@praneeth_54/agentdoctor 2.1.0 → 3.0.0

package/dist/product/truth.js

@@ -0,0 +1,30 @@
+const TRUTH_ORDER = [
+    "VERIFIED",
+    "INFERRED",
+    "PARTIAL",
+    "EXPERIMENTAL",
+    "UNKNOWN",
+    "EXTERNAL",
+];
+/** Never promote weaker evidence to stronger by accident. */
+export function minProductTruth(a, b) {
+    const ia = TRUTH_ORDER.indexOf(a);
+    const ib = TRUTH_ORDER.indexOf(b);
+    return TRUTH_ORDER[Math.max(ia, ib)];
+}
+export function truthLabelDescription(label) {
+    switch (label) {
+        case "VERIFIED":
+            return "Directly supported by repository file evidence.";
+        case "INFERRED":
+            return "Heuristic or pattern match; not fully verified.";
+        case "PARTIAL":
+            return "Some evidence exists; coverage is incomplete.";
+        case "EXPERIMENTAL":
+            return "Early capability; behavior may change.";
+        case "UNKNOWN":
+            return "Cannot be determined from current evidence.";
+        case "EXTERNAL":
+            return "Requires information outside the repository.";
+    }
+}

package/dist/product/twin/digital-twin.d.ts

@@ -0,0 +1,23 @@
+import { getBrainStatus } from "../../core/brain-cli/service.js";
+import { analyzeCodeHealth } from "../health/code-health.js";
+import { type ProjectDna } from "../dna/build.js";
+import type { TruthLabel } from "../truth.js";
+export interface SoftwareDigitalTwin {
+    root: string;
+    generatedAt: string;
+    dna: ProjectDna;
+    brain: Awaited<ReturnType<typeof getBrainStatus>>;
+    graphSummary: {
+        nodeCount: number;
+        edgeCount: number;
+        truth: TruthLabel;
+    };
+    gitSummary: {
+        gitAvailable: boolean;
+        hotspotCount: number;
+        truth: TruthLabel;
+    };
+    health: Awaited<ReturnType<typeof analyzeCodeHealth>>;
+    limitations: string[];
+}
+export declare function buildSoftwareDigitalTwinSnapshot(rootInput: string): Promise<SoftwareDigitalTwin>;

package/dist/product/twin/digital-twin.js

@@ -0,0 +1,52 @@
+import { getBrainStatus } from "../../core/brain-cli/service.js";
+import { buildIntelligenceGraph } from "../../intelligence/graph/build.js";
+import { analyzeGitIntelligence } from "../../intelligence/git/analyze.js";
+import { analyzeCodeHealth } from "../health/code-health.js";
+import { buildProjectDna } from "../dna/build.js";
+import { resolveRepoRoot } from "../../utils/path.js";
+export async function buildSoftwareDigitalTwinSnapshot(rootInput) {
+    const root = resolveRepoRoot(rootInput);
+    const limitations = [
+        "Digital twin is a deterministic snapshot of local analyzers, not live runtime state.",
+        "Graph summary may be partial when graph build skips files.",
+    ];
+    const [dna, brain, git] = await Promise.all([
+        buildProjectDna(root),
+        getBrainStatus(root),
+        analyzeGitIntelligence(root),
+    ]);
+    let nodeCount = 0;
+    let edgeCount = 0;
+    let graphTruth = "UNKNOWN";
+    try {
+        const graph = await buildIntelligenceGraph({ root, mode: "auto" });
+        nodeCount = graph.nodes.length;
+        edgeCount = graph.edges.length;
+        graphTruth = "INFERRED";
+        if (graph.limitations?.length) {
+            limitations.push(...graph.limitations.slice(0, 3));
+        }
+    }
+    catch {
+        limitations.push("Intelligence graph build failed for twin snapshot.");
+    }
+    const healthWithGit = await analyzeCodeHealth(root, { gitReport: git });
+    return {
+        root,
+        generatedAt: new Date().toISOString(),
+        dna,
+        brain,
+        graphSummary: {
+            nodeCount,
+            edgeCount,
+            truth: graphTruth,
+        },
+        gitSummary: {
+            gitAvailable: git.gitAvailable,
+            hotspotCount: git.hotspots.length,
+            truth: git.gitAvailable ? "INFERRED" : "UNKNOWN",
+        },
+        health: healthWithGit,
+        limitations,
+    };
+}

