@securecode-ai/mcp 0.5.5 → 0.5.7

package/dist/attack/evidenceLedger.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Evidence ledger — tracks why a task or candidate is complete instead of
+ * marking checklist steps complete because a tool was merely called.
+ *
+ * A tool invocation alone does not satisfy an evidence requirement.
+ * The ledger records structured evidence with fingerprints and links it
+ * to requirements. Progress is derived from newly accepted evidence,
+ * not set manually.
+ */
+import type { LineRange } from './investigationState';
+import type { AgentScanActionType } from './agentScanProtocol';
+export type EvidenceKind = 'source-range' | 'symbol-definition' | 'symbol-reference' | 'handler-inventory' | 'policy-result' | 'guard-result' | 'config-result' | 'cross-file-flow' | 'test-location' | 'test-result' | 'implementation-resolution' | 'proof-result' | 'threat-model-result' | 'reachability-result' | 'ownership-result' | 'capability-result';
+export type EvidenceOutcome = 'positive' | 'negative' | 'empty' | 'blocked' | 'error';
+export interface EvidenceRef {
+    id: string;
+    kind: EvidenceKind;
+    transcriptStep: number;
+    tool: AgentScanActionType;
+    filePath?: string;
+    range?: LineRange;
+    symbol?: string;
+    outcome: EvidenceOutcome;
+    fingerprint: string;
+}
+export interface EvidenceRequirement {
+    id: string;
+    description: string;
+    acceptedKinds: EvidenceKind[];
+    targetFiles?: string[];
+    requiredTools?: AgentScanActionType[];
+    minimumCount: number;
+    acceptsNegative?: boolean;
+}
+export interface ProgressDelta {
+    newRanges: LineRange[];
+    newSymbols: string[];
+    newReferences: number;
+    newFlows: number;
+    completedRequirementIds: string[];
+    meaningful: boolean;
+}
+export declare class EvidenceLedger {
+    private evidence;
+    private requirementStates;
+    private symbols;
+    private flows;
+    addRequirement(requirement: EvidenceRequirement): void;
+    addRequirements(requirements: EvidenceRequirement[]): void;
+    recordEvidence(input: Omit<EvidenceRef, 'id' | 'fingerprint'>): {
+        ref: EvidenceRef;
+        delta: ProgressDelta;
+    };
+    isRequirementSatisfied(requirementId: string): boolean;
+    getUnsatisfiedRequirements(): EvidenceRequirement[];
+    getAllEvidence(): EvidenceRef[];
+    getEvidenceByKind(kind: EvidenceKind): EvidenceRef[];
+    getEvidenceForFile(filePath: string): EvidenceRef[];
+    snapshot(): {
+        evidenceCount: number;
+        requirementCount: number;
+        satisfiedCount: number;
+        symbolCount: number;
+        flowCount: number;
+    };
+    private emptyDelta;
+    private pathMatches;
+}

package/dist/attack/evidenceLedger.js

@@ -0,0 +1,192 @@
+"use strict";
+/**
+ * Evidence ledger — tracks why a task or candidate is complete instead of
+ * marking checklist steps complete because a tool was merely called.
+ *
+ * A tool invocation alone does not satisfy an evidence requirement.
+ * The ledger records structured evidence with fingerprints and links it
+ * to requirements. Progress is derived from newly accepted evidence,
+ * not set manually.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EvidenceLedger = void 0;
+const crypto = __importStar(require("crypto"));
+function fingerprintEvidence(input) {
+    return crypto
+        .createHash('sha256')
+        .update(JSON.stringify(input))
+        .digest('hex')
+        .slice(0, 16);
+}
+class EvidenceLedger {
+    evidence = new Map();
+    requirementStates = new Map();
+    symbols = new Set();
+    flows = 0;
+    addRequirement(requirement) {
+        if (!this.requirementStates.has(requirement.id)) {
+            this.requirementStates.set(requirement.id, { requirement, count: 0 });
+        }
+    }
+    addRequirements(requirements) {
+        for (const req of requirements) {
+            this.addRequirement(req);
+        }
+    }
+    recordEvidence(input) {
+        const fingerprint = fingerprintEvidence({
+            kind: input.kind,
+            tool: input.tool,
+            filePath: input.filePath,
+            range: input.range,
+            symbol: input.symbol,
+            outcome: input.outcome,
+        });
+        // Skip duplicate evidence (same fingerprint)
+        if (this.evidence.has(fingerprint)) {
+            return {
+                ref: this.evidence.get(fingerprint),
+                delta: this.emptyDelta(),
+            };
+        }
+        const ref = {
+            ...input,
+            id: fingerprint,
+            fingerprint,
+        };
+        this.evidence.set(fingerprint, ref);
+        // Track symbols and flows
+        const newSymbols = [];
+        if (input.symbol && !this.symbols.has(input.symbol)) {
+            this.symbols.add(input.symbol);
+            newSymbols.push(input.symbol);
+        }
+        const newFlows = input.kind === 'cross-file-flow' ? 1 : 0;
+        this.flows += newFlows;
+        // Check if this evidence satisfies any requirements
+        const completedRequirementIds = [];
+        for (const [reqId, state] of this.requirementStates) {
+            if (state.count >= state.requirement.minimumCount)
+                continue;
+            const req = state.requirement;
+            if (!req.acceptedKinds.includes(input.kind))
+                continue;
