@securecode-ai/mcp 0.5.4 → 0.5.6

package/dist/project-map/symbolIndex.js

@@ -0,0 +1,385 @@
+"use strict";
+/**
+ * Symbol index — structural find_definition and find_references across the
+ * workspace. Replaces regex-based search_code for "where is X defined?" and
+ * "who calls X?" questions.
+ *
+ * Two providers:
+ *   - TypeScriptProgramProvider: uses ts.createProgram for JS/TS/TSX —
+ *     accurate cross-file definition + references via the type system.
+ *   - TreeSitterProvider: uses tree-sitter AST for Python — intra-file
+ *     definition + workspace-wide reference search via identifier matching.
+ *
+ * Both return SymbolLocation[] with provider + confidence metadata.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.findDefinition = findDefinition;
+exports.findReferences = findReferences;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const parserLoader_1 = require("./parserLoader");
+const astHelpers_1 = require("./astHelpers");
+const files_1 = require("../utils/files");
+const searchCode_1 = require("../utils/searchCode");
+// ── TypeScript provider ────────────────────────────────────────────────────
+class TypeScriptProgramProvider {
+    name = 'typescript';
+    isSupported(filePath) {
+        const ext = path.extname(filePath).toLowerCase();
+        return ext === '.ts' || ext === '.tsx' || ext === '.js' || ext === '.jsx' || ext === '.mjs' || ext === '.cjs';
+    }
+    async findDefinition(query, workspaceRoot) {
+        if (!this.isSupported(query.filePath))
+            return [];
+        const tsResult = this.runTypeScript(query, workspaceRoot, 'definition');
+        if (tsResult.length > 0)
+            return tsResult;
+        // Fall back to tree-sitter for same-file definitions when TS
+        // can't resolve (e.g. temp dirs without node_modules).
+        return treeSitterProvider.findDefinition(query, workspaceRoot);
+    }
+    async findReferences(query, workspaceRoot) {
+        if (!this.isSupported(query.filePath))
+            return [];
+        // For references, workspace-wide search is more reliable than
+        // ts.findAllReferences (which requires a full program with all
+        // files). The agent needs "who uses this name?" — regex search
+        // with word boundaries is precise enough for that question.
+        try {
+            const escaped = query.symbol.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+            const result = await (0, searchCode_1.searchCode)(workspaceRoot, `\\b${escaped}\\b`, undefined);
+            const out = [];
+            for (const hit of result.hits || []) {
+                out.push({
+                    filePath: hit.path,
+                    line: hit.line,
+                    column: 0,
+                    provider: 'typescript',
+                    confidence: 0.9,
+                    kind: 'reference',
+                });
+            }
+            return out;
+        }
+        catch {
+            return [];
+        }
+    }
+    runTypeScript(query, workspaceRoot, mode) {
+        try {
+            const ts = require('typescript');
+            const absPath = (0, files_1.resolveWorkspacePath)(workspaceRoot, query.filePath);
+            const program = ts.createProgram({
+                rootNames: [absPath],
+                options: {
+                    allowJs: true,
+                    jsx: ts.JsxEmit.React,
+                    noEmit: true,
+                    skipLibCheck: true,
+                    target: ts.ScriptTarget.ES2022,
+                    module: ts.ModuleKind.CommonJS,
+                    moduleResolution: ts.ModuleResolutionKind.NodeJs,
+                },
+                host: ts.createCompilerHost({}),
+            });
+            const sourceFile = program.getSourceFile(absPath);
+            if (!sourceFile)
+                return [];
+            // Find the identifier position to search from
+            const pos = this.findSymbolPosition(sourceFile, query.symbol, query.line);
+            if (pos === -1)
+                return [];
+            const checker = program.getTypeChecker();
+            const out = [];
+            if (mode === 'definition') {
+                const symbol = checker.getSymbolAtLocation(sourceFile, pos);
+                if (!symbol)
+                    return [];
+                const declarations = symbol.declarations || [];
+                for (const decl of declarations) {
+                    const declFile = decl.getSourceFile();
+                    const declPath = declFile.fileName;
+                    const relPath = path.relative(workspaceRoot, declPath).replace(/\\/g, '/');
+                    const start = decl.getStart ? decl.getStart() : 0;
+                    const lineChar = declFile.getLineAndCharacterOfPosition(start);
+                    out.push({
+                        filePath: relPath,
+                        line: lineChar.line + 1,
+                        column: lineChar.character + 1,
+                        provider: 'typescript',
+                        confidence: 1.0,
+                        kind: 'definition',
+                    });
+                }
+            }
+            else {
+                // References
+                const symbol = checker.getSymbolAtLocation(sourceFile, pos);
+                if (!symbol)
+                    return [];
+                const refs = checker.findAllReferences(symbol) || [];
+                for (const ref of refs) {
+                    const refFile = ref.fileName;
+                    const relPath = path.relative(workspaceRoot, refFile).replace(/\\/g, '/');
+                    const lineChar = ts.getLineAndCharacterOfPosition(refFile, ref.textSpan.start);
+                    if (!lineChar)
+                        continue;
+                    out.push({
+                        filePath: relPath,
+                        line: lineChar.line + 1,
+                        column: lineChar.character + 1,
+                        provider: 'typescript',
+                        confidence: 1.0,
+                        kind: 'reference',
+                    });
+                }
+            }
+            return out;
+        }
+        catch {
+            return [];
+        }
+    }
+    findSymbolPosition(sourceFile, symbol, hintLine) {
+        let bestPos = -1;
+        let bestDist = Infinity;
+        const visit = (node) => {
+            if (node.kind === 79 /* Identifier */ && node.text === symbol) {
+                const line = sourceFile.getLineAndCharacterOfPosition(node.getStart()).line + 1;
+                const dist = hintLine ? Math.abs(line - hintLine) : 0;
+                if (dist < bestDist) {
+                    bestDist = dist;
+                    bestPos = node.getStart();
+                }
+            }
+            tsForEachChild(node, visit);
+        };
+        visit(sourceFile);
+        return bestPos;
+    }
+}
+function tsForEachChild(node, cb) {
+    if (node && typeof node.forEachChild === 'function') {
+        node.forEachChild(cb);
+    }
+}
+// ── Tree-sitter provider (Python + fallback) ──────────────────────────────
+class TreeSitterProvider {
+    name = 'tree-sitter';
+    async findDefinition(query, workspaceRoot) {
+        // For Python: search the file + its imports for the function definition
+        const grammar = (0, parserLoader_1.grammarForFile)(query.filePath);
+        if (grammar === 'unknown')
+            return [];
+        try {
+            const absPath = (0, files_1.resolveWorkspacePath)(workspaceRoot, query.filePath);
+            const content = fs.readFileSync(absPath, 'utf8');
+            const parsed = await (0, parserLoader_1.parseSource)(content, grammar);
+            if (!parsed)
+                return [];
+            const { root } = parsed;
+            const imports = (0, astHelpers_1.collectImports)(root, content);
+            // First: is the definition in THIS file?
