@qulib/core 0.10.0 → 0.11.0

package/README.md

@@ -368,6 +368,8 @@ A minimal structural snapshot looks like:
 | `qulib_score_automation` | Score local repo test-automation maturity | absolute `repoPath`, optional `includeFullDimensions` |
 | `qulib_score_api` | Discover API endpoints and score their test coverage | absolute `repoPath`, optional `enableTier3`, `includeEndpointDetail` |
 | `qulib_scaffold_tests` | Generate Cypress scaffold from a live URL (`cypress-e2e` only; playwright not yet implemented) | `url`, optional `framework`, `maxPagesToScan`, `recipes` |
+| **`qulib_score_bug_report`** | LLM-as-judge of a learner bug report vs planted-bug target | `report` (title, description, steps, severity), `target` (description, type, severity, expectedBehavior) |
+| **`qulib_score_decisions`** | Pivotal-decision evaluation at agent forks | absolute `forksPath` (JSONL), optional `enableLlmJudge` |
 | `qulib_explore_auth` | Deeper auth-path discovery on unfamiliar apps | `url`, optional `timeoutMs` |
 | `qulib_detect_auth` | Fast single-pass auth pattern guess | `url`, optional `timeoutMs` |
 | `analyze_app` | Legacy alias for `qulib_analyze_app` — kept for backwards compatibility | same as `qulib_analyze_app` |

