@securecode-ai/mcp 0.5.8 → 0.6.0

package/dist/attack/agentScanBatchSelection.js

@@ -0,0 +1,167 @@
+"use strict";
+/**
+ * Deterministic file selection for the agent scan batch tool.
+ *
+ * Selects the top N security-relevant files from the architecture context,
+ * using either the recommended scan order or the important files list.
+ * Filters out missing, empty, binary, and oversized files before selection.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.selectAgentScanBatchFiles = selectAgentScanBatchFiles;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const MAX_FILE_BYTES = 1_500_000;
+const MIN_TOP_N = 1;
+const MAX_TOP_N = 20;
+const DEFAULT_TOP_N = 3;
+function normalizePath(filePath) {
+    return filePath.replace(/\\/g, '/').replace(/^\.\//, '');
+}
+function checkFile(workspaceRoot, filePath) {
+    const absPath = path.isAbsolute(filePath)
+        ? filePath
+        : path.join(workspaceRoot, filePath);
+    if (!fs.existsSync(absPath)) {
+        return { ok: false, reason: 'file does not exist' };
+    }
+    let stat;
+    try {
+        stat = fs.statSync(absPath);
+    }
+    catch {
+        return { ok: false, reason: 'cannot stat file' };
+    }
+    if (!stat.isFile()) {
+        return { ok: false, reason: 'not a regular file' };
+    }
+    if (stat.size === 0) {
+        return { ok: false, reason: 'file is empty' };
+    }
+    if (stat.size > MAX_FILE_BYTES) {
+        return { ok: false, reason: `file too large (${(stat.size / 1_000_000).toFixed(1)}MB > 1.5MB limit)` };
+    }
+    let content;
+    try {
+        content = fs.readFileSync(absPath, 'utf8');
+    }
+    catch {
+        return { ok: false, reason: 'cannot read file' };
+    }
+    if (content.trim().length === 0) {
+        return { ok: false, reason: 'file is empty (whitespace only)' };
+    }
+    const headBytes = Buffer.from(content.slice(0, 1000), 'utf8');
+    if (headBytes.includes(0)) {
+        return { ok: false, reason: 'binary file' };
+    }
+    return { ok: true };
+}
+/**
+ * Select the top N files for sequential agent scanning.
+ *
+ * Algorithm:
+ *  1. Start with recommendedScanOrder (or importantFiles if selected).
+ *  2. Normalize paths to forward-slash workspace-relative.
+ *  3. Remove duplicates.
+ *  4. Filter out missing, empty, binary, and oversized files.
+ *  5. Fill remaining slots from the other list if needed.
+ *  6. Clamp topN to 1..20.
+ *  7. Freeze the selection before returning.
+ */
+function selectAgentScanBatchFiles(workspaceRoot, architecture, options) {
+    const topN = Math.max(MIN_TOP_N, Math.min(MAX_TOP_N, options.topN ?? DEFAULT_TOP_N));
+    const useImportantFirst = options.fileSelection === 'importantFiles';
+    if (!architecture) {
+        return { selected: [], skipped: [] };
+    }
+    const seen = new Set();
+    const selected = [];
+    const skipped = [];
+    const importantMap = new Map();
+    for (const f of architecture.importantFiles || []) {
+        importantMap.set(normalizePath(f.file), f);
+    }
+    const buildEntry = (filePath, rank) => {
+        const norm = normalizePath(filePath);
+        const info = importantMap.get(norm);
+        return {
+            filePath: norm,
+            rank,
+            role: info?.role,
+            importance: info?.importance,
+        };
+    };
+    const tryAdd = (filePath) => {
+        const norm = normalizePath(filePath);
+        if (seen.has(norm))
+            return;
+        seen.add(norm);
+        const check = checkFile(workspaceRoot, norm);
+        if (!check.ok) {
+            skipped.push({ filePath: norm, reason: check.reason });
+            return;
+        }
+        if (selected.length < topN) {
+            selected.push(buildEntry(filePath, selected.length + 1));
+        }
+    };
+    const primaryList = useImportantFirst
+        ? (architecture.importantFiles || [])
+            .slice()
+            .sort((a, b) => (b.importance || 0) - (a.importance || 0))
+            .map(f => f.file)
+        : (architecture.recommendedScanOrder || []);
+    for (const filePath of primaryList) {
+        if (selected.length >= topN)
+            break;
+        tryAdd(filePath);
+    }
+    if (selected.length < topN) {
+        const fallback = useImportantFirst
+            ? (architecture.recommendedScanOrder || [])
+            : (architecture.importantFiles || [])
+                .slice()
+                .sort((a, b) => (b.importance || 0) - (a.importance || 0))
+                .map(f => f.file);
+        for (const filePath of fallback) {
+            if (selected.length >= topN)
+                break;
+            tryAdd(filePath);
+        }
+    }
+    return { selected, skipped };
+}
+//# sourceMappingURL=agentScanBatchSelection.js.map

