@praneeth_54/agentdoctor 2.1.0 → 3.0.0

package/dist/product/search/software-search.js

@@ -0,0 +1,100 @@
+import path from "node:path";
+import { loadLatestBrain, searchBrain } from "../../core/brain-cli/service.js";
+import { detectProject } from "../../detectors/project.js";
+import { readTextFile } from "../../utils/fs.js";
+import { resolveRepoRoot } from "../../utils/path.js";
+import { buildIndex, documentId, searchHybrid } from "./index.js";
+export async function searchSymbolsAndConcepts(rootInput, query, options) {
+    const root = resolveRepoRoot(rootInput);
+    const q = query.trim();
+    const maxHits = options?.maxHits ?? 40;
+    const maxFiles = options?.maxFiles ?? 300;
+    const limitations = [
+        "Search combines TF-IDF keyword index + brain claims + bounded filename/content scan.",
+        "TF-IDF is lexical — not neural embeddings or semantic code search.",
+        "Content substring hits are INFERRED.",
+    ];
+    if (!q) {
+        return { root, query: q, hits: [], limitations: [...limitations, "Empty query"] };
+    }
+    const hits = [];
+    const qLower = q.toLowerCase();
+    const brain = await loadLatestBrain(root);
+    if (brain) {
+        for (const bh of searchBrain(brain, q)) {
+            hits.push({
+                kind: "brain",
+                path: ".agentdoctor/project-brain",
+                excerpt: bh.text,
+                score: bh.score + 0.2,
+                truth: "INFERRED",
+            });
+        }
+    }
+    else {
+        limitations.push("No project brain snapshot; brain search skipped.");
+    }
+    const detection = await detectProject(root);
+    let filesScanned = 0;
+    const indexDocs = [];
+    const substringHits = [];
+    for (const entry of detection.discovery.files) {
+        if (filesScanned >= maxFiles)
+            break;
+        const rel = entry.relativePath.replace(/\\/g, "/");
+        filesScanned += 1;
+        const base = path.basename(rel).toLowerCase();
+        if (base.includes(qLower)) {
+            hits.push({
+                kind: "filename",
+                path: rel,
+                excerpt: rel,
+                score: 1.1,
+                truth: "VERIFIED",
+            });
+        }
+        const text = await readTextFile(path.join(root, rel), 256 * 1024);
+        if (text === null)
+            continue;
+        indexDocs.push({
+            id: documentId(rel, text),
+            path: rel,
+            text: `${rel}\n${text.slice(0, 8_000)}`,
+        });
+        const idx = text.toLowerCase().indexOf(qLower);
+        if (idx >= 0) {
+            const line = text.slice(0, idx).split("\n").length;
+            const lineText = text.split(/\r?\n/)[line - 1]?.trim() ?? "";
+            substringHits.push({
+                path: rel,
+                line,
+                excerpt: lineText.slice(0, 140),
+                score: 1,
+            });
+        }
+    }
+    if (filesScanned >= maxFiles) {
+        limitations.push(`Content scan capped at ${maxFiles} files`);
+    }
+    if (indexDocs.length) {
+        const index = buildIndex(indexDocs);
+        limitations.push(...index.limitations);
+        for (const h of searchHybrid(index, q, substringHits, maxHits)) {
+            hits.push({
+                kind: h.kind === "tfidf" ? "tfidf" : "content",
+                path: h.path,
+                ...(h.line !== undefined ? { line: h.line } : {}),
+                excerpt: h.excerpt,
+                score: h.score,
+                truth: h.kind === "tfidf" ? "INFERRED" : "INFERRED",
+            });
+        }
+    }
+    hits.sort((a, b) => b.score - a.score || a.path.localeCompare(b.path));
+    return {
+        root,
+        query: q,
+        hits: hits.slice(0, maxHits),
+        limitations,
+    };
+}

