@securityreviewai/vibereview-cli 0.1.0

package/dist/src/commands/init.js

@@ -0,0 +1,142 @@
+import path from "node:path";
+import { basename } from "node:path";
+import { access } from "node:fs/promises";
+import { select } from "@inquirer/prompts";
+import { loadCatalog } from "../core/catalog.js";
+import { detectTechnologyProfile } from "../core/detector.js";
+import { sha256, stableJson } from "../core/hash.js";
+import { matchGuardrails } from "../core/matcher.js";
+import { findRepositoryRoot } from "../core/repository.js";
+import { initializeWorkspace } from "../core/workspace.js";
+import { generateCodeGuardrails } from "../core/generator.js";
+import { installProviderIntegration } from "../core/integration.js";
+import { checkProviderPreflight, isProvider, PROVIDER_NAMES, PROVIDERS } from "../providers/index.js";
+import { ui } from "../ui.js";
+export async function initCommand(options) {
+    const root = await findRepositoryRoot(options.cwd);
+    const projectName = basename(root);
+    if (!options.json)
+        ui.title("VibeReview");
+    const provider = await resolveProvider(options);
+    if (!options.force && await exists(path.join(root, ".vibereview", "config.json"))) {
+        throw new Error("VibeReview is already initialized. Re-run with `--force` to regenerate its managed files.");
+    }
+    const preflight = options.skipPreflight ? undefined : await checkProviderPreflight(provider);
+    if (!options.json) {
+        ui.step(`${PROVIDER_NAMES[provider]} CLI detected${preflight ? ` (${preflight.version})` : " (preflight skipped)"}`);
+        if (preflight) {
+            if (preflight.authentication === "deferred")
+                ui.warning(preflight.authenticationMessage);
+            else
+                ui.step(preflight.authenticationMessage);
+        }
+        ui.info("\nAnalyzing workspace...");
+    }
+    const catalog = await loadCatalog();
+    const profile = await detectTechnologyProfile(root, projectName);
+    const matches = matchGuardrails(profile, catalog);
+    profile.matched_packs = matches.packs.map((pack) => pack.slug);
+    const technologies = profile.technologies.map((item) => item.name);
+    if (!options.json) {
+        ui.step(technologies.length ? `Detected ${formatList(technologies)}` : "No supported technologies detected");
+        ui.step(`Matched ${matches.packs.length} guardrail pack${matches.packs.length === 1 ? "" : "s"}`);
+        ui.step(`Selected ${matches.guardrails.length} baseline guardrail${matches.guardrails.length === 1 ? "" : "s"}`);
+        if (options.verbose) {
+            for (const pack of matches.packs)
+                ui.detail(`  ${pack.slug}: ${pack.guardrails.length} catalog rules`);
+            for (const warning of profile.warnings)
+                ui.warning(warning);
+            if (matches.unmatchedTechnologies.length)
+                ui.detail(`  No bundled pack: ${matches.unmatchedTechnologies.join(", ")}`);
+        }
+    }
+    let generation;
+    let generationError;
+    if (!options.skipGeneration) {
+        if (!options.json)
+            ui.info(`\nGenerating code-specific guardrails with ${PROVIDER_NAMES[provider]}...`);
+        try {
+            generation = await generateCodeGuardrails(provider, root, profile, matches.guardrails);
+            if (!options.json) {
+                ui.step(`Analyzed ${generation.evidence.files.length} security-relevant file${generation.evidence.files.length === 1 ? "" : "s"}`);
+                ui.step(`Generated ${generation.guardrails.length} code-specific guardrail${generation.guardrails.length === 1 ? "" : "s"}`);
+                if (options.verbose && generation.attempts > 1)
+                    ui.detail("  Structured output was repaired on the second attempt.");
+            }
+        }
+        catch (error) {
+            generationError = error instanceof Error ? error.message : String(error);
+            if (!options.json) {
+                ui.warning("Code-specific generation failed; baseline guardrails will still be installed.");