+            if (req.targetFiles && input.filePath &&
+                !req.targetFiles.some(f => this.pathMatches(f, input.filePath)))
+                continue;
+            if (req.requiredTools && !req.requiredTools.includes(input.tool))
+                continue;
+            if (input.outcome === 'blocked' || input.outcome === 'error')
+                continue;
+            if (input.outcome === 'empty' && !req.acceptsNegative)
+                continue;
+            state.count++;
+            if (state.count >= req.minimumCount) {
+                completedRequirementIds.push(reqId);
+            }
+        }
+        const meaningful = completedRequirementIds.length > 0 ||
+            newSymbols.length > 0 ||
+            newFlows > 0 ||
+            (input.kind === 'source-range' && input.outcome === 'positive');
+        return {
+            ref,
+            delta: {
+                newRanges: input.range && input.kind === 'source-range' ? [input.range] : [],
+                newSymbols,
+                newReferences: input.kind === 'symbol-reference' ? 1 : 0,
+                newFlows,
+                completedRequirementIds,
+                meaningful,
+            },
+        };
+    }
+    isRequirementSatisfied(requirementId) {
+        const state = this.requirementStates.get(requirementId);
+        if (!state)
+            return false;
+        return state.count >= state.requirement.minimumCount;
+    }
+    getUnsatisfiedRequirements() {
+        const unsatisfied = [];
+        for (const [_, state] of this.requirementStates) {
+            if (state.count < state.requirement.minimumCount) {
+                unsatisfied.push(state.requirement);
+            }
+        }
+        return unsatisfied;
+    }
+    getAllEvidence() {
+        return [...this.evidence.values()];
+    }
+    getEvidenceByKind(kind) {
+        return [...this.evidence.values()].filter(e => e.kind === kind);
+    }
+    getEvidenceForFile(filePath) {
+        return [...this.evidence.values()].filter(e => e.filePath && this.pathMatches(filePath, e.filePath));
+    }
+    snapshot() {
+        let satisfied = 0;
+        for (const [_, state] of this.requirementStates) {
+            if (state.count >= state.requirement.minimumCount)
+                satisfied++;
+        }
+        return {
+            evidenceCount: this.evidence.size,
+            requirementCount: this.requirementStates.size,
+            satisfiedCount: satisfied,
+            symbolCount: this.symbols.size,
+            flowCount: this.flows,
+        };
+    }
+    emptyDelta() {
+        return {
+            newRanges: [],
+            newSymbols: [],
+            newReferences: 0,
+            newFlows: 0,
+            completedRequirementIds: [],
+            meaningful: false,
+        };
+    }
+    pathMatches(pattern, path) {
+        const np = pattern.replace(/\\/g, '/').toLowerCase();
+        const np2 = path.replace(/\\/g, '/').toLowerCase();
+        return np === np2 || np2.includes(np) || np.includes(np2);
+    }
+}
+exports.EvidenceLedger = EvidenceLedger;
+//# sourceMappingURL=evidenceLedger.js.map

package/dist/attack/evidenceLedger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evidenceLedger.js","sourceRoot":"","sources":["../../src/attack/evidenceLedger.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,+CAAiC;AAuDjC,SAAS,mBAAmB,CAAC,KAO5B;IACG,OAAO,MAAM;SACR,UAAU,CAAC,QAAQ,CAAC;SACpB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;SAC7B,MAAM,CAAC,KAAK,CAAC;SACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACtB,CAAC;AAED,MAAa,cAAc;IACf,QAAQ,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC1C,iBAAiB,GAAG,IAAI,GAAG,EAA+D,CAAC;IAC3F,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAC5B,KAAK,GAAG,CAAC,CAAC;IAElB,cAAc,CAAC,WAAgC;QAC3C,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,CAAC;YAC9C,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;QAC1E,CAAC;IACL,CAAC;IAED,eAAe,CAAC,YAAmC;QAC/C,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;YAC7B,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;IACL,CAAC;IAED,cAAc,CAAC,KAA8C;QACzD,MAAM,WAAW,GAAG,mBAAmB,CAAC;YACpC,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,OAAO,EAAE,KAAK,CAAC,OAAO;SACzB,CAAC,CAAC;QAEH,6CAA6C;QAC7C,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YACjC,OAAO;gBACH,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAE;gBACpC,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE;aAC3B,CAAC;QACN,CAAC;QAED,MAAM,GAAG,GAAgB;YACrB,GAAG,KAAK;YACR,EAAE,EAAE,WAAW;YACf,WAAW;SACd,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QAEpC,0BAA0B;QAC1B,MAAM,UAAU,GAAa,EAAE,CAAC;QAChC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YAClD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC/B,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAClC,CAAC;QACD,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,KAAK,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1D,IAAI,CAAC,KAAK,IAAI,QAAQ,CAAC;QAEvB,oDAAoD;QACpD,MAAM,uBAAuB,GAAa,EAAE,CAAC;QAC7C,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAClD,IAAI,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,WAAW,CAAC,YAAY;gBAAE,SAAS;YAE5D,MAAM,GAAG,GAAG,KAAK,CAAC,WAAW,CAAC;YAC9B,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,SAAS;YACtD,IAAI,GAAG,CAAC,WAAW,IAAI,KAAK,CAAC,QAAQ;gBACjC,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,EAAE,KAAK,CAAC,QAAS,CAAC,CAAC;gBAAE,SAAS;YAC/E,IAAI,GAAG,CAAC,aAAa,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC3E,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,KAAK,OAAO;gBAAE,SAAS;YACvE,IAAI,KAAK,CAAC,OAAO,KAAK,OAAO,IAAI,CAAC,GAAG,CAAC,eAAe;gBAAE,SAAS;YAEhE,KAAK,CAAC,KAAK,EAAE,CAAC;YACd,IAAI,KAAK,CAAC,KAAK,IAAI,GAAG,CAAC,YAAY,EAAE,CAAC;gBAClC,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACxC,CAAC;QACL,CAAC;QAED,MAAM,UAAU,GAAG,uBAAuB,CAAC,MAAM,GAAG,CAAC;YACnC,UAAU,CAAC,MAAM,GAAG,CAAC;YACrB,QAAQ,GAAG,CAAC;YACZ,CAAC,KAAK,CAAC,IAAI,KAAK,cAAc,IAAI,KAAK,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC;QAElF,OAAO;YACH,GAAG;YACH,KAAK,EAAE;gBACH,SAAS,EAAE,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE;gBAC5E,UAAU;gBACV,aAAa,EAAE,KAAK,CAAC,IAAI,KAAK,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACxD,QAAQ;gBACR,uBAAuB;gBACvB,UAAU;aACb;SACJ,CAAC;IACN,CAAC;IAED,sBAAsB,CAAC,aAAqB;QACxC,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QACxD,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QACzB,OAAO,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,WAAW,CAAC,YAAY,CAAC;IACzD,CAAC;IAED,0BAA0B;QACtB,MAAM,WAAW,GAA0B,EAAE,CAAC;QAC9C,KAAK,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC9C,IAAI,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC;gBAC/C,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YACxC,CAAC;QACL,CAAC;QACD,OAAO,WAAW,CAAC;IACvB,CAAC;IAED,cAAc;QACV,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACvC,CAAC;IAED,iBAAiB,CAAC,IAAkB;QAChC,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACpE,CAAC;IAED,kBAAkB,CAAC,QAAgB;QAC/B,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,IAAI,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IACzG,CAAC;IAED,QAAQ;QACJ,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,KAAK,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC9C,IAAI,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,WAAW,CAAC,YAAY;gBAAE,SAAS,EAAE,CAAC;QACnE,CAAC;QACD,OAAO;YACH,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI;YACjC,gBAAgB,EAAE,IAAI,CAAC,iBAAiB,CAAC,IAAI;YAC7C,cAAc,EAAE,SAAS;YACzB,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;YAC9B,SAAS,EAAE,IAAI,CAAC,KAAK;SACxB,CAAC;IACN,CAAC;IAEO,UAAU;QACd,OAAO;YACH,SAAS,EAAE,EAAE;YACb,UAAU,EAAE,EAAE;YACd,aAAa,EAAE,CAAC;YAChB,QAAQ,EAAE,CAAC;YACX,uBAAuB,EAAE,EAAE;YAC3B,UAAU,EAAE,KAAK;SACpB,CAAC;IACN,CAAC;IAEO,WAAW,CAAC,OAAe,EAAE,IAAY;QAC7C,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;QACrD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;QACnD,OAAO,EAAE,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC9D,CAAC;CACJ;AAnJD,wCAmJC"}

package/dist/attack/finishGate.d.ts

@@ -0,0 +1,62 @@
+/**
+ * Hard finish gate — rejects premature finish attempts and continues the
+ * investigation while executable work and budget remain.
+ *
+ * The finish gate is MCP-owned. When the model proposes `finish`, the gate
+ * evaluates whether the investigation is actually complete:
+ *
+ * - Required checklist steps must be complete
+ * - Architecture-risk tasks must be resolved, refuted, or blocked
+ * - All candidates must be terminal
+ * - Security-sensitive handlers must be reviewed
+ * - No executable work items remain (when budget is available)
+ *
+ * If any of these conditions fail and budget remains, finish is REJECTED
+ * and the gate returns a recovery action to continue the investigation.
+ *
+ * If budget is exhausted, finish is accepted as "forced-incomplete" with
+ * coverage gaps for every unresolved item.
+ */
+import type { AgentScanAction, AgentScanFinishAction } from './agentScanProtocol';
+import type { ScanRunState } from './scanState';
+import type { EvidenceLedger } from './evidenceLedger';
+import type { WorkItemQueue } from './workItem';
+import type { HandlerInventory } from '../project-map/handlerInventory';
+import type { CandidateStore } from './candidateStore';
+import type { InvestigationState } from './investigationState';
+import type { ScheduleDecision } from './scanScheduler';
+export type FinishGateMode = 'complete' | 'continue' | 'forced-incomplete';
+export interface FinishGateReason {
+    code: string;
+    description: string;
+}
+export interface FinishGateResult {
+    accepted: boolean;
+    mode: FinishGateMode;
+    reasons: FinishGateReason[];
+    recoveryAction?: AgentScanAction;
+    normalizedFinish?: AgentScanFinishAction;
+    coverageGaps?: {
+        title: string;
+        detail: string;
+        file: string;
+        requiredEvidence: string[];
+        suggestedNextAction: string;
+        priority: 'high' | 'medium' | 'low';
+    }[];
+}
+export interface FinishGateInput {
+    proposal: AgentScanFinishAction;
+    state: ScanRunState;
+    evidence: EvidenceLedger;
+    workItems: WorkItemQueue;
+    handlers: HandlerInventory;
+    candidates: CandidateStore;
+    investigation: InvestigationState;
+    scheduler: ScheduleDecision;
+    target: {
+        filePath: string;
+        fileContent?: string;
+    };
+}
+export declare function evaluateFinishGate(input: FinishGateInput): FinishGateResult;

package/dist/attack/finishGate.js

@@ -0,0 +1,209 @@
+"use strict";
+/**
+ * Hard finish gate — rejects premature finish attempts and continues the
+ * investigation while executable work and budget remain.