package/dist/baseline/baseline.schema.d.ts

@@ -7,18 +7,18 @@ import { z } from 'zod';
 export declare const BaselineGapSchema: z.ZodObject<{
     path: z.ZodString;
     severity: z.ZodEnum<["critical", "high", "medium", "low"]>;
-    category: z.ZodEnum<["untested-route", "a11y", "console-error", "broken-link", "auth-surface", "coverage", "untested-api-endpoint"]>;
+    category: z.ZodEnum<["untested-route", "a11y", "console-error", "broken-link", "auth-surface", "coverage", "untested-api-endpoint", "prompt-leakage"]>;
     reason: z.ZodString;
 }, "strip", z.ZodTypeAny, {
     path: string;
     severity: "critical" | "high" | "medium" | "low";
     reason: string;
-    category: "untested-route" | "a11y" | "console-error" | "broken-link" | "auth-surface" | "coverage" | "untested-api-endpoint";
+    category: "untested-route" | "a11y" | "console-error" | "broken-link" | "auth-surface" | "coverage" | "untested-api-endpoint" | "prompt-leakage";
 }, {
     path: string;
     severity: "critical" | "high" | "medium" | "low";
     reason: string;
-    category: "untested-route" | "a11y" | "console-error" | "broken-link" | "auth-surface" | "coverage" | "untested-api-endpoint";
+    category: "untested-route" | "a11y" | "console-error" | "broken-link" | "auth-surface" | "coverage" | "untested-api-endpoint" | "prompt-leakage";
 }>;
 export type BaselineGap = z.infer<typeof BaselineGapSchema>;
 /**
@@ -34,18 +34,18 @@ export declare const BaselineSnapshotSchema: z.ZodObject<{
     gaps: z.ZodArray<z.ZodObject<{
         path: z.ZodString;
         severity: z.ZodEnum<["critical", "high", "medium", "low"]>;
-        category: z.ZodEnum<["untested-route", "a11y", "console-error", "broken-link", "auth-surface", "coverage", "untested-api-endpoint"]>;
+        category: z.ZodEnum<["untested-route", "a11y", "console-error", "broken-link", "auth-surface", "coverage", "untested-api-endpoint", "prompt-leakage"]>;
         reason: z.ZodString;
     }, "strip", z.ZodTypeAny, {
         path: string;
         severity: "critical" | "high" | "medium" | "low";
         reason: string;
-        category: "untested-route" | "a11y" | "console-error" | "broken-link" | "auth-surface" | "coverage" | "untested-api-endpoint";
+        category: "untested-route" | "a11y" | "console-error" | "broken-link" | "auth-surface" | "coverage" | "untested-api-endpoint" | "prompt-leakage";
     }, {
         path: string;
         severity: "critical" | "high" | "medium" | "low";
         reason: string;
-        category: "untested-route" | "a11y" | "console-error" | "broken-link" | "auth-surface" | "coverage" | "untested-api-endpoint";
+        category: "untested-route" | "a11y" | "console-error" | "broken-link" | "auth-surface" | "coverage" | "untested-api-endpoint" | "prompt-leakage";
     }>, "many">;
     label: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
@@ -56,7 +56,7 @@ export declare const BaselineSnapshotSchema: z.ZodObject<{
         path: string;
         severity: "critical" | "high" | "medium" | "low";
         reason: string;
-        category: "untested-route" | "a11y" | "console-error" | "broken-link" | "auth-surface" | "coverage" | "untested-api-endpoint";
+        category: "untested-route" | "a11y" | "console-error" | "broken-link" | "auth-surface" | "coverage" | "untested-api-endpoint" | "prompt-leakage";
     }[];
     gapCount: number;
     savedAt: string;
@@ -69,7 +69,7 @@ export declare const BaselineSnapshotSchema: z.ZodObject<{
         path: string;
         severity: "critical" | "high" | "medium" | "low";
         reason: string;
-        category: "untested-route" | "a11y" | "console-error" | "broken-link" | "auth-surface" | "coverage" | "untested-api-endpoint";
+        category: "untested-route" | "a11y" | "console-error" | "broken-link" | "auth-surface" | "coverage" | "untested-api-endpoint" | "prompt-leakage";
     }[];
     gapCount: number;
     savedAt: string;
@@ -81,7 +81,7 @@ export type BaselineSnapshot = z.infer<typeof BaselineSnapshotSchema>;
  */
 export declare const BaselineDeltaItemSchema: z.ZodObject<{
     path: z.ZodString;
-    category: z.ZodEnum<["untested-route", "a11y", "console-error", "broken-link", "auth-surface", "coverage", "untested-api-endpoint"]>;
+    category: z.ZodEnum<["untested-route", "a11y", "console-error", "broken-link", "auth-surface", "coverage", "untested-api-endpoint", "prompt-leakage"]>;
     severity: z.ZodEnum<["critical", "high", "medium", "low"]>;
     reason: z.ZodString;
     status: z.ZodEnum<["new", "resolved", "severity-increased", "severity-decreased"]>;
@@ -90,13 +90,13 @@ export declare const BaselineDeltaItemSchema: z.ZodObject<{
     path: string;
     severity: "critical" | "high" | "medium" | "low";
     reason: string;
-    category: "untested-route" | "a11y" | "console-error" | "broken-link" | "auth-surface" | "coverage" | "untested-api-endpoint";
+    category: "untested-route" | "a11y" | "console-error" | "broken-link" | "auth-surface" | "coverage" | "untested-api-endpoint" | "prompt-leakage";
 }, {
     status: "new" | "resolved" | "severity-increased" | "severity-decreased";
     path: string;
     severity: "critical" | "high" | "medium" | "low";
     reason: string;
-    category: "untested-route" | "a11y" | "console-error" | "broken-link" | "auth-surface" | "coverage" | "untested-api-endpoint";
+    category: "untested-route" | "a11y" | "console-error" | "broken-link" | "auth-surface" | "coverage" | "untested-api-endpoint" | "prompt-leakage";
 }>;
 export type BaselineDeltaItem = z.infer<typeof BaselineDeltaItemSchema>;
 /**
@@ -112,7 +112,7 @@ export declare const BaselineDeltaSchema: z.ZodObject<{
     confidenceDelta: z.ZodNumber;
     newGaps: z.ZodArray<z.ZodObject<{
         path: z.ZodString;
-        category: z.ZodEnum<["untested-route", "a11y", "console-error", "broken-link", "auth-surface", "coverage", "untested-api-endpoint"]>;
+        category: z.ZodEnum<["untested-route", "a11y", "console-error", "broken-link", "auth-surface", "coverage", "untested-api-endpoint", "prompt-leakage"]>;
         severity: z.ZodEnum<["critical", "high", "medium", "low"]>;
         reason: z.ZodString;
         status: z.ZodEnum<["new", "resolved", "severity-increased", "severity-decreased"]>;
@@ -121,17 +121,17 @@ export declare const BaselineDeltaSchema: z.ZodObject<{
         path: string;
         severity: "critical" | "high" | "medium" | "low";
         reason: string;
-        category: "untested-route" | "a11y" | "console-error" | "broken-link" | "auth-surface" | "coverage" | "untested-api-endpoint";
+        category: "untested-route" | "a11y" | "console-error" | "broken-link" | "auth-surface" | "coverage" | "untested-api-endpoint" | "prompt-leakage";
     }, {
