@shakecodeslikecray/whiterose 0.1.0

package/dist/cli/index.js

@@ -0,0 +1,4033 @@
+#!/usr/bin/env node
+import { Command } from 'commander';
+import chalk from 'chalk';
+import * as p3 from '@clack/prompts';
+import { existsSync, mkdirSync, writeFileSync, readdirSync, readFileSync, statSync, mkdtempSync, rmSync } from 'fs';
+import { join, isAbsolute, resolve, basename, relative, dirname } from 'path';
+import { execa } from 'execa';
+import { homedir, tmpdir } from 'os';
+import { z } from 'zod';
+import fg3 from 'fast-glob';
+import { createHash } from 'crypto';
+import YAML from 'yaml';
+import { render, useApp, useInput, Box, Text } from 'ink';
+import { useState, useEffect } from 'react';
+import { jsx, jsxs, Fragment } from 'react/jsx-runtime';
+import Spinner from 'ink-spinner';
+
+var providerChecks = [
+  {
+    name: "claude-code",
+    command: "claude",
+    args: ["--version"],
+    paths: [
+      join(homedir(), ".local", "bin", "claude"),
+      "/usr/local/bin/claude",
+      "/opt/homebrew/bin/claude"
+    ]
+  },
+  {
+    name: "aider",
+    command: "aider",
+    args: ["--version"],
+    paths: [
+      join(homedir(), ".local", "bin", "aider"),
+      "/usr/local/bin/aider",
+      "/opt/homebrew/bin/aider"
+    ]
+  },
+  {
+    name: "codex",
+    command: "codex",
+    args: ["--version"],
+    paths: [
+      join(homedir(), ".local", "bin", "codex"),
+      "/usr/local/bin/codex",
+      "/opt/homebrew/bin/codex"
+    ]
+  },
+  {
+    name: "opencode",
+    command: "opencode",
+    args: ["--version"],
+    paths: [
+      join(homedir(), ".local", "bin", "opencode"),
+      "/usr/local/bin/opencode",
+      "/opt/homebrew/bin/opencode"
+    ]
+  },
+  {
+    name: "gemini",
+    command: "gemini",
+    args: ["--version"],
+    paths: [
+      join(homedir(), ".local", "bin", "gemini"),
+      "/usr/local/bin/gemini",
+      "/opt/homebrew/bin/gemini"
+    ]
+  },
+  {
+    name: "ollama",
+    command: "ollama",
+    args: ["--version"],
+    paths: [
+      join(homedir(), ".local", "bin", "ollama"),
+      "/usr/local/bin/ollama",
+      "/opt/homebrew/bin/ollama"
+    ]
+  }
+];
+var resolvedPaths = /* @__PURE__ */ new Map();
+async function findCommand(check) {
+  try {
+    await execa(check.command, check.args, { timeout: 5e3 });
+    return check.command;
+  } catch {
+  }
+  if (check.paths) {
+    for (const path of check.paths) {
+      if (existsSync(path)) {
+        try {
+          await execa(path, check.args, { timeout: 5e3 });
+          return path;
+        } catch {
+        }
+      }
+    }
+  }
+  return null;
+}
+async function detectProvider() {
+  const available = [];
+  for (const check of providerChecks) {
+    const commandPath = await findCommand(check);
+    if (commandPath) {
+      resolvedPaths.set(check.name, commandPath);
+      available.push(check.name);
+    }
+  }
+  return available;
+}
+async function isProviderAvailable(name) {
+  const check = providerChecks.find((c) => c.name === name);
+  if (!check) return false;
+  const commandPath = await findCommand(check);
+  if (commandPath) {
+    resolvedPaths.set(name, commandPath);
+    return true;
+  }
+  return false;
+}
+function getProviderCommand(name) {
+  return resolvedPaths.get(name) || name.replace("-code", "");
+}
+
+// src/core/utils.ts
+function generateBugId(index) {
+  return `WR-${String(index + 1).padStart(3, "0")}`;
+}
+var BugSeverity = z.enum(["critical", "high", "medium", "low"]);
+var BugCategory = z.enum([
+  "logic-error",
+  "security",
+  "async-race-condition",
+  "edge-case",
+  "null-reference",
+  "type-coercion",
+  "resource-leak",
+  "intent-violation"
+]);
+var ConfidenceLevel = z.enum(["high", "medium", "low"]);
+var ConfidenceScore = z.object({
+  overall: ConfidenceLevel,
+  codePathValidity: z.number().min(0).max(1),
+  reachability: z.number().min(0).max(1),
+  intentViolation: z.boolean(),
+  staticToolSignal: z.boolean(),
+  adversarialSurvived: z.boolean()
+});
+var CodePathStep = z.object({
+  step: z.number(),
+  file: z.string(),
+  line: z.number(),
+  code: z.string(),
+  explanation: z.string()
+});
+var Bug = z.object({
+  id: z.string(),
+  title: z.string(),
+  description: z.string(),
+  file: z.string(),
+  line: z.number(),
+  endLine: z.number().optional(),
+  severity: BugSeverity,
+  category: BugCategory,
+  confidence: ConfidenceScore,
+  codePath: z.array(CodePathStep),
+  evidence: z.array(z.string()),
+  suggestedFix: z.string().optional(),
+  relatedContract: z.string().optional(),
+  staticAnalysisSignals: z.array(z.string()).optional(),
+  createdAt: z.string().datetime()
+});
+var ProviderType = z.enum([
+  "claude-code",
+  "aider",
+  "codex",
+  "opencode",
+  "ollama",
+  "gemini"
+]);
+var PriorityLevel = z.enum(["critical", "high", "medium", "low", "ignore"]);
+var PackageConfig = z.object({
+  path: z.string(),
+  priority: PriorityLevel,
+  include: z.array(z.string()).optional(),
+  exclude: z.array(z.string()).optional()
+});
+var MonorepoConfig = z.object({
+  detection: z.enum(["auto", "explicit"]),
+  packages: z.array(PackageConfig).optional(),
+  crossPackageAnalysis: z.boolean().default(true)
+});
+var WhiteroseConfig = z.object({
+  version: z.string().default("1"),
+  provider: ProviderType.default("claude-code"),
+  providerFallback: z.array(ProviderType).optional(),
+  // Scan settings
+  include: z.array(z.string()).default(["**/*.ts", "**/*.tsx", "**/*.js", "**/*.jsx"]),
+  exclude: z.array(z.string()).default(["node_modules", "dist", "build", ".next", "coverage"]),
+  // Priority areas
+  priorities: z.record(z.string(), PriorityLevel).default({}),
+  // Bug categories to scan for
+  categories: z.array(BugCategory).default([
+    "logic-error",
+    "security",
+    "async-race-condition",
+    "edge-case",
+    "null-reference"
+  ]),
+  // Confidence threshold for reporting
+  minConfidence: ConfidenceLevel.default("low"),
+  // Monorepo settings
+  monorepo: MonorepoConfig.optional(),
+  // Static analysis integration
+  staticAnalysis: z.object({
+    typescript: z.boolean().default(true),
+    eslint: z.boolean().default(true)
+  }).default({}),
+  // Output settings
+  output: z.object({
+    sarif: z.boolean().default(true),
+    markdown: z.boolean().default(true),
+    sarifPath: z.string().default(".whiterose/reports"),
+    markdownPath: z.string().default("BUGS.md")
+  }).default({})
+});
+var BehavioralContract = z.object({
+  function: z.string(),
+  file: z.string(),
+  inputs: z.array(
+    z.object({
+      name: z.string(),
+      type: z.string(),
+      constraints: z.string().optional()
+    })
+  ),
+  outputs: z.object({
+    type: z.string(),
+    constraints: z.string().optional()
+  }),
+  invariants: z.array(z.string()),
+  sideEffects: z.array(z.string()),
+  throws: z.array(z.string()).optional()
+});
+var FeatureIntent = z.object({
+  name: z.string(),
+  description: z.string(),
+  priority: PriorityLevel,
+  constraints: z.array(z.string()),
+  relatedFiles: z.array(z.string())
+});
+z.object({
+  version: z.string(),
+  generatedAt: z.string().datetime(),
+  summary: z.object({
+    framework: z.string().optional(),
+    language: z.string(),
+    type: z.string(),
+    // e-commerce, saas, api, etc.
+    description: z.string()
+  }),
+  features: z.array(FeatureIntent),
+  contracts: z.array(BehavioralContract),
+  dependencies: z.record(z.string(), z.string()),
+  structure: z.object({
+    totalFiles: z.number(),
+    totalLines: z.number(),
+    packages: z.array(z.string()).optional()
+  })
+});
+var FileHash = z.object({
+  path: z.string(),
+  hash: z.string(),
+  lastModified: z.string().datetime()
+});
+z.object({
+  version: z.string(),
+  lastFullScan: z.string().datetime().optional(),
+  lastIncrementalScan: z.string().datetime().optional(),
+  fileHashes: z.array(FileHash)
+});
+z.object({
+  id: z.string(),
+  timestamp: z.string().datetime(),
+  scanType: z.enum(["full", "incremental"]),
+  filesScanned: z.number(),
+  filesChanged: z.number().optional(),
+  duration: z.number(),
+  // ms
+  bugs: z.array(Bug),
+  summary: z.object({
+    critical: z.number(),
+    high: z.number(),
+    medium: z.number(),
+    low: z.number(),
+    total: z.number()
+  })
+});
+
+// src/core/validation.ts
+function safeParseJson(json, schema) {
+  try {
+    const parsed = JSON.parse(json);
+    const result = schema.safeParse(parsed);
+    if (result.success) {
+      return { success: true, data: result.data };
+    }
+    return { success: false, error: formatZodError(result.error) };
+  } catch (error) {
+    return { success: false, error: error.message || "Invalid JSON" };
+  }
+}
+function formatZodError(error) {
+  return error.errors.map((e) => `${e.path.join(".")}: ${e.message}`).join(", ");
+}
+var PartialBugFromLLM = z.object({
+  file: z.string(),
+  line: z.number(),
+  endLine: z.number().optional(),
+  title: z.string(),
+  description: z.string().optional().default(""),
+  severity: BugSeverity.optional().default("medium"),
+  category: BugCategory.optional().default("logic-error"),
+  codePath: z.array(z.object({
+    step: z.number().optional(),
+    file: z.string().optional(),
+    line: z.number().optional(),
+    code: z.string().optional().default(""),
+    explanation: z.string().optional().default("")
+  })).optional().default([]),
+  evidence: z.array(z.string()).optional().default([]),
+  suggestedFix: z.string().optional(),
+  confidence: z.object({
+    overall: ConfidenceLevel.optional().default("medium"),
+    codePathValidity: z.number().min(0).max(1).optional().default(0.5),
+    reachability: z.number().min(0).max(1).optional().default(0.5),
+    intentViolation: z.boolean().optional().default(false),
+    staticToolSignal: z.boolean().optional().default(false),
+    adversarialSurvived: z.boolean().optional().default(false)
+  }).optional().default({})
+});
+var PartialUnderstandingFromLLM = z.object({
+  summary: z.object({
+    type: z.string().optional().default("unknown"),
+    framework: z.string().optional(),
+    language: z.string().optional().default("unknown"),
+    description: z.string().optional().default("")
+  }).optional().default({}),
+  features: z.array(z.object({
+    name: z.string(),
+    description: z.string(),
+    priority: z.enum(["critical", "high", "medium", "low", "ignore"]).optional().default("medium"),
+    constraints: z.array(z.string()).optional().default([]),
+    relatedFiles: z.array(z.string()).optional().default([])
+  })).optional().default([]),
+  contracts: z.array(z.object({
+    function: z.string(),
+    file: z.string(),
+    inputs: z.array(z.object({
+      name: z.string(),
+      type: z.string(),
+      constraints: z.string().optional()
+    })).optional().default([]),
+    outputs: z.object({
+      type: z.string(),
+      constraints: z.string().optional()
+    }).optional().default({ type: "unknown" }),
+    invariants: z.array(z.string()).optional().default([]),
+    sideEffects: z.array(z.string()).optional().default([]),
+    throws: z.array(z.string()).optional()
+  })).optional().default([]),
+  dependencies: z.record(z.string(), z.string()).optional().default({})
+});
+var AdversarialResultSchema = z.object({
+  survived: z.boolean(),
+  counterArguments: z.array(z.string()).optional().default([]),
+  confidence: ConfidenceLevel.optional()
+});
+z.object({
+  $schema: z.string().optional(),
+  version: z.string(),
+  runs: z.array(z.object({
+    tool: z.object({
+      driver: z.object({
+        name: z.string(),
+        version: z.string().optional(),
+        informationUri: z.string().optional(),
+        rules: z.array(z.any()).optional()
+      })
+    }),
+    results: z.array(z.object({
+      ruleId: z.string().optional(),
+      level: z.enum(["none", "note", "warning", "error"]).optional(),
+      message: z.object({
+        text: z.string()
+      }),
+      locations: z.array(z.object({
+        physicalLocation: z.object({
+          artifactLocation: z.object({
+            uri: z.string()
+          }),
+          region: z.object({
+            startLine: z.number(),
+            endLine: z.number().optional()
+          }).optional()
+        })
+      })).optional()
+    })).optional().default([])
+  }))
+});
+z.object({
+  number: z.number(),
+  title: z.string(),
+  body: z.string().nullable(),
+  state: z.string(),
+  labels: z.array(z.object({
+    name: z.string()
+  })).optional().default([]),
+  url: z.string().optional()
+});
+z.array(z.object({
+  filePath: z.string(),
+  messages: z.array(z.object({
+    ruleId: z.string().nullable(),
+    severity: z.number(),
+    message: z.string(),
+    line: z.number(),
+    column: z.number()
+  })),
+  errorCount: z.number(),
+  warningCount: z.number()
+}));
+z.object({
+  name: z.string().optional(),
+  version: z.string().optional(),
+  description: z.string().optional(),
+  scripts: z.record(z.string(), z.string()).optional(),
+  dependencies: z.record(z.string(), z.string()).optional(),
+  devDependencies: z.record(z.string(), z.string()).optional(),
+  workspaces: z.union([
+    z.array(z.string()),
+    z.object({ packages: z.array(z.string()) })
+  ]).optional()
+});
+
+// src/providers/adapters/claude-code.ts
+var MARKERS = {
+  SCANNING: "###SCANNING:",
+  BUG: "###BUG:",
+  UNDERSTANDING: "###UNDERSTANDING:",
+  COMPLETE: "###COMPLETE",
+  ERROR: "###ERROR:"
+};
+var ClaudeCodeProvider = class {
+  name = "claude-code";
+  progressCallback;
+  bugFoundCallback;
+  currentProcess;
+  unsafeMode = false;
+  async detect() {
+    return isProviderAvailable("claude-code");
+  }
+  async isAvailable() {
+    return isProviderAvailable("claude-code");
+  }
+  /**
+   * Enable unsafe mode (--dangerously-skip-permissions).
+   * WARNING: This bypasses Claude's permission prompts and should only be used
+   * when you trust the codebase being analyzed.
+   */
+  setUnsafeMode(enabled) {
+    this.unsafeMode = enabled;
+  }
+  isUnsafeMode() {
+    return this.unsafeMode;
+  }
+  setProgressCallback(callback) {
+    this.progressCallback = callback;
+  }
+  setBugFoundCallback(callback) {
+    this.bugFoundCallback = callback;
+  }
+  reportProgress(message) {
+    if (this.progressCallback) {
+      this.progressCallback(message);
+    }
+  }
+  reportBug(bug) {
+    if (this.bugFoundCallback) {
+      this.bugFoundCallback(bug);
+    }
+  }
+  // Cancel any running analysis
+  cancel() {
+    if (this.currentProcess) {
+      this.currentProcess.kill();
+      this.currentProcess = void 0;
+    }
+  }
+  async analyze(context) {
+    const { files, understanding } = context;
+    if (files.length === 0) {
+      return [];
+    }
+    const cwd = process.cwd();
+    const bugs = [];
+    let bugIndex = 0;
+    const prompt = this.buildAgenticAnalysisPrompt(understanding);
+    this.reportProgress("Starting agentic analysis...");
+    try {
+      await this.runAgenticClaude(prompt, cwd, {
+        onScanning: (file) => {
+          this.reportProgress(`Scanning: ${file}`);
+        },
+        onBugFound: (bugData) => {
+          const bug = this.parseBugData(bugData, bugIndex++, files);
+          if (bug) {
+            bugs.push(bug);
+            this.reportBug(bug);
+            this.reportProgress(`Found: ${bug.title} (${bug.severity})`);
+          }
+        },
+        onComplete: () => {
+          this.reportProgress(`Analysis complete. Found ${bugs.length} bugs.`);
+        },
+        onError: (error) => {
+          this.reportProgress(`Error: ${error}`);
+        }
+      });
+    } catch (error) {
+      if (error.message?.includes("ENOENT")) {
+        throw new Error("Claude CLI not found. Install it with: npm install -g @anthropic-ai/claude-code");
+      }
+      throw error;
+    }
+    return bugs;
+  }
+  async adversarialValidate(bug, _context) {
+    let fileContent = "";
+    try {
+      if (existsSync(bug.file)) {
+        fileContent = readFileSync(bug.file, "utf-8");
+        const lines = fileContent.split("\n");
+        const start = Math.max(0, bug.line - 20);
+        const end = Math.min(lines.length, (bug.endLine || bug.line) + 20);
+        fileContent = lines.slice(start, end).join("\n");
+      }
+    } catch {
+    }
+    const prompt = this.buildAdversarialPrompt(bug, fileContent);
+    const result = await this.runSimpleClaude(prompt, process.cwd());
+    return this.parseAdversarialResponse(result, bug);
+  }
+  async generateUnderstanding(files, existingDocsSummary) {
+    const cwd = process.cwd();
+    this.reportProgress(`Starting codebase analysis (${files.length} files)...`);
+    const prompt = this.buildAgenticUnderstandingPrompt(existingDocsSummary);
+    let understandingJson = "";
+    try {
+      await this.runAgenticClaude(prompt, cwd, {
+        onScanning: (file) => {
+          this.reportProgress(`Examining: ${file}`);
+        },
+        onUnderstanding: (json) => {
+          understandingJson = json;
+        },
+        onComplete: () => {
+          this.reportProgress("Understanding complete.");
+        },
+        onError: (error) => {
+          this.reportProgress(`Error: ${error}`);
+        }
+      });
+      return this.parseUnderstandingResponse(understandingJson, files);
+    } catch (error) {
+      if (error.message?.includes("ENOENT")) {
+        throw new Error("Claude CLI not found. Install it with: npm install -g @anthropic-ai/claude-code");
+      }
+      throw error;
+    }
+  }
+  // ─────────────────────────────────────────────────────────────
+  // Agentic Prompts
+  // ─────────────────────────────────────────────────────────────
+  buildAgenticAnalysisPrompt(understanding) {
+    return `You are whiterose, an expert bug hunter. Your task is to explore this codebase and find real bugs.
+
+CODEBASE CONTEXT:
+- Type: ${understanding.summary.type}
+- Framework: ${understanding.summary.framework || "Unknown"}
+- Description: ${understanding.summary.description}
+
+YOUR TASK:
+1. Explore the codebase by reading files
+2. Look for bugs in these categories:
+   - Logic errors (off-by-one, wrong operators, incorrect conditions)
+   - Null/undefined dereference
+   - Security vulnerabilities (injection, auth bypass, XSS)
+   - Async/race conditions (missing await, unhandled promises)
+   - Edge cases (empty arrays, zero values, boundaries)
+   - Resource leaks (unclosed connections)
+
+PROTOCOL - You MUST output these markers:
+- Before reading each file, output: ${MARKERS.SCANNING}<filepath>
+- When you find a bug, output: ${MARKERS.BUG}<json>
+- When completely done, output: ${MARKERS.COMPLETE}
+- If you encounter an error, output: ${MARKERS.ERROR}<message>
+
+BUG JSON FORMAT:
+${MARKERS.BUG}{"file":"src/api/users.ts","line":42,"title":"Null dereference in getUserById","description":"...","severity":"high","category":"null-reference","evidence":["..."],"suggestedFix":"..."}
+
+IMPORTANT:
+- Only report bugs you have HIGH confidence in
+- Include exact line numbers
+- Focus on real bugs, not style issues
+- Explore systematically - check API routes, data handling, auth flows
+
+Now explore this codebase and find bugs. Start by reading the main entry points.`;
+  }
+  buildAgenticUnderstandingPrompt(existingDocsSummary) {
+    const docsSection = existingDocsSummary ? `
+
+EXISTING DOCUMENTATION (merge this with your exploration):
+${existingDocsSummary}
+` : "";
+    return `You are whiterose. Your task is to understand this codebase.