+ *
+ * The finish gate is MCP-owned. When the model proposes `finish`, the gate
+ * evaluates whether the investigation is actually complete:
+ *
+ * - Required checklist steps must be complete
+ * - Architecture-risk tasks must be resolved, refuted, or blocked
+ * - All candidates must be terminal
+ * - Security-sensitive handlers must be reviewed
+ * - No executable work items remain (when budget is available)
+ *
+ * If any of these conditions fail and budget remains, finish is REJECTED
+ * and the gate returns a recovery action to continue the investigation.
+ *
+ * If budget is exhausted, finish is accepted as "forced-incomplete" with
+ * coverage gaps for every unresolved item.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.evaluateFinishGate = evaluateFinishGate;
+function evaluateFinishGate(input) {
+    const { proposal, state, evidence, workItems, handlers, candidates, investigation, scheduler, target } = input;
+    const reasons = [];
+    const coverageGaps = [];
+    const hasBudget = state.budget.stepsRemaining > 0 &&
+        state.budget.costSpentUsd < state.budget.costCapUsd;
+    const hasWallClock = Date.now() - state.budget.startedAt < state.budget.wallClockMs;
+    // Check 1: Incomplete investigation steps
+    const incompleteSteps = investigation.getIncompleteSteps();
+    if (incompleteSteps.length > 0) {
+        for (const step of incompleteSteps) {
+            reasons.push({
+                code: 'incomplete-checklist',
+                description: `Required investigation step not completed: ${step}`,
+            });
+            coverageGaps.push({
+                title: `Investigation step not completed: ${step}`,
+                detail: `The agent finished without completing this required investigation step: ${step}. This means the investigation was incomplete and vulnerabilities may have been missed.`,
+                file: target.filePath,
+                requiredEvidence: [`Complete the ${step} step before concluding no vulnerabilities exist`],
+                suggestedNextAction: step === 'config-inspection' ? 'read_config'
+                    : step === 'policy-check' ? 'check_policy'
+                        : step === 'cross-file-flow' ? 'trace_flow_cross_file'
+                            : step === 'route-discovery' ? 'get_endpoints'
+                                : step === 'auth-symbol-search' ? 'search_code'
+                                    : 'continue investigation',
+                priority: 'high',
+            });
+        }
+    }
+    // Check 2: Unresolved architecture-risk tasks
+    const unresolvedTasks = investigation.getUnresolvedTasks();
+    if (unresolvedTasks.length > 0) {
+        for (const task of unresolvedTasks) {
+            reasons.push({
+                code: 'unresolved-task',
+                description: `Architecture risk task unresolved: ${task.claim}`,
+            });
+            coverageGaps.push({
+                title: `Architecture risk unresolved: ${task.claim}`,
+                detail: `This architecture-risk investigation task was not resolved: ${task.claim}. Required evidence: ${task.requiredEvidence.join('; ')}.`,
+                file: task.targetFiles[0] || target.filePath,
+                requiredEvidence: task.requiredEvidence,
+                suggestedNextAction: task.requiredTools[0] || 'continue investigation',
+                priority: 'high',
+            });
+        }
+    }
+    // Check 3: Non-terminal candidates — unsupported candidates block finish
+    // when budget remains. When budget is exhausted, they become coverage gaps.