         status: "new" | "resolved" | "severity-increased" | "severity-decreased";
         path: string;
         severity: "critical" | "high" | "medium" | "low";
         reason: string;
-        category: "untested-route" | "a11y" | "console-error" | "broken-link" | "auth-surface" | "coverage" | "untested-api-endpoint";
+        category: "untested-route" | "a11y" | "console-error" | "broken-link" | "auth-surface" | "coverage" | "untested-api-endpoint" | "prompt-leakage";
     }>, "many">;
     resolvedGaps: z.ZodArray<z.ZodObject<{
         path: z.ZodString;
-        category: z.ZodEnum<["untested-route", "a11y", "console-error", "broken-link", "auth-surface", "coverage", "untested-api-endpoint"]>;
+        category: z.ZodEnum<["untested-route", "a11y", "console-error", "broken-link", "auth-surface", "coverage", "untested-api-endpoint", "prompt-leakage"]>;
         severity: z.ZodEnum<["critical", "high", "medium", "low"]>;
         reason: z.ZodString;
         status: z.ZodEnum<["new", "resolved", "severity-increased", "severity-decreased"]>;
@@ -140,17 +140,17 @@ export declare const BaselineDeltaSchema: z.ZodObject<{
         path: string;
         severity: "critical" | "high" | "medium" | "low";
         reason: string;
-        category: "untested-route" | "a11y" | "console-error" | "broken-link" | "auth-surface" | "coverage" | "untested-api-endpoint";
+        category: "untested-route" | "a11y" | "console-error" | "broken-link" | "auth-surface" | "coverage" | "untested-api-endpoint" | "prompt-leakage";
     }, {
         status: "new" | "resolved" | "severity-increased" | "severity-decreased";
         path: string;
         severity: "critical" | "high" | "medium" | "low";
         reason: string;
-        category: "untested-route" | "a11y" | "console-error" | "broken-link" | "auth-surface" | "coverage" | "untested-api-endpoint";
+        category: "untested-route" | "a11y" | "console-error" | "broken-link" | "auth-surface" | "coverage" | "untested-api-endpoint" | "prompt-leakage";
     }>, "many">;
     severityChanges: z.ZodArray<z.ZodObject<{
         path: z.ZodString;
-        category: z.ZodEnum<["untested-route", "a11y", "console-error", "broken-link", "auth-surface", "coverage", "untested-api-endpoint"]>;
+        category: z.ZodEnum<["untested-route", "a11y", "console-error", "broken-link", "auth-surface", "coverage", "untested-api-endpoint", "prompt-leakage"]>;
         severity: z.ZodEnum<["critical", "high", "medium", "low"]>;
         reason: z.ZodString;
         status: z.ZodEnum<["new", "resolved", "severity-increased", "severity-decreased"]>;
@@ -159,13 +159,13 @@ export declare const BaselineDeltaSchema: z.ZodObject<{
         path: string;
         severity: "critical" | "high" | "medium" | "low";
         reason: string;
-        category: "untested-route" | "a11y" | "console-error" | "broken-link" | "auth-surface" | "coverage" | "untested-api-endpoint";
+        category: "untested-route" | "a11y" | "console-error" | "broken-link" | "auth-surface" | "coverage" | "untested-api-endpoint" | "prompt-leakage";
     }, {
         status: "new" | "resolved" | "severity-increased" | "severity-decreased";
         path: string;
         severity: "critical" | "high" | "medium" | "low";
         reason: string;
-        category: "untested-route" | "a11y" | "console-error" | "broken-link" | "auth-surface" | "coverage" | "untested-api-endpoint";
+        category: "untested-route" | "a11y" | "console-error" | "broken-link" | "auth-surface" | "coverage" | "untested-api-endpoint" | "prompt-leakage";
     }>, "many">;
     summary: z.ZodString;
 }, "strip", z.ZodTypeAny, {
@@ -182,21 +182,21 @@ export declare const BaselineDeltaSchema: z.ZodObject<{
         path: string;
         severity: "critical" | "high" | "medium" | "low";
         reason: string;
-        category: "untested-route" | "a11y" | "console-error" | "broken-link" | "auth-surface" | "coverage" | "untested-api-endpoint";
+        category: "untested-route" | "a11y" | "console-error" | "broken-link" | "auth-surface" | "coverage" | "untested-api-endpoint" | "prompt-leakage";
     }[];
     resolvedGaps: {
         status: "new" | "resolved" | "severity-increased" | "severity-decreased";
         path: string;
         severity: "critical" | "high" | "medium" | "low";
         reason: string;
-        category: "untested-route" | "a11y" | "console-error" | "broken-link" | "auth-surface" | "coverage" | "untested-api-endpoint";
+        category: "untested-route" | "a11y" | "console-error" | "broken-link" | "auth-surface" | "coverage" | "untested-api-endpoint" | "prompt-leakage";
     }[];
     severityChanges: {
         status: "new" | "resolved" | "severity-increased" | "severity-decreased";
         path: string;
         severity: "critical" | "high" | "medium" | "low";
         reason: string;
-        category: "untested-route" | "a11y" | "console-error" | "broken-link" | "auth-surface" | "coverage" | "untested-api-endpoint";
+        category: "untested-route" | "a11y" | "console-error" | "broken-link" | "auth-surface" | "coverage" | "untested-api-endpoint" | "prompt-leakage";
     }[];
 }, {
     summary: string;
@@ -212,21 +212,21 @@ export declare const BaselineDeltaSchema: z.ZodObject<{
         path: string;
         severity: "critical" | "high" | "medium" | "low";
         reason: string;
-        category: "untested-route" | "a11y" | "console-error" | "broken-link" | "auth-surface" | "coverage" | "untested-api-endpoint";
+        category: "untested-route" | "a11y" | "console-error" | "broken-link" | "auth-surface" | "coverage" | "untested-api-endpoint" | "prompt-leakage";
     }[];
     resolvedGaps: {
         status: "new" | "resolved" | "severity-increased" | "severity-decreased";
         path: string;
         severity: "critical" | "high" | "medium" | "low";
         reason: string;
-        category: "untested-route" | "a11y" | "console-error" | "broken-link" | "auth-surface" | "coverage" | "untested-api-endpoint";
+        category: "untested-route" | "a11y" | "console-error" | "broken-link" | "auth-surface" | "coverage" | "untested-api-endpoint" | "prompt-leakage";
     }[];
     severityChanges: {
         status: "new" | "resolved" | "severity-increased" | "severity-decreased";
         path: string;
         severity: "critical" | "high" | "medium" | "low";
         reason: string;
-        category: "untested-route" | "a11y" | "console-error" | "broken-link" | "auth-surface" | "coverage" | "untested-api-endpoint";
+        category: "untested-route" | "a11y" | "console-error" | "broken-link" | "auth-surface" | "coverage" | "untested-api-endpoint" | "prompt-leakage";
     }[];
 }>;
 export type BaselineDelta = z.infer<typeof BaselineDeltaSchema>;