package/dist/product/security/doctor.d.ts

@@ -0,0 +1,23 @@
+import { type SecretFinding } from "../../core/secrets/scan.js";
+import type { ProductEvidence, TruthLabel } from "../truth.js";
+export interface SecurityPatternFinding {
+    id: string;
+    title: string;
+    truth: TruthLabel;
+    evidence: ProductEvidence[];
+}
+export interface SecurityDoctorReport {
+    root: string;
+    /** Local heuristic rules only — not enterprise SAST. */
+    staticAnalysisLabel: "TECHNICAL_STATIC_ANALYSIS_SUPPORTED";
+    secretScan: {
+        enabled: boolean;
+        filesScanned: number;
+        findings: SecretFinding[];
+        limitations: string[];
+    };
+    authMarkers: SecurityPatternFinding[];
+    dangerousPatterns: SecurityPatternFinding[];
+    limitations: string[];
+}
+export declare function analyzeSecuritySurface(rootInput: string): Promise<SecurityDoctorReport>;

package/dist/product/security/doctor.js

@@ -0,0 +1,124 @@
+import { scanSecrets } from "../../core/secrets/scan.js";
+import { resolveRepoRoot } from "../../utils/path.js";
+import { lineNumberAt, loadProjectSourceFiles } from "../evidence-scan.js";
+const AUTH_MARKERS = [
+    {
+        id: "middleware-auth",
+        title: "Auth middleware marker",
+        re: /\b(?:auth|authenticate|authorize)\s*\(/i,
+    },
+    { id: "laravel-gate", title: "Laravel Gate/Policy marker", re: /\bGate::|\bPolicy\b|\b@can\b/i },
+    { id: "nestjs-guard", title: "NestJS guard/decorator marker", re: /@UseGuards\b|AuthGuard\b/i },
+    {
+        id: "rbac-role",
+        title: "RBAC role/permission marker",
+        re: /\b(?:hasPermission|hasRole|@PreAuthorize|@Roles)\b/i,
+    },
+];
+const DANGEROUS_PATTERNS = [
+    { id: "eval-call", title: "Dynamic eval() (CWE-95)", re: /\beval\s*\(/g },
+    {
+        id: "child-process-exec-string",
+        title: "child_process exec with string literal (CWE-78)",
+        re: /\b(?:exec|execSync)\s*\(\s*['"`]/g,
+    },
+    {
+        id: "child-process-exec-concat",
+        title: "child_process exec with string concatenation (CWE-78)",
+        re: /\b(?:exec|execSync)\s*\(\s*[^)]*\+/g,
+    },
+    {
+        id: "innerhtml-assign",
+        title: "DOM innerHTML assignment (CWE-79)",
+        re: /\.innerHTML\s*=/g,
+    },
+    {
+        id: "path-join-user-input",
+        title: "Path join with request/user input pattern (CWE-22)",
+        re: /\bpath\.(?:join|resolve)\s*\([^)]*(?:req\.|request\.|params\.|query\.|user[A-Z_a-z]*|input)/g,
+    },
+    { id: "shell-exec", title: "Shell invocation helper", re: /\bshell\s*:\s*true\b/g },
+];
+function redactExcerpt(line) {
+    return line
+        .trim()
+        .slice(0, 120)
+        .replace(/['"][^'"]{8,}['"]/g, "'[REDACTED]'");
+}
+export async function analyzeSecuritySurface(rootInput) {
+    const root = resolveRepoRoot(rootInput);
+    const limitations = [
+        "TECHNICAL STATIC ANALYSIS SUPPORTED locally (regex/heuristic rules with file evidence — not full SAST).",
+        "Security doctor uses heuristic pattern scans — not a substitute for SAST/DAST or manual review.",
+        "Secret values are never included; only redacted snippets and rule ids.",
+    ];
+    const secretScan = await scanSecrets({ root, enabled: true, maxFiles: 400 });
+    const { files } = await loadProjectSourceFiles(root, (rel) => /\.(ts|tsx|js|jsx|mjs|cjs|py|php|go)$/i.test(rel));
+    const authMarkers = [];
+    const dangerousPatterns = [];
+    for (const file of files) {
+        for (const marker of AUTH_MARKERS) {
+            marker.re.lastIndex = 0;
+            if (marker.re.test(file.content)) {
+                const idx = file.content.search(marker.re);
+                authMarkers.push({
+                    id: marker.id,
+                    title: marker.title,
+                    truth: "INFERRED",
+                    evidence: [
+                        {
+                            path: file.relativePath,
+                            ...(idx >= 0 ? { line: lineNumberAt(file.content, idx) } : {}),
+                            excerpt: redactExcerpt(file.content.split(/\r?\n/)[Math.max(0, lineNumberAt(file.content, Math.max(idx, 0)) - 1)] ?? ""),
+                        },
+                    ],
+                });
+                break;
+            }
+        }
+        for (const pattern of DANGEROUS_PATTERNS) {
+            pattern.re.lastIndex = 0;
+            let match;
+            while ((match = pattern.re.exec(file.content)) !== null) {
+                const line = lineNumberAt(file.content, match.index);
+                const lineText = file.content.split(/\r?\n/)[line - 1] ?? "";
+                dangerousPatterns.push({
+                    id: pattern.id,
+                    title: pattern.title,
+                    truth: "INFERRED",
+                    evidence: [
+                        {
+                            path: file.relativePath,
+                            line,
+                            excerpt: redactExcerpt(lineText),
+                        },
+                    ],
+                });
+                if (dangerousPatterns.length >= 80)
+                    break;
+            }
+            if (dangerousPatterns.length >= 80)
+                break;
+        }
+        if (dangerousPatterns.length >= 80) {
+            limitations.push("Dangerous pattern finding cap reached (80)");
+            break;
+        }
+    }
+    if (authMarkers.length === 0) {
+        limitations.push("No auth/permission file markers matched heuristics (absence is not proof).");
+    }
+    return {
+        root,
+        staticAnalysisLabel: "TECHNICAL_STATIC_ANALYSIS_SUPPORTED",
+        secretScan: {
+            enabled: secretScan.enabled,
+            filesScanned: secretScan.filesScanned,
+            findings: secretScan.findings,
+            limitations: secretScan.limitations,
+        },
+        authMarkers: authMarkers.slice(0, 40),
+        dangerousPatterns,
+        limitations,
+    };
+}