+    if (!candidates.allReadyForJuror()) {
+        const underInvestigation = candidates.getUnderInvestigation();
+        for (const candidate of underInvestigation) {
+            const missingDims = candidate.requiredProofDimensions?.filter(d => !candidate.satisfiedDimensions?.includes(d)) || [];
+            const dimInfo = missingDims.length > 0
+                ? ` (missing proof dimensions: ${missingDims.join(', ')})`
+                : ` (${candidate.evidenceRefs.length} evidence ref(s))`;
+            reasons.push({
+                code: 'non-terminal-candidate',
+                description: `Candidate needs more evidence: ${candidate.claim} (status: ${candidate.status}${dimInfo})`,
+            });
+            coverageGaps.push({
+                title: `Candidate needs more evidence: ${candidate.claim}`,
+                detail: `This vulnerability candidate at ${candidate.locations.map(l => `${l.filePath}:${l.line}`).join(', ')} has status "${candidate.status}" with ${candidate.evidenceRefs.length} evidence reference(s). Missing proof dimensions: ${missingDims.join(', ') || 'none'}. Run trace_flow, check_guard, or check_policy on the finding location to gather more evidence before finishing.`,
+                file: candidate.locations[0]?.filePath || target.filePath,
+                requiredEvidence: candidate.requiredEvidence.map(e => `${e.description} (tools: ${(e.requiredTools || []).join(', ')})`),
+                suggestedNextAction: (candidate.requiredEvidence[0]?.requiredTools || ['trace_flow_cross_file'])[0],
+                priority: candidate.severity === 'high' || candidate.severity === 'critical' ? 'high' : 'medium',
+            });
+        }
+    }
+    // Check 3b: Unsatisfied evidence-ledger requirements
+    const unsatisfiedReqs = evidence.getUnsatisfiedRequirements();
+    if (unsatisfiedReqs.length > 0) {
+        for (const req of unsatisfiedReqs) {
+            reasons.push({
+                code: 'unsatisfied-evidence-requirement',
+                description: `Evidence requirement not satisfied: ${req.description}`,
+            });
+            coverageGaps.push({
+                title: `Evidence requirement not satisfied: ${req.description}`,
+                detail: `The evidence ledger requirement "${req.description}" was not satisfied. Required tools: ${(req.requiredTools || []).join(', ')}. Accepted kinds: ${req.acceptedKinds.join(', ')}.`,
+                file: req.targetFiles?.[0] || target.filePath,
+                requiredEvidence: [req.description],
+                suggestedNextAction: req.requiredTools?.[0] || 'continue investigation',
+                priority: 'medium',
+            });
+        }
+    }
+    // Check 4: Unreviewed security-sensitive handlers
+    const unreviewedSensitive = handlers.getUnreviewedSensitiveCount();
+    if (unreviewedSensitive > 0) {
+        reasons.push({
+            code: 'unreviewed-handlers',
+            description: `${unreviewedSensitive} security-sensitive handler(s) unreviewed`,
+        });
+    }
+    // Check 5: Executable work items remain (only when budget is available)
+    const executableWork = workItems.getExecutable();
+    if (executableWork.length > 0 && hasBudget && hasWallClock) {
+        reasons.push({
+            code: 'executable-work-remaining',
+            description: `${executableWork.length} executable work item(s) remain`,
+        });
+    }
+    // Check 6: Scheduler has a deterministic action (only when checklist incomplete)
+    if (incompleteSteps.length > 0 && scheduler.kind === 'deterministic-action' && hasBudget && hasWallClock) {
+        reasons.push({
+            code: 'scheduler-has-action',
+            description: `Scheduler has a deterministic action available: ${scheduler.reason}`,
+        });
+    }
+    // Check 7: High-priority unread ranges — security-relevant code that
+    // was never read. This prevents finishing while authentication,
+    // authorization, or command-execution code remains uninspected.
+    if (hasBudget && hasWallClock && target.fileContent) {
+        const uncoveredRanges = investigation.getUncoveredRanges(target.filePath);
+        if (uncoveredRanges.length > 0) {
+            const lines = target.fileContent.split('\n');
+            const HIGH_PRIORITY_KEYWORDS = [
+                'authenticat', 'authorize', 'authorization', 'token', 'session',
+                'credential', 'password', 'execfile', 'exec(', 'spawn(',
+                'child_process', 'writefile', 'permission', 'ownership',
+                'bootstrap', 'pairing', 'sql', 'queryraw', 'eval(',
+            ];
+            for (const range of uncoveredRanges) {
+                const rangeLines = lines.slice(Math.max(0, range.start - 1), Math.min(lines.length, range.end));
+                const rangeText = rangeLines.join('\n').toLowerCase();
+                const hasHighPriority = HIGH_PRIORITY_KEYWORDS.some(kw => rangeText.includes(kw));