+                if (options.verbose)
+                    ui.detail(`  ${generationError}`);
+                ui.detail("  Retry later with: vibereview guardrails generate");
+            }
+        }
+    }
+    const written = await initializeWorkspace({
+        root,
+        projectName,
+        provider,
+        profile,
+        guardrails: matches.guardrails,
+        ...(generation ? { codeSpecific: generation.guardrails } : {}),
+        catalogHash: sha256(stableJson(catalog)),
+        force: options.force,
+    });
+    const integrationFiles = await installProviderIntegration({ root, projectName, provider });
+    written.push(...integrationFiles);
+    if (options.json) {
+        process.stdout.write(`${JSON.stringify({
+            project_name: projectName,
+            provider,
+            technologies,
+            packs: matches.packs.map((p) => p.slug),
+            baseline_guardrail_count: matches.guardrails.length,
+            code_specific_guardrail_count: generation?.guardrails.length ?? 0,
+            generation_status: options.skipGeneration ? "skipped" : generation ? "completed" : "failed",
+            ...(generationError ? { generation_error: generationError } : {}),
+            written,
+        }, null, 2)}\n`);
+        return;
+    }
+    ui.info("\nWorkspace configured.");
+    ui.detail(`Profile:    ${path.relative(root, path.join(root, ".vibereview", "profile.json"))}`);
+    ui.detail(`Guardrails: ${path.relative(root, path.join(root, ".vibereview", "guardrails.yml"))}`);
+    ui.step(`Installed local security workflow for ${PROVIDER_NAMES[provider]}`);
+    ui.detail(`Reports:    ${path.relative(root, path.join(root, ".vibereview", "reports"))}/*.md`);
+    ui.info("\nVibeReview is ready. Restart the IDE agent if it is already running.\n");
+}
+async function exists(filePath) {
+    try {
+        await access(filePath);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+async function resolveProvider(options) {
+    const requested = options.provider;
+    if (requested) {
+        if (!isProvider(requested)) {
+            throw new Error(`Unknown provider ${JSON.stringify(requested)}. Choose one of: ${PROVIDERS.join(", ")}.`);
+        }
+        return requested;
+    }
+    if (options.yes) {
+        throw new Error("`--yes` requires `--provider cursor|codex|claude|copilot`.");
+    }
+    return select({
+        message: "Which coding agent do you use?",
+        choices: PROVIDERS.map((provider) => ({ name: PROVIDER_NAMES[provider], value: provider })),
+    });
+}
+function formatList(items) {
+    if (items.length <= 1)
+        return items.join("");
+    if (items.length === 2)
+        return `${items[0]} and ${items[1]}`;
+    return `${items.slice(0, -1).join(", ")} and ${items.at(-1)}`;
+}
+//# sourceMappingURL=init.js.map

package/dist/src/core/assets.js

@@ -0,0 +1,19 @@
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+export async function loadGuardrailGeneratorAssets() {
+    const root = packageRoot();
+    const skillPath = path.join(root, "skills", "guardrail-generator", "SKILL.md");
+    const outputContractPath = path.join(root, "skills", "guardrail-generator", "references", "output-contract.md");
+    const schemaPath = path.join(root, "schemas", "code-guardrails-v1.json");
+    const [skill, outputContract, schemaText] = await Promise.all([
+        readFile(skillPath, "utf8"),
+        readFile(outputContractPath, "utf8"),
+        readFile(schemaPath, "utf8"),
+    ]);
+    return { skill, outputContract, schema: JSON.parse(schemaText), schemaPath };
+}
+function packageRoot() {
+    return path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..", "..", "..");
+}
+//# sourceMappingURL=assets.js.map

package/dist/src/core/catalog.js

@@ -0,0 +1,51 @@
+import { readFile } from "node:fs/promises";
+import { brotliDecompressSync } from "node:zlib";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+export async function loadCatalog(catalogPath = defaultCatalogPath()) {
+    const compressed = await readFile(catalogPath);
