@securecode-ai/mcp 0.5.5 → 0.5.6

package/dist/utils/effectMock.js

@@ -0,0 +1,162 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createEffectMock = createEffectMock;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const EFFECT_MOCK_JS = `const E = {
+    sync: (fn) => ({ _tag: "Sync", fn }),
+    die: (msg) => { throw new Error(typeof msg === "string" ? msg : JSON.stringify(msg)); },
+    gen: (generatorFn) => ({
+        _tag: "Gen",
+        run() {
+            const gen = generatorFn();
+            let result = gen.next();
+            while (!result.done) {
+                const y = result.value;
+                if (y && y._tag === "Sync") result = gen.next(y.fn());
+                else if (y && y._tag === "Die") throw new Error(y.msg);
+                else if (y && y._tag === "Succeed") result = gen.next(y.v);
+                else if (y && y._tag === "Fail") throw y.e;
+                else result = gen.next(y);
+            }
+            return result.value;
+        }
+    }),
+    succeed: (v) => ({ _tag: "Succeed", v }),
+    fail: (e) => ({ _tag: "Fail", e }),
+    runSync: (e) => e && e._tag === "Gen" ? e.run() : e && e._tag === "Sync" ? e.fn() : e,
+    runPromise: async (e) => e && e._tag === "Gen" ? e.run() : e && e._tag === "Sync" ? e.fn() : e,
+    map: (e, fn) => e && e._tag === "Sync" ? { _tag: "Sync", fn: () => fn(e.fn()) } : e,
+    flatMap: (e, fn) => e && e._tag === "Sync" ? { _tag: "Sync", fn: () => { const r = e.fn(); return fn(r); } } : e,
+    catchAll: (e, fn) => e,
+    try_: (fn) => ({ _tag: "Sync", fn: () => { try { return fn(); } catch (e) { return e; } } }),
+};
+export const Effect = E;
+export const Layer = {
+    effect: (tag, genEffect) => {
+        const result = genEffect && genEffect._tag === "Gen" ? genEffect.run() : genEffect;
+        return { _tag: "Layer", tag, gen: genEffect, ...result };
+    },
+    succeed: (val) => ({ _tag: "Layer", val }),
+    fail: (e) => ({ _tag: "Layer", e }),
+    empty: { _tag: "Layer" },
+    build: (layer) => layer,
+    toRuntime: (layer) => layer,
+    provide: (effect, layer) => effect,
+};
+export const Context = {
+    Tag: (id) => class { static _tag = id; },
+    make: (tag, val) => ({ [tag]: val }),
+    get: (tag) => ({ _tag: "Sync", fn: () => tag }),
+};
+export const Schema = {
+    TaggedErrorClass: () => () => class extends Error {
+        constructor(props) { super(props?.message || ""); Object.assign(this, props); }
+    },
+    String: { _tag: "String" },
+    Number: { _tag: "Number" },
+    Boolean: { _tag: "Boolean" },
+    optional: (s) => s,
+    Defect: { _tag: "Defect" },
+    Struct: (fields) => ({ _tag: "Struct", fields }),
+    Array: (item) => ({ _tag: "Array", item }),
+    decodeUnknownSync: (schema) => (val) => val,
+    encodeSync: (schema) => (val) => val,
+};
+export const ServiceMap = {
+    Service: () => () => class {
+        static _tag = "mock-service";
+        static key = "mock-service";
+    },
+};
+export const pipe = (val, ...fns) => fns.reduce((v, fn) => fn(v), val);
+export const Option = {
+    some: (v) => ({ _tag: "Some", value: v }),
+    none: { _tag: "None" },
+    isSome: (o) => o && o._tag === "Some",
+    isNone: (o) => !o || o._tag === "None",
+    getOrElse: (o, fn) => o && o._tag === "Some" ? o.value : fn(),
+    map: (o, fn) => o && o._tag === "Some" ? { _tag: "Some", value: fn(o.value) } : o,
+};
+export const Either = {
+    left: (e) => ({ _tag: "Left", left: e }),
+    right: (v) => ({ _tag: "Right", right: v }),
+    isRight: (e) => e && e._tag === "Right",
+    isLeft: (e) => e && e._tag === "Left",
+    getOrElse: (e, fn) => e && e._tag === "Right" ? e.right : fn(),
+    map: (e, fn) => e && e._tag === "Right" ? { _tag: "Right", right: fn(e.right) } : e,
+};
+export const Cause = {
