@shakecodeslikecray/whiterose 0.1.0

package/dist/index.js

@@ -0,0 +1,2794 @@
+import { z } from 'zod';
+import { existsSync, readFileSync, writeFileSync, mkdtempSync, rmSync } from 'fs';
+import { join, dirname, resolve, extname, relative, basename, isAbsolute } from 'path';
+import YAML from 'yaml';
+import fg3 from 'fast-glob';
+import { createHash } from 'crypto';
+import { execa } from 'execa';
+import { homedir, tmpdir } from 'os';
+
+// src/types.ts
+var BugSeverity = z.enum(["critical", "high", "medium", "low"]);
+var BugCategory = z.enum([
+  "logic-error",
+  "security",
+  "async-race-condition",
+  "edge-case",
+  "null-reference",
+  "type-coercion",
+  "resource-leak",
+  "intent-violation"
+]);
+var ConfidenceLevel = z.enum(["high", "medium", "low"]);
+var ConfidenceScore = z.object({
+  overall: ConfidenceLevel,
+  codePathValidity: z.number().min(0).max(1),
+  reachability: z.number().min(0).max(1),
+  intentViolation: z.boolean(),
+  staticToolSignal: z.boolean(),
+  adversarialSurvived: z.boolean()
+});
+var CodePathStep = z.object({
+  step: z.number(),
+  file: z.string(),
+  line: z.number(),
+  code: z.string(),
+  explanation: z.string()
+});
+var Bug = z.object({
+  id: z.string(),
+  title: z.string(),
+  description: z.string(),
+  file: z.string(),
+  line: z.number(),
+  endLine: z.number().optional(),
+  severity: BugSeverity,
+  category: BugCategory,
+  confidence: ConfidenceScore,
+  codePath: z.array(CodePathStep),
+  evidence: z.array(z.string()),
+  suggestedFix: z.string().optional(),
+  relatedContract: z.string().optional(),
+  staticAnalysisSignals: z.array(z.string()).optional(),
+  createdAt: z.string().datetime()
+});
+var ProviderType = z.enum([
+  "claude-code",
+  "aider",
+  "codex",
+  "opencode",
+  "ollama",
+  "gemini"
+]);
+var PriorityLevel = z.enum(["critical", "high", "medium", "low", "ignore"]);
+var PackageConfig = z.object({
+  path: z.string(),
+  priority: PriorityLevel,
+  include: z.array(z.string()).optional(),
+  exclude: z.array(z.string()).optional()
+});
+var MonorepoConfig = z.object({
+  detection: z.enum(["auto", "explicit"]),
+  packages: z.array(PackageConfig).optional(),
+  crossPackageAnalysis: z.boolean().default(true)
+});
+var WhiteroseConfig = z.object({
+  version: z.string().default("1"),
+  provider: ProviderType.default("claude-code"),
+  providerFallback: z.array(ProviderType).optional(),
+  // Scan settings
+  include: z.array(z.string()).default(["**/*.ts", "**/*.tsx", "**/*.js", "**/*.jsx"]),
+  exclude: z.array(z.string()).default(["node_modules", "dist", "build", ".next", "coverage"]),
+  // Priority areas
+  priorities: z.record(z.string(), PriorityLevel).default({}),
+  // Bug categories to scan for
+  categories: z.array(BugCategory).default([
+    "logic-error",
+    "security",
+    "async-race-condition",
+    "edge-case",
+    "null-reference"
+  ]),
+  // Confidence threshold for reporting
+  minConfidence: ConfidenceLevel.default("low"),
+  // Monorepo settings
+  monorepo: MonorepoConfig.optional(),
+  // Static analysis integration
+  staticAnalysis: z.object({
+    typescript: z.boolean().default(true),
+    eslint: z.boolean().default(true)
+  }).default({}),
+  // Output settings
+  output: z.object({
+    sarif: z.boolean().default(true),
+    markdown: z.boolean().default(true),
+    sarifPath: z.string().default(".whiterose/reports"),
+    markdownPath: z.string().default("BUGS.md")
+  }).default({})
+});
+var BehavioralContract = z.object({
+  function: z.string(),
+  file: z.string(),
+  inputs: z.array(
+    z.object({
+      name: z.string(),
+      type: z.string(),
+      constraints: z.string().optional()
+    })
+  ),
+  outputs: z.object({
+    type: z.string(),
+    constraints: z.string().optional()
+  }),
+  invariants: z.array(z.string()),
+  sideEffects: z.array(z.string()),
+  throws: z.array(z.string()).optional()
+});
+var FeatureIntent = z.object({
+  name: z.string(),
+  description: z.string(),
+  priority: PriorityLevel,
+  constraints: z.array(z.string()),
+  relatedFiles: z.array(z.string())
+});
+var CodebaseUnderstanding = z.object({
+  version: z.string(),
+  generatedAt: z.string().datetime(),
+  summary: z.object({
+    framework: z.string().optional(),
+    language: z.string(),
+    type: z.string(),
+    // e-commerce, saas, api, etc.