+                if (hasHighPriority) {
+                    reasons.push({
+                        code: 'high-priority-unread-range',
+                        description: `Unread range lines ${range.start}-${range.end} contains security-relevant code (auth, exec, token, etc.)`,
+                    });
+                    coverageGaps.push({
+                        title: `Unread high-priority range: lines ${range.start}-${range.end} of ${target.filePath}`,
+                        detail: `This unread range contains security-relevant code (authentication, authorization, command execution, or token handling). Vulnerabilities in this range were not checked.`,
+                        file: target.filePath,
+                        requiredEvidence: [`Read lines ${range.start}-${range.end} and analyze for vulnerabilities`],
+                        suggestedNextAction: 'read_file',
+                        priority: 'high',
+                    });
+                    break;
+                }
+            }
+        }
+    }
+    // Decision:
+    // - If no reasons → accept as complete
+    // - If reasons exist but no budget/wall-clock → accept as forced-incomplete
+    // - If reasons exist and budget remains → reject and continue
+    if (reasons.length === 0) {
+        return {
+            accepted: true,
+            mode: 'complete',
+            reasons: [],
+            normalizedFinish: proposal,
+        };
+    }
+    // Check if we can continue (budget + wall clock available)
+    const canContinue = hasBudget && hasWallClock && !isScanTerminal(state);
+    if (!canContinue) {
+        // Forced-incomplete: budget or wall clock exhausted
+        return {
+            accepted: true,
+            mode: 'forced-incomplete',
+            reasons,
+            coverageGaps,
+            normalizedFinish: proposal,
+        };
+    }
+    // Reject finish — continue investigation
+    const recoveryAction = scheduler.kind === 'deterministic-action' && scheduler.action
+        ? scheduler.action
+        : undefined;
+    return {
+        accepted: false,
+        mode: 'continue',
+        reasons,
+        recoveryAction,
+        coverageGaps,
+    };
+}
+function isScanTerminal(state) {
+    return state.phase === 'completed' || state.phase === 'terminated';
+}
+//# sourceMappingURL=finishGate.js.map

package/dist/attack/finishGate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"finishGate.js","sourceRoot":"","sources":["../../src/attack/finishGate.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;GAkBG;;AAuCH,gDAuMC;AAvMD,SAAgB,kBAAkB,CAAC,KAAsB;IACrD,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IAE/G,MAAM,OAAO,GAAuB,EAAE,CAAC;IACvC,MAAM,YAAY,GAAqC,EAAE,CAAC;IAC1D,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,cAAc,GAAG,CAAC;QAC/B,KAAK,CAAC,MAAM,CAAC,YAAY,GAAG,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC;IACtE,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC;IAEpF,0CAA0C;IAC1C,MAAM,eAAe,GAAG,aAAa,CAAC,kBAAkB,EAAE,CAAC;IAC3D,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;YACjC,OAAO,CAAC,IAAI,CAAC;gBACT,IAAI,EAAE,sBAAsB;gBAC5B,WAAW,EAAE,8CAA8C,IAAI,EAAE;aACpE,CAAC,CAAC;YACH,YAAY,CAAC,IAAI,CAAC;gBACd,KAAK,EAAE,qCAAqC,IAAI,EAAE;gBAClD,MAAM,EAAE,2EAA2E,IAAI,yFAAyF;gBAChL,IAAI,EAAE,MAAM,CAAC,QAAQ;gBACrB,gBAAgB,EAAE,CAAC,gBAAgB,IAAI,kDAAkD,CAAC;gBAC1F,mBAAmB,EAAE,IAAI,KAAK,mBAAmB,CAAC,CAAC,CAAC,aAAa;oBAC7D,CAAC,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,cAAc;wBAC1C,CAAC,CAAC,IAAI,KAAK,iBAAiB,CAAC,CAAC,CAAC,uBAAuB;4BACtD,CAAC,CAAC,IAAI,KAAK,iBAAiB,CAAC,CAAC,CAAC,eAAe;gCAC9C,CAAC,CAAC,IAAI,KAAK,oBAAoB,CAAC,CAAC,CAAC,aAAa;oCAC/C,CAAC,CAAC,wBAAwB;gBAC9B,QAAQ,EAAE,MAAM;aACnB,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IAED,8CAA8C;IAC9C,MAAM,eAAe,GAAG,aAAa,CAAC,kBAAkB,EAAE,CAAC;IAC3D,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;YACjC,OAAO,CAAC,IAAI,CAAC;gBACT,IAAI,EAAE,iBAAiB;gBACvB,WAAW,EAAE,sCAAsC,IAAI,CAAC,KAAK,EAAE;aAClE,CAAC,CAAC;YACH,YAAY,CAAC,IAAI,CAAC;gBACd,KAAK,EAAE,iCAAiC,IAAI,CAAC,KAAK,EAAE;gBACpD,MAAM,EAAE,+DAA+D,IAAI,CAAC,KAAK,wBAAwB,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;gBAC5I,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,QAAQ;gBAC5C,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;gBACvC,mBAAmB,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,wBAAwB;gBACtE,QAAQ,EAAE,MAAM;aACnB,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IAED,yEAAyE;IACzE,4EAA4E;IAC5E,IAAI,CAAC,UAAU,CAAC,gBAAgB,EAAE,EAAE,CAAC;QACjC,MAAM,kBAAkB,GAAG,UAAU,CAAC,qBAAqB,EAAE,CAAC;QAC9D,KAAK,MAAM,SAAS,IAAI,kBAAkB,EAAE,CAAC;YACzC,MAAM,WAAW,GAAG,SAAS,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAC9D,CAAC,SAAS,CAAC,mBAAmB,EAAE,QAAQ,CAAC,CAAC,CAAC,CAC9C,IAAI,EAAE,CAAC;YACR,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,GAAG,CAAC;gBAClC,CAAC,CAAC,+BAA+B,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;gBAC1D,CAAC,CAAC,KAAK,SAAS,CAAC,YAAY,CAAC,MAAM,mBAAmB,CAAC;YAC5D,OAAO,CAAC,IAAI,CAAC;gBACT,IAAI,EAAE,wBAAwB;gBAC9B,WAAW,EAAE,kCAAkC,SAAS,CAAC,KAAK,aAAa,SAAS,CAAC,MAAM,GAAG,OAAO,GAAG;aAC3G,CAAC,CAAC;YACH,YAAY,CAAC,IAAI,CAAC;gBACd,KAAK,EAAE,kCAAkC,SAAS,CAAC,KAAK,EAAE;gBAC1D,MAAM,EAAE,mCAAmC,SAAS,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,SAAS,CAAC,MAAM,UAAU,SAAS,CAAC,YAAY,CAAC,MAAM,qDAAqD,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,kHAAkH;gBAC3X,IAAI,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,IAAI,MAAM,CAAC,QAAQ;gBACzD,gBAAgB,EAAE,SAAS,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,WAAW,YAAY,CAAC,CAAC,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;gBACxH,mBAAmB,EAAE,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,aAAa,IAAI,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,CAAC;gBACnG,QAAQ,EAAE,SAAS,CAAC,QAAQ,KAAK,MAAM,IAAI,SAAS,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;aACnG,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IAED,qDAAqD;IACrD,MAAM,eAAe,GAAG,QAAQ,CAAC,0BAA0B,EAAE,CAAC;IAC9D,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,KAAK,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;YAChC,OAAO,CAAC,IAAI,CAAC;gBACT,IAAI,EAAE,kCAAkC;gBACxC,WAAW,EAAE,uCAAuC,GAAG,CAAC,WAAW,EAAE;aACxE,CAAC,CAAC;YACH,YAAY,CAAC,IAAI,CAAC;gBACd,KAAK,EAAE,uCAAuC,GAAG,CAAC,WAAW,EAAE;gBAC/D,MAAM,EAAE,oCAAoC,GAAG,CAAC,WAAW,wCAAwC,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,qBAAqB,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;gBAC3L,IAAI,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,QAAQ;gBAC7C,gBAAgB,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC;gBACnC,mBAAmB,EAAE,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,IAAI,wBAAwB;gBACvE,QAAQ,EAAE,QAAQ;aACrB,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IAED,kDAAkD;IAClD,MAAM,mBAAmB,GAAG,QAAQ,CAAC,2BAA2B,EAAE,CAAC;IACnE,IAAI,mBAAmB,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,qBAAqB;YAC3B,WAAW,EAAE,GAAG,mBAAmB,2CAA2C;SACjF,CAAC,CAAC;IACP,CAAC;IAED,wEAAwE;IACxE,MAAM,cAAc,GAAG,SAAS,CAAC,aAAa,EAAE,CAAC;IACjD,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,IAAI,YAAY,EAAE,CAAC;QACzD,OAAO,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,2BAA2B;YACjC,WAAW,EAAE,GAAG,cAAc,CAAC,MAAM,iCAAiC;SACzE,CAAC,CAAC;IACP,CAAC;IAED,iFAAiF;IACjF,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,CAAC,IAAI,KAAK,sBAAsB,IAAI,SAAS,IAAI,YAAY,EAAE,CAAC;QACvG,OAAO,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,sBAAsB;YAC5B,WAAW,EAAE,mDAAmD,SAAS,CAAC,MAAM,EAAE;SACrF,CAAC,CAAC;IACP,CAAC;IAED,qEAAqE;IACrE,gEAAgE;IAChE,gEAAgE;IAChE,IAAI,SAAS,IAAI,YAAY,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QAClD,MAAM,eAAe,GAAG,aAAa,CAAC,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC1E,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC7C,MAAM,sBAAsB,GAAG;gBAC3B,aAAa,EAAE,WAAW,EAAE,eAAe,EAAE,OAAO,EAAE,SAAS;gBAC/D,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ;gBACvD,eAAe,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW;gBACvD,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO;aACrD,CAAC;YACF,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;gBAClC,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;gBAChG,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;gBACtD,MAAM,eAAe,GAAG,sBAAsB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;gBAClF,IAAI,eAAe,EAAE,CAAC;oBAClB,OAAO,CAAC,IAAI,CAAC;wBACT,IAAI,EAAE,4BAA4B;wBAClC,WAAW,EAAE,sBAAsB,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,GAAG,4DAA4D;qBAC1H,CAAC,CAAC;oBACH,YAAY,CAAC,IAAI,CAAC;wBACd,KAAK,EAAE,qCAAqC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,GAAG,OAAO,MAAM,CAAC,QAAQ,EAAE;wBAC5F,MAAM,EAAE,0KAA0K;wBAClL,IAAI,EAAE,MAAM,CAAC,QAAQ;wBACrB,gBAAgB,EAAE,CAAC,cAAc,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,GAAG,kCAAkC,CAAC;wBAC5F,mBAAmB,EAAE,WAAW;wBAChC,QAAQ,EAAE,MAAM;qBACnB,CAAC,CAAC;oBACH,MAAM;gBACV,CAAC;YACL,CAAC;QACL,CAAC;IACL,CAAC;IAED,YAAY;IACZ,uCAAuC;IACvC,4EAA4E;IAC5E,8DAA8D;IAE9D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO;YACH,QAAQ,EAAE,IAAI;YACd,IAAI,EAAE,UAAU;YAChB,OAAO,EAAE,EAAE;YACX,gBAAgB,EAAE,QAAQ;SAC7B,CAAC;IACN,CAAC;IAED,2DAA2D;IAC3D,MAAM,WAAW,GAAG,SAAS,IAAI,YAAY,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAExE,IAAI,CAAC,WAAW,EAAE,CAAC;QACf,oDAAoD;QACpD,OAAO;YACH,QAAQ,EAAE,IAAI;YACd,IAAI,EAAE,mBAAmB;YACzB,OAAO;YACP,YAAY;YACZ,gBAAgB,EAAE,QAAQ;SAC7B,CAAC;IACN,CAAC;IAED,yCAAyC;IACzC,MAAM,cAAc,GAAG,SAAS,CAAC,IAAI,KAAK,sBAAsB,IAAI,SAAS,CAAC,MAAM;QAChF,CAAC,CAAC,SAAS,CAAC,MAAM;QAClB,CAAC,CAAC,SAAS,CAAC;IAEhB,OAAO;QACH,QAAQ,EAAE,KAAK;QACf,IAAI,EAAE,UAAU;QAChB,OAAO;QACP,cAAc;QACd,YAAY;KACf,CAAC;AACN,CAAC;AAED,SAAS,cAAc,CAAC,KAAmB;IACvC,OAAO,KAAK,CAAC,KAAK,KAAK,WAAW,IAAI,KAAK,CAAC,KAAK,KAAK,YAAY,CAAC;AACvE,CAAC"}

package/dist/attack/fixCodeMerge.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Fixed-code merge helper — reconstructs the full file by replacing the
+ * declared line range with the proposed fixed code.