+    die: (msg) => ({ _tag: "Die", msg }),
+    fail: (e) => ({ _tag: "Fail", e }),
+    toString: (c) => JSON.stringify(c),
+};
+export const Stream = {
+    fromIterable: (items) => ({ _tag: "Stream", items }),
+    run: (stream) => stream,
+};
+export const SubscriptionRef = {
+    make: (val) => ({ _tag: "SubscriptionRef", ref: { value: val } }),
+    get: (sr) => ({ _tag: "Sync", fn: () => sr.ref.value }),
+    set: (sr, val) => ({ _tag: "Sync", fn: () => { sr.ref.value = val; } }),
+};
+export const Ref = {
+    make: (val) => ({ value: val }),
+    get: (r) => ({ _tag: "Sync", fn: () => r.value }),
+    set: (r, val) => ({ _tag: "Sync", fn: () => { r.value = val; } }),
+    update: (r, fn) => ({ _tag: "Sync", fn: () => { r.value = fn(r.value); } }),
+};
+export const Fiber = {
+    run: (effect) => ({ _tag: "Fiber", effect }),
+    join: (fiber) => fiber.effect,
+};
+export const Runtime = {
+    defaultRuntime: { runSync: E.runSync, runPromise: E.runPromise },
+};
+`;
+const EFFECT_PKG_JSON = JSON.stringify({
+    name: "effect",
+    version: "0.0.0-mock",
+    main: "index.js",
+    type: "module",
+});
+function createEffectMock(workspaceRoot) {
+    const mockDir = path.join(workspaceRoot, 'node_modules', 'effect');
+    fs.mkdirSync(mockDir, { recursive: true });
+    fs.writeFileSync(path.join(mockDir, 'package.json'), EFFECT_PKG_JSON, 'utf8');
+    fs.writeFileSync(path.join(mockDir, 'index.js'), EFFECT_MOCK_JS, 'utf8');
+}
+//# sourceMappingURL=effectMock.js.map

package/dist/utils/effectMock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"effectMock.js","sourceRoot":"","sources":["../../src/utils/effectMock.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0HA,4CAKC;AA/HD,uCAAyB;AACzB,2CAA6B;AAE7B,MAAM,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8GtB,CAAC;AAEF,MAAM,eAAe,GAAG,IAAI,CAAC,SAAS,CAAC;IACnC,IAAI,EAAE,QAAQ;IACd,OAAO,EAAE,YAAY;IACrB,IAAI,EAAE,UAAU;IAChB,IAAI,EAAE,QAAQ;CACjB,CAAC,CAAC;AAEH,SAAgB,gBAAgB,CAAC,aAAqB;IAClD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC;IACnE,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3C,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,CAAC;IAC9E,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC;AAC7E,CAAC"}

package/dist/utils/gitContext.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Git context — safe, read-only git blame and history extraction for the
+ * agent scan's git_blame and git_history tools.
+ *
+ * Security rules (enforced here, not by the caller):
+ *   - execFile only, no shell
+ *   - argument arrays, never string concatenation
+ *   - `--` before every file path (prevents option injection)
+ *   - workspace confinement via resolveWorkspacePath
+ *   - 20 commits maximum (hard cap)
+ *   - output truncated to 8KB and redacted (emails, secrets)
+ *   - non-git workspaces return a clear "not a git repo" message
+ *
+ * The agent is told that history is CONTEXT, never proof that code is safe.
+ */
+export declare function getGitBlame(workspaceRoot: string, filePath: string, startLine?: number, endLine?: number): Promise<string>;
+export declare function getGitHistory(workspaceRoot: string, filePath?: string, functionName?: string, limit?: number): Promise<string>;
+export interface GitChangedFilesResult {
+    ok: boolean;
+    files: string[];
+    baseRef: string;
+    headRef: string;
+    error?: string;
+}
+export declare function getGitChangedFiles(workspaceRoot: string, baseRef: string, headRef?: string): Promise<GitChangedFilesResult>;
+export declare function formatGitChangedFiles(workspaceRoot: string, baseRef: string, headRef?: string): Promise<string>;

package/dist/utils/gitContext.js

@@ -0,0 +1,317 @@
+"use strict";
+/**
+ * Git context — safe, read-only git blame and history extraction for the
+ * agent scan's git_blame and git_history tools.