+    const value = JSON.parse(brotliDecompressSync(compressed).toString("utf8"));
+    return validateCatalog(value);
+}
+export function validateCatalog(value) {
+    if (!isRecord(value) || value.schema_version !== "1" || !Array.isArray(value.packs)) {
+        throw new Error("invalid embedded guardrail catalog");
+    }
+    for (const pack of value.packs)
+        validatePack(pack);
+    return value;
+}
+function validatePack(value) {
+    if (!isRecord(value))
+        throw new Error("guardrail pack must be an object");
+    for (const key of ["slug", "technology", "description"]) {
+        if (typeof value[key] !== "string" || value[key].trim() === "") {
+            throw new Error(`guardrail pack ${key} must be a non-empty string`);
+        }
+    }
+    if (!Array.isArray(value.keywords) || !value.keywords.every((item) => typeof item === "string")) {
+        throw new Error(`guardrail pack ${value.slug} has invalid keywords`);
+    }
+    if (!Array.isArray(value.guardrails))
+        throw new Error(`guardrail pack ${value.slug} has no guardrails`);
+    for (const guardrail of value.guardrails) {
+        if (!isRecord(guardrail))
+            throw new Error(`guardrail pack ${value.slug} contains a non-object rule`);
+        for (const key of ["title", "category", "instruction"]) {
+            if (typeof guardrail[key] !== "string" || guardrail[key].trim() === "") {
+                throw new Error(`guardrail pack ${value.slug} contains a rule with invalid ${key}`);
+            }
+        }
+        if (!["do", "dont", "must", "must_not"].includes(String(guardrail.rule_type))) {
+            throw new Error(`guardrail pack ${value.slug} contains an invalid rule_type`);
+        }
+    }
+}
+function defaultCatalogPath() {
+    const currentDir = path.dirname(fileURLToPath(import.meta.url));
+    return path.resolve(currentDir, "..", "..", "catalog", "guardrails.br");
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+//# sourceMappingURL=catalog.js.map

package/dist/src/core/code-guardrails.js

@@ -0,0 +1,154 @@
+import { sha256 } from "./hash.js";
+export class GuardrailOutputError extends Error {
+    name = "GuardrailOutputError";
+}
+export function parseGeneratedGuardrails(raw, allowedEvidencePaths) {
+    const value = unwrapProviderOutput(raw);
+    return validateOutput(value, allowedEvidencePaths);
+}
+export function normalizeGeneratedGuardrails(output, baseline) {
+    const baselineFingerprints = new Set(baseline.map(ruleFingerprint));
+    const generated = new Map();
+    for (const rule of output.guardrails) {
+        const fingerprint = ruleFingerprint(rule);
+        if (baselineFingerprints.has(fingerprint) || generated.has(fingerprint))
+            continue;
+        const idPart = sha256(`${rule.type}\0${rule.category}\0${rule.instruction}`).slice(0, 16);
+        generated.set(fingerprint, {
+            id: `code:${slugify(rule.title)}:${idPart}`,
+            source: "code_generated",
+            type: rule.type,
+            title: rule.title.trim(),
+            category: rule.category.trim(),
+            instruction: rule.instruction.trim(),
+            rationale: rule.rationale.trim(),
+            confidence: rule.confidence,
+            evidence: rule.evidence,
+            ...(rule.cwe_ids?.length ? { cwe_ids: unique(rule.cwe_ids) } : {}),
+            ...(rule.owasp_top10?.length ? { owasp_top10: unique(rule.owasp_top10) } : {}),
+        });
+    }
+    return [...generated.values()].sort((left, right) => left.category.localeCompare(right.category) || left.title.localeCompare(right.title));
+}
+function unwrapProviderOutput(raw) {
+    const trimmed = raw.trim();
+    if (!trimmed)
+        throw new GuardrailOutputError("provider returned an empty response");
+    const direct = tryJson(trimmed);
+    if (direct !== undefined)
+        return unwrapKnownWrapper(direct);
+    const fenced = /```(?:json)?\s*([\s\S]*?)```/i.exec(trimmed);
+    if (fenced) {
+        const value = tryJson(fenced[1].trim());
+        if (value !== undefined)
