root);
+    const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const maxBuffer = options.maxBuffer ?? DEFAULT_MAX_BUFFER;
+    const useShell = options.useShell === true;
+    let argv;
+    try {
+        argv =
+            options.argv && options.argv.length > 0 ? options.argv : parseArgv(options.command ?? "");
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return buildFailedResult(root, message, "not-executed");
+    }
+    const commandStr = argv.join(" ");
+    if (!commandStr) {
+        return buildFailedResult(root, "empty command", "not-executed");
+    }
     const action = {
         actionId: randomUUID(),
         agentId: "enforcement-runner",
         timestamp: new Date().toISOString(),
         type: "shell",
-        params: { command: options.command },
-        repositoryRoot: options.root,
+        params: { command: commandStr },
+        repositoryRoot: root,
     };
-    const verdict = await evaluateAgentAction(options.root, action, {
+    const verdict = await evaluateAgentAction(root, action, {
         failClosed: options.failClosed === true,
     });
     const blocked = verdict.decision === "block" || verdict.decision === "deny-network";
-    const decision = {
+    if (blocked) {
+        const decision = toDecision(verdict, "blocked-by-enforcement");
+        await appendExecutionAudit(root, {
+            id: auditRecordId(`${commandStr}:${Date.now()}`),
+            command: commandStr,
+            argv,
+            executionStatus: "blocked-by-enforcement",
+            decision: verdict.decision,
+            reason: verdict.reason,
+            at: new Date().toISOString(),
+        });
+        return {
+            decision,
+            enforced: true,
+            notice: `Blocked by AgentDoctor-controlled runner. ${verdict.reason}`,
+        };
+    }
+    if (!options.executeIfAllowed || verdict.decision !== "allow") {
+        const decision = toDecision(verdict, "not-executed");
+        return {
+            decision,
+            enforced: false,
+            notice: verdict.decision === "allow"
+                ? `Policy allow; runner did not execute (executeIfAllowed=false). ${EVALUATE_ONLY}`
+                : `Policy ${verdict.decision}; runner did not execute. ${EVALUATE_ONLY}`,
+        };
+    }
+    if (!useShell) {
+        try {
+            assertArgsInsideRoot(argv, root);
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            const decision = toDecision(verdict, "execution-failed", message);
+            await appendExecutionAudit(root, {
+                id: auditRecordId(`${commandStr}:${Date.now()}`),
+                command: commandStr,
+                argv,
+                executionStatus: "execution-failed",
+                reason: message,
+                at: new Date().toISOString(),
+            });
+            return {
+                decision,
+                enforced: false,
+                notice: `Execution failed: ${message}`,
+            };
+        }
+    }
+    const execResult = await executeArgv({
+        root,
+        argv,
+        timeoutMs,
+        maxBuffer,
+        useShell,
+    });
+    const executionStatus = execResult.failed ? "execution-failed" : "executed";
+    const decision = toDecision(verdict, executionStatus, execResult.error, useShell ? "HIGH RISK: executed via shell=true (explicit --shell flag)" : undefined);
+    await appendExecutionAudit(root, {
+        id: auditRecordId(`${commandStr}:${Date.now()}`),
+        command: commandStr,
+        argv,
+        useShell,
+        executionStatus,
+        exitCode: execResult.exitCode,
+        durationMs: execResult.durationMs,
+        stdout: execResult.stdout,
+        stderr: execResult.stderr,
+        ...(execResult.error ? { error: execResult.error } : {}),
+        at: new Date().toISOString(),
+    });
+    return {
+        decision,
+        enforced: false,
+        notice: execResult.failed
+            ? `Execution failed${execResult.error ? `: ${execResult.error}` : ""}`
+            : useShell
+                ? "Executed under AgentDoctor control with shell=true (HIGH RISK)."