+            const localDef = this.findLocalDefinition(root, content, query.symbol);
+            if (localDef) {
+                return [{
+                        filePath: query.filePath,
+                        line: localDef.line,
+                        column: localDef.column,
+                        provider: 'tree-sitter',
+                        confidence: 0.8,
+                        kind: 'definition',
+                    }];
+            }
+            // Second: is it imported from another file?
+            const importSource = imports.get(query.symbol);
+            if (importSource) {
+                const resolvedFile = this.resolveImport(importSource, query.filePath, workspaceRoot);
+                if (resolvedFile) {
+                    const resolvedContent = fs.readFileSync(resolvedFile, 'utf8');
+                    const resolvedGrammar = (0, parserLoader_1.grammarForFile)(resolvedFile);
+                    if (resolvedGrammar !== 'unknown') {
+                        const resolvedParsed = await (0, parserLoader_1.parseSource)(resolvedContent, resolvedGrammar);
+                        if (resolvedParsed) {
+                            const defInImport = this.findLocalDefinition(resolvedParsed.root, resolvedContent, query.symbol);
+                            if (defInImport) {
+                                return [{
+                                        filePath: path.relative(workspaceRoot, resolvedFile).replace(/\\/g, '/'),
+                                        line: defInImport.line,
+                                        column: defInImport.column,
+                                        provider: 'tree-sitter',
+                                        confidence: 0.7,
+                                        kind: 'definition',
+                                    }];
+                            }
+                        }
+                    }
+                }
+            }
+            return [];
+        }
+        catch {
+            return [];
+        }
+    }
+    async findReferences(query, workspaceRoot) {
+        // For Python: workspace-wide search for the symbol name
+        try {
+            const result = await (0, searchCode_1.searchCode)(workspaceRoot, `\\b${query.symbol.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\b`, undefined);
+            const out = [];
+            for (const hit of result.hits || []) {
+                out.push({
+                    filePath: hit.path,
+                    line: hit.line,
+                    column: 0,
+                    provider: 'tree-sitter',
+                    confidence: 0.6,
+                    kind: 'reference',
+                });
+            }
+            return out;
+        }
+        catch {
+            return [];
+        }
+    }
+    findLocalDefinition(root, source, name) {
+        const FUNCTION_TYPES = new Set([
+            'function_declaration', 'function_definition', 'method_definition',
+            'async_function_declaration', 'async_function_definition',
+            'arrow_function', 'function_expression',
+            'generator_function_declaration', 'generator_declaration',
+            'class_definition', 'class_declaration',
+        ]);
+        for (const n of (0, astHelpers_1.walk)(root)) {
+            if (!FUNCTION_TYPES.has(n.type))
+                continue;
+            for (const child of n.namedChildren) {
+                if ((0, astHelpers_1.isIdentifier)(child) || child.type === 'type_identifier') {
+                    const text = source.slice(child.startIndex, child.endIndex);
+                    if (text === name) {
+                        return {
+                            line: n.startPosition.row + 1,
+                            column: n.startPosition.column + 1,
+                        };
+                    }
+                }
+            }
+            // const name = () => {} — check parent
+            const parent = n.parent;
+            if (parent && (parent.type === 'lexical_declaration' || parent.type === 'variable_declaration')) {
+                const decl = parent.namedChildren.find(c => c.type === 'variable_declarator');
+                if (decl) {
+                    const id = decl.child(0);
+                    if (id && (0, astHelpers_1.isIdentifier)(id) && source.slice(id.startIndex, id.endIndex) === name) {
+                        return {
+                            line: parent.startPosition.row + 1,
+                            column: parent.startPosition.column + 1,
+                        };
+                    }
+                }
+            }
+        }
+        return null;
+    }
+    resolveImport(spec, fromFile, workspaceRoot) {
+        if (!spec.startsWith('.'))