+${docsSection}
+YOUR TASK:
+1. Review the existing documentation above (if any)
+2. Explore the codebase structure to fill in gaps
+3. Read key files (main entry points, config files, core modules)
+4. Build a comprehensive understanding merging docs + code exploration
+5. Identify main features, business rules, and behavioral contracts
+
+PROTOCOL - You MUST output these markers:
+- Before reading each file, output: ${MARKERS.SCANNING}<filepath>
+- When you have full understanding, output: ${MARKERS.UNDERSTANDING}<json>
+- When completely done, output: ${MARKERS.COMPLETE}
+
+UNDERSTANDING JSON FORMAT:
+${MARKERS.UNDERSTANDING}{
+  "summary": {
+    "type": "api|web-app|cli|library|etc",
+    "framework": "next.js|express|react|etc",
+    "language": "typescript|javascript",
+    "description": "2-3 sentence description"
+  },
+  "features": [
+    {"name": "Feature", "description": "What it does", "priority": "critical|high|medium|low", "constraints": ["business rule 1", "invariant 2"], "relatedFiles": ["path/to/file.ts"]}
+  ],
+  "contracts": [
+    {"function": "functionName", "file": "path/to/file.ts", "inputs": [], "outputs": {}, "invariants": ["must do X before Y"], "sideEffects": [], "throws": []}
+  ]
+}
+
+IMPORTANT:
+- Merge existing documentation with what you discover in the code
+- Focus on business rules and invariants (what MUST be true)
+- Identify critical paths (checkout, auth, payments, etc.)
+- Document behavioral contracts for important functions
+
+Now explore this codebase and build understanding.`;
+  }
+  buildAdversarialPrompt(bug, fileContent) {
+    return `You are a skeptical code reviewer. Try to DISPROVE this bug report.
+
+REPORTED BUG:
+- File: ${bug.file}:${bug.line}
+- Title: ${bug.title}
+- Description: ${bug.description}
+- Severity: ${bug.severity}
+
+CODE CONTEXT:
+${fileContent}
+
+Try to prove this is NOT a bug by finding:
+1. Guards or validation that prevents this
+2. Type system guarantees
+3. Framework behavior that handles this
+4. Unreachable code paths
+
+OUTPUT AS JSON:
+{"survived": true/false, "counterArguments": ["reason 1"], "confidence": "high/medium/low", "explanation": "..."}
+
+Set "survived": true if you CANNOT disprove it (it's a real bug).`;
+  }
+  // ─────────────────────────────────────────────────────────────
+  // Claude CLI Execution (Agentic Mode)
+  // ─────────────────────────────────────────────────────────────
+  async runAgenticClaude(prompt, cwd, callbacks) {
+    const claudeCommand = getProviderCommand("claude-code");
+    const args = ["--verbose", "-p", prompt];
+    if (this.unsafeMode) {
+      args.unshift("--dangerously-skip-permissions");
+    }
+    this.currentProcess = execa(
+      claudeCommand,
+      args,
+      {
+        cwd,
+        env: {
+          ...process.env,
+          NO_COLOR: "1"
+        },
+        reject: false
+      }
+    );
+    let buffer = "";
+    this.currentProcess.stdout?.on("data", (chunk) => {
+      buffer += chunk.toString();
+      const lines = buffer.split("\n");
+      buffer = lines.pop() || "";
+      for (const line of lines) {
+        this.processAgentOutput(line, callbacks);
+      }
+    });
+    this.currentProcess.stderr?.on("data", (chunk) => {
+      const text3 = chunk.toString().trim();
+      if (text3 && !text3.includes("Loading")) ;
+    });
+    await this.currentProcess;
+    if (buffer.trim()) {
+      this.processAgentOutput(buffer, callbacks);
+    }
+    this.currentProcess = void 0;
+  }
+  processAgentOutput(line, callbacks) {
+    const trimmed = line.trim();
+    if (trimmed.startsWith(MARKERS.SCANNING)) {
+      const file = trimmed.slice(MARKERS.SCANNING.length).trim();
+      callbacks.onScanning?.(file);
+    } else if (trimmed.startsWith(MARKERS.BUG)) {
+      const json = trimmed.slice(MARKERS.BUG.length).trim();
+      callbacks.onBugFound?.(json);
+    } else if (trimmed.startsWith(MARKERS.UNDERSTANDING)) {
+      const json = trimmed.slice(MARKERS.UNDERSTANDING.length).trim();
+      callbacks.onUnderstanding?.(json);
+    } else if (trimmed.startsWith(MARKERS.COMPLETE)) {
+      callbacks.onComplete?.();
+    } else if (trimmed.startsWith(MARKERS.ERROR)) {
+      const error = trimmed.slice(MARKERS.ERROR.length).trim();
+      callbacks.onError?.(error);
+    }
+  }
+  // Simple non-agentic mode for short prompts (adversarial validation)
+  async runSimpleClaude(prompt, cwd) {
+    const claudeCommand = getProviderCommand("claude-code");
+    try {
+      const { stdout } = await execa(
+        claudeCommand,
+        ["-p", prompt, "--output-format", "text"],
+        {
+          cwd,
+          timeout: 12e4,
+          // 2 min for simple prompts
+          env: { ...process.env, NO_COLOR: "1" }
+        }
+      );
+      return stdout;
+    } catch (error) {
+      if (error.stdout) return error.stdout;
+      throw error;
+    }
+  }
+  // ─────────────────────────────────────────────────────────────
+  // Response Parsers
+  // ─────────────────────────────────────────────────────────────
+  parseBugData(json, index, files) {
+    const result = safeParseJson(json, PartialBugFromLLM);
+    if (!result.success) {
+      return null;
+    }
+    const data = result.data;
+    let filePath = data.file;
+    if (!filePath.startsWith("/")) {
+      const match = files.find((f) => f.endsWith(filePath) || f.includes(filePath));
+      if (match) filePath = match;
+    }
+    return {
+      id: generateBugId(index),
+      title: String(data.title).slice(0, 100),
+      description: String(data.description || ""),
+      file: filePath,
+      line: data.line,
+      endLine: data.endLine,
+      severity: data.severity ?? "medium",
+      category: data.category ?? "logic-error",
+      confidence: {
+        overall: data.confidence?.overall || "medium",
+        codePathValidity: data.confidence?.codePathValidity ?? 0.8,
+        reachability: data.confidence?.reachability ?? 0.8,
+        intentViolation: data.confidence?.intentViolation ?? false,
+        staticToolSignal: data.confidence?.staticToolSignal ?? false,
+        adversarialSurvived: data.confidence?.adversarialSurvived ?? false
+      },
+      codePath: (data.codePath || []).map((step, idx) => ({
+        step: idx + 1,
+        file: step.file || filePath,
+        line: step.line || data.line,
+        code: step.code || "",
+        explanation: step.explanation || ""
+      })),
+      evidence: data.evidence || [],
+      suggestedFix: data.suggestedFix,
+      createdAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+  }
+  parseAdversarialResponse(response, bug) {
+    const json = this.extractJson(response);
+    if (!json) {
+      return { survived: true, counterArguments: [] };
+    }
+    const result = safeParseJson(json, AdversarialResultSchema);
+    if (!result.success) {
+      return { survived: true, counterArguments: [] };
+    }
+    const parsed = result.data;
+    const survived = parsed.survived !== false;
+    return {
+      survived,
+      counterArguments: parsed.counterArguments || [],
+      adjustedConfidence: survived ? {
+        ...bug.confidence,
+        overall: parsed.confidence || bug.confidence.overall,
+        adversarialSurvived: true
+      } : void 0
+    };
+  }
+  parseUnderstandingResponse(response, files) {
+    let totalLines = 0;
+    for (const file of files.slice(0, 50)) {
+      try {
+        const content = readFileSync(file, "utf-8");
+        totalLines += content.split("\n").length;
+      } catch {
+      }
+    }
+    const json = this.extractJson(response);
+    if (!json) {
+      return {
+        version: "1",
+        generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        summary: {
+          type: "unknown",
+          language: "unknown",
+          description: "Failed to analyze codebase: No JSON found in response"
+        },
+        features: [],
+        contracts: [],
+        dependencies: {},
+        structure: { totalFiles: files.length, totalLines }
+      };
+    }
+    const result = safeParseJson(json, PartialUnderstandingFromLLM);
+    if (!result.success) {
+      return {
+        version: "1",
+        generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        summary: {
+          type: "unknown",
+          language: "unknown",
+          description: `Failed to analyze codebase: ${result.error}`
+        },
+        features: [],
+        contracts: [],
+        dependencies: {},
+        structure: { totalFiles: files.length, totalLines }
+      };
+    }
+    const parsed = result.data;
+    return {
+      version: "1",
+      generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      summary: {
+        type: parsed.summary?.type || "unknown",
+        framework: parsed.summary?.framework || void 0,
+        language: parsed.summary?.language || "typescript",
+        description: parsed.summary?.description || "No description available"
+      },
+      features: (parsed.features || []).map((f) => ({
+        name: f.name || "Unknown",
+        description: f.description || "",
+        priority: f.priority || "medium",
+        constraints: f.constraints || [],
+        relatedFiles: f.relatedFiles || []
+      })),
+      contracts: (parsed.contracts || []).map((c) => ({
+        function: c.function || "unknown",
+        file: c.file || "unknown",
+        inputs: c.inputs || [],
+        outputs: c.outputs || { type: "unknown" },
+        invariants: c.invariants || [],
+        sideEffects: c.sideEffects || [],
+        throws: c.throws
+      })),
+      dependencies: {},
+      structure: {
+        totalFiles: files.length,
+        totalLines
+      }
+    };
+  }
+  // ─────────────────────────────────────────────────────────────
+  // Utilities
+  // ─────────────────────────────────────────────────────────────
+  extractJson(text3) {
+    const codeBlockMatch = text3.match(/```(?:json)?\s*([\s\S]*?)```/);
+    if (codeBlockMatch) {
+      return codeBlockMatch[1].trim();
+    }
+    const arrayMatch = text3.match(/\[[\s\S]*\]/);
+    if (arrayMatch) {
+      return arrayMatch[0];
+    }
+    const objectMatch = text3.match(/\{[\s\S]*\}/);
+    if (objectMatch) {
+      return objectMatch[0];
+    }
+    return null;
+  }
+};
+var MAX_FILE_SIZE = 5e4;
+var MAX_TOTAL_CONTEXT = 2e5;
+var AIDER_TIMEOUT = 3e5;
+var AiderProvider = class {
+  name = "aider";
+  async detect() {
+    return isProviderAvailable("aider");
+  }
+  async isAvailable() {
+    return isProviderAvailable("aider");
+  }
+  async analyze(context) {
+    const { files, understanding, staticAnalysisResults } = context;
+    if (files.length === 0) {
+      return [];
+    }
+    const fileContents = this.readFilesWithLimit(files, MAX_TOTAL_CONTEXT);
+    const prompt = this.buildAnalysisPrompt(fileContents, understanding, staticAnalysisResults);
+    const result = await this.runAider(prompt, files, dirname(files[0]));
+    return this.parseAnalysisResponse(result, files);
+  }
+  async adversarialValidate(bug, _context) {
+    let fileContent = "";
+    try {
+      if (existsSync(bug.file)) {
+        fileContent = readFileSync(bug.file, "utf-8");
+        const lines = fileContent.split("\n");
+        const start = Math.max(0, bug.line - 20);
+        const end = Math.min(lines.length, (bug.endLine || bug.line) + 20);
+        fileContent = lines.slice(start, end).join("\n");
+      }
+    } catch {
+    }
+    const prompt = this.buildAdversarialPrompt(bug, fileContent);
+    const result = await this.runAider(prompt, [bug.file], dirname(bug.file));
+    return this.parseAdversarialResponse(result, bug);
+  }
+  async generateUnderstanding(files, _existingDocsSummary) {
+    const sampledFiles = this.prioritizeFiles(files, 40);
+    const fileContents = this.readFilesWithLimit(sampledFiles, MAX_TOTAL_CONTEXT);
+    let packageJson = null;
+    const packageJsonPath = files.find((f) => f.endsWith("package.json"));
+    if (packageJsonPath) {
+      try {
+        packageJson = JSON.parse(readFileSync(packageJsonPath, "utf-8"));
+      } catch {
+      }
+    }
+    const prompt = this.buildUnderstandingPrompt(files.length, fileContents, packageJson);
+    const result = await this.runAider(prompt, sampledFiles.slice(0, 5), process.cwd());
+    return this.parseUnderstandingResponse(result, files);
+  }
+  // ─────────────────────────────────────────────────────────────
+  // File Reading Helpers
+  // ─────────────────────────────────────────────────────────────
+  readFilesWithLimit(files, maxTotal) {
+    const result = [];
+    let totalSize = 0;
+    for (const file of files) {
+      if (totalSize >= maxTotal) break;
+      try {
+        if (!existsSync(file)) continue;
+        let content = readFileSync(file, "utf-8");
+        if (content.length > MAX_FILE_SIZE) {
+          content = content.slice(0, MAX_FILE_SIZE) + "\n// ... truncated ...";
+        }
+        if (totalSize + content.length > maxTotal) {
+          const remaining = maxTotal - totalSize;
+          content = content.slice(0, remaining) + "\n// ... truncated ...";
+        }
+        result.push({ path: file, content });
+        totalSize += content.length;
+      } catch {
+      }
+    }
+    return result;
+  }
+  prioritizeFiles(files, count) {
+    if (files.length <= count) return files;
+    const priorityPatterns = [
+      { pattern: /package\.json$/, priority: 100 },
+      { pattern: /tsconfig\.json$/, priority: 90 },
+      { pattern: /README\.md$/i, priority: 80 },
+      { pattern: /\/index\.(ts|js|tsx|jsx)$/, priority: 70 },
+      { pattern: /\/app\.(ts|js|tsx|jsx)$/, priority: 70 },
+      { pattern: /\/main\.(ts|js|tsx|jsx)$/, priority: 70 },
+      { pattern: /\/api\//, priority: 60 },
+      { pattern: /\/routes?\//, priority: 55 },
+      { pattern: /\/pages\//, priority: 55 },
+      { pattern: /\/services?\//, priority: 50 },
+      { pattern: /\.(ts|tsx)$/, priority: 30 },
+      { pattern: /\.(js|jsx)$/, priority: 20 }
+    ];
+    const scored = files.map((file) => {
+      let score = 0;
+      for (const { pattern, priority } of priorityPatterns) {
+        if (pattern.test(file)) {
+          score = Math.max(score, priority);
+        }
+      }
+      return { file, score };
+    });
+    scored.sort((a, b) => b.score - a.score);
+    return scored.slice(0, count).map((s) => s.file);
+  }
+  // ─────────────────────────────────────────────────────────────
+  // Prompt Builders (similar to Claude Code but adapted for Aider)
+  // ─────────────────────────────────────────────────────────────
+  buildAnalysisPrompt(fileContents, understanding, staticResults) {
+    const filesSection = fileContents.map((f) => `=== ${f.path} ===
+${f.content}`).join("\n\n");
+    const staticSignals = staticResults.length > 0 ? `
+Static analysis signals:
+${staticResults.slice(0, 50).map((r) => `- ${r.file}:${r.line}: ${r.message}`).join("\n")}` : "";
+    return `Analyze the following code for bugs. This is a ${understanding.summary.type} application using ${understanding.summary.framework || "no specific framework"}.
+
+${filesSection}
+${staticSignals}
+
+Find bugs in these categories:
+1. Logic errors (off-by-one, wrong operators)
+2. Null/undefined dereference
+3. Security vulnerabilities
+4. Async/race conditions
+5. Edge cases not handled
+
+Output as JSON array ONLY:
+[{"file": "path", "line": 42, "title": "Bug title", "description": "Description", "severity": "high", "category": "null-reference", "codePath": [{"step": 1, "file": "path", "line": 40, "code": "code", "explanation": "explanation"}], "evidence": ["evidence1"], "suggestedFix": "fix code"}]
+
+If no bugs found, output: []`;
+  }
+  buildAdversarialPrompt(bug, fileContent) {
+    return `Try to DISPROVE this bug report:
+
+Bug: ${bug.title}
+File: ${bug.file}:${bug.line}
+Description: ${bug.description}
+
+Code context:
+${fileContent}
+
+Find reasons this is NOT a bug (guards, type checks, etc).
+
+Output JSON ONLY:
+{"survived": true/false, "counterArguments": ["reason1", "reason2"], "confidence": "high/medium/low"}`;
+  }
+  buildUnderstandingPrompt(totalFiles, fileContents, packageJson) {
+    const filesSection = fileContents.map((f) => `=== ${f.path} ===
+${f.content}`).join("\n\n");
+    const depsSection = packageJson ? `
+Dependencies: ${JSON.stringify(packageJson.dependencies || {})}` : "";
+    return `Analyze this codebase (${totalFiles} total files).