+                : "Executed under AgentDoctor control (shell=false).",
+        stdout: execResult.stdout,
+        stderr: execResult.stderr,
+        exitCode: execResult.exitCode,
+        durationMs: execResult.durationMs,
+    };
+}
+function toDecision(verdict, executionStatus, extraReason, riskNote) {
+    return {
         actionId: verdict.actionId,
         decision: verdict.decision,
-        reason: verdict.reason,
+        reason: [verdict.reason, extraReason, riskNote].filter(Boolean).join(" | "),
         ...(verdict.policyId ? { policyId: verdict.policyId } : {}),
         policyVersion: "2.0",
         inputClassification: "shell",
         evidence: [{ id: "ev_policy", kind: "observed", detail: verdict.reason }],
         riskLevel: verdict.riskLevel,
-        executionStatus: blocked
-            ? "blocked-by-enforcement"
-            : options.executeIfAllowed && verdict.decision === "allow"
-                ? "not-executed"
-                : "not-executed",
+        executionStatus,
         approvalStatus: verdict.approvalStatus,
         timestamp: new Date().toISOString(),
     };
+}
+function buildFailedResult(_root, message, executionStatus) {
     return {
-        decision,
-        enforced: blocked,
-        notice: blocked
-            ? `Blocked by AgentDoctor-controlled runner. ${EVALUATE_ONLY}`
-            : `Policy ${verdict.decision}; runner did not execute. ${EVALUATE_ONLY}`,
+        decision: {
+            actionId: randomUUID(),
+            decision: "block",
+            reason: message,
+            policyVersion: "2.0",
+            inputClassification: "shell",
+            evidence: [{ id: "ev_parse", kind: "observed", detail: message }],
+            riskLevel: "high",
+            executionStatus,
+            approvalStatus: "not-required",
+            timestamp: new Date().toISOString(),
+        },
+        enforced: executionStatus === "blocked-by-enforcement",
+        notice: message,
     };
 }
 /** Append-only tamper-evident audit chain (HMAC over previous hash). */
@@ -54,3 +449,59 @@ export function appendAuditChain(previousHash, record, secret = "local-dev-audit
 export function auditRecordId(parts) {
     return `audit_${createHash("sha1").update(parts).digest("hex").slice(0, 12)}`;
 }
+/**
+ * Explain what the controlled runner would do for a command (evaluate-only).
+ * Does not execute.
+ */
+export async function explainControlledRun(options) {
+    const root = resolveRealRoot(options.root);
+    let argv;
+    try {
+        argv =
+            options.argv && options.argv.length > 0 ? options.argv : parseArgv(options.command ?? "");
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return {
+            command: options.command ?? "",
+            argv: [],
+            useShell: options.useShell === true,
+            decision: "block",
+            reason: message,
+            policyId: null,
+            riskLevel: "high",
+            wouldExecute: false,
+            executionResult: "not-executed",
+            notice: EVALUATE_ONLY,
+            meaning: "Command could not be parsed for controlled execution.",
+        };
+    }
+    const commandStr = argv.join(" ");
+    const action = {
+        actionId: randomUUID(),
+        agentId: "enforcement-explain",
+        timestamp: new Date().toISOString(),
+        type: "shell",
+        params: { command: commandStr },
+        repositoryRoot: root,
+    };
+    const verdict = await evaluateAgentAction(root, action, {
+        failClosed: options.failClosed === true,
+    });
+    const wouldExecute = verdict.decision === "allow";
+    return {
+        command: commandStr,
+        argv,
+        useShell: options.useShell === true,
+        decision: verdict.decision,
+        reason: verdict.reason,
+        policyId: verdict.policyId ?? null,
+        riskLevel: verdict.riskLevel,
+        wouldExecute,
+        executionResult: "not-executed",
+        notice: EVALUATE_ONLY,
+        meaning: wouldExecute
+            ? "Policy allow — `agentdoctor run` would execute under AgentDoctor control (still not claimed as enterprise interception)."