+            return null;
+        const fromDir = path.dirname(path.resolve(workspaceRoot, fromFile));
+        const base = path.resolve(fromDir, spec);
+        const candidates = [
+            base, base + '.ts', base + '.tsx', base + '.js', base + '.jsx',
+            base + '.mjs', base + '.cjs', base + '.py',
+            path.join(base, 'index.ts'), path.join(base, 'index.js'),
+            path.join(base, '__init__.py'),
+        ];
+        for (const c of candidates) {
+            if (fs.existsSync(c))
+                return c;
+        }
+        return null;
+    }
+}
+// ── Provider registry ──────────────────────────────────────────────────────
+const tsProvider = new TypeScriptProgramProvider();
+const treeSitterProvider = new TreeSitterProvider();
+function getProvider(filePath) {
+    const ext = path.extname(filePath).toLowerCase();
+    if (ext === '.ts' || ext === '.tsx' || ext === '.js' || ext === '.jsx' || ext === '.mjs' || ext === '.cjs') {
+        return tsProvider;
+    }
+    return treeSitterProvider;
+}
+// ── Public API ──────────────────────────────────────────────────────────────
+async function findDefinition(workspaceRoot, filePath, symbol, line) {
+    try {
+        (0, files_1.resolveWorkspacePath)(workspaceRoot, filePath);
+    }
+    catch (e) {
+        return `Error: ${e.message}`;
+    }
+    const provider = getProvider(filePath);
+    const locations = await provider.findDefinition({ filePath, symbol, line }, workspaceRoot);
+    if (locations.length === 0) {
+        return `No definition found for "${symbol}" in ${filePath}.`;
+    }
+    const lines = [`Definition of "${symbol}" (${locations.length} location(s)):`];
+    for (const loc of locations) {
+        const prov = loc.provider === 'typescript' ? 'ts' : 'ast';
+        lines.push(`  ${loc.filePath}:${loc.line}:${loc.column} [${prov}, confidence ${loc.confidence}]`);
+    }
+    return lines.join('\n');
+}
+async function findReferences(workspaceRoot, filePath, symbol, line) {
+    try {
+        (0, files_1.resolveWorkspacePath)(workspaceRoot, filePath);
+    }
+    catch (e) {
+        return `Error: ${e.message}`;
+    }
+    const provider = getProvider(filePath);
+    const locations = await provider.findReferences({ filePath, symbol, line }, workspaceRoot);
+    if (locations.length === 0) {
+        return `No references found for "${symbol}" in ${filePath}.`;
+    }
+    const lines = [`References to "${symbol}" (${locations.length} location(s)):`];
+    for (const loc of locations) {
+        const prov = loc.provider === 'typescript' ? 'ts' : 'ast';
+        lines.push(`  ${loc.filePath}:${loc.line} [${prov}, confidence ${loc.confidence}]`);
+    }
+    return lines.join('\n');
+}
+//# sourceMappingURL=symbolIndex.js.map

package/dist/project-map/symbolIndex.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"symbolIndex.js","sourceRoot":"","sources":["../../src/project-map/symbolIndex.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6VH,wCAyBC;AAED,wCAyBC;AA/YD,uCAAyB;AACzB,2CAA6B;AAC7B,iDAA6D;AAC7D,6CAAkE;AAClE,0CAAsD;AACtD,oDAAiD;AAkCjD,8EAA8E;AAE9E,MAAM,yBAAyB;IAClB,IAAI,GAAG,YAAY,CAAC;IAErB,WAAW,CAAC,QAAgB;QAChC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;QACjD,OAAO,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,MAAM,CAAC;IAClH,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,KAAkB,EAAE,aAAqB;QAC1D,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,CAAC;QACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,aAAa,EAAE,YAAY,CAAC,CAAC;QACxE,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,QAAQ,CAAC;QACzC,6DAA6D;QAC7D,uDAAuD;QACvD,OAAO,kBAAkB,CAAC,cAAc,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;IACnE,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,KAAkB,EAAE,aAAqB;QAC1D,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,CAAC;QACjD,8DAA8D;QAC9D,+DAA+D;QAC/D,+DAA+D;QAC/D,4DAA4D;QAC5D,IAAI,CAAC;YACD,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;YACpE,MAAM,MAAM,GAAG,MAAM,IAAA,uBAAU,EAAC,aAAa,EAAE,MAAM,OAAO,KAAK,EAAE,SAAS,CAAC,CAAC;YAC9E,MAAM,GAAG,GAAqB,EAAE,CAAC;YACjC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;gBAClC,GAAG,CAAC,IAAI,CAAC;oBACL,QAAQ,EAAE,GAAG,CAAC,IAAI;oBAClB,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,MAAM,EAAE,CAAC;oBACT,QAAQ,EAAE,YAAY;oBACtB,UAAU,EAAE,GAAG;oBACf,IAAI,EAAE,WAAW;iBACpB,CAAC,CAAC;YACP,CAAC;YACD,OAAO,GAAG,CAAC;QACf,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,EAAE,CAAC;QACd,CAAC;IACL,CAAC;IAEO,aAAa,CAAC,KAAkB,EAAE,aAAqB,EAAE,IAAiC;QAC9F,IAAI,CAAC;YACD,MAAM,EAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;YACjC,MAAM,OAAO,GAAG,IAAA,4BAAoB,EAAC,aAAa,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;YAEpE,MAAM,OAAO,GAAG,EAAE,CAAC,aAAa,CAAC;gBAC7B,SAAS,EAAE,CAAC,OAAO,CAAC;gBACpB,OAAO,EAAE;oBACL,OAAO,EAAE,IAAI;oBACb,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK;oBACrB,MAAM,EAAE,IAAI;oBACZ,YAAY,EAAE,IAAI;oBAClB,MAAM,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM;oBAC9B,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ;oBAC9B,gBAAgB,EAAE,EAAE,CAAC,oBAAoB,CAAC,MAAM;iBACnD;gBACD,IAAI,EAAE,EAAE,CAAC,kBAAkB,CAAC,EAAE,CAAC;aAClC,CAAC,CAAC;YAEH,MAAM,UAAU,GAAG,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;YAClD,IAAI,CAAC,UAAU;gBAAE,OAAO,EAAE,CAAC;YAE3B,8CAA8C;YAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,kBAAkB,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAC1E,IAAI,GAAG,KAAK,CAAC,CAAC;gBAAE,OAAO,EAAE,CAAC;YAE1B,MAAM,OAAO,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;YACzC,MAAM,GAAG,GAAqB,EAAE,CAAC;YAEjC,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;gBACxB,MAAM,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,UAAiB,EAAE,GAAU,CAAC,CAAC;gBAC1E,IAAI,CAAC,MAAM;oBAAE,OAAO,EAAE,CAAC;gBAEvB,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC;gBAC/C,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;oBAC9B,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;oBACtC,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC;oBACnC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;oBAE3E,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;oBAClD,MAAM,QAAQ,GAAG,QAAQ,CAAC,6BAA6B,CAAC,KAAK,CAAC,CAAC;oBAC/D,GAAG,CAAC,IAAI,CAAC;wBACL,QAAQ,EAAE,OAAO;wBACjB,IAAI,EAAE,QAAQ,CAAC,IAAI,GAAG,CAAC;wBACvB,MAAM,EAAE,QAAQ,CAAC,SAAS,GAAG,CAAC;wBAC9B,QAAQ,EAAE,YAAY;wBACtB,UAAU,EAAE,GAAG;wBACf,IAAI,EAAE,YAAY;qBACrB,CAAC,CAAC;gBACP,CAAC;YACL,CAAC;iBAAM,CAAC;gBACJ,aAAa;gBACb,MAAM,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,UAAiB,EAAE,GAAU,CAAC,CAAC;gBAC1E,IAAI,CAAC,MAAM;oBAAE,OAAO,EAAE,CAAC;gBAEvB,MAAM,IAAI,GAAG,OAAO,CAAC,iBAAiB,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;gBACrD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;oBACrB,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC;oBAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;oBAC1E,MAAM,QAAQ,GAAG,EAAE,CAAC,6BAA6B,CAAC,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;oBAC/E,IAAI,CAAC,QAAQ;wBAAE,SAAS;oBAExB,GAAG,CAAC,IAAI,CAAC;wBACL,QAAQ,EAAE,OAAO;wBACjB,IAAI,EAAE,QAAQ,CAAC,IAAI,GAAG,CAAC;wBACvB,MAAM,EAAE,QAAQ,CAAC,SAAS,GAAG,CAAC;wBAC9B,QAAQ,EAAE,YAAY;wBACtB,UAAU,EAAE,GAAG;wBACf,IAAI,EAAE,WAAW;qBACpB,CAAC,CAAC;gBACP,CAAC;YACL,CAAC;YAED,OAAO,GAAG,CAAC;QACf,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,EAAE,CAAC;QACd,CAAC;IACL,CAAC;IAEO,kBAAkB,CAAC,UAAe,EAAE,MAAc,EAAE,QAAiB;QACzE,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC;QACjB,IAAI,QAAQ,GAAG,QAAQ,CAAC;QAExB,MAAM,KAAK,GAAG,CAAC,IAAS,EAAE,EAAE;YACxB,IAAI,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC,gBAAgB,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBAC5D,MAAM,IAAI,GAAG,UAAU,CAAC,6BAA6B,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;gBAChF,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACtD,IAAI,IAAI,GAAG,QAAQ,EAAE,CAAC;oBAClB,QAAQ,GAAG,IAAI,CAAC;oBAChB,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC9B,CAAC;YACL,CAAC;YACD,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAChC,CAAC,CAAC;QACF,KAAK,CAAC,UAAU,CAAC,CAAC;QAElB,OAAO,OAAO,CAAC;IACnB,CAAC;CACJ;AAED,SAAS,cAAc,CAAC,IAAS,EAAE,EAAoB;IACnD,IAAI,IAAI,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,UAAU,EAAE,CAAC;QAClD,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IAC1B,CAAC;AACL,CAAC;AAED,6EAA6E;AAE7E,MAAM,kBAAkB;IACX,IAAI,GAAG,aAAa,CAAC;IAE9B,KAAK,CAAC,cAAc,CAAC,KAAkB,EAAE,aAAqB;QAC1D,wEAAwE;QACxE,MAAM,OAAO,GAAG,IAAA,6BAAc,EAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,EAAE,CAAC;QAErC,IAAI,CAAC;YACD,MAAM,OAAO,GAAG,IAAA,4BAAoB,EAAC,aAAa,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;YACpE,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACjD,MAAM,MAAM,GAAG,MAAM,IAAA,0BAAW,EAAC,OAAO,EAAE,OAAc,CAAC,CAAC;YAC1D,IAAI,CAAC,MAAM;gBAAE,OAAO,EAAE,CAAC;YAEvB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC;YACxB,MAAM,OAAO,GAAG,IAAA,2BAAc,EAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAE9C,yCAAyC;YACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,mBAAmB,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YACvE,IAAI,QAAQ,EAAE,CAAC;gBACX,OAAO,CAAC;wBACJ,QAAQ,EAAE,KAAK,CAAC,QAAQ;wBACxB,IAAI,EAAE,QAAQ,CAAC,IAAI;wBACnB,MAAM,EAAE,QAAQ,CAAC,MAAM;wBACvB,QAAQ,EAAE,aAAa;wBACvB,UAAU,EAAE,GAAG;wBACf,IAAI,EAAE,YAAY;qBACrB,CAAC,CAAC;YACP,CAAC;YAED,4CAA4C;YAC5C,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC/C,IAAI,YAAY,EAAE,CAAC;gBACf,MAAM,YAAY,GAAG,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,KAAK,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;gBACrF,IAAI,YAAY,EAAE,CAAC;oBACf,MAAM,eAAe,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;oBAC9D,MAAM,eAAe,GAAG,IAAA,6BAAc,EAAC,YAAY,CAAC,CAAC;oBACrD,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;wBAChC,MAAM,cAAc,GAAG,MAAM,IAAA,0BAAW,EAAC,eAAe,EAAE,eAAsB,CAAC,CAAC;wBAClF,IAAI,cAAc,EAAE,CAAC;4BACjB,MAAM,WAAW,GAAG,IAAI,CAAC,mBAAmB,CAAC,cAAc,CAAC,IAAI,EAAE,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;4BACjG,IAAI,WAAW,EAAE,CAAC;gCACd,OAAO,CAAC;wCACJ,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;wCACxE,IAAI,EAAE,WAAW,CAAC,IAAI;wCACtB,MAAM,EAAE,WAAW,CAAC,MAAM;wCAC1B,QAAQ,EAAE,aAAa;wCACvB,UAAU,EAAE,GAAG;wCACf,IAAI,EAAE,YAAY;qCACrB,CAAC,CAAC;4BACP,CAAC;wBACL,CAAC;oBACL,CAAC;gBACL,CAAC;YACL,CAAC;YAED,OAAO,EAAE,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,EAAE,CAAC;QACd,CAAC;IACL,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,KAAkB,EAAE,aAAqB;QAC1D,wDAAwD;QACxD,IAAI,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,IAAA,uBAAU,EAAC,aAAa,EAAE,MAAM,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YAC1H,MAAM,GAAG,GAAqB,EAAE,CAAC;YACjC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;gBAClC,GAAG,CAAC,IAAI,CAAC;oBACL,QAAQ,EAAE,GAAG,CAAC,IAAI;oBAClB,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,MAAM,EAAE,CAAC;oBACT,QAAQ,EAAE,aAAa;oBACvB,UAAU,EAAE,GAAG;oBACf,IAAI,EAAE,WAAW;iBACpB,CAAC,CAAC;YACP,CAAC;YACD,OAAO,GAAG,CAAC;QACf,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,EAAE,CAAC;QACd,CAAC;IACL,CAAC;IAEO,mBAAmB,CAAC,IAAS,EAAE,MAAc,EAAE,IAAY;QAC/D,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;YAC3B,sBAAsB,EAAE,qBAAqB,EAAE,mBAAmB;YAClE,4BAA4B,EAAE,2BAA2B;YACzD,gBAAgB,EAAE,qBAAqB;YACvC,gCAAgC,EAAE,uBAAuB;YACzD,kBAAkB,EAAE,mBAAmB;SAC1C,CAAC,CAAC;QAEH,KAAK,MAAM,CAAC,IAAI,IAAA,iBAAI,EAAC,IAAI,CAAC,EAAE,CAAC;YACzB,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC1C,KAAK,MAAM,KAAK,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC;gBAClC,IAAI,IAAA,yBAAY,EAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;oBAC1D,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;oBAC5D,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;wBAChB,OAAO;4BACH,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC;4BAC7B,MAAM,EAAE,CAAC,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC;yBACrC,CAAC;oBACN,CAAC;gBACL,CAAC;YACL,CAAC;YACD,uCAAuC;YACvC,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;YACxB,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,qBAAqB,IAAI,MAAM,CAAC,IAAI,KAAK,sBAAsB,CAAC,EAAE,CAAC;gBAC9F,MAAM,IAAI,GAAG,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,qBAAqB,CAAC,CAAC;gBAC9E,IAAI,IAAI,EAAE,CAAC;oBACP,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;oBACzB,IAAI,EAAE,IAAI,IAAA,yBAAY,EAAC,EAAE,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC;wBAC9E,OAAO;4BACH,IAAI,EAAE,MAAM,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC;4BAClC,MAAM,EAAE,MAAM,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC;yBAC1C,CAAC;oBACN,CAAC;gBACL,CAAC;YACL,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC;IAChB,CAAC;IAEO,aAAa,CAAC,IAAY,EAAE,QAAgB,EAAE,aAAqB;QACvE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC,CAAC;QACpE,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACzC,MAAM,UAAU,GAAG;YACf,IAAI,EAAE,IAAI,GAAG,KAAK,EAAE,IAAI,GAAG,MAAM,EAAE,IAAI,GAAG,KAAK,EAAE,IAAI,GAAG,MAAM;YAC9D,IAAI,GAAG,MAAM,EAAE,IAAI,GAAG,MAAM,EAAE,IAAI,GAAG,KAAK;YAC1C,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC;YACxD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC;SACjC,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YACzB,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;gBAAE,OAAO,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,IAAI,CAAC;IAChB,CAAC;CACJ;AAED,8EAA8E;AAE9E,MAAM,UAAU,GAAG,IAAI,yBAAyB,EAAE,CAAC;AACnD,MAAM,kBAAkB,GAAG,IAAI,kBAAkB,EAAE,CAAC;AAEpD,SAAS,WAAW,CAAC,QAAgB;IACjC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IACjD,IAAI,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;QACzG,OAAO,UAAU,CAAC;IACtB,CAAC;IACD,OAAO,kBAAkB,CAAC;AAC9B,CAAC;AAED,+EAA+E;AAExE,KAAK,UAAU,cAAc,CAChC,aAAqB,EACrB,QAAgB,EAChB,MAAc,EACd,IAAa;IAEb,IAAI,CAAC;QACD,IAAA,4BAAoB,EAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,CAAM,EAAE,CAAC;QACd,OAAO,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC;IACjC,CAAC;IAED,MAAM,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,cAAc,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,aAAa,CAAC,CAAC;IAE3F,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,4BAA4B,MAAM,QAAQ,QAAQ,GAAG,CAAC;IACjE,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,kBAAkB,MAAM,MAAM,SAAS,CAAC,MAAM,gBAAgB,CAAC,CAAC;IAC/E,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;QAC1D,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,gBAAgB,GAAG,CAAC,UAAU,GAAG,CAAC,CAAC;IACtG,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC;AAEM,KAAK,UAAU,cAAc,CAChC,aAAqB,EACrB,QAAgB,EAChB,MAAc,EACd,IAAa;IAEb,IAAI,CAAC;QACD,IAAA,4BAAoB,EAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,CAAM,EAAE,CAAC;QACd,OAAO,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC;IACjC,CAAC;IAED,MAAM,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,cAAc,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,aAAa,CAAC,CAAC;IAE3F,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,4BAA4B,MAAM,QAAQ,QAAQ,GAAG,CAAC;IACjE,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,kBAAkB,MAAM,MAAM,SAAS,CAAC,MAAM,gBAAgB,CAAC,CAAC;IAC/E,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;QAC1D,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,gBAAgB,GAAG,CAAC,UAAU,GAAG,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC"}

package/dist/tooling/agentEvalScoring.d.ts

@@ -0,0 +1,77 @@
+/**
+ * Agent eval scoring — pure functions for scoring Pipeline 2 scan results
+ * against a golden testset.