+ *
+ * Security rules (enforced here, not by the caller):
+ *   - execFile only, no shell
+ *   - argument arrays, never string concatenation
+ *   - `--` before every file path (prevents option injection)
+ *   - workspace confinement via resolveWorkspacePath
+ *   - 20 commits maximum (hard cap)
+ *   - output truncated to 8KB and redacted (emails, secrets)
+ *   - non-git workspaces return a clear "not a git repo" message
+ *
+ * The agent is told that history is CONTEXT, never proof that code is safe.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getGitBlame = getGitBlame;
+exports.getGitHistory = getGitHistory;
+exports.getGitChangedFiles = getGitChangedFiles;
+exports.formatGitChangedFiles = formatGitChangedFiles;
+const path = __importStar(require("path"));
+const child_process_1 = require("child_process");
+const files_1 = require("./files");
+const MAX_COMMITS = 20;
+const MAX_OUTPUT_BYTES = 8192;
+const GIT_TIMEOUT_MS = 10_000;
+function execGit(args, workspaceRoot) {
+    return new Promise((resolve) => {
+        (0, child_process_1.execFile)('git', args, {
+            cwd: workspaceRoot,
+            timeout: GIT_TIMEOUT_MS,
+            maxBuffer: MAX_OUTPUT_BYTES,
+            encoding: 'utf8',
+            windowsHide: true,
+        }, (err, stdout, stderr) => {
+            if (err) {
+                resolve({ ok: false, output: '', error: err.message || String(err) });
+                return;
+            }
+            resolve({ ok: true, output: stdout || stderr });
+        });
+    });
+}
+function isGitRepo(workspaceRoot) {
+    return new Promise((resolve) => {
+        (0, child_process_1.execFile)('git', ['rev-parse', '--is-inside-work-tree'], {
+            cwd: workspaceRoot,
+            timeout: 3000,
+            windowsHide: true,
+        }, (err, stdout) => {
+            resolve(!err && stdout.trim() === 'true');
+        });
+    });
+}
+/** Redact email addresses and obvious secret patterns from git output. */
+function redactGitOutput(text) {
+    return text
+        .replace(/<[^>]+@[^>]+>/g, '<redacted>') // author emails <foo@bar.com>
+        .replace(/\b[\w.+-]+@[\w-]+\.[\w.-]+\b/g, 'redacted@email') // bare emails
+        .replace(/(sk-[\w]{20,})/gi, 'sk-REDACTED') // OpenAI keys
+        .replace(/(AKIA[\w]{16})/g, 'AKIA-REDACTED') // AWS keys
+        .replace(/(ghp_[\w]{36})/g, 'ghp-REDACTED') // GitHub PATs
+        .replace(/(xox[baprs]-[\w-]+)/g, 'xox-REDACTED'); // Slack tokens
+}
+function truncate(text, max = MAX_OUTPUT_BYTES) {
+    if (text.length <= max)
+        return text;
+    return text.slice(0, max) + '\n… [truncated]';
+}
+async function getGitBlame(workspaceRoot, filePath, startLine, endLine) {
+    const isGit = await isGitRepo(workspaceRoot);
+    if (!isGit) {
+        return `Not a git repository — git_blame unavailable.`;
+    }
+    let absPath;
+    try {
+        absPath = (0, files_1.resolveWorkspacePath)(workspaceRoot, filePath);
+    }
+    catch (e) {
+        return `Error: ${e.message}`;
+    }
+    const relPath = path.relative(workspaceRoot, absPath).replace(/\\/g, '/');
+    const range = startLine && endLine ? `-L ${startLine},${endLine}` : null;
+    const args = ['blame', '--porcelain', '--'];
+    if (range)
+        args.splice(1, 0, ...range.split(' '));
+    args.push(relPath);
+    const result = await execGit(args, workspaceRoot);
+    if (!result.ok) {
+        return `git blame failed: ${result.error || 'unknown error'}. The file may not be tracked by git.`;
+    }
+    const lines = result.output.split('\n');
+    const blameEntries = [];
+    let current = null;
+    for (const line of lines) {
+        if (line.startsWith('\t')) {
+            if (current) {
+                current.line = line.slice(1);
+                blameEntries.push(current);
+                current = null;
+            }