+${depsSection}
+
+${filesSection}
+
+Output JSON ONLY describing:
+{
+  "summary": {"type": "app-type", "framework": "framework", "language": "typescript", "description": "description"},
+  "features": [{"name": "Feature", "description": "desc", "priority": "critical", "constraints": ["constraint"], "relatedFiles": ["file"]}],
+  "contracts": [{"function": "funcName", "file": "file.ts", "inputs": [{"name": "param", "type": "string"}], "outputs": {"type": "Result"}, "invariants": ["rule"], "sideEffects": ["effect"]}]
+}`;
+  }
+  // ─────────────────────────────────────────────────────────────
+  // Aider CLI Execution
+  // ─────────────────────────────────────────────────────────────
+  async runAider(prompt, files, cwd) {
+    const tempDir = mkdtempSync(join(tmpdir(), "whiterose-"));
+    const promptFile = join(tempDir, "prompt.txt");
+    try {
+      writeFileSync(promptFile, prompt, "utf-8");
+      const args = [
+        "--no-auto-commits",
+        "--no-git",
+        "--yes",
+        "--message-file",
+        promptFile
+      ];
+      for (const file of files.slice(0, 10)) {
+        if (existsSync(file)) {
+          args.push(file);
+        }
+      }
+      const aiderCommand = getProviderCommand("aider");
+      const { stdout, stderr } = await execa(aiderCommand, args, {
+        cwd,
+        timeout: AIDER_TIMEOUT,
+        env: {
+          ...process.env,
+          NO_COLOR: "1"
+        },
+        reject: false
+      });
+      return stdout || stderr || "";
+    } catch (error) {
+      if (error.stdout) {
+        return error.stdout;
+      }
+      if (error.message?.includes("ENOENT")) {
+        throw new Error("Aider not found. Install it with: pip install aider-chat");
+      }
+      throw new Error(`Aider failed: ${error.message}`);
+    } finally {
+      try {
+        rmSync(tempDir, { recursive: true, force: true });
+      } catch {
+      }
+    }
+  }
+  // ─────────────────────────────────────────────────────────────
+  // Response Parsers
+  // ─────────────────────────────────────────────────────────────
+  parseAnalysisResponse(response, files) {
+    try {
+      const json = this.extractJson(response);
+      if (!json) return [];
+      const parsed = JSON.parse(json);
+      if (!Array.isArray(parsed)) return [];
+      const bugs = [];
+      for (let i = 0; i < parsed.length; i++) {
+        const item = parsed[i];
+        if (!item.file || !item.line || !item.title) continue;
+        let filePath = item.file;
+        if (!filePath.startsWith("/")) {
+          const match = files.find((f) => f.endsWith(filePath) || f.includes(filePath));
+          if (match) filePath = match;
+        }
+        const codePath = (item.codePath || []).map(
+          (step, idx) => ({
+            step: step.step || idx + 1,
+            file: step.file || filePath,
+            line: step.line || item.line,
+            code: step.code || "",
+            explanation: step.explanation || ""
+          })
+        );
+        bugs.push({
+          id: generateBugId(i),
+          title: String(item.title).slice(0, 100),
+          description: String(item.description || ""),
+          file: filePath,
+          line: Number(item.line) || 0,
+          endLine: item.endLine ? Number(item.endLine) : void 0,
+          severity: this.parseSeverity(item.severity),
+          category: this.parseCategory(item.category),
+          confidence: {
+            overall: "medium",
+            codePathValidity: 0.75,
+            reachability: 0.75,
+            intentViolation: false,
+            staticToolSignal: false,
+            adversarialSurvived: false
+          },
+          codePath,
+          evidence: Array.isArray(item.evidence) ? item.evidence.map(String) : [],
+          suggestedFix: item.suggestedFix ? String(item.suggestedFix) : void 0,
+          createdAt: (/* @__PURE__ */ new Date()).toISOString()
+        });
+      }
+      return bugs;
+    } catch {
+      return [];
+    }
+  }
+  parseAdversarialResponse(response, bug) {
+    try {
+      const json = this.extractJson(response);
+      if (!json) return { survived: true, counterArguments: [] };
+      const parsed = JSON.parse(json);
+      const survived = parsed.survived !== false;
+      return {
+        survived,
+        counterArguments: Array.isArray(parsed.counterArguments) ? parsed.counterArguments.map(String) : [],
+        adjustedConfidence: survived ? {
+          ...bug.confidence,
+          overall: this.parseConfidence(parsed.confidence),
+          adversarialSurvived: true
+        } : void 0
+      };
+    } catch {
+      return { survived: true, counterArguments: [] };
+    }
+  }
+  parseUnderstandingResponse(response, files) {
+    try {
+      const json = this.extractJson(response);
+      if (!json) throw new Error("No JSON found");
+      const parsed = JSON.parse(json);
+      let totalLines = 0;
+      for (const file of files.slice(0, 50)) {
+        try {
+          totalLines += readFileSync(file, "utf-8").split("\n").length;
+        } catch {
+        }
+      }
+      return {
+        version: "1",
+        generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        summary: {
+          type: parsed.summary?.type || "unknown",
+          framework: parsed.summary?.framework,
+          language: parsed.summary?.language || "typescript",
+          description: parsed.summary?.description || "No description available"
+        },
+        features: (parsed.features || []).map((f) => ({
+          name: f.name || "Unknown",
+          description: f.description || "",
+          priority: f.priority || "medium",
+          constraints: Array.isArray(f.constraints) ? f.constraints : [],
+          relatedFiles: Array.isArray(f.relatedFiles) ? f.relatedFiles : []
+        })),
+        contracts: (parsed.contracts || []).map((c) => ({
+          function: c.function || "unknown",
+          file: c.file || "unknown",
+          inputs: Array.isArray(c.inputs) ? c.inputs : [],
+          outputs: c.outputs || { type: "unknown" },
+          invariants: Array.isArray(c.invariants) ? c.invariants : [],
+          sideEffects: Array.isArray(c.sideEffects) ? c.sideEffects : []
+        })),
+        dependencies: {},
+        structure: {
+          totalFiles: files.length,
+          totalLines
+        }
+      };
+    } catch {
+      return {
+        version: "1",
+        generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        summary: {
+          type: "unknown",
+          language: "typescript",
+          description: "Failed to analyze codebase"
+        },
+        features: [],
+        contracts: [],
+        dependencies: {},
+        structure: {
+          totalFiles: files.length,
+          totalLines: 0
+        }
+      };
+    }
+  }
+  // ─────────────────────────────────────────────────────────────
+  // Utilities
+  // ─────────────────────────────────────────────────────────────
+  extractJson(text3) {
+    const codeBlockMatch = text3.match(/```(?:json)?\s*([\s\S]*?)```/);
+    if (codeBlockMatch) return codeBlockMatch[1].trim();
+    const arrayMatch = text3.match(/\[[\s\S]*\]/);
+    if (arrayMatch) return arrayMatch[0];
+    const objectMatch = text3.match(/\{[\s\S]*\}/);
+    if (objectMatch) return objectMatch[0];
+    return null;
+  }
+  parseSeverity(value) {
+    const str = String(value).toLowerCase();
+    if (["critical", "high", "medium", "low"].includes(str)) {
+      return str;
+    }
+    return "medium";
+  }
+  parseCategory(value) {
+    const str = String(value).toLowerCase().replace(/_/g, "-");
+    const validCategories = [
+      "logic-error",
+      "security",
+      "async-race-condition",
+      "edge-case",
+      "null-reference",
+      "type-coercion",
+      "resource-leak",
+      "intent-violation"
+    ];
+    if (validCategories.includes(str)) {
+      return str;
+    }
+    if (str.includes("null") || str.includes("undefined")) return "null-reference";
+    if (str.includes("security")) return "security";
+    if (str.includes("async") || str.includes("race")) return "async-race-condition";
+    return "logic-error";
+  }
+  parseConfidence(value) {
+    const str = String(value).toLowerCase();
+    if (["high", "medium", "low"].includes(str)) {
+      return str;
+    }
+    return "medium";
+  }
+};
+
+// src/providers/index.ts
+var providers = {
+  "claude-code": () => new ClaudeCodeProvider(),
+  aider: () => new AiderProvider(),
+  codex: () => {
+    throw new Error("Codex provider not yet implemented");
+  },
+  opencode: () => {
+    throw new Error("OpenCode provider not yet implemented");
+  },
+  ollama: () => {
+    throw new Error("Ollama provider not yet implemented");
+  },
+  gemini: () => {
+    throw new Error("Gemini provider not yet implemented");
+  }
+};
+async function getProvider(name) {
+  const factory = providers[name];
+  if (!factory) {
+    throw new Error(`Unknown provider: ${name}`);
+  }
+  const provider = factory();
+  const available = await provider.isAvailable();
+  if (!available) {
+    throw new Error(`Provider ${name} is not available. Make sure it's installed and configured.`);
+  }
+  return provider;
+}
+
+// src/core/scanner/index.ts
+var DEFAULT_INCLUDE = ["**/*.ts", "**/*.tsx", "**/*.js", "**/*.jsx"];
+var DEFAULT_EXCLUDE = [
+  "node_modules/**",
+  "dist/**",
+  "build/**",
+  ".next/**",
+  "coverage/**",
+  "**/*.test.*",
+  "**/*.spec.*",
+  "**/*.d.ts",
+  ".whiterose/**"
+];
+async function scanCodebase(cwd, config) {
+  const include = config?.include || DEFAULT_INCLUDE;
+  const exclude = config?.exclude || DEFAULT_EXCLUDE;
+  const files = await fg3(include, {
+    cwd,
+    ignore: exclude,
+    absolute: true,
+    onlyFiles: true
+  });
+  return files.sort();
+}
+function hashFile(filePath) {
+  const content = readFileSync(filePath, "utf-8");
+  return createHash("md5").update(content).digest("hex");
+}
+async function getChangedFiles(cwd, config) {
+  const cachePath = join(cwd, ".whiterose", "cache", "file-hashes.json");
+  const currentFiles = await scanCodebase(cwd, config);
+  let cachedState = {
+    fileHashes: []
+  };
+  if (existsSync(cachePath)) {
+    cachedState = JSON.parse(readFileSync(cachePath, "utf-8"));
+  }
+  const cachedHashes = new Map(cachedState.fileHashes.map((h) => [h.path, h.hash]));
+  const changedFiles = [];
+  const newHashes = [];
+  for (const file of currentFiles) {
+    const relativePath = relative(cwd, file);
+    const currentHash = hashFile(file);
+    newHashes.push({
+      path: relativePath,
+      hash: currentHash,
+      lastModified: (/* @__PURE__ */ new Date()).toISOString()
+    });
+    const cachedHash = cachedHashes.get(relativePath);
+    if (!cachedHash || cachedHash !== currentHash) {
+      changedFiles.push(file);
+    }
+  }
+  const newState = {
+    version: "1",
+    lastIncrementalScan: (/* @__PURE__ */ new Date()).toISOString(),
+    lastFullScan: cachedState.lastFullScan,
+    fileHashes: newHashes
+  };
+  writeFileSync(cachePath, JSON.stringify(newState, null, 2), "utf-8");
+  return { files: changedFiles, hashes: newHashes };
+}
+
+// src/core/contracts/intent.ts
+function generateIntentDocument(understanding) {
+  const lines = [];
+  lines.push(`# App Intent: ${understanding.summary.type}`);
+  lines.push("");
+  lines.push(`> Generated by whiterose on ${(/* @__PURE__ */ new Date()).toISOString()}`);
+  lines.push("> Edit the sections above the line. Contracts below are auto-generated.");
+  lines.push("");
+  lines.push("## Overview");
+  lines.push("");
+  lines.push(understanding.summary.description);
+  lines.push("");
+  lines.push(`- **Framework:** ${understanding.summary.framework || "None detected"}`);
+  lines.push(`- **Language:** ${understanding.summary.language}`);
+  lines.push(`- **Files:** ${understanding.structure.totalFiles}`);
+  if (understanding.structure.packages?.length) {
+    lines.push(`- **Packages:** ${understanding.structure.packages.join(", ")}`);
+  }
+  lines.push("");
+  if (understanding.features.length > 0) {
+    lines.push("## Critical Features");
+    lines.push("");
+    const criticalFeatures = understanding.features.filter((f) => f.priority === "critical");
+    const highFeatures = understanding.features.filter((f) => f.priority === "high");
+    const otherFeatures = understanding.features.filter(
+      (f) => f.priority !== "critical" && f.priority !== "high"
+    );
+    for (const feature of criticalFeatures) {
+      lines.push(formatFeature(feature, "CRITICAL"));
+    }
+    if (highFeatures.length > 0) {
+      lines.push("## High Priority Features");
+      lines.push("");
+      for (const feature of highFeatures) {
+        lines.push(formatFeature(feature, "HIGH"));
+      }
+    }
+    if (otherFeatures.length > 0) {
+      lines.push("## Other Features");
+      lines.push("");
+      for (const feature of otherFeatures) {
+        lines.push(formatFeature(feature));
+      }
+    }
+  }
+  lines.push("## Known Constraints");
+  lines.push("");
+  lines.push("<!-- Add any known constraints or business rules here -->");
+  lines.push("");
+  lines.push("- (Add your constraints here)");
+  lines.push("");
+  lines.push("## Areas of Concern");
+  lines.push("");
+  lines.push("<!-- Add files or areas that need extra scrutiny -->");
+  lines.push("");
+  lines.push("- (Add files that have had bugs before)");
+  lines.push("");
+  lines.push("---");
+  lines.push("");
+  lines.push("<!-- \u26A0\uFE0F DO NOT EDIT BELOW THIS LINE - Auto-generated contracts -->");
+  lines.push("");
+  if (understanding.contracts.length > 0) {
+    lines.push("## Behavioral Contracts");
+    lines.push("");
+    for (const contract of understanding.contracts) {
+      lines.push(formatContract(contract));
+    }
+  }
+  return lines.join("\n");
+}
+function formatFeature(feature, badge) {
+  const lines = [];
+  const badgeStr = badge ? ` [${badge}]` : "";
+  lines.push(`### ${feature.name}${badgeStr}`);
+  lines.push("");
+  lines.push(feature.description);
+  lines.push("");
+  if (feature.constraints.length > 0) {
+    lines.push("**Constraints:**");
+    for (const constraint of feature.constraints) {
+      lines.push(`- ${constraint}`);
+    }
+    lines.push("");
+  }
+  if (feature.relatedFiles.length > 0) {
+    lines.push(`**Files:** \`${feature.relatedFiles.join("`, `")}\``);
+    lines.push("");
+  }
+  return lines.join("\n");
+}
+function formatContract(contract) {
+  const lines = [];
+  lines.push(`### \`${contract.file}:${contract.function}()\``);
+  lines.push("");
+  if (contract.inputs.length > 0) {
+    lines.push("**Inputs:**");
+    for (const input of contract.inputs) {
+      const constraints = input.constraints ? ` (${input.constraints})` : "";
+      lines.push(`- \`${input.name}\`: ${input.type}${constraints}`);
+    }
+    lines.push("");
+  }
+  lines.push("**Returns:** `" + contract.outputs.type + "`");
+  if (contract.outputs.constraints) {
+    lines.push(`  - ${contract.outputs.constraints}`);
+  }
+  lines.push("");
+  if (contract.invariants.length > 0) {
+    lines.push("**Invariants:**");
+    for (const invariant of contract.invariants) {
+      lines.push(`- ${invariant}`);
+    }
+    lines.push("");
+  }
+  if (contract.sideEffects.length > 0) {
+    lines.push("**Side Effects:**");
+    for (const effect of contract.sideEffects) {
+      lines.push(`- ${effect}`);
+    }
+    lines.push("");
+  }
+  if (contract.throws && contract.throws.length > 0) {
+    lines.push("**Throws:**");
+    for (const t of contract.throws) {
+      lines.push(`- ${t}`);
+    }
+    lines.push("");
+  }
+  return lines.join("\n");
+}
+async function readExistingDocs(cwd) {
+  const docs = {
+    readme: null,
+    contributing: null,
+    apiDocs: [],
+    changelog: null,
+    packageJson: null,
+    tsconfig: null,
+    envExample: null,
+    otherDocs: []
+  };
+  for (const name of ["README.md", "readme.md", "README", "Readme.md"]) {
+    const path = join(cwd, name);
+    if (existsSync(path)) {
+      docs.readme = readFileSync(path, "utf-8");
+      break;
+    }
+  }
+  for (const name of ["CONTRIBUTING.md", "contributing.md", "CONTRIBUTING"]) {
+    const path = join(cwd, name);
+    if (existsSync(path)) {
+      docs.contributing = readFileSync(path, "utf-8");
+      break;
+    }
+  }
+  for (const name of ["CHANGELOG.md", "changelog.md", "CHANGELOG", "HISTORY.md"]) {
+    const path = join(cwd, name);
+    if (existsSync(path)) {
+      docs.changelog = readFileSync(path, "utf-8");
+      break;
+    }
+  }
+  const packageJsonPath = join(cwd, "package.json");
+  if (existsSync(packageJsonPath)) {
+    try {
+      docs.packageJson = JSON.parse(readFileSync(packageJsonPath, "utf-8"));
+    } catch {
+    }
+  }
+  const tsconfigPath = join(cwd, "tsconfig.json");
+  if (existsSync(tsconfigPath)) {
+    try {
+      docs.tsconfig = JSON.parse(readFileSync(tsconfigPath, "utf-8"));
+    } catch {
+    }
+  }
+  for (const name of [".env.example", ".env.sample", ".env.template"]) {
+    const path = join(cwd, name);
+    if (existsSync(path)) {
+      docs.envExample = readFileSync(path, "utf-8");
+      break;
+    }
+  }
+  const apiDocPaths = await fg3(["docs/**/*.md", "documentation/**/*.md", "api/**/*.md"], {
+    cwd,
+    absolute: true,
+    ignore: ["**/node_modules/**"]
+  });
+  for (const path of apiDocPaths.slice(0, 10)) {
+    try {
+      docs.apiDocs.push(readFileSync(path, "utf-8"));
+    } catch {
+    }
+  }
+  const otherDocPaths = await fg3(["*.md", "docs/*.md"], {
+    cwd,
+    absolute: true,
+    ignore: ["**/node_modules/**", "README.md", "CONTRIBUTING.md", "CHANGELOG.md"]
+  });
+  for (const path of otherDocPaths.slice(0, 5)) {
+    try {
+      docs.otherDocs.push({
+        name: basename(path),
+        content: readFileSync(path, "utf-8")
+      });
+    } catch {
+    }
+  }
+  return docs;
+}
+function extractIntentFromDocs(docs) {
+  const intent = {
+    projectName: "",
+    description: "",
+    features: [],
+    techStack: [],
+    conventions: [],
+    apiEndpoints: [],
+    envVariables: [],
+    scripts: {}
+  };
+  if (docs.packageJson) {
+    intent.projectName = docs.packageJson.name || "";
+    intent.description = docs.packageJson.description || "";
+    intent.scripts = docs.packageJson.scripts || {};
+    const deps = {
+      ...docs.packageJson.dependencies,
+      ...docs.packageJson.devDependencies
+    };
+    if (deps) {
+      if (deps["next"]) intent.techStack.push("Next.js");
+      if (deps["react"]) intent.techStack.push("React");
+      if (deps["vue"]) intent.techStack.push("Vue");
+      if (deps["express"]) intent.techStack.push("Express");
+      if (deps["fastify"]) intent.techStack.push("Fastify");
+      if (deps["typescript"]) intent.techStack.push("TypeScript");
+      if (deps["prisma"]) intent.techStack.push("Prisma");