package/dist/attack/agentScanBatchSelection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentScanBatchSelection.js","sourceRoot":"","sources":["../../src/attack/agentScanBatchSelection.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2FH,8DA8EC;AAvKD,uCAAyB;AACzB,2CAA6B;AAoB7B,MAAM,cAAc,GAAG,SAAS,CAAC;AACjC,MAAM,SAAS,GAAG,CAAC,CAAC;AACpB,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,aAAa,GAAG,CAAC,CAAC;AAExB,SAAS,aAAa,CAAC,QAAgB;IACnC,OAAO,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,SAAS,CAAC,aAAqB,EAAE,QAAgB;IACtD,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QACrC,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;IAEzC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IACxD,CAAC;IAED,IAAI,IAAc,CAAC;IACnB,IAAI,CAAC;QACD,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACrD,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QACjB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IACvD,CAAC;IAED,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QAClB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAClD,CAAC;IAED,IAAI,IAAI,CAAC,IAAI,GAAG,cAAc,EAAE,CAAC;QAC7B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,CAAC,IAAI,CAAC,IAAI,GAAG,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,mBAAmB,EAAE,CAAC;IAC3G,CAAC;IAED,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACD,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACrD,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAC;IACpE,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;IAC9D,IAAI,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QACxB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAChD,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACxB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAgB,yBAAyB,CACrC,aAAqB,EACrB,YAAwC,EACxC,OAGC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,IAAI,aAAa,CAAC,CAAC,CAAC;IACrF,MAAM,iBAAiB,GAAG,OAAO,CAAC,aAAa,KAAK,gBAAgB,CAAC;IAErE,IAAI,CAAC,YAAY,EAAE,CAAC;QAChB,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACzC,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,QAAQ,GAAwB,EAAE,CAAC;IACzC,MAAM,OAAO,GAAuB,EAAE,CAAC;IAEvC,MAAM,YAAY,GAAG,IAAI,GAAG,EAAyB,CAAC;IACtD,KAAK,MAAM,CAAC,IAAI,YAAY,CAAC,cAAc,IAAI,EAAE,EAAE,CAAC;QAChD,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/C,CAAC;IAED,MAAM,UAAU,GAAG,CAAC,QAAgB,EAAE,IAAY,EAAqB,EAAE;QACrE,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;QACrC,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACpC,OAAO;YACH,QAAQ,EAAE,IAAI;YACd,IAAI;YACJ,IAAI,EAAE,IAAI,EAAE,IAA0B;YACtC,UAAU,EAAE,IAAI,EAAE,UAAU;SAC/B,CAAC;IACN,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,CAAC,QAAgB,EAAQ,EAAE;QACtC,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;QACrC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO;QAC3B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAEf,MAAM,KAAK,GAAG,SAAS,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;QAC7C,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;YACZ,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;YACvD,OAAO;QACX,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;YACzB,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;QAC7D,CAAC;IACL,CAAC,CAAC;IAEF,MAAM,WAAW,GAAG,iBAAiB;QACjC,CAAC,CAAC,CAAC,YAAY,CAAC,cAAc,IAAI,EAAE,CAAC;aAChC,KAAK,EAAE;aACP,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC;aACzD,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACrB,CAAC,CAAC,CAAC,YAAY,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC;IAEhD,KAAK,MAAM,QAAQ,IAAI,WAAW,EAAE,CAAC;QACjC,IAAI,QAAQ,CAAC,MAAM,IAAI,IAAI;YAAE,MAAM;QACnC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACrB,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,iBAAiB;YAC9B,CAAC,CAAC,CAAC,YAAY,CAAC,oBAAoB,IAAI,EAAE,CAAC;YAC3C,CAAC,CAAC,CAAC,YAAY,CAAC,cAAc,IAAI,EAAE,CAAC;iBAChC,KAAK,EAAE;iBACP,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC;iBACzD,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAE1B,KAAK,MAAM,QAAQ,IAAI,QAAQ,EAAE,CAAC;YAC9B,IAAI,QAAQ,CAAC,MAAM,IAAI,IAAI;gBAAE,MAAM;YACnC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACrB,CAAC;IACL,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AACjC,CAAC"}