+            : "Policy would block or require approval — controlled runner will not execute.",
+    };
+}

package/dist/index.d.ts

@@ -2,9 +2,22 @@ export { CONTRACTS_VERSION, DEFAULT_FEATURE_FLAGS } from "./contracts/index.js";
 export { buildIntelligenceGraph } from "./intelligence/graph/build.js";
 export { analyzeGitIntelligence } from "./intelligence/git/analyze.js";
 export { buildC4Views } from "./architecture/c4.js";
+export { loadArchitectureContract, checkArchitecture, checkArchitectureAtRoot, initArchitecture, explainArchitecture, DEFAULT_ARCHITECTURE_CONTRACT, } from "./architecture/contract.js";
+export type { ArchitectureContract, ArchitectureViolation, ArchitectureCheckResult, } from "./architecture/contract.js";
+export { loadCoverage, parseLcov, parseIstanbul, parseCobertura } from "./coverage/load.js";
+export type { NormalizedCoverage, CoverageFormat, CoverageFile } from "./coverage/types.js";
+export { parseSourceFile, languageAdapters, detectLanguage } from "./languages/index.js";
+export type { LanguageAdapter, ParseResult, LanguageId } from "./languages/index.js";
 export { createKnowledgeRecord, listKnowledge, transitionKnowledge, retrieveAuthoritative, } from "./knowledge/store.js";
-export { FilesystemStorageProvider, MemoryStorageProvider } from "./storage/provider.js";
-export { runControlledCommand } from "./enforcement/runner.js";
+export { FilesystemStorageProvider, MemoryStorageProvider, tryCreateSqliteStorage, tryCreatePostgresStorage, } from "./storage/provider.js";
+export { SqliteStorageProvider } from "./storage/sqlite.js";
+export { PostgresStorageProvider } from "./storage/postgres.js";
+export { LocalIdentityProvider, OidcIdentityProvider, hasRbacPermission } from "./auth/index.js";
+export type { IdentityClaims, IdentityProvider, RbacRole, RbacPermission } from "./auth/index.js";
+export { initWorkspace, listWorkspaces, loadWorkspace, addRepositoryToWorkspace, removeWorkspace, workspaceStatus, assertWorkspacePathAccess, readFileWithinWorkspace, } from "./workspace/index.js";
+export type { WorkspaceModel } from "./workspace/index.js";
+export { composePolicy, explainComposedDecision } from "./policy/compose.js";
+export { runControlledCommand, parseArgv, assertArgsInsideRoot, explainControlledRun, } from "./enforcement/runner.js";
 export { registerLocalDevUser, authenticateLocalDev, authorize } from "./team/auth.js";
 export { runProjectInit, listProposals, reviewProposal } from "./core/brain-product/init.js";
 export { collectOpsHealth } from "./ops/health.js";
@@ -14,6 +27,14 @@ export { scan } from "./core/scanner/scan.js";
 export { verify } from "./core/verify/verify.js";
 export { compareFindings } from "./core/verify/compare.js";
 export { PACKAGE_VERSION } from "./constants.js";
+export { analyzeChange, verifyChange, inspectEvidence, verifyEvidence, explainChange, diffChange, changeStatus, deriveGraphChangeImpact, derivePackageImpact, EVIDENCE_SCHEMA_VERSION, } from "./assurance/change.js";
+export type { ChangeAssessment, EvidenceManifest, VerificationStatus } from "./assurance/change.js";
+export { buildProofFromEvidence, inspectProof, verifyProof, exportProof, explainProof, } from "./assurance/proof.js";
+export type { ChangeProof, IntegrityStatus, CorrectnessStatus, EngineeringChecksStatus, ProofVerificationState, } from "./assurance/proof.js";
+export { assertInsideRepo, resolveSafeRepoPath, safeRelPath, PathEscapeError, } from "./security/paths.js";
+export { resolveImportSpecifier, resolveImportEdges, loadTsconfigPaths, } from "./intelligence/resolve/imports.js";
+export type { ImportConfidence, ImportResolutionResult, TsconfigPathsConfig, } from "./intelligence/resolve/imports.js";
+export { graphBuild, graphUpdate, graphRebuild, graphStatus, } from "./intelligence/graph/incremental.js";