+      if (deps["mongoose"]) intent.techStack.push("MongoDB/Mongoose");
+      if (deps["pg"] || deps["postgres"]) intent.techStack.push("PostgreSQL");
+      if (deps["redis"]) intent.techStack.push("Redis");
+      if (deps["stripe"]) intent.techStack.push("Stripe");
+      if (deps["@auth/core"] || deps["next-auth"]) intent.techStack.push("Auth.js");
+    }
+  }
+  if (docs.readme) {
+    const featuresMatch = docs.readme.match(/##\s*Features?\s*\n([\s\S]*?)(?=\n##|\n---|\$)/i);
+    if (featuresMatch) {
+      const featureLines = featuresMatch[1].split("\n").filter((line) => line.trim().startsWith("-") || line.trim().startsWith("*")).map((line) => line.replace(/^[-*]\s*/, "").trim()).filter((line) => line.length > 0);
+      intent.features.push(...featureLines.slice(0, 20));
+    }
+  }
+  if (docs.envExample) {
+    const envLines = docs.envExample.split("\n").filter((line) => line.includes("=") && !line.startsWith("#")).map((line) => line.split("=")[0].trim()).filter((line) => line.length > 0);
+    intent.envVariables.push(...envLines);
+  }
+  for (const apiDoc of docs.apiDocs) {
+    const endpointMatches = apiDoc.matchAll(/`(GET|POST|PUT|DELETE|PATCH)\s+([^`]+)`/g);
+    for (const match of endpointMatches) {
+      intent.apiEndpoints.push(`${match[1]} ${match[2]}`);
+    }
+  }
+  if (docs.contributing) {
+    const conventionLines = docs.contributing.split("\n").filter((line) => line.trim().startsWith("-") || line.trim().startsWith("*")).map((line) => line.replace(/^[-*]\s*/, "").trim()).filter((line) => line.length > 10 && line.length < 200).slice(0, 10);
+    intent.conventions.push(...conventionLines);
+  }
+  return intent;
+}
+function buildDocsSummary(docs, extracted) {
+  const parts = [];
+  parts.push(`# Existing Documentation Summary
+`);
+  if (extracted.projectName) {
+    parts.push(`## Project: ${extracted.projectName}`);
+    if (extracted.description) {
+      parts.push(`
+${extracted.description}
+`);
+    }
+  }
+  if (extracted.techStack.length > 0) {
+    parts.push(`
+## Tech Stack`);
+    parts.push(extracted.techStack.map((t) => `- ${t}`).join("\n"));
+  }
+  if (extracted.features.length > 0) {
+    parts.push(`
+## Features (from README)`);
+    parts.push(extracted.features.map((f) => `- ${f}`).join("\n"));
+  }
+  if (extracted.apiEndpoints.length > 0) {
+    parts.push(`
+## API Endpoints`);
+    parts.push(extracted.apiEndpoints.slice(0, 20).map((e) => `- ${e}`).join("\n"));
+  }
+  if (extracted.envVariables.length > 0) {
+    parts.push(`
+## Environment Variables`);
+    parts.push(extracted.envVariables.map((v) => `- ${v}`).join("\n"));
+  }
+  if (extracted.conventions.length > 0) {
+    parts.push(`
+## Conventions (from CONTRIBUTING)`);
+    parts.push(extracted.conventions.map((c) => `- ${c}`).join("\n"));
+  }
+  if (Object.keys(extracted.scripts).length > 0) {
+    parts.push(`
+## NPM Scripts`);
+    for (const [name, cmd] of Object.entries(extracted.scripts).slice(0, 10)) {
+      parts.push(`- \`npm run ${name}\`: ${cmd}`);
+    }
+  }
+  if (docs.readme && docs.readme.length > 0) {
+    const excerpt = docs.readme.slice(0, 2e3);
+    parts.push(`
+## README Excerpt
+\`\`\`
+${excerpt}
+\`\`\``);
+  }
+  return parts.join("\n");
+}
+async function initCommand(options) {
+  const cwd = process.cwd();
+  const whiterosePath = join(cwd, ".whiterose");
+  if (existsSync(whiterosePath) && !options.force) {
+    p3.log.error("whiterose is already initialized in this directory.");
+    p3.log.info('Use --force to reinitialize, or run "whiterose refresh" to update understanding.');
+    process.exit(1);
+  }
+  p3.intro(chalk.red("whiterose") + chalk.dim(" - initialization"));
+  const providerSpinner = p3.spinner();
+  providerSpinner.start("Detecting available LLM providers...");
+  const availableProviders = await detectProvider();
+  if (availableProviders.length === 0) {
+    providerSpinner.stop("No LLM providers detected");
+    p3.log.error("whiterose requires an LLM provider to function.");
+    p3.log.info("Supported providers: claude-code, aider, codex, opencode");
+    p3.log.info("Install one and ensure it's configured, then run init again.");
+    process.exit(1);
+  }
+  providerSpinner.stop(`Detected providers: ${availableProviders.join(", ")}`);
+  let selectedProvider;
+  if (options.skipQuestions) {
+    selectedProvider = availableProviders[0];
+    p3.log.info(`Using ${selectedProvider} as your LLM provider.`);
+  } else {
+    const providerChoice = await p3.select({
+      message: "Which LLM provider should whiterose use?",
+      options: availableProviders.map((prov) => ({
+        value: prov,
+        label: prov,
+        hint: prov === "claude-code" ? "recommended" : void 0
+      }))
+    });
+    if (p3.isCancel(providerChoice)) {
+      p3.cancel("Initialization cancelled.");
+      process.exit(0);
+    }
+    selectedProvider = providerChoice;
+  }
+  const verifySpinner = p3.spinner();
+  verifySpinner.start("Verifying provider CLI works...");
+  try {
+    const command = getProviderCommand(selectedProvider);
+    await execa(command, ["--version"], { timeout: 1e4 });
+    verifySpinner.stop(`Using ${selectedProvider} at: ${command}`);
+  } catch (error) {
+    verifySpinner.stop("Provider CLI verification failed");
+    const installHint = selectedProvider === "claude-code" ? "npm install -g @anthropic-ai/claude-code" : `Install ${selectedProvider} and ensure it's in your PATH`;
+    p3.log.error(`Cannot run ${selectedProvider} CLI. ${installHint}`);
+    p3.log.info(`Resolved path: ${getProviderCommand(selectedProvider)}`);
+    if (error.message) {
+      p3.log.info(`Error: ${error.message}`);
+    }
+    process.exit(1);
+  }
+  const scanSpinner = p3.spinner();
+  scanSpinner.start("Scanning codebase...");
+  let codebaseFiles;
+  try {
+    codebaseFiles = await scanCodebase(cwd);
+    scanSpinner.stop(`Found ${codebaseFiles.length} source files`);
+  } catch (error) {
+    scanSpinner.stop("Failed to scan codebase");
+    p3.log.error(String(error));
+    process.exit(1);
+  }
+  const docsSpinner = p3.spinner();
+  docsSpinner.start("Reading existing documentation...");
+  let docsSummary;
+  try {
+    const existingDocs = await readExistingDocs(cwd);
+    const extractedIntent = extractIntentFromDocs(existingDocs);
+    docsSummary = buildDocsSummary(existingDocs, extractedIntent);
+    const docsFound = [];
+    if (existingDocs.readme) docsFound.push("README");
+    if (existingDocs.contributing) docsFound.push("CONTRIBUTING");
+    if (existingDocs.packageJson) docsFound.push("package.json");
+    if (existingDocs.envExample) docsFound.push(".env.example");
+    if (existingDocs.apiDocs.length > 0) docsFound.push(`${existingDocs.apiDocs.length} API docs`);
+    if (docsFound.length > 0) {
+      docsSpinner.stop(`Found existing docs: ${docsFound.join(", ")}`);
+    } else {
+      docsSpinner.stop("No existing documentation found (will generate from code)");
+      docsSummary = void 0;
+    }
+  } catch (error) {
+    docsSpinner.stop("Could not read existing docs (continuing without)");
+    docsSummary = void 0;
+  }
+  const understandingSpinner = p3.spinner();
+  const startTime = Date.now();
+  understandingSpinner.start("Starting codebase analysis...");
+  let understanding;
+  try {
+    const provider = await getProvider(selectedProvider);
+    if (options.unsafe && "setUnsafeMode" in provider) {
+      provider.setUnsafeMode(true);
+      p3.log.warn("Running in unsafe mode (--unsafe). LLM permission prompts are bypassed.");
+    }
+    if ("setProgressCallback" in provider) {
+      provider.setProgressCallback((message) => {
+        understandingSpinner.message(message);
+      });
+    }
+    understanding = await provider.generateUnderstanding(codebaseFiles, docsSummary);
+    const totalTime = Math.floor((Date.now() - startTime) / 1e3);
+    understandingSpinner.stop(`Analysis complete (${totalTime}s)`);
+  } catch (error) {
+    understandingSpinner.stop("Analysis failed");
+    p3.log.error(String(error));
+    process.exit(1);
+  }
+  if (!options.skipQuestions) {
+    p3.log.message(chalk.bold("\nHere's what I understand about your codebase:\n"));
+    p3.log.message(`  ${chalk.cyan("Type:")} ${understanding.summary.type}`);
+    p3.log.message(`  ${chalk.cyan("Framework:")} ${understanding.summary.framework || "None detected"}`);
+    p3.log.message(`  ${chalk.cyan("Language:")} ${understanding.summary.language}`);
+    p3.log.message(`  ${chalk.cyan("Files:")} ${understanding.structure.totalFiles}`);
+    p3.log.message(`  ${chalk.cyan("Lines:")} ${understanding.structure.totalLines.toLocaleString()}`);
+    p3.log.message(`
+  ${chalk.dim(understanding.summary.description)}
+`);
+    if (understanding.features.length > 0) {
+      p3.log.message(chalk.bold("Detected features:"));
+      for (const feature of understanding.features.slice(0, 5)) {
+        p3.log.message(`  ${chalk.yellow("\u25CF")} ${feature.name} - ${chalk.dim(feature.description)}`);
+      }
+      if (understanding.features.length > 5) {
+        p3.log.message(`  ${chalk.dim(`...and ${understanding.features.length - 5} more`)}`);
+      }
+      console.log();
+    }
+    const isAccurate = await p3.confirm({
+      message: "Is this understanding accurate?",
+      initialValue: true
+    });
+    if (p3.isCancel(isAccurate)) {
+      p3.cancel("Initialization cancelled.");
+      process.exit(0);
+    }
+    if (!isAccurate) {
+      p3.log.info("You can edit .whiterose/intent.md after initialization to correct the understanding.");
+    }
+    const priorities = {};
+    for (const feature of understanding.features.filter((f) => f.priority === "critical").slice(0, 3)) {
+      const priority = await p3.select({
+        message: `I detected ${chalk.bold(feature.name)}. How should I prioritize bugs here?`,
+        options: [
+          { value: "critical", label: "Critical", hint: "highest priority" },
+          { value: "high", label: "High" },
+          { value: "medium", label: "Medium" },
+          { value: "low", label: "Low" },
+          { value: "ignore", label: "Ignore", hint: "skip this area" }
+        ],
+        initialValue: "critical"
+      });
+      if (p3.isCancel(priority)) {
+        p3.cancel("Initialization cancelled.");
+        process.exit(0);
+      }
+      for (const file of feature.relatedFiles) {
+        priorities[file] = priority;
+      }
+    }
+    const areasOfConcern = await p3.text({
+      message: "Any specific files or directories you want me to focus on? (comma-separated, or leave empty)",
+      placeholder: "src/api/checkout.ts, src/hooks/useAuth.ts"
+    });
+    if (!p3.isCancel(areasOfConcern) && areasOfConcern) {
+      for (const area of areasOfConcern.split(",").map((s) => s.trim())) {
+        priorities[area] = "critical";
+      }
+    }
+    understanding._userPriorities = priorities;
+  }
+  const writeSpinner = p3.spinner();
+  writeSpinner.start("Creating configuration...");
+  try {
+    mkdirSync(join(whiterosePath, "cache"), { recursive: true });
+    mkdirSync(join(whiterosePath, "reports"), { recursive: true });
+    const config = {
+      version: "1",
+      provider: selectedProvider,
+      include: ["**/*.ts", "**/*.tsx", "**/*.js", "**/*.jsx"],
+      exclude: ["node_modules", "dist", "build", ".next", "coverage", "**/*.test.*", "**/*.spec.*"],
+      priorities: understanding._userPriorities || {},
+      categories: ["logic-error", "security", "async-race-condition", "edge-case", "null-reference"],
+      minConfidence: "low",
+      staticAnalysis: {
+        typescript: true,
+        eslint: true
+      },
+      output: {
+        sarif: true,
+        markdown: true,
+        sarifPath: ".whiterose/reports",
+        markdownPath: "BUGS.md"
+      }
+    };
+    writeFileSync(join(whiterosePath, "config.yml"), YAML.stringify(config), "utf-8");
+    writeFileSync(
+      join(whiterosePath, "cache", "understanding.json"),
+      JSON.stringify(understanding, null, 2),
+      "utf-8"
+    );
+    const intentDoc = generateIntentDocument(understanding);
+    writeFileSync(join(whiterosePath, "intent.md"), intentDoc, "utf-8");
+    writeFileSync(
+      join(whiterosePath, "cache", "file-hashes.json"),
+      JSON.stringify({ version: "1", fileHashes: [], lastFullScan: null }, null, 2),
+      "utf-8"
+    );
+    const gitignorePath = join(cwd, ".gitignore");
+    if (existsSync(gitignorePath)) {
+      const gitignore = await import('fs').then((fs) => fs.readFileSync(gitignorePath, "utf-8"));
+      if (!gitignore.includes(".whiterose/cache")) {
+        writeFileSync(gitignorePath, gitignore + "\n# whiterose cache\n.whiterose/cache/\n", "utf-8");
+      }
+    }
+    writeSpinner.stop("Configuration created");
+  } catch (error) {
+    writeSpinner.stop("Failed to create configuration");
+    p3.log.error(String(error));
+    process.exit(1);
+  }
+  p3.outro(chalk.green("whiterose initialized successfully!"));
+  console.log();
+  console.log(chalk.dim("  Next steps:"));
+  console.log(chalk.dim("  1. Review .whiterose/intent.md and edit if needed"));
+  console.log(chalk.dim("  2. Run ") + chalk.cyan("whiterose scan") + chalk.dim(" to find bugs"));
+  console.log(chalk.dim("  3. Run ") + chalk.cyan("whiterose fix") + chalk.dim(" to fix them interactively"));
+  console.log();
+}
+async function loadConfig(cwd) {
+  const configPath = join(cwd, ".whiterose", "config.yml");
+  if (!existsSync(configPath)) {
+    throw new Error('Config file not found. Run "whiterose init" first.');
+  }
+  const content = readFileSync(configPath, "utf-8");
+  const parsed = YAML.parse(content);
+  return WhiteroseConfig.parse(parsed);
+}
+async function loadUnderstanding(cwd) {
+  const understandingPath = join(cwd, ".whiterose", "cache", "understanding.json");
+  if (!existsSync(understandingPath)) {
+    return null;
+  }
+  const content = readFileSync(understandingPath, "utf-8");
+  return JSON.parse(content);
+}
+async function runStaticAnalysis(cwd, files, config) {
+  const results = [];
+  if (config.staticAnalysis.typescript) {
+    const tscResults = await runTypeScript(cwd);
+    results.push(...tscResults);
+  }
+  if (config.staticAnalysis.eslint) {
+    const eslintResults = await runEslint(cwd, files);
+    results.push(...eslintResults);
+  }
+  return results;
+}
+async function runTypeScript(cwd) {
+  const results = [];
+  const tsconfigPath = join(cwd, "tsconfig.json");
+  if (!existsSync(tsconfigPath)) {
+    return results;
+  }
+  try {
+    await execa("npx", ["tsc", "--noEmit", "--pretty", "false"], {
+      cwd,
+      timeout: 6e4
+    });
+  } catch (error) {
+    const output = error.stdout || "";
+    const lines = output.split("\n");
+    for (const line of lines) {
+      const match = line.match(/^(.+)\((\d+),(\d+)\):\s+(error|warning)\s+TS\d+:\s+(.+)$/);
+      if (match) {
+        results.push({
+          tool: "typescript",
+          file: match[1],
+          line: parseInt(match[2], 10),
+          message: match[5],
+          severity: match[4] === "error" ? "error" : "warning",
+          code: `TS${match[4]}`
+        });
+      }
+    }
+  }
+  return results;
+}
+async function runEslint(cwd, files) {
+  const results = [];
+  const hasEslint = existsSync(join(cwd, ".eslintrc")) || existsSync(join(cwd, ".eslintrc.js")) || existsSync(join(cwd, ".eslintrc.json")) || existsSync(join(cwd, ".eslintrc.yml")) || existsSync(join(cwd, "eslint.config.js")) || existsSync(join(cwd, "eslint.config.mjs"));
+  if (!hasEslint) {
+    return results;
+  }
+  try {
+    const { stdout } = await execa(
+      "npx",
+      ["eslint", "--format", "json", "--no-error-on-unmatched-pattern", ...files.slice(0, 50)],
+      {
+        cwd,
+        timeout: 6e4,
+        reject: false
+      }
+    );
+    const eslintResults = JSON.parse(stdout || "[]");
+    for (const fileResult of eslintResults) {
+      for (const message of fileResult.messages || []) {
+        results.push({
+          tool: "eslint",
+          file: fileResult.filePath,
+          line: message.line || 0,
+          message: message.message,
+          severity: message.severity === 2 ? "error" : "warning",
+          code: message.ruleId
+        });
+      }
+    }
+  } catch {
+  }
+  return results;
+}
+
+// src/output/sarif.ts
+function outputSarif(result) {
+  const rules = [];
+  const results = [];
+  const seenRules = /* @__PURE__ */ new Set();
+  for (const bug of result.bugs) {
+    if (!seenRules.has(bug.category)) {
+      seenRules.add(bug.category);
+      rules.push({
+        id: bug.category,
+        name: formatRuleName(bug.category),
+        shortDescription: { text: getCategoryDescription(bug.category) },
+        fullDescription: { text: getCategoryDescription(bug.category) },
+        defaultConfiguration: { level: "warning" },
+        properties: { category: bug.category }
+      });
+    }
+    results.push(bugToSarifResult(bug));
+  }
+  return {
+    $schema: "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
+    version: "2.1.0",
+    runs: [
+      {
+        tool: {
+          driver: {
+            name: "whiterose",
+            version: "0.1.0",
+            informationUri: "https://github.com/shakecodeslikecray/whiterose",
+            rules
+          }
+        },
+        results
+      }
+    ]
+  };
+}
+function bugToSarifResult(bug) {
+  const result = {
+    ruleId: bug.id,
+    level: severityToLevel(bug.severity),
+    message: {
+      text: bug.title,
+      markdown: `**${bug.title}**
+
+${bug.description}
+
+**Evidence:**
+${bug.evidence.map((e) => `- ${e}`).join("\n")}`
+    },
+    locations: [
+      {
+        physicalLocation: {
+          artifactLocation: { uri: bug.file },
+          region: { startLine: bug.line, endLine: bug.endLine }
+        }
+      }
+    ]
+  };
+  if (bug.codePath.length > 0) {
+    result.codeFlows = [
+      {
+        threadFlows: [
+          {
+            locations: bug.codePath.map((step) => ({
+              location: {
+                physicalLocation: {
+                  artifactLocation: { uri: step.file },
+                  region: { startLine: step.line }
+                }
+              },
+              message: { text: step.explanation }
+            }))
+          }
+        ]
+      }
+    ];
+  }
+  return result;
+}
+function severityToLevel(severity) {
+  switch (severity) {
+    case "critical":
+      return "error";
+    case "high":
+      return "error";
+    case "medium":
+      return "warning";
+    case "low":
+      return "note";
+    default:
+      return "warning";
+  }
+}
+function formatRuleName(category) {
+  return category.split("-").map((word) => word.charAt(0).toUpperCase() + word.slice(1)).join(" ");
+}
+function getCategoryDescription(category) {
+  const descriptions = {
+    "logic-error": "Logic errors such as off-by-one, wrong operators, or incorrect conditions",