package/dist/attack/agentScanCoordinator.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Per-workspace agent scan coordinator.
+ *
+ * Ensures one active agent-scan workflow per workspace per MCP process.
+ * Independent direct calls queue in FIFO order. A batch holds the lock for
+ * its full workflow (map + architecture + all scans). Different workspaces
+ * may run concurrently.
+ *
+ * Cancellation removes waiting requests. Releasing the lock occurs in finally.
+ */
+export declare class AgentScanCoordinator {
+    private readonly locks;
+    private getLock;
+    /**
+     * Run an operation exclusively for the given workspace.
+     * If another operation is already running for the same workspace,
+     * this waits until it completes (FIFO queue) before starting.
+     * Different workspaces run concurrently.
+     */
+    runExclusive<T>(workspaceRoot: string, operation: () => Promise<T>, options?: {
+        signal?: AbortSignal;
+        maxWaitMs?: number;
+    }): Promise<T>;
+    /**
+     * Check if an operation is currently active for the given workspace.
+     */
+    isRunning(workspaceRoot: string): boolean;
+    /**
+     * Get the number of queued operations waiting for the workspace lock.
+     */
+    queueDepth(workspaceRoot: string): number;
+}
+export declare const globalScanCoordinator: AgentScanCoordinator;

package/dist/attack/agentScanCoordinator.js

@@ -0,0 +1,116 @@
+"use strict";
+/**
+ * Per-workspace agent scan coordinator.
+ *
+ * Ensures one active agent-scan workflow per workspace per MCP process.
+ * Independent direct calls queue in FIFO order. A batch holds the lock for
+ * its full workflow (map + architecture + all scans). Different workspaces
+ * may run concurrently.
+ *
+ * Cancellation removes waiting requests. Releasing the lock occurs in finally.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.globalScanCoordinator = exports.AgentScanCoordinator = void 0;
+class WorkspaceLock {
+    active = false;
+    queue = [];
+    get isActive() {
+        return this.active;
+    }
+    get queueLength() {
+        return this.queue.length;
+    }
+    async acquire(signal, maxWaitMs) {
+        if (!this.active) {
+            this.active = true;
+            return;
+        }
+        if (signal?.aborted) {
+            throw new Error('Agent scan cancelled while waiting for workspace lock.');
+        }
+        return new Promise((resolve, reject) => {
+            const entry = { resolve, reject, signal };
+            const cleanup = () => {
+                const idx = this.queue.indexOf(entry);
+                if (idx >= 0)
+                    this.queue.splice(idx, 1);
+                if (entry.abortListener && signal) {
+                    signal.removeEventListener('abort', entry.abortListener);
+                }
+            };
+            if (signal) {
+                entry.abortListener = () => {
+                    cleanup();
+                    reject(new Error('Agent scan cancelled while waiting for workspace lock.'));
+                };
+                signal.addEventListener('abort', entry.abortListener);
+            }
+            if (maxWaitMs !== undefined) {
+                const timeout = setTimeout(() => {
+                    cleanup();
+                    reject(new Error(`Agent scan timed out waiting for workspace lock after ${maxWaitMs}ms.`));
+                }, maxWaitMs);
+                const originalResolve = entry.resolve;
+                const originalReject = entry.reject;
+                entry.resolve = () => { clearTimeout(timeout); originalResolve(); };
+                entry.reject = (err) => { clearTimeout(timeout); originalReject(err); };
+            }
+            this.queue.push(entry);
+        });
+    }
+    release() {
+        this.active = false;
+        const next = this.queue.shift();
+        if (next) {
+            this.active = true;
+            next.resolve();
+        }
+    }
+}
+class AgentScanCoordinator {
+    locks = new Map();
+    getLock(workspaceRoot) {
+        let lock = this.locks.get(workspaceRoot);
+        if (!lock) {
+            lock = new WorkspaceLock();
+            this.locks.set(workspaceRoot, lock);
+        }
+        return lock;
+    }
+    /**
+     * Run an operation exclusively for the given workspace.
+     * If another operation is already running for the same workspace,
+     * this waits until it completes (FIFO queue) before starting.
+     * Different workspaces run concurrently.
+     */
+    async runExclusive(workspaceRoot, operation, options) {
+        const lock = this.getLock(workspaceRoot);
+        await lock.acquire(options?.signal, options?.maxWaitMs);
+        try {
+            return await operation();
+        }
+        finally {
+            lock.release();
+            if (!lock.isActive && lock.queueLength === 0) {
+                this.locks.delete(workspaceRoot);
+            }
+        }
+    }
+    /**
+     * Check if an operation is currently active for the given workspace.
+     */
+    isRunning(workspaceRoot) {
+        const lock = this.locks.get(workspaceRoot);
+        return lock?.isActive ?? false;
+    }
+    /**
+     * Get the number of queued operations waiting for the workspace lock.
+     */
+    queueDepth(workspaceRoot) {
+        const lock = this.locks.get(workspaceRoot);
+        return lock?.queueLength ?? 0;
+    }
+}
+exports.AgentScanCoordinator = AgentScanCoordinator;
+exports.globalScanCoordinator = new AgentScanCoordinator();
+//# sourceMappingURL=agentScanCoordinator.js.map