+            return unwrapKnownWrapper(value);
+    }
+    const start = trimmed.indexOf("{");
+    const end = trimmed.lastIndexOf("}");
+    if (start >= 0 && end > start) {
+        const value = tryJson(trimmed.slice(start, end + 1));
+        if (value !== undefined)
+            return unwrapKnownWrapper(value);
+    }
+    throw new GuardrailOutputError("provider response did not contain valid JSON");
+}
+function unwrapKnownWrapper(value) {
+    if (!isRecord(value))
+        return value;
+    if (isRecord(value.structured_output))
+        return value.structured_output;
+    if (isRecord(value.result))
+        return value.result;
+    if (typeof value.result === "string") {
+        const nested = tryJson(value.result.trim());
+        if (nested !== undefined)
+            return nested;
+    }
+    return value;
+}
+function validateOutput(value, allowedPaths) {
+    if (!isRecord(value))
+        throw new GuardrailOutputError("output must be an object");
+    assertExactKeys(value, ["schema_version", "summary", "guardrails"], "output");
+    if (value.schema_version !== "1")
+        throw new GuardrailOutputError("schema_version must be \"1\"");
+    const summary = nonEmptyString(value.summary, "summary", 1000);
+    if (!Array.isArray(value.guardrails) || value.guardrails.length > 20) {
+        throw new GuardrailOutputError("guardrails must be an array with at most 20 items");
+    }
+    const guardrails = value.guardrails.map((item, index) => validateRule(item, index, allowedPaths));
+    return { schema_version: "1", summary, guardrails };
+}
+function validateRule(value, index, allowedPaths) {
+    if (!isRecord(value))
+        throw new GuardrailOutputError(`guardrails[${index}] must be an object`);
+    assertExactKeys(value, ["title", "type", "category", "instruction", "rationale", "confidence", "evidence", "cwe_ids", "owasp_top10"], `guardrails[${index}]`);
+    if (value.type !== "must" && value.type !== "must_not")
+        throw new GuardrailOutputError(`guardrails[${index}].type is invalid`);
+    if (value.confidence !== "high" && value.confidence !== "medium")
+        throw new GuardrailOutputError(`guardrails[${index}].confidence is invalid`);
+    if (!Array.isArray(value.evidence) || value.evidence.length === 0 || value.evidence.length > 10) {
+        throw new GuardrailOutputError(`guardrails[${index}].evidence must contain 1-10 items`);
+    }
+    const evidence = value.evidence.map((item, evidenceIndex) => validateEvidence(item, index, evidenceIndex, allowedPaths));
+    return {
+        title: nonEmptyString(value.title, `guardrails[${index}].title`, 200),
+        type: value.type,
+        category: nonEmptyString(value.category, `guardrails[${index}].category`, 100),
+        instruction: nonEmptyString(value.instruction, `guardrails[${index}].instruction`, 1000),
+        rationale: nonEmptyString(value.rationale, `guardrails[${index}].rationale`, 1000),
+        confidence: value.confidence,
+        evidence,
+        cwe_ids: stringArray(value.cwe_ids, `guardrails[${index}].cwe_ids`, /^\d+$/),
+        owasp_top10: stringArray(value.owasp_top10, `guardrails[${index}].owasp_top10`),
+    };
+}
+function validateEvidence(value, ruleIndex, evidenceIndex, allowedPaths) {
+    const label = `guardrails[${ruleIndex}].evidence[${evidenceIndex}]`;
+    if (!isRecord(value))
+        throw new GuardrailOutputError(`${label} must be an object`);
+    assertExactKeys(value, ["path", "reason"], label);
+    const evidencePath = nonEmptyString(value.path, `${label}.path`, 500);
+    if (!allowedPaths.has(evidencePath))
+        throw new GuardrailOutputError(`${label}.path was not supplied as evidence: ${evidencePath}`);
+    return { path: evidencePath, reason: nonEmptyString(value.reason, `${label}.reason`, 500) };
+}
+function assertExactKeys(value, allowed, label) {
+    const allowedSet = new Set(allowed);
+    const extra = Object.keys(value).filter((key) => !allowedSet.has(key));
+    if (extra.length)
+        throw new GuardrailOutputError(`${label} contains unsupported fields: ${extra.join(", ")}`);