+    security: "Security vulnerabilities including injection, auth bypass, and data exposure",
+    "async-race-condition": "Async/concurrency issues like race conditions and missing awaits",
+    "edge-case": "Edge cases that are not properly handled",
+    "null-reference": "Potential null or undefined reference issues",
+    "type-coercion": "Type coercion bugs that may cause unexpected behavior",
+    "resource-leak": "Resource leaks such as unclosed handles or connections",
+    "intent-violation": "Violations of documented behavioral contracts or business rules"
+  };
+  return descriptions[category] || "Unknown bug category";
+}
+
+// src/output/markdown.ts
+function outputMarkdown(result) {
+  const lines = [];
+  lines.push("# Bug Report");
+  lines.push("");
+  lines.push(`> Generated by [whiterose](https://github.com/shakecodeslikecray/whiterose) on ${(/* @__PURE__ */ new Date()).toISOString()}`);
+  lines.push("");
+  lines.push("## Summary");
+  lines.push("");
+  lines.push(`| Severity | Count |`);
+  lines.push(`|----------|-------|`);
+  lines.push(`| Critical | ${result.summary.critical} |`);
+  lines.push(`| High | ${result.summary.high} |`);
+  lines.push(`| Medium | ${result.summary.medium} |`);
+  lines.push(`| Low | ${result.summary.low} |`);
+  lines.push(`| **Total** | **${result.summary.total}** |`);
+  lines.push("");
+  lines.push(`- **Scan Type:** ${result.scanType}`);
+  lines.push(`- **Files Scanned:** ${result.filesScanned}`);
+  if (result.filesChanged !== void 0) {
+    lines.push(`- **Files Changed:** ${result.filesChanged}`);
+  }
+  lines.push("");
+  if (result.bugs.length === 0) {
+    lines.push("No bugs found.");
+    return lines.join("\n");
+  }
+  const bySeverity = {
+    critical: [],
+    high: [],
+    medium: [],
+    low: []
+  };
+  for (const bug of result.bugs) {
+    bySeverity[bug.severity].push(bug);
+  }
+  if (bySeverity.critical.length > 0) {
+    lines.push("## Critical");
+    lines.push("");
+    for (const bug of bySeverity.critical) {
+      lines.push(formatBug(bug));
+    }
+  }
+  if (bySeverity.high.length > 0) {
+    lines.push("## High");
+    lines.push("");
+    for (const bug of bySeverity.high) {
+      lines.push(formatBug(bug));
+    }
+  }
+  if (bySeverity.medium.length > 0) {
+    lines.push("## Medium");
+    lines.push("");
+    for (const bug of bySeverity.medium) {
+      lines.push(formatBug(bug));
+    }
+  }
+  if (bySeverity.low.length > 0) {
+    lines.push("## Low");
+    lines.push("");
+    for (const bug of bySeverity.low) {
+      lines.push(formatBug(bug));
+    }
+  }
+  return lines.join("\n");
+}
+function formatBug(bug) {
+  const lines = [];
+  const confidenceBadge = getConfidenceBadge(bug.confidence.overall);
+  lines.push(`### ${bug.id}: ${bug.title} ${confidenceBadge}`);
+  lines.push("");
+  lines.push(`**Location:** \`${bug.file}:${bug.line}\``);
+  lines.push(`**Category:** ${formatCategory(bug.category)}`);
+  lines.push("");
+  lines.push(bug.description);
+  lines.push("");
+  if (bug.codePath.length > 0) {
+    lines.push("<details>");
+    lines.push("<summary>Code Path</summary>");
+    lines.push("");
+    for (const step of bug.codePath) {
+      lines.push(`${step.step}. \`${step.file}:${step.line}\``);
+      lines.push(`   \`\`\`${getLanguage(step.file)}`);
+      lines.push(`   ${step.code}`);
+      lines.push("   ```");
+      lines.push(`   ${step.explanation}`);
+      lines.push("");
+    }
+    lines.push("</details>");
+    lines.push("");
+  }
+  if (bug.evidence.length > 0) {
+    lines.push("**Evidence:**");
+    for (const e of bug.evidence) {
+      lines.push(`- ${e}`);
+    }
+    lines.push("");
+  }
+  if (bug.suggestedFix) {
+    lines.push("**Suggested Fix:**");
+    lines.push("```");
+    lines.push(bug.suggestedFix);
+    lines.push("```");
+    lines.push("");
+  }
+  lines.push("---");
+  lines.push("");
+  return lines.join("\n");
+}
+function getConfidenceBadge(confidence) {
+  switch (confidence) {
+    case "high":
+      return "`[HIGH CONFIDENCE]`";
+    case "medium":
+      return "`[MEDIUM CONFIDENCE]`";
+    case "low":
+      return "`[LOW CONFIDENCE]`";
+    default:
+      return "";
+  }
+}
+function formatCategory(category) {
+  return category.split("-").map((word) => word.charAt(0).toUpperCase() + word.slice(1)).join(" ");
+}
+function getLanguage(file) {
+  if (file.endsWith(".ts") || file.endsWith(".tsx")) return "typescript";
+  if (file.endsWith(".js") || file.endsWith(".jsx")) return "javascript";
+  if (file.endsWith(".py")) return "python";
+  if (file.endsWith(".go")) return "go";
+  return "";
+}
+
+// src/cli/commands/scan.ts
+async function scanCommand(paths, options) {
+  const cwd = process.cwd();
+  const whiterosePath = join(cwd, ".whiterose");
+  if (!existsSync(whiterosePath)) {
+    if (!options.json && !options.sarif) {
+      p3.log.error("whiterose is not initialized in this directory.");
+      p3.log.info('Run "whiterose init" first.');
+    } else {
+      console.error(JSON.stringify({ error: "Not initialized. Run whiterose init first." }));
+    }
+    process.exit(1);
+  }
+  const isQuiet = options.json || options.sarif;
+  if (!isQuiet) {
+    p3.intro(chalk.red("whiterose") + chalk.dim(" - scanning for bugs"));
+  }
+  let config;
+  try {
+    config = await loadConfig(cwd);
+  } catch (error) {
+    if (!isQuiet) p3.log.error(`Failed to load config: ${error}`);
+    process.exit(1);
+  }
+  const understanding = await loadUnderstanding(cwd);
+  if (!understanding) {
+    if (!isQuiet) {
+      p3.log.error('No codebase understanding found. Run "whiterose refresh" to regenerate.');
+    }
+    process.exit(1);
+  }
+  let filesToScan;
+  let scanType;
+  if (options.full || paths.length > 0) {
+    scanType = "full";
+    if (!isQuiet) {
+      const spinner5 = p3.spinner();
+      spinner5.start("Scanning files...");
+      filesToScan = paths.length > 0 ? paths : await scanCodebase(cwd, config);
+      spinner5.stop(`Found ${filesToScan.length} files to scan`);
+    } else {
+      filesToScan = paths.length > 0 ? paths : await scanCodebase(cwd, config);
+    }
+  } else {
+    scanType = "incremental";
+    const changed = await getChangedFiles(cwd, config);
+    filesToScan = changed.files;
+    if (filesToScan.length === 0) {
+      if (!isQuiet) {
+        p3.log.info("No files changed since last scan. Use --full for a complete scan.");
+      } else {
+        console.log(JSON.stringify({ bugs: [], message: "No changes detected" }));
+      }
+      process.exit(0);
+    }
+    if (!isQuiet) {
+      p3.log.info(`Incremental scan: ${filesToScan.length} changed files`);
+    }
+  }
+  let staticResults;
+  if (!isQuiet) {
+    const staticSpinner = p3.spinner();
+    staticSpinner.start("Running static analysis (tsc, eslint)...");
+    staticResults = await runStaticAnalysis(cwd, filesToScan, config);
+    staticSpinner.stop(`Static analysis: ${staticResults.length} signals found`);
+  } else {
+    staticResults = await runStaticAnalysis(cwd, filesToScan, config);
+  }
+  const providerName = options.provider || config.provider;
+  const provider = await getProvider(providerName);
+  if (options.unsafe) {
+    if ("setUnsafeMode" in provider) {
+      provider.setUnsafeMode(true);
+      if (!isQuiet) {
+        p3.log.warn("Running in unsafe mode (--unsafe). LLM permission prompts are bypassed.");
+      }
+    }
+  }
+  let bugs;
+  if (!isQuiet) {
+    const llmSpinner = p3.spinner();
+    const analysisStartTime = Date.now();
+    llmSpinner.start(`Analyzing with ${providerName}... (this may take 1-2 minutes)`);
+    const analysisTimeInterval = setInterval(() => {
+      const elapsed = Math.floor((Date.now() - analysisStartTime) / 1e3);
+      const minutes = Math.floor(elapsed / 60);
+      const seconds = elapsed % 60;
+      const timeStr = minutes > 0 ? `${minutes}m ${seconds}s` : `${seconds}s`;
+      llmSpinner.message(`Analyzing with ${providerName}... (${timeStr} elapsed)`);
+    }, 5e3);
+    try {
+      bugs = await provider.analyze({
+        files: filesToScan,
+        understanding,
+        config,
+        staticAnalysisResults: staticResults
+      });
+      clearInterval(analysisTimeInterval);
+      const totalTime = Math.floor((Date.now() - analysisStartTime) / 1e3);
+      llmSpinner.stop(`Found ${bugs.length} potential bugs (${totalTime}s)`);
+    } catch (error) {
+      clearInterval(analysisTimeInterval);
+      llmSpinner.stop("Analysis failed");
+      p3.log.error(String(error));
+      process.exit(1);
+    }
+  } else {
+    bugs = await provider.analyze({
+      files: filesToScan,
+      understanding,
+      config,
+      staticAnalysisResults: staticResults
+    });
+  }
+  if (options.adversarial && bugs.length > 0) {
+    if (!isQuiet) {
+      const advSpinner = p3.spinner();
+      advSpinner.start("Running adversarial validation...");
+      const validatedBugs = [];
+      for (const bug of bugs) {
+        const result2 = await provider.adversarialValidate(bug, {
+          files: filesToScan,
+          understanding,
+          config,
+          staticAnalysisResults: staticResults
+        });
+        if (result2.survived) {
+          validatedBugs.push({
+            ...bug,
+            confidence: result2.adjustedConfidence || bug.confidence
+          });
+        }
+      }
+      const filtered = bugs.length - validatedBugs.length;
+      advSpinner.stop(`Adversarial validation: ${filtered} false positives filtered`);
+      bugs = validatedBugs;
+    } else {
+      const validatedBugs = [];
+      for (const bug of bugs) {
+        const result2 = await provider.adversarialValidate(bug, {
+          files: filesToScan,
+          understanding,
+          config,
+          staticAnalysisResults: staticResults
+        });
+        if (result2.survived) {
+          validatedBugs.push({
+            ...bug,
+            confidence: result2.adjustedConfidence || bug.confidence
+          });
+        }
+      }
+      bugs = validatedBugs;
+    }
+  }
+  const minConfidence = options.minConfidence;
+  const confidenceOrder = { high: 3, medium: 2, low: 1 };
+  bugs = bugs.filter((bug) => confidenceOrder[bug.confidence.overall] >= confidenceOrder[minConfidence]);
+  if (options.category && options.category.length > 0) {
+    bugs = bugs.filter((bug) => options.category.includes(bug.category));
+  }
+  bugs = bugs.map((bug, index) => ({
+    ...bug,
+    id: bug.id || generateBugId(index)
+  }));
+  const result = {
+    id: `scan-${Date.now()}`,
+    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+    scanType,
+    filesScanned: filesToScan.length,
+    filesChanged: scanType === "incremental" ? filesToScan.length : void 0,
+    duration: 0,
+    // TODO: track actual duration
+    bugs,
+    summary: {
+      critical: bugs.filter((b) => b.severity === "critical").length,
+      high: bugs.filter((b) => b.severity === "high").length,
+      medium: bugs.filter((b) => b.severity === "medium").length,
+      low: bugs.filter((b) => b.severity === "low").length,
+      total: bugs.length
+    }
+  };
+  if (options.json) {
+    console.log(JSON.stringify(result, null, 2));
+  } else if (options.sarif) {
+    console.log(JSON.stringify(outputSarif(result), null, 2));
+  } else {
+    if (config.output.sarif) {
+      const sarifPath = join(whiterosePath, "reports", `${(/* @__PURE__ */ new Date()).toISOString().split("T")[0]}.sarif`);
+      writeFileSync(sarifPath, JSON.stringify(outputSarif(result), null, 2));
+    }
+    if (config.output.markdown) {
+      const markdown = outputMarkdown(result);
+      writeFileSync(join(cwd, config.output.markdownPath), markdown);
+    }
+    console.log();
+    p3.log.message(chalk.bold("Scan Results"));
+    console.log();
+    console.log(`  ${chalk.red("\u25CF")} Critical: ${result.summary.critical}`);
+    console.log(`  ${chalk.yellow("\u25CF")} High: ${result.summary.high}`);
+    console.log(`  ${chalk.blue("\u25CF")} Medium: ${result.summary.medium}`);
+    console.log(`  ${chalk.dim("\u25CF")} Low: ${result.summary.low}`);
+    console.log();
+    console.log(`  ${chalk.bold("Total:")} ${result.summary.total} bugs found`);
+    console.log();
+    if (result.summary.total > 0) {
+      p3.log.info(`Run ${chalk.cyan("whiterose fix")} to fix bugs interactively.`);
+    }
+    p3.outro(chalk.green("Scan complete"));
+  }
+}
+var Dashboard = ({ bugs, onSelectCategory }) => {
+  const [selectedIndex, setSelectedIndex] = useState(0);
+  const summary = {
+    critical: bugs.filter((b) => b.severity === "critical").length,
+    high: bugs.filter((b) => b.severity === "high").length,
+    medium: bugs.filter((b) => b.severity === "medium").length,
+    low: bugs.filter((b) => b.severity === "low").length
+  };
+  const byCategory = {};
+  for (const bug of bugs) {
+    byCategory[bug.category] = (byCategory[bug.category] || 0) + 1;
+  }
+  const menuItems = [
+    { key: "all", label: "All Bugs", count: bugs.length, color: "white" },
+    { key: "critical", label: "Critical", count: summary.critical, color: "red" },
+    { key: "high", label: "High", count: summary.high, color: "yellow" },
+    { key: "medium", label: "Medium", count: summary.medium, color: "blue" },
+    { key: "low", label: "Low", count: summary.low, color: "gray" }
+  ];
+  const categoryColors = {
+    "logic-error": "magenta",
+    security: "red",
+    "async-race-condition": "cyan",
+    "edge-case": "yellow",
+    "null-reference": "blue",
+    "type-coercion": "green",
+    "resource-leak": "yellow",
+    "intent-violation": "magenta"
+  };
+  for (const [category, count] of Object.entries(byCategory)) {
+    menuItems.push({
+      key: category,
+      label: formatCategory2(category),
+      count,
+      color: categoryColors[category] || "white"
+    });
+  }
+  useInput((input, key) => {
+    if (key.upArrow) {
+      setSelectedIndex((i) => Math.max(0, i - 1));
+    } else if (key.downArrow) {
+      setSelectedIndex((i) => Math.min(menuItems.length - 1, i + 1));
+    } else if (key.return) {
+      const item = menuItems[selectedIndex];
+      if (item.key === "all") {
+        onSelectCategory(null);
+      } else {
+        onSelectCategory(item.key);
+      }
+    }
+  });
+  if (bugs.length === 0) {
+    return /* @__PURE__ */ jsxs(Box, { flexDirection: "column", padding: 1, children: [
+      /* @__PURE__ */ jsx(Text, { color: "green", bold: true, children: "\u2713 No bugs found!" }),
+      /* @__PURE__ */ jsx(Text, { color: "gray", children: "Your codebase looks clean." })
+    ] });
+  }
+  return /* @__PURE__ */ jsxs(Box, { flexDirection: "column", children: [
+    /* @__PURE__ */ jsxs(Box, { marginBottom: 1, flexDirection: "column", children: [
+      /* @__PURE__ */ jsx(Text, { bold: true, underline: true, children: "Summary" }),
+      /* @__PURE__ */ jsxs(Box, { marginTop: 1, children: [
+        /* @__PURE__ */ jsx(Box, { marginRight: 3, children: /* @__PURE__ */ jsxs(Text, { color: "red", children: [
+          "\u25CF Critical: ",
+          summary.critical
+        ] }) }),
+        /* @__PURE__ */ jsx(Box, { marginRight: 3, children: /* @__PURE__ */ jsxs(Text, { color: "yellow", children: [
+          "\u25CF High: ",
+          summary.high
+        ] }) }),
+        /* @__PURE__ */ jsx(Box, { marginRight: 3, children: /* @__PURE__ */ jsxs(Text, { color: "blue", children: [
+          "\u25CF Medium: ",
+          summary.medium
+        ] }) }),
+        /* @__PURE__ */ jsx(Box, { children: /* @__PURE__ */ jsxs(Text, { color: "gray", children: [
+          "\u25CF Low: ",
+          summary.low
+        ] }) })
+      ] })
+    ] }),
+    /* @__PURE__ */ jsxs(Box, { flexDirection: "column", marginTop: 1, children: [
+      /* @__PURE__ */ jsx(Text, { bold: true, underline: true, children: "Filter by" }),
+      /* @__PURE__ */ jsx(Box, { flexDirection: "column", marginTop: 1, children: menuItems.map((item, index) => /* @__PURE__ */ jsxs(Box, { children: [
+        /* @__PURE__ */ jsx(Text, { color: index === selectedIndex ? "cyan" : "white", children: index === selectedIndex ? "\u25B6 " : "  " }),
+        /* @__PURE__ */ jsx(Text, { color: item.color, children: item.label }),
+        /* @__PURE__ */ jsxs(Text, { color: "gray", children: [
+          " (",
+          item.count,
+          ")"
+        ] })
+      ] }, item.key)) })
+    ] }),
+    /* @__PURE__ */ jsx(Box, { marginTop: 2, children: /* @__PURE__ */ jsx(Text, { color: "gray", children: "[\u2191\u2193] Navigate  [Enter] Select  [q] Quit" }) })
+  ] });
+};
+function formatCategory2(category) {
+  return category.split("-").map((word) => word.charAt(0).toUpperCase() + word.slice(1)).join(" ");
+}
+var VISIBLE_ITEMS = 10;
+var BugList = ({ bugs, selectedIndex, onSelect, onBack }) => {
+  const [localIndex, setLocalIndex] = useState(selectedIndex);
+  const [scrollOffset, setScrollOffset] = useState(0);
+  useEffect(() => {
+    setLocalIndex(selectedIndex);
+  }, [selectedIndex]);
+  useEffect(() => {
+    if (localIndex < scrollOffset) {
+      setScrollOffset(localIndex);
+    } else if (localIndex >= scrollOffset + VISIBLE_ITEMS) {
+      setScrollOffset(localIndex - VISIBLE_ITEMS + 1);
+    }
+  }, [localIndex, scrollOffset]);
+  useInput((input, key) => {
+    if (key.upArrow) {
+      setLocalIndex((i) => Math.max(0, i - 1));
+    } else if (key.downArrow) {
+      setLocalIndex((i) => Math.min(bugs.length - 1, i + 1));
+    } else if (key.return) {
+      onSelect(localIndex);
+    } else if (input === "b" || key.escape) {
+      onBack();
+    } else if (key.pageUp) {
+      setLocalIndex((i) => Math.max(0, i - VISIBLE_ITEMS));
+    } else if (key.pageDown) {
+      setLocalIndex((i) => Math.min(bugs.length - 1, i + VISIBLE_ITEMS));
+    }
+  });
+  if (bugs.length === 0) {
+    return /* @__PURE__ */ jsxs(Box, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsx(Text, { color: "gray", children: "No bugs in this category." }),
+      /* @__PURE__ */ jsx(Text, { color: "gray", children: "[b] Back to dashboard" })
+    ] });
+  }
+  const visibleBugs = bugs.slice(scrollOffset, scrollOffset + VISIBLE_ITEMS);
+  return /* @__PURE__ */ jsxs(Box, { flexDirection: "column", children: [
+    /* @__PURE__ */ jsxs(Box, { marginBottom: 1, children: [
+      /* @__PURE__ */ jsx(Box, { width: 8, children: /* @__PURE__ */ jsx(Text, { bold: true, color: "gray", children: "ID" }) }),
+      /* @__PURE__ */ jsx(Box, { width: 10, children: /* @__PURE__ */ jsx(Text, { bold: true, color: "gray", children: "Severity" }) }),
+      /* @__PURE__ */ jsx(Box, { width: 10, children: /* @__PURE__ */ jsx(Text, { bold: true, color: "gray", children: "Confidence" }) }),
+      /* @__PURE__ */ jsx(Box, { flexGrow: 1, children: /* @__PURE__ */ jsx(Text, { bold: true, color: "gray", children: "Title" }) })
+    ] }),