package/dist/baseline/baseline.schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"baseline.schema.d.ts","sourceRoot":"","sources":["../../src/baseline/baseline.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;GAIG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;EAa5B,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D;;GAEG;AACH,eAAO,MAAM,sBAAsB;IACjC,gFAAgF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAQhF,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE;;GAEG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;EAMlC,CAAC;AAEH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE;;GAEG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAY9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC"}
+{"version":3,"file":"baseline.schema.d.ts","sourceRoot":"","sources":["../../src/baseline/baseline.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;GAIG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;EAc5B,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D;;GAEG;AACH,eAAO,MAAM,sBAAsB;IACjC,gFAAgF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAQhF,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE;;GAEG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;EAMlC,CAAC;AAEH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE;;GAEG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAY9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC"}

package/dist/baseline/baseline.schema.js

@@ -15,6 +15,7 @@ export const BaselineGapSchema = z.object({
         'auth-surface',
         'coverage',
         'untested-api-endpoint',
+        'prompt-leakage',
     ]),
     reason: z.string(),
 });

package/dist/cli/confidence-run.js

@@ -47,6 +47,11 @@ export function formatConfidenceReport(rc, subjectRef) {
         for (const b of rc.blockers)
             lines.push(`    • ${b}`);
     }
+    if (rc.honestyNotes.length > 0) {
+        lines.push('  honesty notes:');
+        for (const n of rc.honestyNotes)
+            lines.push(`    • ${n}`);
+    }
     lines.push('  contributions:');
     for (const c of rc.contributions) {
         const scoreLabel = c.score !== null ? `${c.score}/100` : 'n/a';
@@ -66,11 +71,6 @@ export function formatConfidenceReport(rc, subjectRef) {
         for (const r of rc.recommendedNextChecks)
             lines.push(`    • ${r}`);
     }
-    if (rc.honestyNotes.length > 0) {
-        lines.push('  honesty notes:');
-        for (const n of rc.honestyNotes)
-            lines.push(`    • ${n}`);
-    }
     return lines.join('\n');
 }
 /**

package/dist/index.d.ts

@@ -12,6 +12,11 @@ export { discoverApiSurface, discoverApiSurfaceWithRepo } from './tools/repo/api
 export type { ApiSurface, DiscoveredEndpoint, DiscoverApiSurfaceOptions } from './tools/repo/api-surface.js';
 export { computeAutomationMaturity } from './tools/scoring/automation-maturity.js';
 export { computeApiCoverage } from './tools/scoring/api-coverage.js';
+export { detectPromptLeakage } from './tools/scoring/prompt-leakage.js';
+export { scoreBugReport, scoreBugReportDeterministic, buildBugReportJudgePrompt, parseBugReportJudgeResponse, BUG_REPORT_JUDGE_MODEL, RUBRIC_MAX_PTS, SEVERITY_WEIGHT, hasQualityRepro, hasEvidence, delimitUntrusted, } from './tools/scoring/bug-report-score.js';
+export type { ScoreBugReportOptions } from './tools/scoring/bug-report-score.js';
+export { scoreDecisions, scoreForkDeterministic, loadDecisionForks, validateForksPath, resolveAllowedForksRoot, buildDecisionJudgePrompt, parseDecisionJudgeResponse, } from './tools/scoring/score-decisions.js';
+export type { ScoreDecisionsOptions } from './tools/scoring/score-decisions.js';
 export type { ApiCoverageResult, ApiEndpointCoverage } from './tools/scoring/api-coverage.js';
 export { scaffoldTests } from './scaffold-tests.js';
 export type { ScaffoldOptions, ScaffoldResult, ProjectConfig } from './scaffold-tests.js';
@@ -26,7 +31,7 @@ export { NoopTelemetrySink } from './telemetry/telemetry.interface.js';
 export { redactUrlForTelemetry } from './telemetry/emit.js';
 export type { LlmCallResult, LlmProvider } from './llm/provider.interface.js';
 export type { CallLlmConfigSlice } from './llm/provider.js';
-export type { HarnessConfig, AuthConfig, RouteInventory, GapAnalysis, RepoAnalysis, DetectedAuth, AuthExploration, AuthPath, AuthPathRequirements, CostIntelligence, LlmUsageRecord, RepeatedAiPattern, DeterministicMaturity, PublicSurface, AutomationMaturity, AutomationMaturityDimension, FrameworkDetectionResult, DetectedFrameworkPrimary, RecipeId, RecipeConfig, } from './schemas/index.js';
+export type { HarnessConfig, AuthConfig, RouteInventory, GapAnalysis, RepoAnalysis, DetectedAuth, AuthExploration, AuthPath, AuthPathRequirements, CostIntelligence, LlmUsageRecord, RepeatedAiPattern, DeterministicMaturity, PublicSurface, AutomationMaturity, AutomationMaturityDimension, FrameworkDetectionResult, DetectedFrameworkPrimary, RecipeId, RecipeConfig, BugReportScoreResult, BugReportRubric, BugReportInput, BugReportTarget, ScoreBugReportInput, DecisionScoreResult, ScoredDecisionFork, DecisionFork, ScoreDecisionsInput, } from './schemas/index.js';
 export { RecipeIdSchema } from './schemas/index.js';
 export { computeReleaseConfidence } from './tools/scoring/confidence.js';
 export { analyzeRunDiff, formatAnalyzeDiffMarkdown, loadGapAnalysisFile } from './cli/analyze-diff-run.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EACL,UAAU,EACV,mBAAmB,EACnB,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,cAAc,EACd,gBAAgB,GACjB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,WAAW,EACX,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,GACd,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,YAAY,EACV,YAAY,EACZ,kBAAkB,EAClB,SAAS,EACT,cAAc,EACd,uBAAuB,GACxB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,UAAU,EACV,oBAAoB,EACpB,4BAA4B,EAC5B,yBAAyB,EACzB,qBAAqB,GACtB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,yBAAyB,EACzB,4BAA4B,GAC7B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AAC1G,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAC;AAC7F,YAAY,EAAE,UAAU,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AAC7G,OAAO,EAAE,yBAAyB,EAAE,MAAM,wCAAwC,CAAC;AACnF,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,YAAY,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAC9F,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,YAAY,EAAE,eAAe,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAC1F,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAClI,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,gCAAgC,EAAE,MAAM,4BAA4B,CAAC;AAC9E,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACvF,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AACjF,YAAY,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACrE,YAAY,EACV,aAAa,EACb,cAAc,EACd,kBAAkB,GACnB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AACvE,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAC9E,YAAY,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,YAAY,EACV,aAAa,EACb,UAAU,EACV,cAAc,EACd,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,QAAQ,EACR,oBAAoB,EACpB,gBAAgB,EAChB,cAAc,EACd,iBAAiB,EACjB,qBAAqB,EACrB,aAAa,EACb,kBAAkB,EAClB,2BAA2B,EAC3B,wBAAwB,EACxB,wBAAwB,EACxB,QAAQ,EACR,YAAY,GACb,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEpD,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AAEzE,OAAO,EAAE,cAAc,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAE3G,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AACtH,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AACrG,YAAY,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAEnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,YAAY,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,YAAY,EAAE,eAAe,EAAE,WAAW,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACtH,OAAO,EAAE,6BAA6B,EAAE,MAAM,0CAA0C,CAAC;AACzF,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AAC7G,YAAY,EACV,kBAAkB,EAClB,YAAY,EACZ,iBAAiB,EACjB,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,sBAAsB,EACtB,iBAAiB,EACjB,oBAAoB,EACpB,SAAS,EACT,aAAa,EACb,UAAU,EACV,WAAW,EACX,UAAU,GACX,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,wBAAwB,EACxB,kBAAkB,EAClB,uBAAuB,EACvB,qBAAqB,EACrB,sBAAsB,EACtB,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EACL,UAAU,EACV,mBAAmB,EACnB,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,cAAc,EACd,gBAAgB,GACjB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,WAAW,EACX,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,GACd,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,YAAY,EACV,YAAY,EACZ,kBAAkB,EAClB,SAAS,EACT,cAAc,EACd,uBAAuB,GACxB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,UAAU,EACV,oBAAoB,EACpB,4BAA4B,EAC5B,yBAAyB,EACzB,qBAAqB,GACtB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,yBAAyB,EACzB,4BAA4B,GAC7B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AAC1G,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAC;AAC7F,YAAY,EAAE,UAAU,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AAC7G,OAAO,EAAE,yBAAyB,EAAE,MAAM,wCAAwC,CAAC;AACnF,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EACL,cAAc,EACd,2BAA2B,EAC3B,yBAAyB,EACzB,2BAA2B,EAC3B,sBAAsB,EACtB,cAAc,EACd,eAAe,EACf,eAAe,EACf,WAAW,EACX,gBAAgB,GACjB,MAAM,qCAAqC,CAAC;AAC7C,YAAY,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AACjF,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,iBAAiB,EACjB,iBAAiB,EACjB,uBAAuB,EACvB,wBAAwB,EACxB,0BAA0B,GAC3B,MAAM,oCAAoC,CAAC;AAC5C,YAAY,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAChF,YAAY,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAC9F,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,YAAY,EAAE,eAAe,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAC1F,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAClI,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,gCAAgC,EAAE,MAAM,4BAA4B,CAAC;AAC9E,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACvF,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AACjF,YAAY,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACrE,YAAY,EACV,aAAa,EACb,cAAc,EACd,kBAAkB,GACnB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AACvE,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAC9E,YAAY,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,YAAY,EACV,aAAa,EACb,UAAU,EACV,cAAc,EACd,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,QAAQ,EACR,oBAAoB,EACpB,gBAAgB,EAChB,cAAc,EACd,iBAAiB,EACjB,qBAAqB,EACrB,aAAa,EACb,kBAAkB,EAClB,2BAA2B,EAC3B,wBAAwB,EACxB,wBAAwB,EACxB,QAAQ,EACR,YAAY,EACZ,oBAAoB,EACpB,eAAe,EACf,cAAc,EACd,eAAe,EACf,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,EAClB,YAAY,EACZ,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEpD,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AAEzE,OAAO,EAAE,cAAc,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAE3G,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AACtH,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AACrG,YAAY,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAEnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,YAAY,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,YAAY,EAAE,eAAe,EAAE,WAAW,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACtH,OAAO,EAAE,6BAA6B,EAAE,MAAM,0CAA0C,CAAC;AACzF,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AAC7G,YAAY,EACV,kBAAkB,EAClB,YAAY,EACZ,iBAAiB,EACjB,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,sBAAsB,EACtB,iBAAiB,EACjB,oBAAoB,EACpB,SAAS,EACT,aAAa,EACb,UAAU,EACV,WAAW,EACX,UAAU,GACX,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,wBAAwB,EACxB,kBAAkB,EAClB,uBAAuB,EACvB,qBAAqB,EACrB,sBAAsB,EACtB,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,oBAAoB,CAAC"}