+}
+function nonEmptyString(value, label, maxLength) {
+    if (typeof value !== "string" || value.trim() === "" || value.length > maxLength) {
+        throw new GuardrailOutputError(`${label} must be a non-empty string no longer than ${maxLength} characters`);
+    }
+    return value.trim();
+}
+function stringArray(value, label, pattern) {
+    if (!Array.isArray(value) || !value.every((item) => typeof item === "string" && (!pattern || pattern.test(item)))) {
+        throw new GuardrailOutputError(`${label} must be a valid string array`);
+    }
+    return unique(value);
+}
+function ruleFingerprint(rule) {
+    return `${rule.type}\0${rule.category.trim().toLowerCase()}\0${rule.instruction.trim().toLowerCase().replace(/\s+/g, " ")}`;
+}
+function slugify(value) {
+    return value.toLowerCase().normalize("NFKD").replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "").slice(0, 60) || "guardrail";
+}
+function unique(values) {
+    return [...new Set(values.map((value) => value.trim()).filter(Boolean))];
+}
+function tryJson(value) {
+    try {
+        return JSON.parse(value);
+    }
+    catch {
+        return undefined;
+    }
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+//# sourceMappingURL=code-guardrails.js.map

package/dist/src/core/detector.js

@@ -0,0 +1,214 @@
+import { readdir, readFile, stat } from "node:fs/promises";
+import path from "node:path";
+const EXCLUDED_DIRS = new Set([
+    ".git", ".vibereview", "node_modules", "vendor", "dist", "build", ".next", ".turbo",
+    "coverage", ".venv", "venv", "target", "Pods",
+]);
+const MAX_FILES = 50_000;
+const MAX_MANIFEST_BYTES = 2_000_000;
+const DISPLAY_NAMES = {
+    typescript: "TypeScript", javascript: "JavaScript", nodejs: "Node.js", nextjs: "Next.js",
+    react: "React", vuejs: "Vue.js", angular: "Angular", express: "Express", fastify: "Fastify",
+    nestjs: "NestJS", honojs: "Hono", python: "Python", django: "Django", flask: "Flask",
+    fastapi: "FastAPI", go: "Go", rust: "Rust", java: "Java", "java-spring-boot": "Spring Boot",
+    postgresql: "PostgreSQL", "mysql-mariadb": "MySQL/MariaDB", mongodb: "MongoDB", redis: "Redis",
+    docker: "Docker", kubernetes: "Kubernetes", "github-actions": "GitHub Actions",
+    "terraform-aws": "Terraform/AWS", "terraform-azure": "Terraform/Azure",
+    "terraform-gcp": "Terraform/GCP", "oauth-oidc": "OAuth/OIDC", jwt: "JWT",
+    "openapi-rest-api": "OpenAPI/REST", grpc: "gRPC", websockets: "WebSockets",
+    "mcp-server-hardening": "MCP server", langchain: "LangChain", langgraph: "LangGraph",
+    "openai-agents-sdk": "OpenAI Agents SDK",
+};
+const DEPENDENCY_RULES = {
+    typescript: ["typescript", "ts-node", "tsx"],
+    nextjs: ["next"], react: ["react", "react-dom"], vuejs: ["vue"], angular: ["@angular/core"],
+    express: ["express"], fastify: ["fastify"], nestjs: ["@nestjs/core"], honojs: ["hono"],
+    postgresql: ["pg", "postgres", "@prisma/adapter-pg"],
+    "mysql-mariadb": ["mysql", "mysql2", "mariadb"], mongodb: ["mongodb", "mongoose"], redis: ["redis", "ioredis"],
+    "oauth-oidc": ["next-auth", "@auth/core", "passport", "openid-client", "@auth0/nextjs-auth0"],
+    jwt: ["jsonwebtoken", "jose", "jwt-decode"],
+    websockets: ["ws", "socket.io"], grpc: ["@grpc/grpc-js"],
+    "mcp-server-hardening": ["@modelcontextprotocol/sdk"],
+    langchain: ["langchain", "@langchain/core"], langgraph: ["@langchain/langgraph"],
+    "openai-agents-sdk": ["@openai/agents", "openai-agents"],
+};
+export async function detectTechnologyProfile(root, projectName) {
+    const evidence = new Map();
+    const warnings = [];
+    const files = await walkFiles(root, warnings);
+    const relativeFiles = files.map((file) => path.relative(root, file).split(path.sep).join("/"));
+    detectByExtensions(relativeFiles, evidence);
+    await detectNodeProjects(root, relativeFiles, evidence, warnings);
+    await detectManifestTechnologies(root, relativeFiles, evidence, warnings);
+    await detectInfrastructure(root, relativeFiles, evidence);