+    visibleBugs.map((bug, index) => {
+      const actualIndex = scrollOffset + index;
+      const isSelected = actualIndex === localIndex;
+      return /* @__PURE__ */ jsxs(Box, { children: [
+        /* @__PURE__ */ jsx(Text, { color: isSelected ? "cyan" : "white", children: isSelected ? "\u25B6 " : "  " }),
+        /* @__PURE__ */ jsx(Box, { width: 6, children: /* @__PURE__ */ jsx(Text, { color: "gray", children: bug.id }) }),
+        /* @__PURE__ */ jsx(Box, { width: 10, children: /* @__PURE__ */ jsx(Text, { color: getSeverityColor(bug.severity), children: bug.severity.toUpperCase().padEnd(8) }) }),
+        /* @__PURE__ */ jsx(Box, { width: 10, children: /* @__PURE__ */ jsx(Text, { color: getConfidenceColor(bug.confidence.overall), children: bug.confidence.overall.toUpperCase().padEnd(8) }) }),
+        /* @__PURE__ */ jsx(Box, { flexGrow: 1, children: /* @__PURE__ */ jsx(Text, { color: isSelected ? "white" : "gray", children: truncate(bug.title, 50) }) })
+      ] }, bug.id);
+    }),
+    bugs.length > VISIBLE_ITEMS && /* @__PURE__ */ jsx(Box, { marginTop: 1, children: /* @__PURE__ */ jsxs(Text, { color: "gray", children: [
+      "Showing ",
+      scrollOffset + 1,
+      "-",
+      Math.min(scrollOffset + VISIBLE_ITEMS, bugs.length),
+      " of ",
+      bugs.length,
+      scrollOffset > 0 && " [\u2191 more above]",
+      scrollOffset + VISIBLE_ITEMS < bugs.length && " [\u2193 more below]"
+    ] }) }),
+    /* @__PURE__ */ jsx(Box, { marginTop: 1, children: /* @__PURE__ */ jsx(Text, { color: "gray", children: "[\u2191\u2193] Navigate  [Enter] View details  [PgUp/PgDn] Page  [b] Back" }) })
+  ] });
+};
+function getSeverityColor(severity) {
+  switch (severity) {
+    case "critical":
+      return "red";
+    case "high":
+      return "yellow";
+    case "medium":
+      return "blue";
+    case "low":
+      return "gray";
+    default:
+      return "white";
+  }
+}
+function getConfidenceColor(confidence) {
+  switch (confidence) {
+    case "high":
+      return "green";
+    case "medium":
+      return "yellow";
+    case "low":
+      return "red";
+    default:
+      return "white";
+  }
+}
+function truncate(str, maxLen) {
+  if (str.length <= maxLen) return str;
+  return str.slice(0, maxLen - 3) + "...";
+}
+var BugDetail = ({
+  bug,
+  index,
+  total,
+  onFix,
+  onNext,
+  onPrev,
+  onBack
+}) => {
+  const [activeTab, setActiveTab] = useState("overview");
+  useInput((input, key) => {
+    if (input === "f") {
+      onFix();
+    } else if (input === "n" || key.rightArrow) {
+      onNext();
+    } else if (input === "p" || key.leftArrow) {
+      onPrev();
+    } else if (input === "b" || key.escape) {
+      onBack();
+    } else if (input === "1") {
+      setActiveTab("overview");
+    } else if (input === "2") {
+      setActiveTab("codepath");
+    } else if (input === "3") {
+      setActiveTab("evidence");
+    } else if (input === "4") {
+      setActiveTab("fix");
+    } else if (key.tab) {
+      const tabs = ["overview", "codepath", "evidence", "fix"];
+      const currentIndex = tabs.indexOf(activeTab);
+      setActiveTab(tabs[(currentIndex + 1) % tabs.length]);
+    }
+  });
+  return /* @__PURE__ */ jsxs(Box, { flexDirection: "column", children: [
+    /* @__PURE__ */ jsxs(Box, { flexDirection: "column", marginBottom: 1, children: [
+      /* @__PURE__ */ jsxs(Box, { children: [
+        /* @__PURE__ */ jsxs(Text, { color: "gray", children: [
+          bug.id,
+          " "
+        ] }),
+        /* @__PURE__ */ jsxs(Text, { color: getSeverityColor2(bug.severity), bold: true, children: [
+          "[",
+          bug.severity.toUpperCase(),
+          "]"
+        ] }),
+        /* @__PURE__ */ jsx(Text, { children: " " }),
+        /* @__PURE__ */ jsx(Text, { bold: true, children: bug.title })
+      ] }),
+      /* @__PURE__ */ jsxs(Box, { marginTop: 1, children: [
+        /* @__PURE__ */ jsx(Text, { color: "gray", children: "File: " }),
+        /* @__PURE__ */ jsx(Text, { color: "cyan", children: bug.file }),
+        /* @__PURE__ */ jsx(Text, { color: "gray", children: ":" }),
+        /* @__PURE__ */ jsx(Text, { color: "yellow", children: bug.line }),
+        bug.endLine && /* @__PURE__ */ jsxs(Fragment, { children: [
+          /* @__PURE__ */ jsx(Text, { color: "gray", children: "-" }),
+          /* @__PURE__ */ jsx(Text, { color: "yellow", children: bug.endLine })
+        ] })
+      ] }),
+      /* @__PURE__ */ jsxs(Box, { children: [
+        /* @__PURE__ */ jsx(Text, { color: "gray", children: "Category: " }),
+        /* @__PURE__ */ jsx(Text, { children: formatCategory3(bug.category) }),
+        /* @__PURE__ */ jsx(Text, { color: "gray", children: " | Confidence: " }),
+        /* @__PURE__ */ jsx(Text, { color: getConfidenceColor2(bug.confidence.overall), children: bug.confidence.overall.toUpperCase() }),
+        bug.confidence.adversarialSurvived && /* @__PURE__ */ jsx(Text, { color: "green", children: " \u2713 Validated" })
+      ] })
+    ] }),
+    /* @__PURE__ */ jsxs(Box, { marginBottom: 1, children: [
+      /* @__PURE__ */ jsx(TabButton, { label: "1:Overview", active: activeTab === "overview" }),
+      /* @__PURE__ */ jsx(TabButton, { label: "2:Code Path", active: activeTab === "codepath" }),
+      /* @__PURE__ */ jsx(TabButton, { label: "3:Evidence", active: activeTab === "evidence" }),
+      /* @__PURE__ */ jsx(TabButton, { label: "4:Fix", active: activeTab === "fix" })
+    ] }),
+    /* @__PURE__ */ jsxs(
+      Box,
+      {
+        flexDirection: "column",
+        borderStyle: "single",
+        borderColor: "gray",
+        padding: 1,
+        minHeight: 10,
+        children: [
+          activeTab === "overview" && /* @__PURE__ */ jsxs(Box, { flexDirection: "column", children: [
+            /* @__PURE__ */ jsx(Text, { bold: true, children: "Description" }),
+            /* @__PURE__ */ jsx(Text, { wrap: "wrap", children: bug.description })
+          ] }),
+          activeTab === "codepath" && /* @__PURE__ */ jsxs(Box, { flexDirection: "column", children: [
+            /* @__PURE__ */ jsxs(Text, { bold: true, children: [
+              "Code Path (",
+              bug.codePath.length,
+              " steps)"
+            ] }),
+            bug.codePath.length === 0 ? /* @__PURE__ */ jsx(Text, { color: "gray", children: "No code path available" }) : bug.codePath.map((step, i) => /* @__PURE__ */ jsxs(Box, { flexDirection: "column", marginTop: i > 0 ? 1 : 0, children: [
+              /* @__PURE__ */ jsxs(Box, { children: [
+                /* @__PURE__ */ jsxs(Text, { color: "cyan", children: [
+                  step.step,
+                  ". "
+                ] }),
+                /* @__PURE__ */ jsxs(Text, { color: "yellow", children: [
+                  step.file,
+                  ":",
+                  step.line
+                ] })
+              ] }),
+              step.code && /* @__PURE__ */ jsx(Box, { marginLeft: 3, children: /* @__PURE__ */ jsx(Text, { color: "gray", children: step.code }) }),
+              /* @__PURE__ */ jsx(Box, { marginLeft: 3, children: /* @__PURE__ */ jsx(Text, { children: step.explanation }) })
+            ] }, i))
+          ] }),
+          activeTab === "evidence" && /* @__PURE__ */ jsxs(Box, { flexDirection: "column", children: [
+            /* @__PURE__ */ jsxs(Text, { bold: true, children: [
+              "Evidence (",
+              bug.evidence.length,
+              " items)"
+            ] }),
+            bug.evidence.length === 0 ? /* @__PURE__ */ jsx(Text, { color: "gray", children: "No evidence provided" }) : bug.evidence.map((e, i) => /* @__PURE__ */ jsxs(Box, { children: [
+              /* @__PURE__ */ jsx(Text, { color: "gray", children: "\u2022 " }),
+              /* @__PURE__ */ jsx(Text, { children: e })
+            ] }, i)),
+            /* @__PURE__ */ jsxs(Box, { flexDirection: "column", marginTop: 2, children: [
+              /* @__PURE__ */ jsx(Text, { bold: true, children: "Confidence Breakdown" }),
+              /* @__PURE__ */ jsxs(Box, { children: [
+                /* @__PURE__ */ jsx(Text, { color: "gray", children: "Code Path Validity: " }),
+                /* @__PURE__ */ jsxs(Text, { children: [
+                  (bug.confidence.codePathValidity * 100).toFixed(0),
+                  "%"
+                ] })
+              ] }),
+              /* @__PURE__ */ jsxs(Box, { children: [
+                /* @__PURE__ */ jsx(Text, { color: "gray", children: "Reachability: " }),
+                /* @__PURE__ */ jsxs(Text, { children: [
+                  (bug.confidence.reachability * 100).toFixed(0),
+                  "%"
+                ] })
+              ] }),
+              /* @__PURE__ */ jsxs(Box, { children: [
+                /* @__PURE__ */ jsx(Text, { color: "gray", children: "Intent Violation: " }),
+                /* @__PURE__ */ jsx(Text, { children: bug.confidence.intentViolation ? "Yes" : "No" })
+              ] }),
+              /* @__PURE__ */ jsxs(Box, { children: [
+                /* @__PURE__ */ jsx(Text, { color: "gray", children: "Static Tool Signal: " }),
+                /* @__PURE__ */ jsx(Text, { children: bug.confidence.staticToolSignal ? "Yes" : "No" })
+              ] }),
+              /* @__PURE__ */ jsxs(Box, { children: [
+                /* @__PURE__ */ jsx(Text, { color: "gray", children: "Adversarial Validated: " }),
+                /* @__PURE__ */ jsx(Text, { color: bug.confidence.adversarialSurvived ? "green" : "gray", children: bug.confidence.adversarialSurvived ? "Yes \u2713" : "No" })
+              ] })
+            ] })
+          ] }),
+          activeTab === "fix" && /* @__PURE__ */ jsxs(Box, { flexDirection: "column", children: [
+            /* @__PURE__ */ jsx(Text, { bold: true, children: "Suggested Fix" }),
+            bug.suggestedFix ? /* @__PURE__ */ jsx(Box, { marginTop: 1, flexDirection: "column", children: /* @__PURE__ */ jsx(Text, { color: "green", children: bug.suggestedFix }) }) : /* @__PURE__ */ jsx(Text, { color: "gray", children: "No suggested fix available. Press [f] to generate one." })
+          ] })
+        ]
+      }
+    ),
+    /* @__PURE__ */ jsxs(Box, { marginTop: 1, justifyContent: "space-between", children: [
+      /* @__PURE__ */ jsxs(Text, { color: "gray", children: [
+        "Bug ",
+        index + 1,
+        " of ",
+        total
+      ] }),
+      /* @__PURE__ */ jsx(Text, { color: "gray", children: "[\u2190/p] Prev  [\u2192/n] Next  [f] Fix  [Tab] Switch tab  [b] Back" })
+    ] })
+  ] });
+};
+var TabButton = ({ label, active }) => /* @__PURE__ */ jsx(Box, { marginRight: 2, children: /* @__PURE__ */ jsx(Text, { color: active ? "cyan" : "gray", bold: active, underline: active, children: label }) });
+function getSeverityColor2(severity) {
+  switch (severity) {
+    case "critical":
+      return "red";
+    case "high":
+      return "yellow";
+    case "medium":
+      return "blue";
+    case "low":
+      return "gray";
+    default:
+      return "white";
+  }
+}
+function getConfidenceColor2(confidence) {
+  switch (confidence) {
+    case "high":
+      return "green";
+    case "medium":
+      return "yellow";
+    case "low":
+      return "red";
+    default:
+      return "white";
+  }
+}
+function formatCategory3(category) {
+  return category.split("-").map((word) => word.charAt(0).toUpperCase() + word.slice(1)).join(" ");
+}
+var FixConfirm = ({ bug, dryRun, onConfirm, onCancel }) => {
+  const [status, setStatus] = useState("confirm");
+  const [error, setError] = useState(null);
+  useInput(async (input, key) => {
+    if (status !== "confirm") return;
+    if (input === "y" || key.return) {
+      setStatus("fixing");
+      try {
+        await onConfirm();
+        setStatus("done");
+        setTimeout(() => {
+          onCancel();
+        }, 1500);
+      } catch (e) {
+        setError(e.message || "Unknown error");
+        setStatus("error");
+      }
+    } else if (input === "n" || key.escape) {
+      onCancel();
+    }
+  });
+  return /* @__PURE__ */ jsxs(Box, { flexDirection: "column", children: [
+    /* @__PURE__ */ jsxs(Box, { flexDirection: "column", marginBottom: 1, children: [
+      /* @__PURE__ */ jsxs(Box, { children: [
+        /* @__PURE__ */ jsx(Text, { bold: true, children: "Fix: " }),
+        /* @__PURE__ */ jsx(Text, { children: bug.title })
+      ] }),
+      /* @__PURE__ */ jsxs(Box, { children: [
+        /* @__PURE__ */ jsx(Text, { color: "gray", children: "File: " }),
+        /* @__PURE__ */ jsxs(Text, { color: "cyan", children: [
+          bug.file,
+          ":",
+          bug.line
+        ] })
+      ] })
+    ] }),
+    /* @__PURE__ */ jsxs(
+      Box,
+      {
+        flexDirection: "column",
+        borderStyle: "single",
+        borderColor: "gray",
+        padding: 1,
+        marginBottom: 1,
+        children: [
+          /* @__PURE__ */ jsx(Text, { bold: true, children: "Proposed Fix:" }),
+          bug.suggestedFix ? /* @__PURE__ */ jsx(Box, { marginTop: 1, children: /* @__PURE__ */ jsx(Text, { color: "green", children: bug.suggestedFix }) }) : /* @__PURE__ */ jsx(Text, { color: "yellow", children: "No suggested fix available. Will ask AI to generate and apply a fix." })
+        ]
+      }
+    ),
+    status === "confirm" && /* @__PURE__ */ jsxs(Box, { flexDirection: "column", children: [
+      dryRun && /* @__PURE__ */ jsx(Box, { marginBottom: 1, children: /* @__PURE__ */ jsx(Text, { color: "yellow", children: "DRY RUN MODE - Changes will NOT be applied" }) }),
+      /* @__PURE__ */ jsxs(Box, { children: [
+        /* @__PURE__ */ jsx(Text, { children: "Apply this fix? " }),
+        /* @__PURE__ */ jsx(Text, { color: "green", children: "[y]es" }),
+        /* @__PURE__ */ jsx(Text, { children: " / " }),
+        /* @__PURE__ */ jsx(Text, { color: "red", children: "[n]o" })
+      ] })
+    ] }),
+    status === "fixing" && /* @__PURE__ */ jsxs(Box, { children: [
+      /* @__PURE__ */ jsx(Text, { color: "cyan", children: /* @__PURE__ */ jsx(Spinner, { type: "dots" }) }),
+      /* @__PURE__ */ jsx(Text, { children: " Applying fix..." })
+    ] }),
+    status === "done" && /* @__PURE__ */ jsx(Box, { children: /* @__PURE__ */ jsx(Text, { color: "green", children: "\u2713 Fix applied successfully!" }) }),
+    status === "error" && /* @__PURE__ */ jsxs(Box, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsx(Text, { color: "red", children: "\u2717 Failed to apply fix" }),
+      error && /* @__PURE__ */ jsx(Text, { color: "gray", children: error }),
+      /* @__PURE__ */ jsx(Box, { marginTop: 1, children: /* @__PURE__ */ jsx(Text, { color: "gray", children: "Press any key to go back" }) })
+    ] })
+  ] });
+};
+var App = ({ bugs, config, fixOptions, onFix, onExit }) => {
+  const { exit } = useApp();
+  const [state, setState] = useState({
+    screen: "dashboard",
+    bugs,
+    selectedCategory: null,
+    selectedBugIndex: 0,
+    config,
+    fixOptions
+  });
+  const filteredBugs = state.selectedCategory ? state.bugs.filter((b) => b.category === state.selectedCategory || b.severity === state.selectedCategory) : state.bugs;
+  const selectedBug = filteredBugs[state.selectedBugIndex];
+  useInput((input, key) => {
+    if (input === "q" || key.ctrl && input === "c") {
+      onExit();
+      exit();
+      return;
+    }
+    if (key.escape) {
+      if (state.screen === "fix") {
+        setState((s) => ({ ...s, screen: "detail" }));
+      } else if (state.screen === "detail") {
+        setState((s) => ({ ...s, screen: "list" }));
+      } else if (state.screen === "list") {
+        setState((s) => ({ ...s, screen: "dashboard", selectedCategory: null }));
+      }
+    }
+  });
+  const handleSelectCategory = (category) => {
+    setState((s) => ({
+      ...s,
+      screen: "list",
+      selectedCategory: category,
+      selectedBugIndex: 0
+    }));
+  };
+  const handleSelectBug = (index) => {
+    setState((s) => ({
+      ...s,
+      screen: "detail",
+      selectedBugIndex: index
+    }));
+  };
+  const handleStartFix = () => {
+    setState((s) => ({ ...s, screen: "fix" }));
+  };
+  const handleConfirmFix = async () => {
+    if (selectedBug) {
+      await onFix(selectedBug);
+      if (state.selectedBugIndex < filteredBugs.length - 1) {
+        setState((s) => ({
+          ...s,
+          screen: "detail",
+          selectedBugIndex: s.selectedBugIndex + 1
+        }));
+      } else {
+        setState((s) => ({ ...s, screen: "list" }));
+      }
+    }
+  };
+  const handleCancelFix = () => {
+    setState((s) => ({ ...s, screen: "detail" }));
+  };
+  const handleBack = () => {
+    if (state.screen === "fix") {
+      setState((s) => ({ ...s, screen: "detail" }));
+    } else if (state.screen === "detail") {
+      setState((s) => ({ ...s, screen: "list" }));
+    } else if (state.screen === "list") {
+      setState((s) => ({ ...s, screen: "dashboard", selectedCategory: null }));
+    }
+  };
+  return /* @__PURE__ */ jsxs(Box, { flexDirection: "column", padding: 1, children: [
+    /* @__PURE__ */ jsxs(Box, { marginBottom: 1, children: [
+      /* @__PURE__ */ jsx(Text, { color: "red", bold: true, children: "whiterose" }),
+      /* @__PURE__ */ jsx(Text, { color: "gray", children: " - fix mode" }),
+      /* @__PURE__ */ jsx(Text, { color: "gray", children: " | " }),
+      /* @__PURE__ */ jsxs(Text, { color: "gray", children: [
+        state.screen === "dashboard" && "Dashboard",
+        state.screen === "list" && `Bugs${state.selectedCategory ? ` (${state.selectedCategory})` : ""}`,
+        state.screen === "detail" && `Bug ${state.selectedBugIndex + 1}/${filteredBugs.length}`,
+        state.screen === "fix" && "Confirm Fix"
+      ] })
+    ] }),
+    state.screen === "dashboard" && /* @__PURE__ */ jsx(Dashboard, { bugs: state.bugs, onSelectCategory: handleSelectCategory }),
+    state.screen === "list" && /* @__PURE__ */ jsx(
+      BugList,
+      {
+        bugs: filteredBugs,
+        selectedIndex: state.selectedBugIndex,
+        onSelect: handleSelectBug,
+        onBack: handleBack
+      }
+    ),
+    state.screen === "detail" && selectedBug && /* @__PURE__ */ jsx(
+      BugDetail,
+      {
+        bug: selectedBug,
+        index: state.selectedBugIndex,
+        total: filteredBugs.length,
+        onFix: handleStartFix,
+        onNext: () => setState((s) => ({
+          ...s,
+          selectedBugIndex: Math.min(s.selectedBugIndex + 1, filteredBugs.length - 1)
+        })),
+        onPrev: () => setState((s) => ({
+          ...s,
+          selectedBugIndex: Math.max(s.selectedBugIndex - 1, 0)
+        })),
+        onBack: handleBack
+      }
+    ),
+    state.screen === "fix" && selectedBug && /* @__PURE__ */ jsx(
+      FixConfirm,
+      {
+        bug: selectedBug,
+        dryRun: fixOptions.dryRun,
+        onConfirm: handleConfirmFix,
+        onCancel: handleCancelFix
+      }