package/dist/attack/agentScanCoordinator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentScanCoordinator.js","sourceRoot":"","sources":["../../src/attack/agentScanCoordinator.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;AASH,MAAM,aAAa;IACP,MAAM,GAAG,KAAK,CAAC;IACf,KAAK,GAAiB,EAAE,CAAC;IAEjC,IAAI,QAAQ;QACR,OAAO,IAAI,CAAC,MAAM,CAAC;IACvB,CAAC;IAED,IAAI,WAAW;QACX,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,MAAoB,EAAE,SAAkB;QAClD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;YACnB,OAAO;QACX,CAAC;QAED,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;QAC9E,CAAC;QAED,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACzC,MAAM,KAAK,GAAe,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;YAEtD,MAAM,OAAO,GAAG,GAAG,EAAE;gBACjB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;gBACtC,IAAI,GAAG,IAAI,CAAC;oBAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;gBACxC,IAAI,KAAK,CAAC,aAAa,IAAI,MAAM,EAAE,CAAC;oBAChC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;gBAC7D,CAAC;YACL,CAAC,CAAC;YAEF,IAAI,MAAM,EAAE,CAAC;gBACT,KAAK,CAAC,aAAa,GAAG,GAAG,EAAE;oBACvB,OAAO,EAAE,CAAC;oBACV,MAAM,CAAC,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC,CAAC;gBAChF,CAAC,CAAC;gBACF,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;YAC1D,CAAC;YAED,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;oBAC5B,OAAO,EAAE,CAAC;oBACV,MAAM,CAAC,IAAI,KAAK,CAAC,yDAAyD,SAAS,KAAK,CAAC,CAAC,CAAC;gBAC/F,CAAC,EAAE,SAAS,CAAC,CAAC;gBACd,MAAM,eAAe,GAAG,KAAK,CAAC,OAAO,CAAC;gBACtC,MAAM,cAAc,GAAG,KAAK,CAAC,MAAM,CAAC;gBACpC,KAAK,CAAC,OAAO,GAAG,GAAG,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,CAAC;gBACpE,KAAK,CAAC,MAAM,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAC5E,CAAC;YAED,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC,CAAC,CAAC;IACP,CAAC;IAED,OAAO;QACH,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QAEpB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QAChC,IAAI,IAAI,EAAE,CAAC;YACP,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;YACnB,IAAI,CAAC,OAAO,EAAE,CAAC;QACnB,CAAC;IACL,CAAC;CACJ;AAED,MAAa,oBAAoB;IACZ,KAAK,GAAG,IAAI,GAAG,EAAyB,CAAC;IAElD,OAAO,CAAC,aAAqB;QACjC,IAAI,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QACzC,IAAI,CAAC,IAAI,EAAE,CAAC;YACR,IAAI,GAAG,IAAI,aAAa,EAAE,CAAC;YAC3B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;QACxC,CAAC;QACD,OAAO,IAAI,CAAC;IAChB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,YAAY,CACd,aAAqB,EACrB,SAA2B,EAC3B,OAGC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QAEzC,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QAExD,IAAI,CAAC;YACD,OAAO,MAAM,SAAS,EAAE,CAAC;QAC7B,CAAC;gBAAS,CAAC;YACP,IAAI,CAAC,OAAO,EAAE,CAAC;YACf,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,WAAW,KAAK,CAAC,EAAE,CAAC;gBAC3C,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;YACrC,CAAC;QACL,CAAC;IACL,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,aAAqB;QAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QAC3C,OAAO,IAAI,EAAE,QAAQ,IAAI,KAAK,CAAC;IACnC,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,aAAqB;QAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QAC3C,OAAO,IAAI,EAAE,WAAW,IAAI,CAAC,CAAC;IAClC,CAAC;CACJ;AAvDD,oDAuDC;AAEY,QAAA,qBAAqB,GAAG,IAAI,oBAAoB,EAAE,CAAC"}