package/dist/index.js

@@ -8,6 +8,9 @@ export { scanRepo } from './tools/repo/scan.js';
 export { discoverApiSurface, discoverApiSurfaceWithRepo } from './tools/repo/api-surface.js';
 export { computeAutomationMaturity } from './tools/scoring/automation-maturity.js';
 export { computeApiCoverage } from './tools/scoring/api-coverage.js';
+export { detectPromptLeakage } from './tools/scoring/prompt-leakage.js';
+export { scoreBugReport, scoreBugReportDeterministic, buildBugReportJudgePrompt, parseBugReportJudgeResponse, BUG_REPORT_JUDGE_MODEL, RUBRIC_MAX_PTS, SEVERITY_WEIGHT, hasQualityRepro, hasEvidence, delimitUntrusted, } from './tools/scoring/bug-report-score.js';
+export { scoreDecisions, scoreForkDeterministic, loadDecisionForks, validateForksPath, resolveAllowedForksRoot, buildDecisionJudgePrompt, parseDecisionJudgeResponse, } from './tools/scoring/score-decisions.js';
 export { scaffoldTests } from './scaffold-tests.js';
 export { expandRecipes, buildAuthScenarios, buildA11yScenarios, buildNavScenarios, buildSeedScenarios } from './recipes/index.js';
 export { createProvider } from './llm/provider-registry.js';