+    ),
+    /* @__PURE__ */ jsx(Box, { marginTop: 1, borderStyle: "single", borderColor: "gray", paddingX: 1, children: /* @__PURE__ */ jsx(Text, { color: "gray", children: "[q] Quit  [esc] Back  [\u2191\u2193] Navigate  [enter] Select  [f] Fix" }) })
+  ] });
+};
+var GIT_TIMEOUT = 3e4;
+async function createFixBranch(branchName, bug, cwd = process.cwd()) {
+  const safeBugId = bug.id.toLowerCase().replace(/[^a-z0-9]/g, "-");
+  const safeTitle = bug.title.toLowerCase().replace(/[^a-z0-9\s]/g, "").replace(/\s+/g, "-").slice(0, 30);
+  const fullBranchName = branchName || `whiterose/fix-${safeBugId}-${safeTitle}`;
+  try {
+    try {
+      await execa("git", ["rev-parse", "--verify", fullBranchName], {
+        cwd,
+        timeout: GIT_TIMEOUT
+      });
+      await execa("git", ["checkout", fullBranchName], { cwd, timeout: GIT_TIMEOUT });
+    } catch {
+      await execa("git", ["checkout", "-b", fullBranchName], { cwd, timeout: GIT_TIMEOUT });
+    }
+    return fullBranchName;
+  } catch (error) {
+    throw new Error(`Failed to create branch: ${error.message}`);
+  }
+}
+async function commitFix(bug, cwd = process.cwd()) {
+  try {
+    await execa("git", ["add", bug.file], { cwd, timeout: GIT_TIMEOUT });
+    const { stdout: diff } = await execa("git", ["diff", "--cached", "--name-only"], {
+      cwd,
+      timeout: GIT_TIMEOUT
+    });
+    if (!diff.trim()) {
+      return "";
+    }
+    const commitMessage = `fix(${bug.category}): ${bug.title}
+
+Bug ID: ${bug.id}
+File: ${bug.file}:${bug.line}
+Severity: ${bug.severity}
+
+${bug.description}
+
+Fixed by whiterose`;
+    await execa("git", ["commit", "-m", commitMessage], {
+      cwd,
+      timeout: GIT_TIMEOUT
+    });
+    const { stdout: hash } = await execa("git", ["rev-parse", "HEAD"], {
+      cwd,
+      timeout: GIT_TIMEOUT
+    });
+    return hash.trim();
+  } catch (error) {
+    throw new Error(`Failed to commit fix: ${error.message}`);
+  }
+}
+
+// src/core/fixer.ts
+function isPathWithinProject(filePath, projectDir) {
+  const resolvedPath = resolve(projectDir, filePath);
+  const relativePath = relative(projectDir, resolvedPath);
+  return !relativePath.startsWith("..") && !isAbsolute(relativePath);
+}
+function validateFilePath(filePath, projectDir) {
+  const resolvedPath = isAbsolute(filePath) ? filePath : resolve(projectDir, filePath);
+  if (!isPathWithinProject(resolvedPath, projectDir)) {
+    throw new Error(`Security: Refusing to access file outside project directory: ${filePath}`);
+  }
+  if (filePath.includes("\0") || filePath.includes("..")) {
+    throw new Error(`Security: Invalid file path contains suspicious characters: ${filePath}`);
+  }
+  return resolvedPath;
+}
+async function applyFix(bug, config, options) {
+  const { dryRun, branch } = options;
+  const projectDir = process.cwd();
+  let safePath;
+  try {
+    safePath = validateFilePath(bug.file, projectDir);
+  } catch (error) {
+    return {
+      success: false,
+      error: error.message
+    };
+  }
+  if (!existsSync(safePath)) {
+    return {
+      success: false,
+      error: `File not found: ${bug.file}`
+    };
+  }
+  const originalContent = readFileSync(safePath, "utf-8");
+  const lines = originalContent.split("\n");
+  let fixedContent;
+  let diff;
+  if (bug.suggestedFix) {
+    const result = applySimpleFix(lines, bug.line, bug.endLine || bug.line, bug.suggestedFix);
+    if (result.success) {
+      fixedContent = result.content;
+      diff = result.diff;
+    } else {
+      const llmResult = await generateAndApplyFix(bug, config, originalContent, safePath);
+      if (!llmResult.success) {
+        return llmResult;
+      }
+      fixedContent = llmResult.content;
+      diff = llmResult.diff;
+    }
+  } else {
+    const llmResult = await generateAndApplyFix(bug, config, originalContent, safePath);
+    if (!llmResult.success) {
+      return llmResult;
+    }
+    fixedContent = llmResult.content;
+    diff = llmResult.diff;
+  }
+  if (dryRun) {
+    console.log("\n--- Dry Run: Proposed changes ---");
+    console.log(diff);
+    console.log("--- End of proposed changes ---\n");
+    return {
+      success: true,
+      diff
+    };
+  }
+  let branchName;
+  if (branch) {
+    branchName = await createFixBranch(branch, bug);
+  }
+  writeFileSync(safePath, fixedContent, "utf-8");
+  if (branchName || !branch) {
+    await commitFix(bug);
+  }
+  return {
+    success: true,
+    diff,
+    branchName
+  };
+}
+function applySimpleFix(lines, startLine, endLine, fix) {
+  const lineIndex = startLine - 1;
+  const endIndex = endLine - 1;
+  if (lineIndex < 0 || lineIndex >= lines.length) {
+    return { success: false, content: "", diff: "" };
+  }
+  const originalLine = lines[lineIndex];
+  const indentMatch = originalLine.match(/^(\s*)/);
+  const indent = indentMatch ? indentMatch[1] : "";
+  const fixLines = fix.split("\n").map((line, i) => {
+    if (i === 0 || line.trim() === "") return line;
+    return indent + line.trimStart();
+  });
+  const removedLines = lines.slice(lineIndex, endIndex + 1);
+  const diff = [
+    `--- ${lines[lineIndex]}`,
+    ...removedLines.map((l) => `- ${l}`),
+    ...fixLines.map((l) => `+ ${l}`)
+  ].join("\n");
+  const newLines = [...lines.slice(0, lineIndex), ...fixLines, ...lines.slice(endIndex + 1)];
+  return {
+    success: true,
+    content: newLines.join("\n"),
+    diff
+  };
+}
+async function generateAndApplyFix(bug, _config, originalContent, safePath) {
+  try {
+    const prompt = buildFixPrompt(bug, originalContent);
+    const workingDir = safePath ? dirname(safePath) : process.cwd();
+    const { stdout } = await execa(
+      "claude",
+      ["-p", prompt, "--output-format", "text"],
+      {
+        cwd: workingDir,
+        timeout: 12e4,
+        env: { ...process.env, NO_COLOR: "1" }
+      }
+    );
+    const fixedContent = parseFixResponse(stdout, originalContent);
+    if (!fixedContent) {
+      return {
+        success: false,
+        error: "Failed to parse fix from LLM response"
+      };
+    }
+    const diff = generateDiff(originalContent, fixedContent, bug.file);
+    return {
+      success: true,
+      content: fixedContent,
+      diff
+    };
+  } catch (error) {
+    return {
+      success: false,
+      error: error.message || "Unknown error generating fix"
+    };
+  }
+}
+function buildFixPrompt(bug, originalContent) {
+  return `Fix the following bug in the code.
+
+BUG DETAILS:
+- Title: ${bug.title}
+- Description: ${bug.description}
+- File: ${bug.file}
+- Line: ${bug.line}${bug.endLine ? `-${bug.endLine}` : ""}
+- Category: ${bug.category}
+- Severity: ${bug.severity}
+
+EVIDENCE:
+${bug.evidence.map((e) => `- ${e}`).join("\n")}
+
+CODE PATH:
+${bug.codePath.map((s) => `${s.step}. ${s.file}:${s.line} - ${s.explanation}`).join("\n")}
+
+ORIGINAL FILE CONTENT:
+\`\`\`
+${originalContent}
+\`\`\`
+
+${bug.suggestedFix ? `SUGGESTED FIX APPROACH:
+${bug.suggestedFix}
+
+` : ""}
+
+Please provide the COMPLETE fixed file content. Output ONLY the fixed code, no explanations.
+Wrap the code in \`\`\` code blocks.
+
+IMPORTANT:
+- Fix ONLY the identified bug
+- Do not refactor or change anything else
+- Preserve all formatting and style
+- Ensure the fix actually addresses the bug`;
+}
+function parseFixResponse(response, originalContent) {
+  const codeBlockMatch = response.match(/```(?:\w+)?\s*([\s\S]*?)```/);
+  if (codeBlockMatch) {
+    const extracted = codeBlockMatch[1].trim();
+    const originalLines = originalContent.split("\n").slice(0, 5);
+    const extractedLines = extracted.split("\n").slice(0, 5);
+    let matchCount = 0;
+    for (const origLine of originalLines) {
+      if (extractedLines.some((l) => l.trim() === origLine.trim())) {
+        matchCount++;
+      }
+    }
+    if (matchCount >= 2 || extracted.length > originalContent.length * 0.5) {
+      return extracted;
+    }
+  }
+  if (response.includes("function") || response.includes("const ") || response.includes("import ")) {
+    return response.trim();
+  }
+  return null;
+}
+function generateDiff(original, fixed, filename) {
+  const origLines = original.split("\n");
+  const fixedLines = fixed.split("\n");
+  const diff = [`--- a/${basename(filename)}`, `+++ b/${basename(filename)}`];
+  const maxLen = Math.max(origLines.length, fixedLines.length);
+  for (let i = 0; i < maxLen; i++) {
+    const origLine = origLines[i];
+    const fixedLine = fixedLines[i];
+    if (origLine === void 0) {
+      diff.push(`+ ${fixedLine}`);
+    } else if (fixedLine === void 0) {
+      diff.push(`- ${origLine}`);
+    } else if (origLine !== fixedLine) {
+      diff.push(`- ${origLine}`);
+      diff.push(`+ ${fixedLine}`);
+    }
+  }
+  return diff.join("\n");
+}
+async function startFixTUI(bugs, config, options) {
+  return new Promise((resolve3) => {
+    const handleFix = async (bug) => {
+      await applyFix(bug, config, options);
+    };
+    const handleExit = () => {
+      resolve3();
+    };
+    const { unmount, waitUntilExit } = render(
+      /* @__PURE__ */ jsx(
+        App,
+        {
+          bugs,
+          config,
+          fixOptions: options,
+          onFix: handleFix,
+          onExit: handleExit
+        }
+      )
+    );
+    waitUntilExit().then(() => {
+      resolve3();
+    });
+  });
+}
+
+// src/cli/commands/fix.ts
+async function fixCommand(bugId, options) {
+  const cwd = process.cwd();
+  const whiterosePath = join(cwd, ".whiterose");
+  if (options.sarif) {
+    const sarifPath = isAbsolute(options.sarif) ? options.sarif : resolve(cwd, options.sarif);
+    if (!existsSync(sarifPath)) {
+      p3.log.error(`SARIF file not found: ${sarifPath}`);
+      process.exit(1);
+    }
+    p3.intro(chalk.red("whiterose") + chalk.dim(" - fixing bugs from external SARIF"));
+    const bugs2 = loadBugsFromSarif(sarifPath);
+    if (bugs2.length === 0) {
+      p3.log.success("No bugs found in SARIF file!");
+      process.exit(0);
+    }
+    p3.log.info(`Loaded ${bugs2.length} bugs from ${options.sarif}`);
+    const config2 = existsSync(whiterosePath) ? await loadConfig(cwd) : getDefaultConfig();
+    return await processBugList(bugs2, config2, options, bugId);
+  }
+  if (options.github) {
+    p3.intro(chalk.red("whiterose") + chalk.dim(" - fixing bug from GitHub issue"));
+    const bug = await loadBugFromGitHub(options.github, cwd);
+    if (!bug) {
+      p3.log.error("Failed to parse GitHub issue as a bug");
+      process.exit(1);
+    }
+    p3.log.info(`Loaded bug from GitHub: ${bug.title}`);
+    const config2 = existsSync(whiterosePath) ? await loadConfig(cwd) : getDefaultConfig();
+    return await fixSingleBug(bug, config2, options);
+  }
+  if (options.describe) {
+    p3.intro(chalk.red("whiterose") + chalk.dim(" - fixing manually described bug"));
+    const bug = await collectManualBugDescription(cwd);
+    if (!bug) {
+      p3.cancel("Bug description cancelled.");
+      process.exit(0);
+    }
+    const config2 = existsSync(whiterosePath) ? await loadConfig(cwd) : getDefaultConfig();
+    return await fixSingleBug(bug, config2, options);
+  }
+  if (!existsSync(whiterosePath)) {
+    p3.log.error("whiterose is not initialized in this directory.");
+    p3.log.info('Run "whiterose init" first, or use:');
+    p3.log.info("  --sarif <path>   Fix bugs from an external SARIF file");
+    p3.log.info("  --github <url>   Fix bug from a GitHub issue");
+    p3.log.info("  --describe       Manually describe a bug to fix");
+    process.exit(1);
+  }
+  const config = await loadConfig(cwd);
+  const reportsDir = join(whiterosePath, "reports");
+  if (!existsSync(reportsDir)) {
+    p3.log.error('No scan results found. Run "whiterose scan" first.');
+    p3.log.info("Or use --sarif, --github, or --describe for external bugs.");
+    process.exit(1);
+  }
+  const reports = readdirSync(reportsDir).filter((f) => f.endsWith(".sarif")).sort().reverse();
+  if (reports.length === 0) {
+    p3.log.error('No scan results found. Run "whiterose scan" first.');
+    p3.log.info("Or use --sarif, --github, or --describe for external bugs.");
+    process.exit(1);
+  }
+  const latestReport = join(reportsDir, reports[0]);
+  const bugs = loadBugsFromSarif(latestReport);
+  return await processBugList(bugs, config, options, bugId);
+}
+function loadBugsFromSarif(sarifPath) {
+  const sarif = JSON.parse(readFileSync(sarifPath, "utf-8"));
+  return sarif.runs?.[0]?.results?.map((r, i) => {
+    const props = r.properties || {};
+    return {
+      id: r.ruleId || `WR-${String(i + 1).padStart(3, "0")}`,
+      title: r.message?.text || "Unknown bug",
+      description: r.message?.markdown || r.message?.text || "",
+      file: r.locations?.[0]?.physicalLocation?.artifactLocation?.uri || "unknown",
+      line: r.locations?.[0]?.physicalLocation?.region?.startLine || 0,
+      endLine: r.locations?.[0]?.physicalLocation?.region?.endLine,
+      severity: mapSarifLevel(r.level),
+      category: props.category || "logic-error",
+      confidence: {
+        overall: props.confidence || "medium",
+        codePathValidity: props.codePathValidity || 0.8,
+        reachability: props.reachability || 0.8,
+        intentViolation: props.intentViolation || false,
+        staticToolSignal: props.staticToolSignal || false,
+        adversarialSurvived: props.adversarialSurvived || false
+      },
+      codePath: r.codeFlows?.[0]?.threadFlows?.[0]?.locations?.map((loc, idx) => ({
+        step: idx + 1,
+        file: loc.location?.physicalLocation?.artifactLocation?.uri || "",
+        line: loc.location?.physicalLocation?.region?.startLine || 0,
+        code: "",
+        explanation: loc.message?.text || ""
+      })) || [],
+      evidence: props.evidence || [],
+      suggestedFix: props.suggestedFix,
+      createdAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+  }) || [];
+}
+async function loadBugFromGitHub(issueUrl, cwd) {
+  try {
+    const match = issueUrl.match(/github\.com\/([^/]+)\/([^/]+)\/issues\/(\d+)/);
+    if (!match) {
+      p3.log.error("Invalid GitHub issue URL format. Expected: https://github.com/owner/repo/issues/123");
+      return null;
+    }
+    const [, owner, repo, issueNumber] = match;
+    const { stdout } = await execa("gh", [
+      "issue",
+      "view",
+      issueNumber,
+      "--repo",
+      `${owner}/${repo}`,
+      "--json",
+      "title,body,labels"
+    ], { cwd });
+    const issue = JSON.parse(stdout);
+    const fileMatch = issue.body?.match(/(?:file|path|location):\s*[`"]?([^\s`"]+)[`"]?/i) || issue.body?.match(/```[\w]*\n(?:\/\/|#)\s*([^\s:]+):(\d+)/);
+    const lineMatch = issue.body?.match(/(?:line|L|:)(\d+)/);
+    let severity = "medium";
+    const labels = issue.labels?.map((l) => l.name.toLowerCase()) || [];
+    if (labels.some((l) => l.includes("critical") || l.includes("security"))) {
+      severity = "critical";
+    } else if (labels.some((l) => l.includes("bug") || l.includes("high"))) {
+      severity = "high";
+    } else if (labels.some((l) => l.includes("low") || l.includes("minor"))) {
+      severity = "low";
+    }
+    let category = "logic-error";
+    if (labels.some((l) => l.includes("security"))) {
+      category = "security";
+    } else if (labels.some((l) => l.includes("null") || l.includes("undefined"))) {
+      category = "null-reference";
+    } else if (labels.some((l) => l.includes("async") || l.includes("race"))) {
+      category = "async-race-condition";
+    }
+    return {
+      id: `GH-${issueNumber}`,
+      title: issue.title,
+      description: issue.body || issue.title,
+      file: fileMatch?.[1] || "",
+      line: parseInt(lineMatch?.[1] || "1", 10),
+      severity,
+      category,
+      confidence: {
+        overall: "medium",
+        codePathValidity: 0.5,
+        reachability: 0.5,
+        intentViolation: false,
+        staticToolSignal: false,
+        adversarialSurvived: false
+      },
+      codePath: [],
+      evidence: [`GitHub issue: ${issueUrl}`],
+      createdAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+  } catch (error) {
+    if (error.message?.includes("gh")) {
+      p3.log.error("GitHub CLI (gh) is required for --github option.");
+      p3.log.info("Install it: https://cli.github.com/");
+    } else {
+      p3.log.error(`Failed to fetch GitHub issue: ${error.message}`);
+    }
+    return null;
+  }
+}
+async function collectManualBugDescription(cwd) {
+  const file = await p3.text({
+    message: "File path containing the bug:",
+    placeholder: "src/components/Button.tsx",
+    validate: (value) => {
+      if (!value) return "File path is required";
+      const fullPath = isAbsolute(value) ? value : resolve(cwd, value);
+      if (!existsSync(fullPath)) return `File not found: ${value}`;
+      return void 0;
+    }
+  });
+  if (p3.isCancel(file)) return null;
+  const lineStr = await p3.text({
+    message: "Line number (approximate is fine):",
+    placeholder: "42",
+    validate: (value) => {
+      if (!value) return "Line number is required";
+      if (isNaN(parseInt(value, 10))) return "Must be a number";
+      return void 0;
+    }
+  });
+  if (p3.isCancel(lineStr)) return null;
+  const title = await p3.text({
+    message: "Bug title (brief description):",
+    placeholder: "Null reference when user is not logged in"
+  });
+  if (p3.isCancel(title)) return null;
+  const description = await p3.text({
+    message: "Detailed description (what happens, how to trigger):",
+    placeholder: "When user.profile is accessed before login check, TypeError is thrown"
+  });
+  if (p3.isCancel(description)) return null;
+  const severity = await p3.select({
+    message: "Bug severity:",
+    options: [
+      { value: "critical", label: "Critical", hint: "security issue, data loss" },
+      { value: "high", label: "High", hint: "crash, incorrect behavior" },
+      { value: "medium", label: "Medium", hint: "bug with workaround" },
+      { value: "low", label: "Low", hint: "minor issue" }
+    ],
+    initialValue: "medium"
+  });
+  if (p3.isCancel(severity)) return null;
+  const category = await p3.select({
+    message: "Bug category:",
+    options: [
+      { value: "logic-error", label: "Logic Error" },
+      { value: "null-reference", label: "Null Reference" },
+      { value: "security", label: "Security" },
+      { value: "async-race-condition", label: "Async/Race Condition" },
+      { value: "edge-case", label: "Edge Case" },
+      { value: "type-coercion", label: "Type Coercion" },
+      { value: "resource-leak", label: "Resource Leak" },
+      { value: "intent-violation", label: "Intent Violation" }
+    ],
+    initialValue: "logic-error"
+  });
+  if (p3.isCancel(category)) return null;
+  const filePath = isAbsolute(file) ? file : resolve(cwd, file);
+  const relativePath = filePath.startsWith(cwd) ? filePath.slice(cwd.length + 1) : filePath;
+  return {