+            continue;
+        }
+        const match = line.match(/^([0-9a-f]{8,40}) (\d+)\s/);
+        if (match && !current) {
+            current = { hash: match[1].slice(0, 8), author: '', date: '', summary: '', line: '' };
+        }
+        if (line.startsWith('author ') && current)
+            current.author = redactGitOutput(line.slice(7));
+        if (line.startsWith('author-mail ') && current)
+            current.author = `${current.author} ${redactGitOutput(line.slice(12))}`;
+        if (line.startsWith('committer-time ') && current) {
+            const ts = parseInt(line.slice(15), 10);
+            if (!isNaN(ts))
+                current.date = new Date(ts * 1000).toISOString().slice(0, 10);
+        }
+        if (line.startsWith('summary ') && current)
+            current.summary = redactGitOutput(line.slice(8));
+    }
+    if (blameEntries.length === 0) {
+        return `No blame data for ${relPath}.`;
+    }
+    const out = [`Git blame for ${relPath} (${blameEntries.length} line(s)):`];
+    for (const e of blameEntries.slice(0, 20)) {
+        out.push(`  ${e.hash}  ${e.date}  ${e.author}`);
+        out.push(`    ${e.summary}`);
+        out.push(`    L: ${e.line}`);
+    }
+    return truncate(out.join('\n'));
+}
+async function getGitHistory(workspaceRoot, filePath, functionName, limit = 10) {
+    const isGit = await isGitRepo(workspaceRoot);
+    if (!isGit) {
+        return `Not a git repository — git_history unavailable.`;
+    }
+    const maxLimit = Math.min(limit, MAX_COMMITS);
+    const args = ['log', `--max-count=${maxLimit}`, '--format=%h|%ad|%an|%s', '--date=short'];
+    if (filePath) {
+        let absPath;
+        try {
+            absPath = (0, files_1.resolveWorkspacePath)(workspaceRoot, filePath);
+        }
+        catch (e) {
+            return `Error: ${e.message}`;
+        }
+        const relPath = path.relative(workspaceRoot, absPath).replace(/\\/g, '/');
+        args.push('--', relPath);
+    }
+    else {
+        args.push('--');
+    }
+    if (functionName) {
+        args.splice(2, 0, `-S${functionName}`);
+    }
+    const result = await execGit(args, workspaceRoot);
+    if (!result.ok) {
+        return `git log failed: ${result.error || 'unknown error'}.`;
+    }
+    const lines = result.output.trim().split('\n').filter(Boolean);
+    if (lines.length === 0) {
+        return filePath
+            ? `No commit history for ${filePath}.`
+            : `No commit history found.`;
+    }
+    const out = [`Git history (${lines.length} commit(s))${filePath ? ` for ${filePath}` : ''}:`];
+    for (const line of lines) {
+        const parts = line.split('|');
+        if (parts.length >= 4) {
+            const [hash, date, author, summary] = parts;
+            out.push(`  ${hash}  ${date}  ${redactGitOutput(author)}`);
+            out.push(`    ${redactGitOutput(summary)}`);
+        }
+    }
+    return truncate(out.join('\n'));
+}
+// ── Git diff (changed files) ────────────────────────────────────────────────
+//
+// Returns the list of files changed between a base ref and HEAD (or between
+// two refs). Used by the agent scan's diff-aware blast radius scoping: only
+// files that changed (and their blast radius) need to be scanned.
+//
+// Security:
+//   - baseRef/headRef validated against a strict regex (no shell injection)
+//   - execFile only, no shell
+//   - argument arrays, `--` separator not needed for refs (git treats them
+//     as positional args to `diff --name-only`)
+//   - output truncated, redacted, 10s timeout
+//   - non-git workspaces return a clear message
+const REF_PATTERN = /^[a-zA-Z0-9._~^/-]{1,100}$/;
+const MAX_CHANGED_FILES = 500;
+function validateRef(ref) {
+    if (!ref || ref.length === 0)
+        return null;
+    if (!REF_PATTERN.test(ref))
+        return null;
+    if (ref.includes('..'))