 export type { ScanOptions, ScanResult, RepositoryInfo, Finding, FindingsSummary, Scores, AgentPresence, AgentDetectionResult, AgentSecurityAnalysisMode, CliOptions, ExitCode, } from "./types/index.js";
 export type { VerifyResult, VerifyOptions } from "./core/verify/verify.js";
 export type { VerifyFindingRef, FindingCompareResult } from "./core/verify/compare.js";
@@ -29,3 +50,16 @@ export { runFix } from "./core/fix/run.js";
 export { evaluatePolicy, evaluateScanPolicy, evaluateVerifyPolicy, parseFailOnRules, parseSeverityGate, } from "./core/policy/evaluate.js";
 export type { PolicyOptions, PolicyViolation, PolicyViolationCode, PolicyInput, } from "./core/policy/evaluate.js";
 export type { FixPlan, FixAction, FixApplyResult } from "./core/fix/types.js";
+/** AgentDoctor 2.1 AI provider layer (optional — core works without AI). */
+export { createModelProvider, loadAiConfig, publicAiConfig, redactForModel, AI_PROVIDER_REQUIRED_MESSAGE, NoneModelProvider, MockModelProvider, OpenAiCompatibleProvider, } from "./ai/index.js";
+export type { AiConfig, AiProviderId, ChatMessage, ChatRequest, ChatResponse, ModelMetadata, ModelProvider, ToolSpec, ToolCallRequest, TokenUsage, } from "./ai/index.js";
+/** AgentDoctor 2.1 Project AI Agent core (M1 scaffolding). */
+export { AgentState, AgentStateMachine, AgentRuntime, DEFAULT_AGENT_LIMITS, retrieveProjectContext, truthLabelHelp, minTruth, } from "./agent/index.js";
+export type { AgentLimits, AgentAuditEvent, AgentRuntimeOptions, AgentTurnResult, AgentStateTransition, ContextBundle, ContextCitation, EvidenceType, TruthLabel, RetrieveContextOptions, } from "./agent/index.js";
+export { ChatService, createChatService, ChatMemory, CHAT_PROVIDER_NONE_MESSAGE, buildChatTurnResponse, formatChatResponseForCli, summarizeProjectForChat, } from "./agent/chat/index.js";
+export type { ChatTurnResponse, ChatServiceOptions, TruthClaim, ProjectChatSummary, } from "./agent/chat/index.js";
+/** AgentDoctor 2.1 agent tools + plan (M3). */
+export { listAgentToolSpecs, getToolSpec, riskForTool, executeAgentTool, isReadTool, newToolCall, evaluateApproval, formatApprovalPrompt, buildAgentPlan, formatAgentPlan, approvePlan, runCodingLoop, verifyAgentWork, formatVerificationReport, } from "./agent/index.js";
+export type { AgentToolName, AgentToolSpec, AgentToolCall, AgentToolResult, AgentRiskLevel, ApprovalRequest, ApprovalResult, ApprovalDecision, AgentPlan, AgentPlanStep, CodingLoopOptions, CodingLoopResult, AgentVerificationReport, VerificationCheck, } from "./agent/index.js";
+export { getModeProfile, defaultStudentMode, parseAgentMode, modeAllowsMutation, modeBlocksToolCategory, StudentService, } from "./agent/index.js";
+export type { AgentMode, ModeProfile, StudentDocSection, BuildWithMeResult, } from "./agent/index.js";

package/dist/index.js

@@ -2,9 +2,17 @@ export { CONTRACTS_VERSION, DEFAULT_FEATURE_FLAGS } from "./contracts/index.js";
 export { buildIntelligenceGraph } from "./intelligence/graph/build.js";
 export { analyzeGitIntelligence } from "./intelligence/git/analyze.js";
 export { buildC4Views } from "./architecture/c4.js";
+export { loadArchitectureContract, checkArchitecture, checkArchitectureAtRoot, initArchitecture, explainArchitecture, DEFAULT_ARCHITECTURE_CONTRACT, } from "./architecture/contract.js";
+export { loadCoverage, parseLcov, parseIstanbul, parseCobertura } from "./coverage/load.js";
+export { parseSourceFile, languageAdapters, detectLanguage } from "./languages/index.js";
 export { createKnowledgeRecord, listKnowledge, transitionKnowledge, retrieveAuthoritative, } from "./knowledge/store.js";
-export { FilesystemStorageProvider, MemoryStorageProvider } from "./storage/provider.js";
-export { runControlledCommand } from "./enforcement/runner.js";
+export { FilesystemStorageProvider, MemoryStorageProvider, tryCreateSqliteStorage, tryCreatePostgresStorage, } from "./storage/provider.js";