+    id: `MANUAL-${Date.now()}`,
+    title: title || "Manual bug",
+    description: description || title || "Manual bug",
+    file: relativePath,
+    line: parseInt(lineStr || "1", 10),
+    severity,
+    category,
+    confidence: {
+      overall: "high",
+      // User-reported bugs are high confidence
+      codePathValidity: 1,
+      reachability: 1,
+      intentViolation: true,
+      staticToolSignal: false,
+      adversarialSurvived: false
+    },
+    codePath: [],
+    evidence: ["Manually reported by user"],
+    createdAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+function getDefaultConfig() {
+  return {
+    version: "1",
+    provider: "claude-code",
+    include: ["**/*.ts", "**/*.tsx", "**/*.js", "**/*.jsx"],
+    exclude: ["node_modules", "dist", "build"],
+    priorities: {},
+    categories: ["logic-error", "security", "null-reference"],
+    minConfidence: "low",
+    staticAnalysis: { typescript: true, eslint: true },
+    output: { sarif: true, markdown: true, sarifPath: ".whiterose/reports", markdownPath: "BUGS.md" }
+  };
+}
+async function processBugList(bugs, config, options, bugId) {
+  if (bugs.length === 0) {
+    p3.log.success("No bugs to fix!");
+    process.exit(0);
+  }
+  if (bugId) {
+    const bug = bugs.find((b) => b.id === bugId || b.id.toLowerCase() === bugId.toLowerCase());
+    if (!bug) {
+      p3.log.error(`Bug ${bugId} not found.`);
+      p3.log.info("Available bugs: " + bugs.map((b) => b.id).join(", "));
+      process.exit(1);
+    }
+    return await fixSingleBug(bug, config, options);
+  }
+  try {
+    await startFixTUI(bugs, config, options);
+  } catch (error) {
+    if (error.message?.includes("stdin") || error.message?.includes("TTY")) {
+      p3.log.warn('Interactive mode not available. Use "whiterose fix <bug-id>" to fix specific bugs.');
+      p3.log.info("Available bugs:");
+      for (const bug of bugs) {
+        const severityColor = bug.severity === "critical" ? "red" : bug.severity === "high" ? "yellow" : "blue";
+        console.log(`  ${chalk[severityColor]("\u25CF")} ${bug.id}: ${bug.title}`);
+      }
+    } else {
+      throw error;
+    }
+  }
+}
+async function fixSingleBug(bug, config, options) {
+  p3.intro(chalk.red("whiterose") + chalk.dim(" - fixing bug"));
+  if (!bug.file) {
+    const file = await p3.text({
+      message: "File path containing the bug (required for fix):",
+      placeholder: "src/components/Button.tsx"
+    });
+    if (p3.isCancel(file) || !file) {
+      p3.cancel("Fix cancelled - file path required.");
+      process.exit(0);
+    }
+    bug.file = file;
+  }
+  console.log();
+  console.log(chalk.bold(`  ${bug.id}: ${bug.title}`));
+  console.log(`  ${chalk.dim("File:")} ${bug.file}:${bug.line}`);
+  console.log(`  ${chalk.dim("Severity:")} ${bug.severity}`);
+  console.log();
+  console.log(`  ${bug.description}`);
+  console.log();
+  if (bug.suggestedFix) {
+    console.log(chalk.dim("  Suggested fix:"));
+    console.log(`  ${chalk.green(bug.suggestedFix)}`);
+    console.log();
+  }
+  if (!options.dryRun) {
+    const confirm3 = await p3.confirm({
+      message: "Apply this fix?",
+      initialValue: true
+    });
+    if (p3.isCancel(confirm3) || !confirm3) {
+      p3.cancel("Fix cancelled.");
+      process.exit(0);
+    }
+  }
+  const spinner5 = p3.spinner();
+  spinner5.start(options.dryRun ? "Generating fix preview..." : "Applying fix...");
+  try {
+    const result = await applyFix(bug, config, options);
+    if (result.success) {
+      spinner5.stop(options.dryRun ? "Fix preview generated" : "Fix applied");
+      if (result.diff) {
+        console.log();
+        console.log(chalk.dim("  Changes:"));
+        for (const line of result.diff.split("\n")) {
+          if (line.startsWith("+")) {
+            console.log(chalk.green(`  ${line}`));
+          } else if (line.startsWith("-")) {
+            console.log(chalk.red(`  ${line}`));
+          } else {
+            console.log(chalk.dim(`  ${line}`));
+          }
+        }
+        console.log();
+      }
+      if (result.branchName) {
+        p3.log.info(`Changes committed to branch: ${result.branchName}`);
+      }
+      p3.outro(chalk.green("Fix complete!"));
+    } else {
+      spinner5.stop("Fix failed");
+      p3.log.error(result.error || "Unknown error");
+      process.exit(1);
+    }
+  } catch (error) {
+    spinner5.stop("Fix failed");
+    p3.log.error(error.message);
+    process.exit(1);
+  }
+}
+function mapSarifLevel(level) {
+  switch (level) {
+    case "error":
+      return "high";
+    case "warning":
+      return "medium";
+    case "note":
+      return "low";
+    default:
+      return "medium";
+  }
+}
+async function refreshCommand(options) {
+  const cwd = process.cwd();
+  const whiterosePath = join(cwd, ".whiterose");
+  if (!existsSync(whiterosePath)) {
+    p3.log.error("whiterose is not initialized in this directory.");
+    p3.log.info('Run "whiterose init" first.');
+    process.exit(1);
+  }
+  p3.intro(chalk.red("whiterose") + chalk.dim(" - refreshing understanding"));
+  const config = await loadConfig(cwd);
+  const scanSpinner = p3.spinner();
+  scanSpinner.start("Scanning codebase...");
+  const files = await scanCodebase(cwd, config);
+  scanSpinner.stop(`Found ${files.length} source files`);
+  const understandingSpinner = p3.spinner();
+  understandingSpinner.start("Regenerating understanding with AI...");
+  try {
+    const provider = await getProvider(config.provider);
+    const understanding = await provider.generateUnderstanding(files);
+    writeFileSync(
+      join(whiterosePath, "cache", "understanding.json"),
+      JSON.stringify(understanding, null, 2),
+      "utf-8"
+    );
+    const intentDoc = generateIntentDocument(understanding);
+    writeFileSync(join(whiterosePath, "intent.md"), intentDoc, "utf-8");
+    writeFileSync(
+      join(whiterosePath, "cache", "file-hashes.json"),
+      JSON.stringify({ version: "1", fileHashes: [], lastFullScan: (/* @__PURE__ */ new Date()).toISOString() }, null, 2),
+      "utf-8"
+    );
+    understandingSpinner.stop("Understanding regenerated");
+  } catch (error) {
+    understandingSpinner.stop("Failed to regenerate understanding");
+    p3.log.error(String(error));
+    process.exit(1);
+  }
+  p3.outro(chalk.green("Refresh complete!"));
+}
+async function statusCommand() {
+  const cwd = process.cwd();
+  const whiterosePath = join(cwd, ".whiterose");
+  if (!existsSync(whiterosePath)) {
+    p3.log.error("whiterose is not initialized in this directory.");
+    p3.log.info('Run "whiterose init" first.');
+    process.exit(1);
+  }
+  p3.intro(chalk.red("whiterose") + chalk.dim(" - status"));
+  const config = await loadConfig(cwd);
+  const understanding = await loadUnderstanding(cwd);
+  const availableProviders = await detectProvider();
+  console.log();
+  console.log(chalk.bold("  Configuration"));
+  console.log(`  ${chalk.dim("Provider:")} ${config.provider}`);
+  console.log(`  ${chalk.dim("Available:")} ${availableProviders.join(", ") || "none"}`);
+  console.log();
+  if (understanding) {
+    console.log(chalk.bold("  Codebase Understanding"));
+    console.log(`  ${chalk.dim("Type:")} ${understanding.summary.type}`);
+    console.log(`  ${chalk.dim("Framework:")} ${understanding.summary.framework || "none"}`);
+    console.log(`  ${chalk.dim("Files:")} ${understanding.structure.totalFiles}`);
+    console.log(`  ${chalk.dim("Features:")} ${understanding.features.length}`);
+    console.log(`  ${chalk.dim("Contracts:")} ${understanding.contracts.length}`);
+    console.log(`  ${chalk.dim("Generated:")} ${understanding.generatedAt}`);
+    console.log();
+  }
+  const hashesPath = join(whiterosePath, "cache", "file-hashes.json");
+  if (existsSync(hashesPath)) {
+    const hashes = JSON.parse(readFileSync(hashesPath, "utf-8"));
+    console.log(chalk.bold("  Cache"));
+    console.log(`  ${chalk.dim("Files tracked:")} ${hashes.fileHashes?.length || 0}`);
+    console.log(`  ${chalk.dim("Last full scan:")} ${hashes.lastFullScan || "never"}`);
+    console.log();
+  }
+  const reportsDir = join(whiterosePath, "reports");
+  if (existsSync(reportsDir)) {
+    const reports = readdirSync(reportsDir).filter((f) => f.endsWith(".sarif"));
+    if (reports.length > 0) {
+      const latestReport = reports.sort().reverse()[0];
+      const reportPath = join(reportsDir, latestReport);
+      const stats = statSync(reportPath);
+      console.log(chalk.bold("  Last Scan"));
+      console.log(`  ${chalk.dim("Report:")} ${latestReport}`);
+      console.log(`  ${chalk.dim("Date:")} ${stats.mtime.toISOString()}`);
+      try {
+        const sarif = JSON.parse(readFileSync(reportPath, "utf-8"));
+        const bugCount = sarif.runs?.[0]?.results?.length || 0;
+        console.log(`  ${chalk.dim("Bugs found:")} ${bugCount}`);
+      } catch {
+      }
+      console.log();
+    }
+  }
+  p3.outro(chalk.dim('Run "whiterose scan" to scan for bugs'));
+}
+async function reportCommand(options) {
+  const cwd = process.cwd();
+  const whiterosePath = join(cwd, ".whiterose");
+  if (!existsSync(whiterosePath)) {
+    p3.log.error("whiterose is not initialized in this directory.");
+    p3.log.info('Run "whiterose init" first.');
+    process.exit(1);
+  }
+  const reportsDir = join(whiterosePath, "reports");
+  if (!existsSync(reportsDir)) {
+    p3.log.error('No scan results found. Run "whiterose scan" first.');
+    process.exit(1);
+  }
+  const reports = readdirSync(reportsDir).filter((f) => f.endsWith(".sarif")).sort().reverse();
+  if (reports.length === 0) {
+    p3.log.error('No scan results found. Run "whiterose scan" first.');
+    process.exit(1);
+  }
+  const latestReport = join(reportsDir, reports[0]);
+  const sarif = JSON.parse(readFileSync(latestReport, "utf-8"));
+  const bugs = sarif.runs?.[0]?.results?.map((r, i) => ({
+    id: r.ruleId || `WR-${String(i + 1).padStart(3, "0")}`,
+    title: r.message?.text || "Unknown bug",
+    description: r.message?.markdown || r.message?.text || "",
+    file: r.locations?.[0]?.physicalLocation?.artifactLocation?.uri || "unknown",
+    line: r.locations?.[0]?.physicalLocation?.region?.startLine || 0,
+    severity: r.level === "error" ? "critical" : r.level === "warning" ? "high" : "medium",
+    category: "logic-error",
+    confidence: { overall: "high", codePathValidity: 0.9, reachability: 0.9, intentViolation: false, staticToolSignal: false, adversarialSurvived: true },
+    codePath: [],
+    evidence: [],
+    createdAt: (/* @__PURE__ */ new Date()).toISOString()
+  })) || [];
+  const result = {
+    id: "report",
+    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+    scanType: "full",
+    filesScanned: 0,
+    duration: 0,
+    bugs,
+    summary: {
+      critical: bugs.filter((b) => b.severity === "critical").length,
+      high: bugs.filter((b) => b.severity === "high").length,
+      medium: bugs.filter((b) => b.severity === "medium").length,
+      low: bugs.filter((b) => b.severity === "low").length,
+      total: bugs.length
+    }
+  };
+  let output;
+  switch (options.format) {
+    case "markdown":
+      output = outputMarkdown(result);
+      break;
+    case "sarif":
+      output = readFileSync(latestReport, "utf-8");
+      break;
+    case "json":
+      output = JSON.stringify(result, null, 2);
+      break;
+    default:
+      output = outputMarkdown(result);
+  }
+  if (options.output === "-") {
+    console.log(output);
+  } else {
+    writeFileSync(options.output, output);
+    p3.log.success(`Report written to ${options.output}`);
+  }
+}
+
+// src/cli/index.ts
+var BANNER = `
+${chalk.red("\u2588\u2588\u2557    \u2588\u2588\u2557\u2588\u2588\u2557  \u2588\u2588\u2557\u2588\u2588\u2557\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2588\u2588\u2588\u2588\u2557  \u2588\u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557")}
+${chalk.red("\u2588\u2588\u2551    \u2588\u2588\u2551\u2588\u2588\u2551  \u2588\u2588\u2551\u2588\u2588\u2551\u255A\u2550\u2550\u2588\u2588\u2554\u2550\u2550\u255D\u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255D\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557\u2588\u2588\u2554\u2550\u2550\u2550\u2588\u2588\u2557\u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255D\u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255D")}
+${chalk.red("\u2588\u2588\u2551 \u2588\u2557 \u2588\u2588\u2551\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2551\u2588\u2588\u2551   \u2588\u2588\u2551   \u2588\u2588\u2588\u2588\u2588\u2557  \u2588\u2588\u2588\u2588\u2588\u2588\u2554\u255D\u2588\u2588\u2551   \u2588\u2588\u2551\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2588\u2588\u2588\u2557  ")}
+${chalk.red("\u2588\u2588\u2551\u2588\u2588\u2588\u2557\u2588\u2588\u2551\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2551\u2588\u2588\u2551   \u2588\u2588\u2551   \u2588\u2588\u2554\u2550\u2550\u255D  \u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557\u2588\u2588\u2551   \u2588\u2588\u2551\u255A\u2550\u2550\u2550\u2550\u2588\u2588\u2551\u2588\u2588\u2554\u2550\u2550\u255D  ")}
+${chalk.red("\u255A\u2588\u2588\u2588\u2554\u2588\u2588\u2588\u2554\u255D\u2588\u2588\u2551  \u2588\u2588\u2551\u2588\u2588\u2551   \u2588\u2588\u2551   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2551  \u2588\u2588\u2551\u255A\u2588\u2588\u2588\u2588\u2588\u2588\u2554\u255D\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2551\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557")}
+${chalk.red(" \u255A\u2550\u2550\u255D\u255A\u2550\u2550\u255D \u255A\u2550\u255D  \u255A\u2550\u255D\u255A\u2550\u255D   \u255A\u2550\u255D   \u255A\u2550\u2550\u2550\u2550\u2550\u2550\u255D\u255A\u2550\u255D  \u255A\u2550\u255D \u255A\u2550\u2550\u2550\u2550\u2550\u255D \u255A\u2550\u2550\u2550\u2550\u2550\u2550\u255D\u255A\u2550\u2550\u2550\u2550\u2550\u2550\u255D")}
+
+${chalk.dim(`  "I've been staring at your code for a long time."`)}
+`;
+var program = new Command();
+program.name("whiterose").description("AI-powered bug hunter that uses your existing LLM subscription").version("0.1.0").hook("preAction", () => {
+  const args = process.argv.slice(2);
+  if (!args.includes("--help") && !args.includes("-h") && args.length > 0) {
+    console.log(BANNER);
+  }
+});
+program.command("init").description("Initialize whiterose for this project (scans codebase, asks questions, generates config)").option("-p, --provider <provider>", "LLM provider to use", "claude-code").option("--skip-questions", "Skip interactive questions, use defaults").option("--force", "Overwrite existing .whiterose directory").option("--unsafe", "Bypass LLM permission prompts (use with caution)").action(initCommand);
+program.command("scan [paths...]").description("Scan for bugs in the codebase").option("-f, --full", "Force full scan (ignore cache)").option("--json", "Output as JSON only").option("--sarif", "Output as SARIF only").option("-p, --provider <provider>", "Override LLM provider").option("-c, --category <categories...>", "Filter by bug categories").option("--min-confidence <level>", "Minimum confidence level to report", "low").option("--no-adversarial", "Skip adversarial validation (faster, less accurate)").option("--unsafe", "Bypass LLM permission prompts (use with caution)").action(scanCommand);
+program.command("fix [bugId]").description("Fix bugs interactively or by ID").option("--dry-run", "Show proposed fixes without applying").option("--branch <name>", "Create fixes in a new branch").option("--sarif <path>", "Load bugs from an external SARIF file").option("--github <url>", "Load bug from a GitHub issue URL").option("--describe", "Manually describe a bug to fix").action(fixCommand);
+program.command("refresh").description("Rebuild codebase understanding from scratch").option("--keep-config", "Keep existing config, only regenerate understanding").action(refreshCommand);
+program.command("status").description("Show whiterose status (cache, last scan, provider)").action(statusCommand);
+program.command("report").description("Generate BUGS.md from last scan").option("-o, --output <path>", "Output path", "BUGS.md").option("--format <format>", "Output format (markdown, sarif, json)", "markdown").action(reportCommand);
+async function showInteractiveMenu() {
+  console.log(BANNER);
+  const cwd = process.cwd();
+  const whiterosePath = join(cwd, ".whiterose");
+  const isInitialized = existsSync(whiterosePath);
+  if (isInitialized) {
+    console.log(chalk.dim(`  Project: ${chalk.white(cwd.split("/").pop())}`));
+    console.log(chalk.dim(`  Status: ${chalk.green("initialized")}`));
+    console.log();
+  } else {
+    console.log(chalk.dim(`  Project: ${chalk.white(cwd.split("/").pop())}`));
+    console.log(chalk.dim(`  Status: ${chalk.yellow("not initialized")}`));
+    console.log();
+  }
+  const menuOptions = [];
+  if (!isInitialized) {
+    menuOptions.push({
+      value: "init",
+      label: "Initialize",
+      hint: "set up whiterose for this project"
+    });
+  } else {
+    menuOptions.push(
+      { value: "scan", label: "Scan", hint: "find bugs in the codebase" },
+      { value: "fix", label: "Fix", hint: "fix bugs interactively" },
+      { value: "status", label: "Status", hint: "show current status" },
+      { value: "report", label: "Report", hint: "generate bug report" },
+      { value: "refresh", label: "Refresh", hint: "rebuild codebase understanding" }
+    );
+  }
+  menuOptions.push({ value: "help", label: "Help", hint: "show all commands" });
+  menuOptions.push({ value: "exit", label: "Exit" });
+  const choice = await p3.select({
+    message: "What would you like to do?",
+    options: menuOptions
+  });
+  if (p3.isCancel(choice) || choice === "exit") {
+    p3.outro(chalk.dim("Goodbye."));
+    process.exit(0);
+  }
+  console.log();
+  switch (choice) {
+    case "init":
+      await initCommand({ provider: "claude-code", skipQuestions: false, force: false, unsafe: false });
+      break;
+    case "scan":
+      await scanCommand([], {
+        full: false,
+        json: false,
+        sarif: false,
+        provider: void 0,
+        category: void 0,
+        minConfidence: "low",
+        adversarial: true,
+        unsafe: false
+      });
+      break;
+    case "fix":
+      await fixCommand(void 0, { dryRun: false });
+      break;
+    case "status":
+      await statusCommand();
+      break;
+    case "report":
+      await reportCommand({ output: "BUGS.md", format: "markdown" });
+      break;
+    case "refresh":
+      await refreshCommand();
+      break;
+    case "help":
+      program.help();
+      break;
+  }
+}
+if (process.argv.length === 2) {
+  showInteractiveMenu().catch((error) => {
+    console.error(chalk.red("Error:"), error.message);
+    process.exit(1);
+  });
+} else {
+  program.parse();
+}
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map