+        return null; // reject range operators
+    return ref;
+}
+async function getGitChangedFiles(workspaceRoot, baseRef, headRef) {
+    const isGit = await isGitRepo(workspaceRoot);
+    if (!isGit) {
+        return {
+            ok: false,
+            files: [],
+            baseRef,
+            headRef: headRef || 'HEAD',
+            error: 'Not a git repository — git_diff unavailable.',
+        };
+    }
+    const base = validateRef(baseRef);
+    if (!base) {
+        return {
+            ok: false,
+            files: [],
+            baseRef,
+            headRef: headRef || 'HEAD',
+            error: `Invalid base ref: "${baseRef}". Refs must match /^[a-zA-Z0-9._\\/-]{1,100}$/ and not contain "..".`,
+        };
+    }
+    const head = headRef ? validateRef(headRef) : 'HEAD';
+    if (headRef && !head) {
+        return {
+            ok: false,
+            files: [],
+            baseRef: base,
+            headRef: headRef,
+            error: `Invalid head ref: "${headRef}".`,
+        };
+    }
+    const args = ['diff', '--name-only', '--no-renames'];
+    if (base === 'HEAD' && !headRef) {
+        args.push('--cached');
+    }
+    else {
+        args.push(`${base}...${head}`);
+    }
+    const result = await execGit(args, workspaceRoot);
+    if (!result.ok) {
+        return {
+            ok: false,
+            files: [],
+            baseRef: base,
+            headRef: head || 'HEAD',
+            error: `git diff failed: ${result.error || 'unknown error'}. The ref "${base}" may not exist.`,
+        };
+    }
+    const files = result.output
+        .trim()
+        .split('\n')
+        .filter(Boolean)
+        .map(f => f.replace(/\\/g, '/'))
+        .filter(f => !f.startsWith(' '));
+    const capped = files.slice(0, MAX_CHANGED_FILES);
+    const truncated = files.length > MAX_CHANGED_FILES;
+    return {
+        ok: true,
+        files: capped,
+        baseRef: base,
+        headRef: head || 'HEAD',
+        error: truncated ? `Truncated to ${MAX_CHANGED_FILES} files (${files.length} total changed).` : undefined,
+    };
+}
+async function formatGitChangedFiles(workspaceRoot, baseRef, headRef) {
+    const result = await getGitChangedFiles(workspaceRoot, baseRef, headRef);
+    if (!result.ok) {
+        return result.error || 'Failed to get changed files.';
+    }
+    if (result.files.length === 0) {
+        return `No files changed between ${result.baseRef} and ${result.headRef}.`;
+    }
+    const out = [
+        `Changed files (${result.files.length}) between ${result.baseRef} and ${result.headRef}:`,
+    ];
+    for (const f of result.files) {
+        out.push(`  ${f}`);
+    }
+    if (result.error) {
+        out.push(`\nNote: ${result.error}`);
+    }
+    return truncate(out.join('\n'));
+}
+//# sourceMappingURL=gitContext.js.map

package/dist/utils/gitContext.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitContext.js","sourceRoot":"","sources":["../../src/utils/gitContext.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8DH,kCAkEC;AAED,sCAqDC;AAkCD,gDAyEC;AAED,sDAwBC;AA1TD,2CAA6B;AAC7B,iDAAyC;AACzC,mCAA+C;AAE/C,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAC9B,MAAM,cAAc,GAAG,MAAM,CAAC;AAQ9B,SAAS,OAAO,CAAC,IAAc,EAAE,aAAqB;IAClD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC3B,IAAA,wBAAQ,EAAC,KAAK,EAAE,IAAI,EAAE;YAClB,GAAG,EAAE,aAAa;YAClB,OAAO,EAAE,cAAc;YACvB,SAAS,EAAE,gBAAgB;YAC3B,QAAQ,EAAE,MAAM;YAChB,WAAW,EAAE,IAAI;SACpB,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YACvB,IAAI,GAAG,EAAE,CAAC;gBACN,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAG,GAAW,CAAC,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC/E,OAAO;YACX,CAAC;YACD,OAAO,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,IAAI,MAAM,EAAE,CAAC,CAAC;QACpD,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,SAAS,CAAC,aAAqB;IACpC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC3B,IAAA,wBAAQ,EAAC,KAAK,EAAE,CAAC,WAAW,EAAE,uBAAuB,CAAC,EAAE;YACpD,GAAG,EAAE,aAAa;YAClB,OAAO,EAAE,IAAI;YACb,WAAW,EAAE,IAAI;SACpB,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE;YACf,OAAO,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,MAAM,CAAC,CAAC;QAC9C,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