package/dist/attack/agentScanCreditPlan.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Pure credit cost calculator for agent scan batch workflows.
+ *
+ * Calculates the total scan credits required for a batch run:
+ *   architecture scout + N × agent scan + optional verification reserve
+ *
+ * Policies:
+ *   base-only            — architecture + agent scans only
+ *   verification-bounded — adds a per-file verification credit reserve
+ *   Batch default: verification-bounded with a 10-credit-per-file cap.
+ *
+ * Fix reserve is always zero — the batch tool disables fix generation.
+ */
+import type { ArchitectureDepth } from '../project-map/architectureContext';
+export type CreditPlanPolicy = 'base-only' | 'verification-bounded';
+export interface CreditPlanOptions {
+    depth: ArchitectureDepth;
+    architectureCacheHit: boolean;
+    uncachedFileCount: number;
+    cachedFileCount: number;
+    policy?: CreditPlanPolicy;
+    verificationCreditsPerFile?: number;
+}
+export interface CreditPlan {
+    architectureCredits: number;
+    agentRunCredits: number;
+    verificationCredits: number;
+    fixReserveCredits: number;
+    total: number;
+    breakdown: {
+        depth: ArchitectureDepth;
+        architectureCacheHit: boolean;
+        uncachedFiles: number;
+        cachedFiles: number;
+        policy: CreditPlanPolicy;
+        verificationCreditsPerFile: number;
+        creditsPerRun: number;
+    };
+}
+export declare function calculateBatchCredits(options: CreditPlanOptions): CreditPlan;