package/dist/product/self/diagnose.d.ts

@@ -0,0 +1,15 @@
+import type { TruthLabel } from "../truth.js";
+export interface SelfDiagnoseFinding {
+    id: string;
+    label: string;
+    ok: boolean;
+    truth: TruthLabel;
+    evidence: string;
+}
+export interface SelfDiagnoseReport {
+    root: string;
+    ok: boolean;
+    findings: SelfDiagnoseFinding[];
+    limitations: string[];
+}
+export declare function diagnoseAgentDoctorSelf(rootInput?: string): Promise<SelfDiagnoseReport>;

package/dist/product/self/diagnose.js

@@ -0,0 +1,82 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+import { detectProject } from "../../detectors/project.js";
+import { resolveRepoRoot } from "../../utils/path.js";
+import { pathExists } from "../../utils/fs.js";
+const REQUIRED_MODULES = [
+    "src/security/paths.ts",
+    "src/enforcement/runner.ts",
+    "src/assurance/change.ts",
+    "src/intelligence/graph/build.ts",
+];
+export async function diagnoseAgentDoctorSelf(rootInput) {
+    const root = resolveRepoRoot(rootInput ?? process.cwd());
+    const limitations = [
+        "Self-check reports VERIFIED findings only when files/signals are present on disk.",
+        "Does not validate npm publish or CI status.",
+    ];
+    const findings = [];
+    try {
+        const detection = await detectProject(root);
+        const langs = detection.repository.languages ?? [];
+        findings.push({
+            id: "detect-project",
+            label: "detectProject completes",
+            ok: true,
+            truth: "VERIFIED",
+            evidence: `languages=${langs.join(",") || "none"}`,
+        });
+    }
+    catch (error) {
+        findings.push({
+            id: "detect-project",
+            label: "detectProject completes",
+            ok: false,
+            truth: "VERIFIED",
+            evidence: error instanceof Error ? error.message : String(error),
+        });
+    }
+    const testsDir = path.join(root, "tests");
+    const testsExists = await pathExists(testsDir);
+    findings.push({
+        id: "tests-dir",
+        label: "tests/ directory exists",
+        ok: testsExists,
+        truth: testsExists ? "VERIFIED" : "VERIFIED",
+        evidence: testsExists ? "tests/" : "missing tests/",
+    });
+    const pkgPath = path.join(root, "package.json");
+    let scriptsOk = false;
+    let scriptEvidence = "no package.json";
+    if (await pathExists(pkgPath)) {
+        try {
+            const pkg = JSON.parse(await fs.readFile(pkgPath, "utf8"));
+            const scripts = pkg.scripts ?? {};
+            scriptsOk = typeof scripts.test === "string";
+            scriptEvidence = scriptsOk ? `test script present` : "test script missing";
+        }
+        catch {
+            scriptEvidence = "package.json unreadable";
+        }
+    }
+    findings.push({
+        id: "package-test-script",
+        label: "package.json defines test script",
+        ok: scriptsOk,
+        truth: "VERIFIED",
+        evidence: scriptEvidence,
+    });
+    for (const rel of REQUIRED_MODULES) {
+        const abs = path.join(root, rel);
+        const ok = await pathExists(abs);
+        findings.push({
+            id: `module-${rel.replace(/[^\w]/g, "-")}`,
+            label: `Required module ${rel}`,
+            ok,
+            truth: "VERIFIED",
+            evidence: ok ? "present" : "missing",
+        });
+    }
+    const ok = findings.every((f) => f.ok);
+    return { root, ok, findings, limitations };
+}

package/dist/product/techdebt/roadmap.d.ts

@@ -0,0 +1,20 @@
+import type { ProductEvidence, TruthLabel } from "../truth.js";
+export interface TechnicalDebtItem {
+    id: string;
+    category: "todo" | "fixme" | "architecture" | "testing";
+    summary: string;
+    truth: TruthLabel;
+    evidence: ProductEvidence[];
+}
+export interface TechnicalDebtRoadmap {
+    root: string;
+    items: TechnicalDebtItem[];
+    metrics: {
+        todoCount: number;
+        fixmeCount: number;
+        testRatio: number | null;
+        architectureViolations: number;
+    };
+    limitations: string[];
+}
+export declare function buildTechnicalDebtRoadmap(rootInput: string): Promise<TechnicalDebtRoadmap>;