+export { SqliteStorageProvider } from "./storage/sqlite.js";
+export { PostgresStorageProvider } from "./storage/postgres.js";
+export { LocalIdentityProvider, OidcIdentityProvider, hasRbacPermission } from "./auth/index.js";
+export { initWorkspace, listWorkspaces, loadWorkspace, addRepositoryToWorkspace, removeWorkspace, workspaceStatus, assertWorkspacePathAccess, readFileWithinWorkspace, } from "./workspace/index.js";
+export { composePolicy, explainComposedDecision } from "./policy/compose.js";
+export { runControlledCommand, parseArgv, assertArgsInsideRoot, explainControlledRun, } from "./enforcement/runner.js";
 export { registerLocalDevUser, authenticateLocalDev, authorize } from "./team/auth.js";
 export { runProjectInit, listProposals, reviewProposal } from "./core/brain-product/init.js";
 export { collectOpsHealth } from "./ops/health.js";
@@ -14,6 +22,11 @@ export { scan } from "./core/scanner/scan.js";
 export { verify } from "./core/verify/verify.js";
 export { compareFindings } from "./core/verify/compare.js";
 export { PACKAGE_VERSION } from "./constants.js";
+export { analyzeChange, verifyChange, inspectEvidence, verifyEvidence, explainChange, diffChange, changeStatus, deriveGraphChangeImpact, derivePackageImpact, EVIDENCE_SCHEMA_VERSION, } from "./assurance/change.js";
+export { buildProofFromEvidence, inspectProof, verifyProof, exportProof, explainProof, } from "./assurance/proof.js";
+export { assertInsideRepo, resolveSafeRepoPath, safeRelPath, PathEscapeError, } from "./security/paths.js";
+export { resolveImportSpecifier, resolveImportEdges, loadTsconfigPaths, } from "./intelligence/resolve/imports.js";
+export { graphBuild, graphUpdate, graphRebuild, graphStatus, } from "./intelligence/graph/incremental.js";
 export { EXIT_CODES } from "./types/index.js";
 export { agentRegistry } from "./agents/registry.js";
 export { detectAgents } from "./agents/detect-agents.js";
@@ -23,3 +36,11 @@ export { buildFixPlan } from "./core/fix/plan.js";
 export { applyFixPlan } from "./core/fix/apply.js";
 export { runFix } from "./core/fix/run.js";
 export { evaluatePolicy, evaluateScanPolicy, evaluateVerifyPolicy, parseFailOnRules, parseSeverityGate, } from "./core/policy/evaluate.js";
+/** AgentDoctor 2.1 AI provider layer (optional — core works without AI). */
+export { createModelProvider, loadAiConfig, publicAiConfig, redactForModel, AI_PROVIDER_REQUIRED_MESSAGE, NoneModelProvider, MockModelProvider, OpenAiCompatibleProvider, } from "./ai/index.js";
+/** AgentDoctor 2.1 Project AI Agent core (M1 scaffolding). */
+export { AgentState, AgentStateMachine, AgentRuntime, DEFAULT_AGENT_LIMITS, retrieveProjectContext, truthLabelHelp, minTruth, } from "./agent/index.js";
+export { ChatService, createChatService, ChatMemory, CHAT_PROVIDER_NONE_MESSAGE, buildChatTurnResponse, formatChatResponseForCli, summarizeProjectForChat, } from "./agent/chat/index.js";
+/** AgentDoctor 2.1 agent tools + plan (M3). */
+export { listAgentToolSpecs, getToolSpec, riskForTool, executeAgentTool, isReadTool, newToolCall, evaluateApproval, formatApprovalPrompt, buildAgentPlan, formatAgentPlan, approvePlan, runCodingLoop, verifyAgentWork, formatVerificationReport, } from "./agent/index.js";
+export { getModeProfile, defaultStudentMode, parseAgentMode, modeAllowsMutation, modeBlocksToolCategory, StudentService, } from "./agent/index.js";

package/dist/intelligence/graph/build.d.ts

@@ -1,5 +1,7 @@
 import type { RepositoryGraph } from "../../platform/types.js";
 export type GraphBuilderMode = "regex" | "typescript-ast" | "auto";
+export declare function nodeId(kind: string, key: string): string;
+export declare function listTsFiles(root: string, limit?: number): Promise<string[]>;
 /**
  * TypeScript compiler API based graph enrichment.
  * Falls back to regex graph when mode=regex or on failure.