package/dist/attack/agentScanCreditPlan.js

@@ -0,0 +1,50 @@
+"use strict";
+/**
+ * Pure credit cost calculator for agent scan batch workflows.
+ *
+ * Calculates the total scan credits required for a batch run:
+ *   architecture scout + N × agent scan + optional verification reserve
+ *
+ * Policies:
+ *   base-only            — architecture + agent scans only
+ *   verification-bounded — adds a per-file verification credit reserve
+ *   Batch default: verification-bounded with a 10-credit-per-file cap.
+ *
+ * Fix reserve is always zero — the batch tool disables fix generation.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.calculateBatchCredits = calculateBatchCredits;
+const agentScanProtocol_1 = require("./agentScanProtocol");
+const architectureScoutProtocol_1 = require("./architectureScoutProtocol");
+const DEFAULT_VERIFICATION_CREDITS_PER_FILE = 10;
+const MAX_VERIFICATION_CREDITS_PER_FILE = 60;
+function calculateBatchCredits(options) {
+    const policy = options.policy ?? 'verification-bounded';
+    const verificationCreditsPerFile = Math.min(MAX_VERIFICATION_CREDITS_PER_FILE, options.verificationCreditsPerFile ?? DEFAULT_VERIFICATION_CREDITS_PER_FILE);
+    const architectureCredits = options.architectureCacheHit
+        ? 0
+        : (0, architectureScoutProtocol_1.scoutDefaultsForDepth)(options.depth).creditsPerRun;
+    const agentRunCredits = options.uncachedFileCount * agentScanProtocol_1.AGENT_SCAN_DEFAULTS.creditsPerRun;
+    const verificationCredits = policy === 'verification-bounded'
+        ? options.uncachedFileCount * verificationCreditsPerFile
+        : 0;
+    const fixReserveCredits = 0;
+    const total = architectureCredits + agentRunCredits + verificationCredits + fixReserveCredits;
+    return {
+        architectureCredits,
+        agentRunCredits,
+        verificationCredits,
+        fixReserveCredits,
+        total,
+        breakdown: {
+            depth: options.depth,
+            architectureCacheHit: options.architectureCacheHit,
+            uncachedFiles: options.uncachedFileCount,
+            cachedFiles: options.cachedFileCount,
+            policy,
+            verificationCreditsPerFile,
+            creditsPerRun: agentScanProtocol_1.AGENT_SCAN_DEFAULTS.creditsPerRun,
+        },
+    };
+}
+//# sourceMappingURL=agentScanCreditPlan.js.map

package/dist/attack/agentScanCreditPlan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentScanCreditPlan.js","sourceRoot":"","sources":["../../src/attack/agentScanCreditPlan.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;AAqCH,sDAqCC;AAxED,2DAA0D;AAC1D,2EAAoE;AA+BpE,MAAM,qCAAqC,GAAG,EAAE,CAAC;AACjD,MAAM,iCAAiC,GAAG,EAAE,CAAC;AAE7C,SAAgB,qBAAqB,CAAC,OAA0B;IAC5D,MAAM,MAAM,GAAqB,OAAO,CAAC,MAAM,IAAI,sBAAsB,CAAC;IAC1E,MAAM,0BAA0B,GAAG,IAAI,CAAC,GAAG,CACvC,iCAAiC,EACjC,OAAO,CAAC,0BAA0B,IAAI,qCAAqC,CAC9E,CAAC;IAEF,MAAM,mBAAmB,GAAG,OAAO,CAAC,oBAAoB;QACpD,CAAC,CAAC,CAAC;QACH,CAAC,CAAC,IAAA,iDAAqB,EAAC,OAAO,CAAC,KAAK,CAAC,CAAC,aAAa,CAAC;IAEzD,MAAM,eAAe,GAAG,OAAO,CAAC,iBAAiB,GAAG,uCAAmB,CAAC,aAAa,CAAC;IAEtF,MAAM,mBAAmB,GAAG,MAAM,KAAK,sBAAsB;QACzD,CAAC,CAAC,OAAO,CAAC,iBAAiB,GAAG,0BAA0B;QACxD,CAAC,CAAC,CAAC,CAAC;IAER,MAAM,iBAAiB,GAAG,CAAC,CAAC;IAE5B,MAAM,KAAK,GAAG,mBAAmB,GAAG,eAAe,GAAG,mBAAmB,GAAG,iBAAiB,CAAC;IAE9F,OAAO;QACH,mBAAmB;QACnB,eAAe;QACf,mBAAmB;QACnB,iBAAiB;QACjB,KAAK;QACL,SAAS,EAAE;YACP,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,oBAAoB,EAAE,OAAO,CAAC,oBAAoB;YAClD,aAAa,EAAE,OAAO,CAAC,iBAAiB;YACxC,WAAW,EAAE,OAAO,CAAC,eAAe;YACpC,MAAM;YACN,0BAA0B;YAC1B,aAAa,EAAE,uCAAmB,CAAC,aAAa;SACnD;KACJ,CAAC;AACN,CAAC"}