package/dist/product/techdebt/roadmap.js

@@ -0,0 +1,118 @@
+import path from "node:path";
+import { checkArchitectureAtRoot } from "../../architecture/contract.js";
+import { detectProject } from "../../detectors/project.js";
+import { buildRepositoryGraph } from "../../platform/graph/build.js";
+import { readTextFile } from "../../utils/fs.js";
+import { resolveRepoRoot } from "../../utils/path.js";
+function isTestPath(relativePath) {
+    const p = relativePath.toLowerCase();
+    return (p.includes(".test.") ||
+        p.includes(".spec.") ||
+        p.startsWith("tests/") ||
+        p.startsWith("test/") ||
+        p.includes("__tests__/"));
+}
+function isSourcePath(relativePath) {
+    const p = relativePath.toLowerCase();
+    if (isTestPath(p))
+        return false;
+    return /\.(ts|tsx|js|jsx|py|php|go|rs)$/i.test(p);
+}
+export async function buildTechnicalDebtRoadmap(rootInput) {
+    const root = resolveRepoRoot(rootInput);
+    const limitations = [
+        "Roadmap aggregates TODO/FIXME markers, architecture contract violations, and test-ratio heuristics.",
+        "Not a substitute for issue trackers or formal debt scoring.",
+    ];
+    const detection = await detectProject(root);
+    const paths = detection.discovery.files.map((f) => f.relativePath.replace(/\\/g, "/"));
+    const sourceFiles = paths.filter(isSourcePath);
+    const testFiles = paths.filter(isTestPath);
+    let todoCount = 0;
+    let fixmeCount = 0;
+    const items = [];
+    const re = /\b(TODO|FIXME)\b(:[^\n]*)?/g;
+    for (const rel of paths) {
+        const text = await readTextFile(path.join(root, rel), 256 * 1024);
+        if (text === null)
+            continue;
+        re.lastIndex = 0;
+        let match;
+        while ((match = re.exec(text)) !== null) {
+            const kind = match[1] === "FIXME" ? "fixme" : "todo";
+            if (kind === "todo")
+                todoCount++;
+            else
+                fixmeCount++;
+            if (items.filter((i) => i.category === kind).length < 15) {
+                const line = text.slice(0, match.index).split("\n").length;
+                items.push({
+                    id: `${kind}-${rel}-${line}`,
+                    category: kind,
+                    summary: (match[0] ?? kind).trim().slice(0, 100),
+                    truth: "VERIFIED",
+                    evidence: [
+                        {
+                            path: rel,
+                            line,
+                            ...(() => {
+                                const excerpt = text.split(/\r?\n/)[line - 1]?.trim().slice(0, 120);
+                                return excerpt !== undefined && excerpt.length > 0 ? { excerpt } : {};
+                            })(),
+                        },
+                    ],
+                });
+            }
+        }
+    }
+    let architectureViolations = 0;
+    try {
+        const graph = await buildRepositoryGraph(root);
+        const arch = await checkArchitectureAtRoot(root, graph);
+        architectureViolations = arch.violations.length;
+        for (const v of arch.violations.slice(0, 10)) {
+            items.push({
+                id: `arch-${v.ruleId}-${v.fromPath ?? v.toPath ?? "root"}`,
+                category: "architecture",
+                summary: v.description.slice(0, 120),
+                truth: "VERIFIED",
+                evidence: [
+                    {
+                        path: v.fromPath || v.toPath || ".",
+                        excerpt: `${v.ruleId}: ${v.description}`.slice(0, 120),
+                    },
+                ],
+            });
+        }
+    }
+    catch {
+        limitations.push("Architecture contract check unavailable or failed.");
+    }
+    const denom = sourceFiles.length + testFiles.length;
+    const testRatio = denom === 0 ? null : testFiles.length / denom;
+    if (testRatio !== null && testRatio < 0.15) {
+        items.push({
+            id: "testing-low-ratio",
+            category: "testing",
+            summary: `Low test-file ratio (${testRatio.toFixed(3)}) — consider adding tests`,
+            truth: "INFERRED",
+            evidence: [
+                {
+                    path: ".",
+                    excerpt: `tests=${testFiles.length}, sources=${sourceFiles.length}`,
+                },
+            ],
+        });
+    }
+    return {
+        root,
+        items,
+        metrics: {
+            todoCount,
+            fixmeCount,
+            testRatio,
+            architectureViolations,
+        },
+        limitations,
+    };
+}