+ *
+ * The fixer API returns `fixed_code` + `replace_range` (start_line, end_line).
+ * Before fix verification, we need the FULL file with the fix applied so the
+ * verify subagent can test whether the original exploit still reproduces.
+ *
+ * Rules:
+ *   - Lines are 1-indexed, end_line is inclusive.
+ *   - Lines before start_line and after end_line are preserved.
+ *   - Malformed ranges (start > end, start < 1, end > total lines) are rejected.
+ *   - The merged code is kept in memory only — never written to the workspace.
+ */
+export interface ReplaceRange {
+    start_line: number;
+    end_line: number;
+}
+export interface MergeResult {
+    ok: true;
+    mergedCode: string;
+}
+export interface MergeError {
+    ok: false;
+    error: string;
+}
+export declare function mergeFixedCode(originalCode: string, fixedCode: string, replaceRange: ReplaceRange): MergeResult | MergeError;

package/dist/attack/fixCodeMerge.js

@@ -0,0 +1,42 @@
+"use strict";
+/**
+ * Fixed-code merge helper — reconstructs the full file by replacing the
+ * declared line range with the proposed fixed code.
+ *
+ * The fixer API returns `fixed_code` + `replace_range` (start_line, end_line).
+ * Before fix verification, we need the FULL file with the fix applied so the
+ * verify subagent can test whether the original exploit still reproduces.
+ *
+ * Rules:
+ *   - Lines are 1-indexed, end_line is inclusive.
+ *   - Lines before start_line and after end_line are preserved.
+ *   - Malformed ranges (start > end, start < 1, end > total lines) are rejected.
+ *   - The merged code is kept in memory only — never written to the workspace.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.mergeFixedCode = mergeFixedCode;
+function mergeFixedCode(originalCode, fixedCode, replaceRange) {
+    const { start_line, end_line } = replaceRange;
+    if (!Number.isInteger(start_line) || !Number.isInteger(end_line)) {
+        return { ok: false, error: `replace_range lines must be integers (got start=${start_line}, end=${end_line})` };
+    }
+    if (start_line < 1) {
+        return { ok: false, error: `replace_range start_line must be >= 1 (got ${start_line})` };
+    }
+    if (end_line < start_line) {
+        return { ok: false, error: `replace_range end_line (${end_line}) must be >= start_line (${start_line})` };
+    }
+    const originalLines = originalCode.split('\n');
+    if (end_line > originalLines.length) {
+        return { ok: false, error: `replace_range end_line (${end_line}) exceeds file length (${originalLines.length} lines)` };
+    }
+    // Lines before the replacement (1-indexed → 0-indexed slice).
+    const before = originalLines.slice(0, start_line - 1);
+    // Lines after the replacement (end_line is inclusive → slice from end_line).
+    const after = originalLines.slice(end_line);
+    // The fixed code may be multi-line — split it and join with the preserved lines.
+    const fixedLines = fixedCode.length > 0 ? fixedCode.split('\n') : [];
+    const mergedLines = [...before, ...fixedLines, ...after];
+    return { ok: true, mergedCode: mergedLines.join('\n') };
+}
+//# sourceMappingURL=fixCodeMerge.js.map

package/dist/attack/fixCodeMerge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fixCodeMerge.js","sourceRoot":"","sources":["../../src/attack/fixCodeMerge.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;GAaG;;AAiBH,wCAgCC;AAhCD,SAAgB,cAAc,CAC1B,YAAoB,EACpB,SAAiB,EACjB,YAA0B;IAE1B,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,YAAY,CAAC;IAE9C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mDAAmD,UAAU,SAAS,QAAQ,GAAG,EAAE,CAAC;IACnH,CAAC;IACD,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;QACjB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,8CAA8C,UAAU,GAAG,EAAE,CAAC;IAC7F,CAAC;IACD,IAAI,QAAQ,GAAG,UAAU,EAAE,CAAC;QACxB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,2BAA2B,QAAQ,4BAA4B,UAAU,GAAG,EAAE,CAAC;IAC9G,CAAC;IAED,MAAM,aAAa,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,QAAQ,GAAG,aAAa,CAAC,MAAM,EAAE,CAAC;QAClC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,2BAA2B,QAAQ,0BAA0B,aAAa,CAAC,MAAM,SAAS,EAAE,CAAC;IAC5H,CAAC;IAED,8DAA8D;IAC9D,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,GAAG,CAAC,CAAC,CAAC;IACtD,6EAA6E;IAC7E,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAE5C,iFAAiF;IACjF,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAErE,MAAM,WAAW,GAAG,CAAC,GAAG,MAAM,EAAE,GAAG,UAAU,EAAE,GAAG,KAAK,CAAC,CAAC;IACzD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AAC5D,CAAC"}