+    const technologies = [...evidence.entries()]
+        .filter(([, items]) => items.length > 0)
+        .sort(([left], [right]) => left.localeCompare(right))
+        .map(([slug, items]) => ({ slug, name: DISPLAY_NAMES[slug] ?? slug, evidence: dedupeEvidence(items) }));
+    return {
+        schema_version: "1",
+        project_name: projectName,
+        detected_at: new Date().toISOString(),
+        repository_root: ".",
+        technologies,
+        matched_packs: technologies.map((item) => item.slug),
+        warnings,
+    };
+}
+async function walkFiles(root, warnings) {
+    const files = [];
+    const pending = [root];
+    while (pending.length > 0 && files.length < MAX_FILES) {
+        const dir = pending.pop();
+        let entries;
+        try {
+            entries = await readdir(dir, { withFileTypes: true });
+        }
+        catch {
+            continue;
+        }
+        entries.sort((a, b) => a.name.localeCompare(b.name));
+        for (const entry of entries) {
+            if (entry.isSymbolicLink())
+                continue;
+            const fullPath = path.join(dir, entry.name);
+            if (entry.isDirectory()) {
+                if (!EXCLUDED_DIRS.has(entry.name))
+                    pending.push(fullPath);
+            }
+            else if (entry.isFile()) {
+                files.push(fullPath);
+                if (files.length >= MAX_FILES)
+                    break;
+            }
+        }
+    }
+    if (files.length >= MAX_FILES)
+        warnings.push(`File scan stopped at the ${MAX_FILES.toLocaleString()} file safety limit.`);
+    return files;
+}
+function detectByExtensions(files, evidence) {
+    const extensionRules = {
+        ".ts": "typescript", ".tsx": "typescript", ".js": "javascript", ".jsx": "javascript",
+        ".py": "python", ".go": "go", ".rs": "rust", ".java": "java",
+    };
+    const firstBySlug = new Map();
+    for (const file of files) {
+        const slug = extensionRules[path.extname(file).toLowerCase()];
+        if (slug && !firstBySlug.has(slug))
+            firstBySlug.set(slug, file);
+    }
+    for (const [slug, file] of firstBySlug)
+        addEvidence(evidence, slug, "extension", file, `Detected ${path.extname(file)} source files`);
+}
+async function detectNodeProjects(root, files, evidence, warnings) {
+    const manifests = files.filter((file) => path.basename(file) === "package.json");
+    for (const relativePath of manifests) {
+        const value = await readJsonSafe(path.join(root, relativePath), warnings);
+        if (!value || typeof value !== "object")
+            continue;
+        addEvidence(evidence, "nodejs", "manifest", relativePath, "Node.js package manifest");
+        const record = value;
+        const dependencyGroups = [record.dependencies, record.devDependencies, record.peerDependencies, record.optionalDependencies];
+        const names = new Set();
+        for (const group of dependencyGroups) {
+            if (group && typeof group === "object")
+                Object.keys(group).forEach((name) => names.add(name));
+        }
+        for (const [slug, dependencies] of Object.entries(DEPENDENCY_RULES)) {
+            for (const dependency of dependencies) {
+                if (names.has(dependency))
+                    addEvidence(evidence, slug, "dependency", relativePath, dependency);
+            }
+        }
+    }
+}
+async function detectManifestTechnologies(root, files, evidence, warnings) {
+    const exactRules = {
+        "pyproject.toml": "python", "requirements.txt": "python", "Pipfile": "python", "poetry.lock": "python",
+        "go.mod": "go", "Cargo.toml": "rust", "pom.xml": "java", "build.gradle": "java", "build.gradle.kts": "java",
+    };
+    for (const relativePath of files) {
+        const basename = path.basename(relativePath);
+        const slug = exactRules[basename];
+        if (slug)
+            addEvidence(evidence, slug, "manifest", relativePath, basename);
+        if (["pyproject.toml", "requirements.txt", "Pipfile"].includes(basename)) {