+ *
+ * Scoring model:
+ *   - Each fixture has an expected verdict (vulnerable | safe) and optionally
+ *     an expected line + type.
+ *   - A finding "matches" a vulnerable fixture if it's at the expected line
+ *     with the expected type (strict) or any finding at all (loose).
+ *   - A finding on a safe fixture is a false positive.
+ *   - Infrastructure failures (crash, timeout, spawn_failed) are tracked
+ *     separately and never count as false negatives.
+ *   - Verify verdicts (PROVEN/UNPROVEN/INCONCLUSIVE) are tracked as
+ *     distribution metrics, not pass/fail.
+ */
+export interface AgentEvalFixture {
+    id: string;
+    class: string;
+    language: string;
+    framework: string;
+    verdict: 'vulnerable' | 'safe';
+    expectLine?: number;
+    expectType?: string;
+}
+export interface AgentEvalFinding {
+    line: number;
+    type: string;
+    severity: string;
+    confidence: number;
+    proven: string;
+    evidenceLevel?: string;
+}
+export interface AgentEvalCaseResult {
+    fixtureId: string;
+    class: string;
+    language: string;
+    framework: string;
+    expected: 'vulnerable' | 'safe';
+    found: boolean;
+    strictFound: boolean;
+    findingCount: number;
+    reportedTypes: string[];
+    reportedLines: number[];
+    provenCount: number;
+    unprovenCount: number;
+    inconclusiveCount: number;
+    skippedCount: number;
+    infraFailure: boolean;
+    infraError?: string;
+    stepsUsed: number;
+    costSpentUsd: number;
+    latencyMs: number;
+}
+export interface AgentEvalMetrics {
+    tp: number;
+    fn: number;
+    fp: number;
+    tn: number;
+    recall: number;
+    precision: number;
+    fpr: number;
+    f1: number;
+    total: number;
+    totalRealVuln: number;
+    totalSafe: number;
+    infraFailures: number;
+    completionRate: number;
+    provenRate: number;
+    unprovenRate: number;
+    inconclusiveRate: number;
+    meanSteps: number;
+    meanCostUsd: number;
+    meanLatencyMs: number;
+}
+export declare function scoreCase(fixture: AgentEvalFixture, findings: AgentEvalFinding[], infraFailure?: boolean, infraError?: string, stepsUsed?: number, costSpentUsd?: number, latencyMs?: number): AgentEvalCaseResult;
+export declare function aggregateMetrics(results: AgentEvalCaseResult[]): AgentEvalMetrics;
+export declare function formatMetricsMarkdown(metrics: AgentEvalMetrics): string;

package/dist/tooling/agentEvalScoring.js

@@ -0,0 +1,140 @@
+"use strict";
+/**
+ * Agent eval scoring — pure functions for scoring Pipeline 2 scan results
+ * against a golden testset.
+ *
+ * Scoring model:
+ *   - Each fixture has an expected verdict (vulnerable | safe) and optionally
+ *     an expected line + type.
+ *   - A finding "matches" a vulnerable fixture if it's at the expected line
+ *     with the expected type (strict) or any finding at all (loose).
+ *   - A finding on a safe fixture is a false positive.
+ *   - Infrastructure failures (crash, timeout, spawn_failed) are tracked
+ *     separately and never count as false negatives.