;AACP,CAAC;AAED,0EAA0E;AAC1E,SAAS,eAAe,CAAC,IAAY;IACjC,OAAO,IAAI;SACN,OAAO,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAAO,8BAA8B;SAC5E,OAAO,CAAC,+BAA+B,EAAE,gBAAgB,CAAC,CAAC,cAAc;SACzE,OAAO,CAAC,kBAAkB,EAAE,aAAa,CAAC,CAAI,cAAc;SAC5D,OAAO,CAAC,iBAAiB,EAAE,eAAe,CAAC,CAAG,WAAW;SACzD,OAAO,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAI,cAAc;SAC5D,OAAO,CAAC,sBAAsB,EAAE,cAAc,CAAC,CAAC,CAAC,eAAe;AACzE,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,MAAc,gBAAgB;IAC1D,IAAI,IAAI,CAAC,MAAM,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC;IACpC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,iBAAiB,CAAC;AAClD,CAAC;AAEM,KAAK,UAAU,WAAW,CAC7B,aAAqB,EACrB,QAAgB,EAChB,SAAkB,EAClB,OAAgB;IAEhB,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,aAAa,CAAC,CAAC;IAC7C,IAAI,CAAC,KAAK,EAAE,CAAC;QACT,OAAO,+CAA+C,CAAC;IAC3D,CAAC;IAED,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACD,OAAO,GAAG,IAAA,4BAAoB,EAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,CAAM,EAAE,CAAC;QACd,OAAO,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC;IACjC,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC1E,MAAM,KAAK,GAAG,SAAS,IAAI,OAAO,CAAC,CAAC,CAAC,MAAM,SAAS,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACzE,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,aAAa,EAAE,IAAI,CAAC,CAAC;IAC5C,IAAI,KAAK;QAAE,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IAClD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAEnB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IAClD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACb,OAAO,qBAAqB,MAAM,CAAC,KAAK,IAAI,eAAe,uCAAuC,CAAC;IACvG,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,YAAY,GAAoF,EAAE,CAAC;IACzG,IAAI,OAAO,GAAyF,IAAI,CAAC;IAEzG,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACvB,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,IAAI,OAAO,EAAE,CAAC;gBACV,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAC7B,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAC3B,OAAO,GAAG,IAAI,CAAC;YACnB,CAAC;YACD,SAAS;QACb,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;QACtD,IAAI,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QAC1F,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,OAAO;YAAE,OAAO,CAAC,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3F,IAAI,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,IAAI,OAAO;YAAE,OAAO,CAAC,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QACxH,IAAI,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,IAAI,OAAO,EAAE,CAAC;YAChD,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACxC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBAAE,OAAO,CAAC,IAAI,GAAG,IAAI,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,OAAO;YAAE,OAAO,CAAC,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACjG,CAAC;IAED,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,qBAAqB,OAAO,GAAG,CAAC;IAC3C,CAAC;IAED,MAAM,GAAG,GAAa,CAAC,iBAAiB,OAAO,KAAK,YAAY,CAAC,MAAM,YAAY,CAAC,CAAC;IACrF,KAAK,MAAM,CAAC,IAAI,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;QACxC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QAChD,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7B,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AACpC,CAAC;AAEM,KAAK,UAAU,aAAa,CAC/B,aAAqB,EACrB,QAAiB,EACjB,YAAqB,EACrB,QAAgB,EAAE;IAElB,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,aAAa,CAAC,CAAC;IAC7C,IAAI,CAAC,KAAK,EAAE,CAAC;QACT,OAAO,iDAAiD,CAAC;IAC7D,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,eAAe,QAAQ,EAAE,EAAE,wBAAwB,EAAE,cAAc,CAAC,CAAC;IAE1F,IAAI,QAAQ,EAAE,CAAC;QACX,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACD,OAAO,GAAG,IAAA,4BAAoB,EAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;QAC5D,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YACd,OAAO,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC;QACjC,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC1E,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC7B,CAAC;SAAM,CAAC;QACJ,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC;IAED,IAAI,YAAY,EAAE,CAAC;QACf,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,YAAY,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IAClD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACb,OAAO,mBAAmB,MAAM,CAAC,KAAK,IAAI,eAAe,GAAG,CAAC;IACjE,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC/D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,QAAQ;YACX,CAAC,CAAC,yBAAyB,QAAQ,GAAG;YACtC,CAAC,CAAC,0BAA0B,CAAC;IACrC,CAAC;IAED,MAAM,GAAG,GAAa,CAAC,gBAAgB,KAAK,CAAC,MAAM,cAAc,QAAQ,CAAC,CAAC,CAAC,QAAQ,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACxG,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YACpB,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC;YAC5C,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,KAAK,IAAI,KAAK,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,IAAI,CAAC,OAAO,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAChD,CAAC;IACL,CAAC;IACD,OAAO,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AACpC,CAAC;AAED,+EAA+E;AAC/E,EAAE;AACF,4EAA4E;AAC5E,4EAA4E;AAC5E,kEAAkE;AAClE,EAAE;AACF,YAAY;AACZ,4EAA4E;AAC5E,8BAA8B;AAC9B,2EAA2E;AAC3E,gDAAgD;AAChD,8CAA8C;AAC9C,gDAAgD;AAEhD,MAAM,WAAW,GAAG,4BAA4B,CAAC;AACjD,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAE9B,SAAS,WAAW,CAAC,GAAW;IAC5B,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,yBAAyB;IAC9D,OAAO,GAAG,CAAC;AACf,CAAC;AAUM,KAAK,UAAU,kBAAkB,CACpC,aAAqB,EACrB,OAAe,EACf,OAAgB;IAEhB,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,aAAa,CAAC,CAAC;IAC7C,IAAI,CAAC,KAAK,EAAE,CAAC;QACT,OAAO;YACH,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,EAAE;YACT,OAAO;YACP,OAAO,EAAE,OAAO,IAAI,MAAM;YAC1B,KAAK,EAAE,8CAA8C;SACxD,CAAC;IACN,CAAC;IAED,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,CAAC,IAAI,EAAE,CAAC;QACR,OAAO;YACH,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,EAAE;YACT,OAAO;YACP,OAAO,EAAE,OAAO,IAAI,MAAM;YAC1B,KAAK,EAAE,sBAAsB,OAAO,uEAAuE;SAC9G,CAAC;IACN,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACrD,IAAI,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC;QACnB,OAAO;YACH,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,EAAE;YACT,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,OAAO;YAChB,KAAK,EAAE,sBAAsB,OAAO,IAAI;SAC3C,CAAC;IACN,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,aAAa,EAAE,cAAc,CAAC,CAAC;IACrD,IAAI,IAAI,KAAK,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC1B,CAAC;SAAM,CAAC;QACJ,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,MAAM,IAAI,EAAE,CAAC,CAAC;IACnC,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IAClD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACb,OAAO;YACH,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,EAAE;YACT,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,IAAI,IAAI,MAAM;YACvB,KAAK,EAAE,oBAAoB,MAAM,CAAC,KAAK,IAAI,eAAe,cAAc,IAAI,kBAAkB;SACjG,CAAC;IACN,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM;SACtB,IAAI,EAAE;SACN,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,OAAO,CAAC;SACf,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;SAC/B,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAA;IAEpC,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC;IACjD,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,GAAG,iBAAiB,CAAC;IAEnD,OAAO;QACH,EAAE,EAAE,IAAI;QACR,KAAK,EAAE,MAAM;QACb,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,IAAI,IAAI,MAAM;QACvB,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,gBAAgB,iBAAiB,WAAW,KAAK,CAAC,MAAM,kBAAkB,CAAC,CAAC,CAAC,SAAS;KAC5G,CAAC;AACN,CAAC;AAEM,KAAK,UAAU,qBAAqB,CACvC,aAAqB,EACrB,OAAe,EACf,OAAgB;IAEhB,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,aAAa,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACzE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACb,OAAO,MAAM,CAAC,KAAK,IAAI,8BAA8B,CAAC;IAC1D,CAAC;IAED,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,4BAA4B,MAAM,CAAC,OAAO,QAAQ,MAAM,CAAC,OAAO,GAAG,CAAC;IAC/E,CAAC;IAED,MAAM,GAAG,GAAa;QAClB,kBAAkB,MAAM,CAAC,KAAK,CAAC,MAAM,aAAa,MAAM,CAAC,OAAO,QAAQ,MAAM,CAAC,OAAO,GAAG;KAC5F,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAC3B,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACvB,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,IAAI,CAAC,WAAW,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AACpC,CAAC"}

package/dist/utils/localTestRunner.d.ts

@@ -1,6 +1,61 @@
+/**
+ * Local test runner — drives execution of LLM-generated verification tests
+ * through the verification sandbox.