package/dist/product/testbrain/analyze.d.ts

@@ -0,0 +1,29 @@
+import { type AnalyzeTestImpactOptions, type TestImpactReport } from "../../platform/test-impact/analyze.js";
+import type { RepositoryGraph } from "../../platform/types.js";
+export type FileTestMappingEvidence = "graph-import" | "naming-heuristic" | "impact-recommendation";
+export interface FileTestMapping {
+    sourceFile: string;
+    testFiles: string[];
+    evidence: FileTestMappingEvidence[];
+    confidence: number;
+}
+export interface TestBrainGraphStats {
+    testFileNodes: number;
+    sourceToTestLinks: number;
+    importEdgesFromTests: number;
+}
+export interface TestBrainReport {
+    root: string;
+    staticAnalysisLabel: "TECHNICAL_STATIC_ANALYSIS_SUPPORTED";
+    testImpact: TestImpactReport;
+    fileTestMappings: FileTestMapping[];
+    graphStats: TestBrainGraphStats;
+    limitations: string[];
+}
+export declare function mapTestsFromGraph(graph: RepositoryGraph): Map<string, Set<string>>;
+/**
+ * Test Brain — combines git test-impact with repository graph test↔source import links.
+ * Does not execute tests.
+ */
+export declare function analyzeTestBrain(rootInput: string | AnalyzeTestImpactOptions, maybeOptions?: AnalyzeTestImpactOptions): Promise<TestBrainReport>;
+export declare function persistTestBrainReport(rootInput: string, report: TestBrainReport): Promise<string>;