+    description: z.string()
+  }),
+  features: z.array(FeatureIntent),
+  contracts: z.array(BehavioralContract),
+  dependencies: z.record(z.string(), z.string()),
+  structure: z.object({
+    totalFiles: z.number(),
+    totalLines: z.number(),
+    packages: z.array(z.string()).optional()
+  })
+});
+var FileHash = z.object({
+  path: z.string(),
+  hash: z.string(),
+  lastModified: z.string().datetime()
+});
+var CacheState = z.object({
+  version: z.string(),
+  lastFullScan: z.string().datetime().optional(),
+  lastIncrementalScan: z.string().datetime().optional(),
+  fileHashes: z.array(FileHash)
+});
+var ScanResult = z.object({
+  id: z.string(),
+  timestamp: z.string().datetime(),
+  scanType: z.enum(["full", "incremental"]),
+  filesScanned: z.number(),
+  filesChanged: z.number().optional(),
+  duration: z.number(),
+  // ms
+  bugs: z.array(Bug),
+  summary: z.object({
+    critical: z.number(),
+    high: z.number(),
+    medium: z.number(),
+    low: z.number(),
+    total: z.number()
+  })
+});
+async function loadConfig(cwd) {
+  const configPath = join(cwd, ".whiterose", "config.yml");
+  if (!existsSync(configPath)) {
+    throw new Error('Config file not found. Run "whiterose init" first.');
+  }
+  const content = readFileSync(configPath, "utf-8");
+  const parsed = YAML.parse(content);
+  return WhiteroseConfig.parse(parsed);
+}
+async function loadUnderstanding(cwd) {
+  const understandingPath = join(cwd, ".whiterose", "cache", "understanding.json");
+  if (!existsSync(understandingPath)) {
+    return null;
+  }
+  const content = readFileSync(understandingPath, "utf-8");
+  return JSON.parse(content);
+}
+async function saveConfig(cwd, config) {
+  const { writeFileSync: writeFileSync4 } = await import('fs');
+  const configPath = join(cwd, ".whiterose", "config.yml");
+  writeFileSync4(configPath, YAML.stringify(config), "utf-8");
+}
+async function buildDependencyGraph(cwd, files) {
+  const graph = {
+    files: /* @__PURE__ */ new Map(),
+    dependents: /* @__PURE__ */ new Map()
+  };
+  for (const file of files) {
+    const imports = await getFileImports(file);
+    const resolvedImports = /* @__PURE__ */ new Set();
+    for (const imp of imports) {
+      const resolved = resolveImport(file, imp.source, cwd);
+      if (resolved && files.includes(resolved)) {
+        resolvedImports.add(resolved);
+      }
+    }
+    graph.files.set(file, resolvedImports);
+    for (const imported of resolvedImports) {
+      if (!graph.dependents.has(imported)) {
+        graph.dependents.set(imported, /* @__PURE__ */ new Set());
+      }
+      graph.dependents.get(imported).add(file);
+    }
+  }
+  return graph;
+}
+async function getDependentFiles(changedFiles, cwd, allFiles) {
+  if (!allFiles) {
+    allFiles = await fg3(["**/*.{ts,tsx,js,jsx}"], {
+      cwd,
+      ignore: ["node_modules/**", "dist/**", "build/**", ".next/**"],
+      absolute: true
+    });
+  }
+  const graph = await buildDependencyGraph(cwd, allFiles);
+  const dependents = new Set(changedFiles);
+  const queue = [...changedFiles];
+  while (queue.length > 0) {
+    const file = queue.shift();
+    const fileDependents = graph.dependents.get(file);
+    if (fileDependents) {
+      for (const dep of fileDependents) {
+        if (!dependents.has(dep)) {
+          dependents.add(dep);
+          queue.push(dep);
+        }
+      }
+    }
+  }
+  return Array.from(dependents);
+}
+async function getFileImports(filePath) {
+  if (!existsSync(filePath)) {
+    return [];
+  }
+  const content = readFileSync(filePath, "utf-8");
+  const imports = [];
+  const importRegex = /import\s+(?:(type)\s+)?(?:(\*\s+as\s+\w+)|(\{[^}]+\})|(\w+)(?:\s*,\s*(\{[^}]+\}))?|)\s*(?:from\s+)?['"]([^'"]+)['"]/g;
+  let match;
+  while ((match = importRegex.exec(content)) !== null) {
+    const isTypeOnly = !!match[1];
+    const isNamespace = !!match[2];