+ *
+ * SECURITY MODEL (post-rewrite):
+ *   1. `checkTestSafety()` runs first as defense-in-depth. If it blocks,
+ *      we return early without spawning anything.
+ *   2. `detectSandbox()` returns the best available real isolation backend
+ *      (Docker preferred, Deno as a JS/TS-only fallback). If neither is
+ *      available, this runner returns `sandbox-unavailable` — it does NOT
+ *      fall back to executing the script with host privileges.
+ *   3. The sandbox backend executes the script with no network, a
+ *      read-only workspace, a tmpfs /tmp, capped CPU/memory/pids, and a
+ *      scrubbed env (only NODE_ENV and PATH). The verdict is parsed from
+ *      stdout/stderr against `/PASS:/` and `/FAIL:/` markers.
+ *
+ * The previous implementation spread the full `process.env` into the
+ * child and ran via `execFileSync` with no isolation. That allowed
+ * prompt-injected content in scanned source to ride into the
+ * verify-generate prompt and produce a test that exfiltrated secrets.
+ */
+import { type SandboxBackend } from './verificationSandbox';
 export interface LocalTestResult {
-    verdict: 'pass' | 'fail' | 'error' | 'timeout';
+    verdict: 'pass' | 'fail' | 'error' | 'timeout' | 'blocked' | 'sandbox-unavailable' | 'cancelled';
     output: string;
     exitCode: number;
+    /** Name of the backend that executed the test (e.g. "docker", "deno"). Empty when blocked or unavailable. */
+    backend?: string;
 }
-export declare function runLocalTest(script: string, runner: string, workspaceRoot: string): Promise<LocalTestResult>;
+/**
+ * The message shown when no isolation backend is available. Exported so the
+ * agent-scan tool can reuse it in its top-level `verifyHint` (instead of
+ * every finding carrying the full text in its `provenReason`).
+ *
+ * Why this matters: without a sandbox, the verify loop returns INCONCLUSIVE
+ * for every high/medium finding. The headline differentiator of Pipeline 2
+ * ("exploit-verified, not just LLM-believed") is offline. The user needs to
+ * know — in one place, with a copy-pasteable install path — what to do.
+ */
+export declare const SANDBOX_UNAVAILABLE_MESSAGE: string;
+export declare function runLocalTest(script: string, runner: string, workspaceRoot: string, options?: {
+    setupScript?: string | null;
+    timeoutMs?: number;
+    signal?: AbortSignal;
+    /** Test-only: inject a sandbox backend. Production code leaves this unset. */
+    sandboxBackend?: SandboxBackend;
+}): Promise<LocalTestResult>;
+/**
+ * Run a validated test command (npm test, pytest, etc.) inside the sandbox.
+ * Uses command mode — no script file is written; the executable + args are
+ * passed directly to the sandbox backend. The sandbox enforces network=none,
+ * read-only workspace, and resource limits.
+ *
+ * Returns the same LocalTestResult shape as runLocalTest, with exit-code-based
+ * verdicts (0 = pass, nonzero = fail).
+ */
+export declare function runTestCommand(executable: string, args: string[], workspaceRoot: string, options?: {
+    timeoutMs?: number;
+    signal?: AbortSignal;
+    sandboxBackend?: SandboxBackend;
+}): Promise<LocalTestResult>;