package/dist/product/testbrain/analyze.js

@@ -0,0 +1,129 @@
+import path from "node:path";
+import { buildRepositoryGraph } from "../../platform/graph/build.js";
+import { analyzeTestImpact, } from "../../platform/test-impact/analyze.js";
+import { writeJsonArtifact } from "../../platform/store.js";
+import { resolveRepoRoot } from "../../utils/path.js";
+function isTestPath(file) {
+    return /\.(test|spec)\./i.test(file) || file.includes("__tests__");
+}
+function resolveRelativeImport(fromFile, specifier) {
+    if (!specifier.startsWith("."))
+        return null;
+    const dir = path.posix.dirname(fromFile.replace(/\\/g, "/"));
+    let resolved = path.posix.normalize(path.posix.join(dir, specifier));
+    if (!resolved.startsWith("."))
+        resolved = resolved.replace(/^\.\//, "");
+    return resolved;
+}
+function sourceCandidatesFromSpecifier(specifier, fromTest) {
+    const base = resolveRelativeImport(fromTest, specifier);
+    if (!base)
+        return [];
+    const exts = [".ts", ".tsx", ".js", ".jsx", ".mjs", ".py", ".go", ".java", ".kt", ".rs", ".dart"];
+    const out = [base];
+    if (!path.posix.extname(base)) {
+        for (const ext of exts)
+            out.push(`${base}${ext}`);
+        out.push(`${base}/index.ts`, `${base}/index.js`);
+    }
+    return [...new Set(out)];
+}
+export function mapTestsFromGraph(graph) {
+    const sourceToTests = new Map();
+    const nodesById = new Map(graph.nodes.map((n) => [n.id, n]));
+    for (const edge of graph.edges) {
+        if (edge.kind !== "imports")
+            continue;
+        const fromNode = nodesById.get(edge.from);
+        const toNode = nodesById.get(edge.to);
+        if (!fromNode?.path || !isTestPath(fromNode.path))
+            continue;
+        const spec = toNode?.meta?.specifier ?? toNode?.label ?? "";
+        if (!spec || !spec.startsWith("."))
+            continue;
+        for (const candidate of sourceCandidatesFromSpecifier(spec, fromNode.path)) {
+            if (!sourceToTests.has(candidate))
+                sourceToTests.set(candidate, new Set());
+            sourceToTests.get(candidate).add(fromNode.path);
+        }
+    }
+    return sourceToTests;
+}
+function mergeMapping(map, sourceFile, testFile, evidence, confidence) {
+    const key = sourceFile.replace(/\\/g, "/");
+    const existing = map.get(key);
+    if (!existing) {
+        map.set(key, {
+            sourceFile: key,
+            testFiles: [testFile],
+            evidence: [evidence],
+            confidence,
+        });
+        return;
+    }
+    if (!existing.testFiles.includes(testFile))
+        existing.testFiles.push(testFile);
+    if (!existing.evidence.includes(evidence))
+        existing.evidence.push(evidence);
+    existing.confidence = Math.max(existing.confidence, confidence);
+    existing.testFiles.sort();
+}
+/**
+ * Test Brain — combines git test-impact with repository graph test↔source import links.
+ * Does not execute tests.
+ */
+export async function analyzeTestBrain(rootInput, maybeOptions) {