+    const namedImports = match[3] || match[5] || "";
+    const defaultImport = match[4] || "";
+    const source = match[6];
+    const specifiers = [];
+    if (defaultImport) {
+      specifiers.push(defaultImport);
+    }
+    if (namedImports) {
+      const named = namedImports.replace(/[{}]/g, "").split(",").map((s) => s.trim().split(/\s+as\s+/)[0].trim()).filter(Boolean);
+      specifiers.push(...named);
+    }
+    imports.push({
+      source,
+      specifiers,
+      isDefault: !!defaultImport,
+      isNamespace,
+      isTypeOnly
+    });
+  }
+  const requireRegex = /require\s*\(\s*['"]([^'"]+)['"]\s*\)/g;
+  while ((match = requireRegex.exec(content)) !== null) {
+    imports.push({
+      source: match[1],
+      specifiers: [],
+      isDefault: false,
+      isNamespace: false,
+      isTypeOnly: false
+    });
+  }
+  const dynamicImportRegex = /import\s*\(\s*['"]([^'"]+)['"]\s*\)/g;
+  while ((match = dynamicImportRegex.exec(content)) !== null) {
+    imports.push({
+      source: match[1],
+      specifiers: [],
+      isDefault: false,
+      isNamespace: false,
+      isTypeOnly: false
+    });
+  }
+  return imports;
+}
+function resolveImport(fromFile, importPath, cwd) {
+  if (!importPath.startsWith(".") && !importPath.startsWith("/")) {
+    return null;
+  }
+  const fromDir = dirname(fromFile);
+  let resolved;
+  if (importPath.startsWith("/")) {
+    resolved = join(cwd, importPath);
+  } else {
+    resolved = resolve(fromDir, importPath);
+  }
+  const extensions = [".ts", ".tsx", ".js", ".jsx", "/index.ts", "/index.tsx", "/index.js", "/index.jsx"];
+  if (existsSync(resolved)) {
+    const ext = extname(resolved);
+    if (ext === ".ts" || ext === ".tsx" || ext === ".js" || ext === ".jsx") {
+      return resolved;
+    }
+    for (const ext2 of ["/index.ts", "/index.tsx", "/index.js", "/index.jsx"]) {
+      if (existsSync(resolved + ext2)) {
+        return resolved + ext2;
+      }
+    }
+  }
+  for (const ext of extensions) {
+    const withExt = resolved + ext;
+    if (existsSync(withExt)) {
+      return withExt;
+    }
+  }
+  if (importPath.endsWith(".js")) {
+    const tsPath = resolved.replace(/\.js$/, ".ts");
+    if (existsSync(tsPath)) {
+      return tsPath;
+    }
+    const tsxPath = resolved.replace(/\.js$/, ".tsx");
+    if (existsSync(tsxPath)) {
+      return tsxPath;
+    }
+  }
+  return null;
+}
+async function getImportsOf(filePath) {
+  const imports = await getFileImports(filePath);
+  return imports.map((i) => i.source);
+}
+async function dependsOn(fileA, fileB, cwd, allFiles) {
+  const graph = await buildDependencyGraph(cwd, allFiles);
+  const visited = /* @__PURE__ */ new Set();
+  const queue = [fileA];
+  while (queue.length > 0) {
+    const current = queue.shift();
+    if (visited.has(current)) continue;
+    visited.add(current);
+    const deps = graph.files.get(current);
+    if (!deps) continue;
+    if (deps.has(fileB)) {
+      return true;
+    }
+    for (const dep of deps) {
+      if (!visited.has(dep)) {
+        queue.push(dep);
+      }
+    }
+  }
+  return false;
+}
+async function findCircularDependencies(cwd, allFiles) {
+  const graph = await buildDependencyGraph(cwd, allFiles);
+  const circles = [];
+  for (const file of allFiles) {
+    const path = findCycle(file, graph, []);
+    if (path && !circles.some((c) => arraysEqual(c, path))) {
+      circles.push(path);
+    }
+  }
+  return circles;
+}
+function findCycle(file, graph, path) {
+  const index = path.indexOf(file);
+  if (index !== -1) {
+    return path.slice(index);
+  }
+  const deps = graph.files.get(file);
+  if (!deps) return null;
+  for (const dep of deps) {
+    const cycle = findCycle(dep, graph, [...path, file]);
+    if (cycle) return cycle;
+  }
+  return null;
+}
+function arraysEqual(a, b) {
+  if (a.length !== b.length) return false;
+  const sortedA = [...a].sort();
+  const sortedB = [...b].sort();