package/dist/llm/provider.interface.d.ts

@@ -8,9 +8,12 @@ export interface LlmCallResult {
         dataQuality: 'actual' | 'estimated';
     };
 }
+export interface LlmCallOptions {
+    temperature?: number;
+}
 export interface LlmProvider {
     readonly name: string;
     readonly model: string;
-    call(prompt: string, maxOutputTokens: number): Promise<LlmCallResult>;
+    call(prompt: string, maxOutputTokens: number, options?: LlmCallOptions): Promise<LlmCallResult>;
 }
 //# sourceMappingURL=provider.interface.d.ts.map

package/dist/llm/provider.interface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider.interface.d.ts","sourceRoot":"","sources":["../../src/llm/provider.interface.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE;QACL,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,EAAE,MAAM,CAAC;QACrB,WAAW,EAAE,QAAQ,GAAG,WAAW,CAAC;KACrC,CAAC;CACH;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;CACvE"}
+{"version":3,"file":"provider.interface.d.ts","sourceRoot":"","sources":["../../src/llm/provider.interface.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE;QACL,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,EAAE,MAAM,CAAC;QACrB,WAAW,EAAE,QAAQ,GAAG,WAAW,CAAC;KACrC,CAAC;CACH;AAED,MAAM,WAAW,cAAc;IAC7B,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;CACjG"}

package/dist/llm/providers/anthropic.d.ts

@@ -1,4 +1,4 @@
-import type { LlmCallResult, LlmProvider } from '../provider.interface.js';
+import type { LlmCallOptions, LlmCallResult, LlmProvider } from '../provider.interface.js';
 import type { TelemetrySink } from '../../telemetry/telemetry.interface.js';
 export type AnthropicProviderOptions = {
     model?: string;
@@ -11,6 +11,6 @@ export declare class AnthropicProvider implements LlmProvider {
     private readonly telemetry?;
     private readonly sessionId;
     constructor(options?: AnthropicProviderOptions);
-    call(prompt: string, maxOutputTokens: number): Promise<LlmCallResult>;
+    call(prompt: string, maxOutputTokens: number, options?: LlmCallOptions): Promise<LlmCallResult>;
 }
 //# sourceMappingURL=anthropic.d.ts.map

package/dist/llm/providers/anthropic.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"anthropic.d.ts","sourceRoot":"","sources":["../../../src/llm/providers/anthropic.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC3E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AAS5E,MAAM,MAAM,wBAAwB,GAAG;IACrC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,qBAAa,iBAAkB,YAAW,WAAW;IACnD,QAAQ,CAAC,IAAI,eAAe;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAgB;IAC3C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;gBAEvB,OAAO,CAAC,EAAE,wBAAwB;IAMxC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;CA+F5E"}
+{"version":3,"file":"anthropic.d.ts","sourceRoot":"","sources":["../../../src/llm/providers/anthropic.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC3F,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AAS5E,MAAM,MAAM,wBAAwB,GAAG;IACrC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,qBAAa,iBAAkB,YAAW,WAAW;IACnD,QAAQ,CAAC,IAAI,eAAe;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAgB;IAC3C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;gBAEvB,OAAO,CAAC,EAAE,wBAAwB;IAMxC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;CAgGtG"}

package/dist/llm/providers/anthropic.js

@@ -13,7 +13,7 @@ export class AnthropicProvider {
         this.telemetry = options?.telemetry;
         this.sessionId = options?.sessionId ?? 'anonymous';
     }
-    async call(prompt, maxOutputTokens) {
+    async call(prompt, maxOutputTokens, options) {
         const apiKey = process.env.ANTHROPIC_API_KEY;
         if (!apiKey)
             throw new Error('ANTHROPIC_API_KEY is not set');
@@ -34,6 +34,7 @@ export class AnthropicProvider {
                 body: JSON.stringify({
                     model: this.model,
                     max_tokens: maxOutputTokens,
+                    ...(options?.temperature !== undefined ? { temperature: options.temperature } : {}),
                     messages: [{ role: 'user', content: prompt }],
                 }),
             });

package/dist/phases/think.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"think.d.ts","sourceRoot":"","sources":["../../src/phases/think.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAAqB,KAAK,WAAW,EAAE,MAAM,mCAAmC,CAAC;AACxF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAGlD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAIrE,wBAAsB,KAAK,CACzB,QAAQ,EAAE,aAAa,EACvB,MAAM,EAAE,aAAa,EACrB,SAAS,GAAE,mBAA8C,GACxD,OAAO,CAAC,WAAW,CAAC,CAmDtB;AAED,OAAO,EAAE,4BAA4B,EAAE,MAAM,qBAAqB,CAAC;AACnE,YAAY,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"think.d.ts","sourceRoot":"","sources":["../../src/phases/think.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAAqB,KAAK,WAAW,EAAE,MAAM,mCAAmC,CAAC;AACxF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAIlD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAIrE,wBAAsB,KAAK,CACzB,QAAQ,EAAE,aAAa,EACvB,MAAM,EAAE,aAAa,EACrB,SAAS,GAAE,mBAA8C,GACxD,OAAO,CAAC,WAAW,CAAC,CAyDtB;AAED,OAAO,EAAE,4BAA4B,EAAE,MAAM,qBAAqB,CAAC;AACnE,YAAY,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/phases/think.js