+ *   - Verify verdicts (PROVEN/UNPROVEN/INCONCLUSIVE) are tracked as
+ *     distribution metrics, not pass/fail.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.scoreCase = scoreCase;
+exports.aggregateMetrics = aggregateMetrics;
+exports.formatMetricsMarkdown = formatMetricsMarkdown;
+function normalizeType(t) {
+    return (t || '').toLowerCase().replace(/[\s-]+/g, '_');
+}
+function scoreCase(fixture, findings, infraFailure = false, infraError, stepsUsed = 0, costSpentUsd = 0, latencyMs = 0) {
+    const reportedTypes = findings.map(f => normalizeType(f.type));
+    const reportedLines = findings.map(f => f.line);
+    const found = findings.length > 0;
+    let strictFound = false;
+    if (fixture.verdict === 'vulnerable' && fixture.expectLine && fixture.expectType) {
+        const expectedType = normalizeType(fixture.expectType);
+        strictFound = findings.some(f => f.line === fixture.expectLine && normalizeType(f.type) === expectedType);
+    }
+    else if (fixture.verdict === 'vulnerable') {
+        strictFound = found;
+    }
+    const provenCount = findings.filter(f => f.proven === 'PROVEN').length;
+    const unprovenCount = findings.filter(f => f.proven === 'UNPROVEN').length;
+    const inconclusiveCount = findings.filter(f => f.proven === 'INCONCLUSIVE').length;
+    const skippedCount = findings.filter(f => f.proven === 'SKIPPED').length;
+    return {
+        fixtureId: fixture.id,
+        class: fixture.class,
+        language: fixture.language,
+        framework: fixture.framework,
+        expected: fixture.verdict,
+        found,
+        strictFound,
+        findingCount: findings.length,
+        reportedTypes,
+        reportedLines,
+        provenCount,
+        unprovenCount,
+        inconclusiveCount,
+        skippedCount,
+        infraFailure,
+        infraError,
+        stepsUsed,
+        costSpentUsd,
+        latencyMs,
+    };
+}
+function aggregateMetrics(results) {
+    let tp = 0, fn = 0, fp = 0, tn = 0;
+    let infraFailures = 0;
+    let totalSteps = 0;
+    let totalCost = 0;
+    let totalLatency = 0;
+    let totalProven = 0;
+    let totalUnproven = 0;
+    let totalInconclusive = 0;
+    let completedRuns = 0;
+    for (const r of results) {
+        if (r.infraFailure) {
+            infraFailures++;
+            continue;
+        }
+        totalSteps += r.stepsUsed;
+        totalCost += r.costSpentUsd;
+        totalLatency += r.latencyMs;
+        completedRuns++;
+        totalProven += r.provenCount;
+        totalUnproven += r.unprovenCount;
+        totalInconclusive += r.inconclusiveCount;
+        if (r.expected === 'vulnerable' && r.found)
+            tp++;
+        else if (r.expected === 'vulnerable' && !r.found)
+            fn++;
+        else if (r.expected === 'safe' && r.found)
+            fp++;
+        else
+            tn++;
+    }
+    const totalRealVuln = tp + fn;
+    const totalSafe = fp + tn;
+    const totalFindings = tp + fp;
+    const nonInfraTotal = results.length - infraFailures;
+    const recall = totalRealVuln ? tp / totalRealVuln : 0;
+    const precision = totalFindings ? tp / totalFindings : 1;
+    const fpr = totalSafe ? fp / totalSafe : 0;
+    const f1 = precision + recall ? (2 * precision * recall) / (precision + recall) : 0;
+    const totalVerdicts = totalProven + totalUnproven + totalInconclusive;
+    const verifyableRuns = results.filter(r => !r.infraFailure && r.expected === 'vulnerable' && r.found).length;
+    return {
+        tp, fn, fp, tn,
+        recall, precision, fpr, f1,
+        total: results.length,
+        totalRealVuln, totalSafe,
+        infraFailures,
+        completionRate: nonInfraTotal ? completedRuns / nonInfraTotal : 0,
+        provenRate: totalVerdicts ? totalProven / totalVerdicts : 0,
+        unprovenRate: totalVerdicts ? totalUnproven / totalVerdicts : 0,
+        inconclusiveRate: totalVerdicts ? totalInconclusive / totalVerdicts : 0,
+        meanSteps: completedRuns ? totalSteps / completedRuns : 0,
+        meanCostUsd: completedRuns ? totalCost / completedRuns : 0,
+        meanLatencyMs: completedRuns ? totalLatency / completedRuns : 0,
+    };
+}
+function formatMetricsMarkdown(metrics) {
+    const pct = (n) => (n * 100).toFixed(1) + '%';
+    const usd = (n) => '$' + n.toFixed(4);
+    const ms = (n) => n.toFixed(0) + 'ms';
+    return `## Agent Scan Golden Eval Results
+
+| Metric | Value |
+|--------|-------|
+| **Recall** | ${pct(metrics.recall)} (${metrics.tp}/${metrics.totalRealVuln}) |
+| **Precision** | ${pct(metrics.precision)} (${metrics.tp}/${metrics.tp + metrics.fp}) |
+| **FPR** | ${pct(metrics.fpr)} (${metrics.fp}/${metrics.totalSafe}) |
+| **F1** | ${metrics.f1.toFixed(3)} |
+| **Completion Rate** | ${pct(metrics.completionRate)} |
+| **Infra Failures** | ${metrics.infraFailures}/${metrics.total} |
+| **Proven Rate** | ${pct(metrics.provenRate)} |
+| **Unproven Rate** | ${pct(metrics.unprovenRate)} |
+| **Inconclusive Rate** | ${pct(metrics.inconclusiveRate)} |
+| **Mean Steps** | metrics.meanSteps.toFixed(1) |
+| **Mean Cost** | ${usd(metrics.meanCostUsd)} |
+| **Mean Latency** | ${ms(metrics.meanLatencyMs)} |
+`;
+}
+//# sourceMappingURL=agentEvalScoring.js.map