+    const options = typeof rootInput === "string" ? { ...(maybeOptions ?? {}), root: rootInput } : rootInput;
+    const root = resolveRepoRoot(options.root ?? process.cwd());
+    const limitations = [
+        "Test Brain wraps test-impact plus graph import heuristics — not mutation testing or coverage oracle.",
+        "Graph file↔test links are import-based for test files only; missing imports are not proven absence of tests.",
+    ];
+    const testImpact = await analyzeTestImpact(options);
+    const graph = await buildRepositoryGraph(root);
+    const graphMap = mapTestsFromGraph(graph);
+    const mappingBySource = new Map();
+    for (const [source, tests] of graphMap) {
+        for (const testFile of tests) {
+            mergeMapping(mappingBySource, source, testFile, "graph-import", 0.85);
+        }
+    }
+    for (const changed of testImpact.changedFiles) {
+        if (isTestPath(changed))
+            continue;
+        const normalized = changed.replace(/\\/g, "/");
+        for (const rec of testImpact.recommendedTests) {
+            if (!rec.reason.includes(normalized))
+                continue;
+            const evidence = rec.evidence === "verified" ? "impact-recommendation" : "naming-heuristic";
+            mergeMapping(mappingBySource, normalized, rec.testPath, evidence, rec.confidence);
+        }
+    }
+    const fileTestMappings = [...mappingBySource.values()].sort((a, b) => a.sourceFile.localeCompare(b.sourceFile));
+    const testFileNodes = graph.nodes.filter((n) => n.kind === "test").length;
+    let importEdgesFromTests = 0;
+    const nodesById = new Map(graph.nodes.map((n) => [n.id, n]));
+    for (const edge of graph.edges) {
+        if (edge.kind !== "imports")
+            continue;
+        const fromNode = nodesById.get(edge.from);
+        if (fromNode?.path && isTestPath(fromNode.path))
+            importEdgesFromTests += 1;
+    }
+    return {
+        root,
+        staticAnalysisLabel: "TECHNICAL_STATIC_ANALYSIS_SUPPORTED",
+        testImpact,
+        fileTestMappings,
+        graphStats: {
+            testFileNodes,
+            sourceToTestLinks: fileTestMappings.reduce((n, m) => n + m.testFiles.length, 0),
+            importEdgesFromTests,
+        },
+        limitations: [...limitations, ...testImpact.limitations, ...graph.limitations.slice(0, 2)],
+    };
+}
+export async function persistTestBrainReport(rootInput, report) {
+    const root = resolveRepoRoot(rootInput);
+    return writeJsonArtifact(root, "reports/test-brain.json", report);
+}

package/dist/product/truth.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Product-layer truth labels (extends agent context labels with maturity markers).
+ */
+export type TruthLabel = "VERIFIED" | "INFERRED" | "UNKNOWN" | "EXTERNAL" | "EXPERIMENTAL" | "PARTIAL";
+export interface ProductEvidence {
+    path: string;
+    line?: number;
+    excerpt?: string;
+}
+/** Never promote weaker evidence to stronger by accident. */
+export declare function minProductTruth(a: TruthLabel, b: TruthLabel): TruthLabel;
+export declare function truthLabelDescription(label: TruthLabel): string;