package/dist/product/twin/store.d.ts

@@ -0,0 +1,21 @@
+import type { SoftwareDigitalTwin } from "./digital-twin.js";
+export interface TwinSnapshotMeta {
+    root: string;
+    generatedAt: string;
+    invalidationHash: string;
+    changedFiles?: string[];
+}
+export interface StoredTwinSnapshot {
+    meta: TwinSnapshotMeta;
+    twin: SoftwareDigitalTwin;
+}
+export declare function loadTwinSnapshot(rootInput: string): Promise<StoredTwinSnapshot | null>;
+export declare function saveTwinSnapshot(rootInput: string, twin: SoftwareDigitalTwin, meta: Omit<TwinSnapshotMeta, "generatedAt"> & {
+    generatedAt?: string;
+}): Promise<string>;
+export declare function invalidateTwinSnapshot(rootInput: string): Promise<void>;
+export declare function updateTwin(rootInput: string, options?: {
+    changedFiles?: string[];
+    force?: boolean;
+}): Promise<SoftwareDigitalTwin>;
+export declare function buildSoftwareDigitalTwin(rootInput: string): Promise<SoftwareDigitalTwin>;

package/dist/product/twin/store.js

@@ -0,0 +1,70 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+import { createHash } from "node:crypto";
+import { DEFAULT_MAX_FILE_SIZE_BYTES } from "../../constants.js";
+import { atomicWriteTextFile, pathExists, readJsonFile } from "../../utils/fs.js";
+import { resolveRepoRoot } from "../../utils/path.js";
+import { buildSoftwareDigitalTwinSnapshot } from "./digital-twin.js";
+function twinDir(root) {
+    return path.join(resolveRepoRoot(root), ".agentdoctor", "twin");
+}
+function snapshotPath(root) {
+    return path.join(twinDir(root), "snapshot.json");
+}
+function hashInputs(changedFiles) {
+    const payload = (changedFiles ?? []).slice().sort().join("\n");
+    return createHash("sha256").update(payload).digest("hex").slice(0, 16);
+}
+export async function loadTwinSnapshot(rootInput) {
+    const root = resolveRepoRoot(rootInput);
+    const parsed = await readJsonFile(snapshotPath(root), DEFAULT_MAX_FILE_SIZE_BYTES);
+    if (!parsed.ok)
+        return null;
+    if (parsed.data.meta.root !== root)
+        return null;
+    return parsed.data;
+}
+export async function saveTwinSnapshot(rootInput, twin, meta) {
+    const root = resolveRepoRoot(rootInput);
+    const file = snapshotPath(root);
+    await fs.mkdir(path.dirname(file), { recursive: true });
+    const stored = {
+        meta: {
+            root,
+            generatedAt: meta.generatedAt ?? new Date().toISOString(),
+            invalidationHash: meta.invalidationHash,
+            ...(meta.changedFiles?.length ? { changedFiles: meta.changedFiles } : {}),
+        },
+        twin,
+    };
+    await atomicWriteTextFile(file, `${JSON.stringify(stored, null, 2)}\n`);
+    return file;
+}
+export async function invalidateTwinSnapshot(rootInput) {
+    const root = resolveRepoRoot(rootInput);
+    const file = snapshotPath(root);
+    if (await pathExists(file)) {
+        await fs.rm(file, { force: true });
+    }
+}
+export async function updateTwin(rootInput, options) {
+    const root = resolveRepoRoot(rootInput);
+    const invalidationHash = hashInputs(options?.changedFiles);
+    const existing = options?.force ? null : await loadTwinSnapshot(root);
+    if (existing &&
+        existing.meta.invalidationHash === invalidationHash &&
+        existing.twin.root === root) {
+        return existing.twin;
+    }
+    await invalidateTwinSnapshot(root);
+    const twin = await buildSoftwareDigitalTwinSnapshot(root);
+    await saveTwinSnapshot(root, twin, {
+        root,
+        invalidationHash,
+        ...(options?.changedFiles?.length ? { changedFiles: options.changedFiles } : {}),
+    });
+    return twin;
+}
+export async function buildSoftwareDigitalTwin(rootInput) {
+    return updateTwin(rootInput);
+}