package/dist/tooling/agentEvalScoring.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentEvalScoring.js","sourceRoot":"","sources":["../../src/tooling/agentEvalScoring.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;;AAqEH,8BAkDC;AAED,4CA2DC;AAED,sDAsBC;AA3ID,SAAS,aAAa,CAAC,CAAS;IAC5B,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;AAC3D,CAAC;AAED,SAAgB,SAAS,CACrB,OAAyB,EACzB,QAA4B,EAC5B,eAAwB,KAAK,EAC7B,UAAmB,EACnB,YAAoB,CAAC,EACrB,eAAuB,CAAC,EACxB,YAAoB,CAAC;IAErB,MAAM,aAAa,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/D,MAAM,aAAa,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAEhD,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IAClC,IAAI,WAAW,GAAG,KAAK,CAAC;IAExB,IAAI,OAAO,CAAC,OAAO,KAAK,YAAY,IAAI,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QAC/E,MAAM,YAAY,GAAG,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACvD,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAC5B,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,UAAU,IAAI,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,YAAY,CAC1E,CAAC;IACN,CAAC;SAAM,IAAI,OAAO,CAAC,OAAO,KAAK,YAAY,EAAE,CAAC;QAC1C,WAAW,GAAG,KAAK,CAAC;IACxB,CAAC;IAED,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,MAAM,CAAC;IACvE,MAAM,aAAa,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,MAAM,CAAC;IAC3E,MAAM,iBAAiB,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,cAAc,CAAC,CAAC,MAAM,CAAC;IACnF,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,MAAM,CAAC;IAEzE,OAAO;QACH,SAAS,EAAE,OAAO,CAAC,EAAE;QACrB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,QAAQ,EAAE,OAAO,CAAC,OAAO;QACzB,KAAK;QACL,WAAW;QACX,YAAY,EAAE,QAAQ,CAAC,MAAM;QAC7B,aAAa;QACb,aAAa;QACb,WAAW;QACX,aAAa;QACb,iBAAiB;QACjB,YAAY;QACZ,YAAY;QACZ,UAAU;QACV,SAAS;QACT,YAAY;QACZ,SAAS;KACZ,CAAC;AACN,CAAC;AAED,SAAgB,gBAAgB,CAAC,OAA8B;IAC3D,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IACnC,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAC1B,IAAI,aAAa,GAAG,CAAC,CAAC;IAEtB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,YAAY,EAAE,CAAC;YACjB,aAAa,EAAE,CAAC;YAChB,SAAS;QACb,CAAC;QAED,UAAU,IAAI,CAAC,CAAC,SAAS,CAAC;QAC1B,SAAS,IAAI,CAAC,CAAC,YAAY,CAAC;QAC5B,YAAY,IAAI,CAAC,CAAC,SAAS,CAAC;QAC5B,aAAa,EAAE,CAAC;QAEhB,WAAW,IAAI,CAAC,CAAC,WAAW,CAAC;QAC7B,aAAa,IAAI,CAAC,CAAC,aAAa,CAAC;QACjC,iBAAiB,IAAI,CAAC,CAAC,iBAAiB,CAAC;QAEzC,IAAI,CAAC,CAAC,QAAQ,KAAK,YAAY,IAAI,CAAC,CAAC,KAAK;YAAE,EAAE,EAAE,CAAC;aAC5C,IAAI,CAAC,CAAC,QAAQ,KAAK,YAAY,IAAI,CAAC,CAAC,CAAC,KAAK;YAAE,EAAE,EAAE,CAAC;aAClD,IAAI,CAAC,CAAC,QAAQ,KAAK,MAAM,IAAI,CAAC,CAAC,KAAK;YAAE,EAAE,EAAE,CAAC;;YAC3C,EAAE,EAAE,CAAC;IACd,CAAC;IAED,MAAM,aAAa,GAAG,EAAE,GAAG,EAAE,CAAC;IAC9B,MAAM,SAAS,GAAG,EAAE,GAAG,EAAE,CAAC;IAC1B,MAAM,aAAa,GAAG,EAAE,GAAG,EAAE,CAAC;IAC9B,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,GAAG,aAAa,CAAC;IAErD,MAAM,MAAM,GAAG,aAAa,CAAC,CAAC,CAAC,EAAE,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,aAAa,CAAC,CAAC,CAAC,EAAE,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IACzD,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3C,MAAM,EAAE,GAAG,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEpF,MAAM,aAAa,GAAG,WAAW,GAAG,aAAa,GAAG,iBAAiB,CAAC;IACtE,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,QAAQ,KAAK,YAAY,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;IAE7G,OAAO;QACH,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE;QACd,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE;QAC1B,KAAK,EAAE,OAAO,CAAC,MAAM;QACrB,aAAa,EAAE,SAAS;QACxB,aAAa;QACb,cAAc,EAAE,aAAa,CAAC,CAAC,CAAC,aAAa,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;QACjE,UAAU,EAAE,aAAa,CAAC,CAAC,CAAC,WAAW,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;QAC3D,YAAY,EAAE,aAAa,CAAC,CAAC,CAAC,aAAa,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;QAC/D,gBAAgB,EAAE,aAAa,CAAC,CAAC,CAAC,iBAAiB,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;QACvE,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC,UAAU,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;QACzD,WAAW,EAAE,aAAa,CAAC,CAAC,CAAC,SAAS,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;QAC1D,aAAa,EAAE,aAAa,CAAC,CAAC,CAAC,YAAY,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;KAClE,CAAC;AACN,CAAC;AAED,SAAgB,qBAAqB,CAAC,OAAyB;IAC3D,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC;IACtD,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC9C,MAAM,EAAE,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IAE9C,OAAO;;;;iBAIM,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,OAAO,CAAC,EAAE,IAAI,OAAO,CAAC,aAAa;oBACxD,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,OAAO,CAAC,EAAE,IAAI,OAAO,CAAC,EAAE,GAAG,OAAO,CAAC,EAAE;cACtE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,EAAE,IAAI,OAAO,CAAC,SAAS;aACrD,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;0BACR,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC;yBAC5B,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,KAAK;sBACzC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC;wBACrB,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC;4BACrB,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC;;oBAErC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC;uBACrB,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC;CAC/C,CAAC;AACF,CAAC"}