@@ -1,5 +1,6 @@
 import { GapAnalysisSchema } from '../schemas/gap-analysis.schema.js';
 import { analyzeGaps } from '../tools/scoring/gaps.js';
+import { detectPromptLeakage } from '../tools/scoring/prompt-leakage.js';
 import { logDecision } from '../harness/decision-logger.js';
 import { finalizeGapAnalysisFromDraft } from './think-finalize.js';
 import { emitTelemetry } from '../telemetry/emit.js';
@@ -13,6 +14,8 @@ export async function think(observed, config, artifacts = { writeArtifacts: true
     };
     emitTelemetry(artifacts.telemetry, 'phase.think.started', sessionId, { mode });
     const gapBlock = analyzeGaps(observed.routes, observed.repo, mode, config);
+    // Merge prompt-leakage gaps from all scanned routes (additive signal).
+    const promptLeakageGaps = observed.routes.routes.flatMap((route) => detectPromptLeakage(route));
     const draft = {
         analyzedAt: gapBlock.analyzedAt,
         mode: gapBlock.mode,
@@ -20,7 +23,7 @@ export async function think(observed, config, artifacts = { writeArtifacts: true
         coveragePagesScanned: gapBlock.coveragePagesScanned,
         coverageBudgetExceeded: gapBlock.coverageBudgetExceeded,
         coverageWarning: gapBlock.coverageWarning,
-        gaps: gapBlock.gaps,
+        gaps: [...gapBlock.gaps, ...promptLeakageGaps],
     };
     const partialAnalysis = GapAnalysisSchema.parse({
         ...draft,

package/dist/reporters/heatmap.d.ts

@@ -10,7 +10,7 @@
  */
 import type { Gap } from '../schemas/gap-analysis.schema.js';
 /** The ordered set of gap categories that appear as heatmap columns. */
-export declare const HEATMAP_DIMENSIONS: readonly ["untested-route", "a11y", "console-error", "broken-link", "coverage", "untested-api-endpoint", "auth-surface"];
+export declare const HEATMAP_DIMENSIONS: readonly ["untested-route", "a11y", "console-error", "broken-link", "coverage", "untested-api-endpoint", "auth-surface", "prompt-leakage"];
 export type HeatmapDimension = (typeof HEATMAP_DIMENSIONS)[number];
 /** Display labels for each dimension column header. */
 export declare const DIMENSION_LABELS: Record<HeatmapDimension, string>;

package/dist/reporters/heatmap.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"heatmap.d.ts","sourceRoot":"","sources":["../../src/reporters/heatmap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,mCAAmC,CAAC;AAM7D,wEAAwE;AACxE,eAAO,MAAM,kBAAkB,0HAQoB,CAAC;AAEpD,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEnE,uDAAuD;AACvD,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAQ7D,CAAC;AAuBF,6EAA6E;AAC7E,MAAM,MAAM,WAAW,GAAG;IACxB,4DAA4D;IAC5D,aAAa,EAAE,GAAG,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC;IACtC,mCAAmC;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,+CAA+C;IAC/C,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,uEAAuE;AACvE,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,qFAAqF;IACrF,KAAK,EAAE,MAAM,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC;IAC7C,2EAA2E;IAC3E,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,iEAAiE;AACjE,MAAM,MAAM,WAAW,GAAG;IACxB,oEAAoE;IACpE,IAAI,EAAE,UAAU,EAAE,CAAC;IACnB,0DAA0D;IAC1D,UAAU,EAAE,OAAO,kBAAkB,CAAC;IACtC,sDAAsD;IACtD,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAMF;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,WAAW,CAuDzD;AAMD;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM,CAmCjE"}
+{"version":3,"file":"heatmap.d.ts","sourceRoot":"","sources":["../../src/reporters/heatmap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,mCAAmC,CAAC;AAM7D,wEAAwE;AACxE,eAAO,MAAM,kBAAkB,4IASoB,CAAC;AAEpD,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEnE,uDAAuD;AACvD,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAS7D,CAAC;AAuBF,6EAA6E;AAC7E,MAAM,MAAM,WAAW,GAAG;IACxB,4DAA4D;IAC5D,aAAa,EAAE,GAAG,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC;IACtC,mCAAmC;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,+CAA+C;IAC/C,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,uEAAuE;AACvE,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,qFAAqF;IACrF,KAAK,EAAE,MAAM,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC;IAC7C,2EAA2E;IAC3E,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,iEAAiE;AACjE,MAAM,MAAM,WAAW,GAAG;IACxB,oEAAoE;IACpE,IAAI,EAAE,UAAU,EAAE,CAAC;IACnB,0DAA0D;IAC1D,UAAU,EAAE,OAAO,kBAAkB,CAAC;IACtC,sDAAsD;IACtD,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAMF;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,WAAW,CAuDzD;AAMD;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM,CAmCjE"}

package/dist/reporters/heatmap.js

@@ -20,6 +20,7 @@ export const HEATMAP_DIMENSIONS = [
     'coverage',
     'untested-api-endpoint',
     'auth-surface',
+    'prompt-leakage',
 ];
 /** Display labels for each dimension column header. */
 export const DIMENSION_LABELS = {
@@ -30,6 +31,7 @@ export const DIMENSION_LABELS = {
     'coverage': 'Coverage',
     'untested-api-endpoint': 'API',
     'auth-surface': 'Auth',
+    'prompt-leakage': 'PromptLeak',
 };
 /** Severity order — higher index = worse. */
 const SEVERITY_ORDER = {