package/dist/product/whatif/engine.d.ts

@@ -0,0 +1,28 @@
+import type { TruthLabel } from "../truth.js";
+export interface WhatIfAffectedItem {
+    pathOrSymbol: string;
+    role: "changed" | "caller" | "callee" | "reverse-dependency";
+    truth: TruthLabel;
+}
+export interface WhatIfReport {
+    root: string;
+    target: string;
+    affected: WhatIfAffectedItem[];
+    limitations: string[];
+}
+export declare function analyzeWhatIf(rootInput: string, target: string, options?: {
+    graph?: {
+        nodes: Array<{
+            id: string;
+            kind: string;
+            label: string;
+            path?: string;
+        }>;
+        edges: Array<{
+            from: string;
+            to: string;
+            kind: string;
+        }>;
+    };
+    buildGraph?: boolean;
+}): Promise<WhatIfReport>;

package/dist/product/whatif/engine.js

@@ -0,0 +1,70 @@
+import { deriveGraphChangeImpact } from "../../assurance/change.js";
+import { buildIntelligenceGraph } from "../../intelligence/graph/build.js";
+import { resolveRepoRoot } from "../../utils/path.js";
+import { minProductTruth } from "../truth.js";
+function normalizeTarget(target) {
+    return target.replace(/\\/g, "/").replace(/^\.\//, "");
+}
+export async function analyzeWhatIf(rootInput, target, options) {
+    const root = resolveRepoRoot(rootInput);
+    const normalized = normalizeTarget(target);
+    const limitations = [
+        "Impact analysis uses intelligence graph import/call edges when available.",
+        "Symbol-level precision depends on graph node coverage.",
+    ];
+    let graph = options?.graph;
+    if (!graph && options?.buildGraph !== false) {
+        try {
+            graph = await buildIntelligenceGraph({ root, mode: "auto" });
+        }
+        catch {
+            limitations.push("Graph build failed; impact may be empty.");
+        }
+    }
+    if (!graph) {
+        limitations.push("No graph provided or built; only the target file is listed.");
+        return {
+            root,
+            target: normalized,
+            affected: [
+                {
+                    pathOrSymbol: normalized,
+                    role: "changed",
+                    truth: "VERIFIED",
+                },
+            ],
+            limitations,
+        };
+    }
+    const changedFiles = [{ path: normalized, kind: "modified" }];
+    const impact = deriveGraphChangeImpact(graph, changedFiles, []);
+    const affected = [
+        {
+            pathOrSymbol: normalized,
+            role: "changed",
+            truth: "VERIFIED",
+        },
+    ];
+    for (const c of impact.callers) {
+        affected.push({
+            pathOrSymbol: c,
+            role: "caller",
+            truth: minProductTruth("INFERRED", "PARTIAL"),
+        });
+    }
+    for (const c of impact.callees) {
+        affected.push({
+            pathOrSymbol: c,
+            role: "callee",
+            truth: minProductTruth("INFERRED", "PARTIAL"),
+        });
+    }
+    for (const c of impact.reverseDependencies) {
+        affected.push({
+            pathOrSymbol: c,
+            role: "reverse-dependency",
+            truth: minProductTruth("INFERRED", "PARTIAL"),
+        });
+    }
+    return { root, target: normalized, affected, limitations };
+}

package/dist/utils/fs.js

@@ -1,3 +1,4 @@
+import { randomBytes } from "node:crypto";
 import fs from "node:fs/promises";
 import path from "node:path";
 export async function pathExists(target) {
@@ -68,8 +69,15 @@ export async function listDirectorySafe(dirPath) {
 export async function atomicWriteTextFile(filePath, content) {
     const dir = path.dirname(filePath);
     await fs.mkdir(dir, { recursive: true });
-    const tmp = path.join(dir, `.${path.basename(filePath)}.agentdoctor.${process.pid}.${Date.now()}.tmp`);
-    await fs.writeFile(tmp, content, "utf8");
+    const tmp = path.join(dir, `.${path.basename(filePath)}.${randomBytes(16).toString("hex")}.tmp`);
+    // Exclusive create + owner-only mode — closes CodeQL js/insecure-temporary-file.
+    const handle = await fs.open(tmp, "wx", 0o600);
+    try {
+        await handle.writeFile(content, "utf8");
+    }
+    finally {
+        await handle.close();
+    }
     try {
         await replaceFile(tmp, filePath);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@praneeth_54/agentdoctor",
-  "version": "2.1.0",
+  "version": "3.0.0",
   "description": "Engineering assurance for AI coding agents — repository intelligence, change evidence, safety controls, and MCP tools.",
   "type": "module",
   "bin": {