+            const content = await readSmallText(path.join(root, relativePath), warnings);
+            if (!content)
+                continue;
+            const lower = content.toLowerCase();
+            for (const [needle, target] of [["django", "django"], ["flask", "flask"], ["fastapi", "fastapi"], ["langchain", "langchain"], ["langgraph", "langgraph"]]) {
+                if (lower.includes(needle))
+                    addEvidence(evidence, target, "dependency", relativePath, needle);
+            }
+        }
+        if (["pom.xml", "build.gradle", "build.gradle.kts"].includes(basename)) {
+            const content = await readSmallText(path.join(root, relativePath), warnings);
+            if (content?.includes("spring-boot"))
+                addEvidence(evidence, "java-spring-boot", "dependency", relativePath, "spring-boot");
+        }
+    }
+}
+async function detectInfrastructure(root, files, evidence) {
+    for (const relativePath of files) {
+        const basename = path.basename(relativePath).toLowerCase();
+        if (basename === "dockerfile" || basename.startsWith("docker-compose") || basename.startsWith("compose.")) {
+            addEvidence(evidence, "docker", "file", relativePath, "Container configuration");
+        }
+        if (relativePath.startsWith(".github/workflows/") && /\.ya?ml$/i.test(relativePath)) {
+            addEvidence(evidence, "github-actions", "file", relativePath, "GitHub Actions workflow");
+        }
+        if (/\.tf$/i.test(relativePath)) {
+            const content = (await readFile(path.join(root, relativePath), "utf8").catch(() => "")).slice(0, 200_000).toLowerCase();
+            if (content.includes("provider \"aws\"") || content.includes("hashicorp/aws"))
+                addEvidence(evidence, "terraform-aws", "content", relativePath, "AWS Terraform provider");
+            if (content.includes("provider \"azurerm\"") || content.includes("hashicorp/azurerm"))
+                addEvidence(evidence, "terraform-azure", "content", relativePath, "Azure Terraform provider");
+            if (content.includes("provider \"google\"") || content.includes("hashicorp/google"))
+                addEvidence(evidence, "terraform-gcp", "content", relativePath, "Google Cloud Terraform provider");
+        }
+        if (/\.(yaml|yml)$/i.test(relativePath) && /(k8s|kubernetes|helm|charts?)/i.test(relativePath)) {
+            addEvidence(evidence, "kubernetes", "file", relativePath, "Kubernetes or Helm configuration");
+        }
+        if (/openapi|swagger/i.test(basename) && /\.(json|ya?ml)$/i.test(basename)) {
+            addEvidence(evidence, "openapi-rest-api", "file", relativePath, "OpenAPI specification");
+        }
+    }
+}
+async function readJsonSafe(filePath, warnings) {
+    try {
+        const metadata = await stat(filePath);
+        if (metadata.size > MAX_MANIFEST_BYTES) {
+            warnings.push(`Skipped unusually large manifest: ${path.basename(filePath)}`);
+            return undefined;
+        }
+        return JSON.parse(await readFile(filePath, "utf8"));
+    }
+    catch {
+        warnings.push(`Could not parse ${path.basename(filePath)}.`);
+        return undefined;
+    }
+}
+async function readSmallText(filePath, warnings) {
+    try {
+        const metadata = await stat(filePath);
+        if (metadata.size > MAX_MANIFEST_BYTES)
+            return undefined;
+        return await readFile(filePath, "utf8");
+    }
+    catch {
+        warnings.push(`Could not read ${path.basename(filePath)}.`);
+        return undefined;
+    }
+}
+function addEvidence(map, slug, kind, filePath, detail) {
+    const current = map.get(slug) ?? [];
+    current.push({ kind, path: filePath, detail });
+    map.set(slug, current);
+}
+function dedupeEvidence(items) {
+    return [...new Map(items.map((item) => [`${item.kind}:${item.path}:${item.detail}`, item])).values()]
+        .sort((left, right) => left.path.localeCompare(right.path) || left.detail.localeCompare(right.detail));
+}
+//# sourceMappingURL=detector.js.map