package/dist/schemas/bug-report-score.schema.d.ts

@@ -0,0 +1,163 @@
+import { z } from 'zod';
+export declare const BugReportSeveritySchema: z.ZodEnum<["critical", "high", "medium", "low"]>;
+export declare const BugReportInputSchema: z.ZodObject<{
+    title: z.ZodString;
+    description: z.ZodString;
+    steps: z.ZodString;
+    severity: z.ZodEnum<["critical", "high", "medium", "low"]>;
+}, "strip", z.ZodTypeAny, {
+    severity: "critical" | "high" | "medium" | "low";
+    description: string;
+    title: string;
+    steps: string;
+}, {
+    severity: "critical" | "high" | "medium" | "low";
+    description: string;
+    title: string;
+    steps: string;
+}>;
+export declare const BugReportTargetSchema: z.ZodObject<{
+    description: z.ZodString;
+    type: z.ZodString;
+    severity: z.ZodEnum<["critical", "high", "medium", "low"]>;
+    expectedBehavior: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    type: string;
+    severity: "critical" | "high" | "medium" | "low";
+    description: string;
+    expectedBehavior: string;
+}, {
+    type: string;
+    severity: "critical" | "high" | "medium" | "low";
+    description: string;
+    expectedBehavior: string;
+}>;
+export declare const ScoreBugReportInputSchema: z.ZodObject<{
+    report: z.ZodObject<{
+        title: z.ZodString;
+        description: z.ZodString;
+        steps: z.ZodString;
+        severity: z.ZodEnum<["critical", "high", "medium", "low"]>;
+    }, "strip", z.ZodTypeAny, {
+        severity: "critical" | "high" | "medium" | "low";
+        description: string;
+        title: string;
+        steps: string;
+    }, {
+        severity: "critical" | "high" | "medium" | "low";
+        description: string;
+        title: string;
+        steps: string;
+    }>;
+    target: z.ZodObject<{
+        description: z.ZodString;
+        type: z.ZodString;
+        severity: z.ZodEnum<["critical", "high", "medium", "low"]>;
+        expectedBehavior: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        type: string;
+        severity: "critical" | "high" | "medium" | "low";
+        description: string;
+        expectedBehavior: string;
+    }, {
+        type: string;
+        severity: "critical" | "high" | "medium" | "low";
+        description: string;
+        expectedBehavior: string;
+    }>;
+}, "strip", z.ZodTypeAny, {
+    target: {
+        type: string;
+        severity: "critical" | "high" | "medium" | "low";
+        description: string;
+        expectedBehavior: string;
+    };
+    report: {
+        severity: "critical" | "high" | "medium" | "low";
+        description: string;
+        title: string;
+        steps: string;
+    };
+}, {
+    target: {
+        type: string;
+        severity: "critical" | "high" | "medium" | "low";
+        description: string;
+        expectedBehavior: string;
+    };
+    report: {
+        severity: "critical" | "high" | "medium" | "low";
+        description: string;
+        title: string;
+        steps: string;
+    };
+}>;
+export declare const BugReportRubricSchema: z.ZodObject<{
+    coverage: z.ZodNumber;
+    severity: z.ZodNumber;
+    repro: z.ZodNumber;
+    evidence: z.ZodNumber;
+}, "strip", z.ZodTypeAny, {
+    severity: number;
+    coverage: number;
+    evidence: number;
+    repro: number;
+}, {
+    severity: number;
+    coverage: number;
+    evidence: number;
+    repro: number;
+}>;
+export declare const BugReportScoringPathSchema: z.ZodEnum<["llm-judge", "deterministic-fallback"]>;
+export declare const BugReportScoreResultSchema: z.ZodObject<{
+    matched: z.ZodBoolean;
+    matchConfidence: z.ZodNumber;
+    rubric: z.ZodObject<{
+        coverage: z.ZodNumber;
+        severity: z.ZodNumber;
+        repro: z.ZodNumber;
+        evidence: z.ZodNumber;
+    }, "strip", z.ZodTypeAny, {
+        severity: number;
+        coverage: number;
+        evidence: number;
+        repro: number;
+    }, {
+        severity: number;
+        coverage: number;
+        evidence: number;
+        repro: number;
+    }>;
+    feedback: z.ZodString;
+    scoringPath: z.ZodEnum<["llm-judge", "deterministic-fallback"]>;
+}, "strip", z.ZodTypeAny, {
+    matched: boolean;
+    matchConfidence: number;
+    rubric: {
+        severity: number;
+        coverage: number;
+        evidence: number;
+        repro: number;
+    };
+    feedback: string;
+    scoringPath: "llm-judge" | "deterministic-fallback";
+}, {
+    matched: boolean;
+    matchConfidence: number;
+    rubric: {
+        severity: number;
+        coverage: number;
+        evidence: number;
+        repro: number;
+    };
+    feedback: string;
+    scoringPath: "llm-judge" | "deterministic-fallback";
+}>;
+export type BugReportSeverity = z.infer<typeof BugReportSeveritySchema>;
+export type BugReportInput = z.infer<typeof BugReportInputSchema>;
+export type BugReportTarget = z.infer<typeof BugReportTargetSchema>;
+export type ScoreBugReportInput = z.infer<typeof ScoreBugReportInputSchema>;
+export type BugReportRubric = z.infer<typeof BugReportRubricSchema>;
+export type BugReportScoringPath = z.infer<typeof BugReportScoringPathSchema>;
+export type BugReportScoreResult = z.infer<typeof BugReportScoreResultSchema>;
+//# sourceMappingURL=bug-report-score.schema.d.ts.map

package/dist/schemas/bug-report-score.schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bug-report-score.schema.d.ts","sourceRoot":"","sources":["../../src/schemas/bug-report-score.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,uBAAuB,kDAAgD,CAAC;AAErF,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;EAK/B,CAAC;AAEH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;EAKhC,CAAC;AAEH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAGpC,CAAC;AAEH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;EAKhC,CAAC;AAEH,eAAO,MAAM,0BAA0B,oDAAkD,CAAC;AAE1F,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAMrC,CAAC;AAEH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AACxE,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAClE,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACpE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAC5E,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACpE,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAC9E,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC"}