+  return sortedA.every((v, i) => v === sortedB[i]);
+}
+
+// src/core/scanner/index.ts
+var DEFAULT_INCLUDE = ["**/*.ts", "**/*.tsx", "**/*.js", "**/*.jsx"];
+var DEFAULT_EXCLUDE = [
+  "node_modules/**",
+  "dist/**",
+  "build/**",
+  ".next/**",
+  "coverage/**",
+  "**/*.test.*",
+  "**/*.spec.*",
+  "**/*.d.ts",
+  ".whiterose/**"
+];
+async function scanCodebase(cwd, config) {
+  const include = config?.include || DEFAULT_INCLUDE;
+  const exclude = config?.exclude || DEFAULT_EXCLUDE;
+  const files = await fg3(include, {
+    cwd,
+    ignore: exclude,
+    absolute: true,
+    onlyFiles: true
+  });
+  return files.sort();
+}
+function hashFile(filePath) {
+  const content = readFileSync(filePath, "utf-8");
+  return createHash("md5").update(content).digest("hex");
+}
+async function getChangedFiles(cwd, config) {
+  const cachePath = join(cwd, ".whiterose", "cache", "file-hashes.json");
+  const currentFiles = await scanCodebase(cwd, config);
+  let cachedState = {
+    fileHashes: []
+  };
+  if (existsSync(cachePath)) {
+    cachedState = JSON.parse(readFileSync(cachePath, "utf-8"));
+  }
+  const cachedHashes = new Map(cachedState.fileHashes.map((h) => [h.path, h.hash]));
+  const changedFiles = [];
+  const newHashes = [];
+  for (const file of currentFiles) {
+    const relativePath = relative(cwd, file);
+    const currentHash = hashFile(file);
+    newHashes.push({
+      path: relativePath,
+      hash: currentHash,
+      lastModified: (/* @__PURE__ */ new Date()).toISOString()
+    });
+    const cachedHash = cachedHashes.get(relativePath);
+    if (!cachedHash || cachedHash !== currentHash) {
+      changedFiles.push(file);
+    }
+  }
+  const newState = {
+    version: "1",
+    lastIncrementalScan: (/* @__PURE__ */ new Date()).toISOString(),
+    lastFullScan: cachedState.lastFullScan,
+    fileHashes: newHashes
+  };
+  writeFileSync(cachePath, JSON.stringify(newState, null, 2), "utf-8");
+  return { files: changedFiles, hashes: newHashes };
+}
+async function getDependentFiles2(changedFiles, cwd, allFiles) {
+  return getDependentFiles(changedFiles, cwd, allFiles);
+}
+var providerChecks = [
+  {
+    name: "claude-code",
+    command: "claude",
+    args: ["--version"],
+    paths: [
+      join(homedir(), ".local", "bin", "claude"),
+      "/usr/local/bin/claude",
+      "/opt/homebrew/bin/claude"
+    ]
+  },
+  {
+    name: "aider",
+    command: "aider",
+    args: ["--version"],
+    paths: [
+      join(homedir(), ".local", "bin", "aider"),
+      "/usr/local/bin/aider",
+      "/opt/homebrew/bin/aider"
+    ]
+  },
+  {
+    name: "codex",
+    command: "codex",
+    args: ["--version"],
+    paths: [
+      join(homedir(), ".local", "bin", "codex"),
+      "/usr/local/bin/codex",
+      "/opt/homebrew/bin/codex"
+    ]
+  },
+  {
+    name: "opencode",
+    command: "opencode",
+    args: ["--version"],
+    paths: [
+      join(homedir(), ".local", "bin", "opencode"),
+      "/usr/local/bin/opencode",
+      "/opt/homebrew/bin/opencode"
+    ]
+  },
+  {
+    name: "gemini",
+    command: "gemini",
+    args: ["--version"],
+    paths: [
+      join(homedir(), ".local", "bin", "gemini"),
+      "/usr/local/bin/gemini",
+      "/opt/homebrew/bin/gemini"
+    ]
+  },
+  {
+    name: "ollama",
+    command: "ollama",
+    args: ["--version"],
+    paths: [
+      join(homedir(), ".local", "bin", "ollama"),
+      "/usr/local/bin/ollama",
+      "/opt/homebrew/bin/ollama"
+    ]
+  }
+];
+var resolvedPaths = /* @__PURE__ */ new Map();
+async function findCommand(check) {
+  try {
+    await execa(check.command, check.args, { timeout: 5e3 });
+    return check.command;
+  } catch {
+  }
+  if (check.paths) {
+    for (const path of check.paths) {
+      if (existsSync(path)) {
+        try {
+          await execa(path, check.args, { timeout: 5e3 });
+          return path;
+        } catch {
+        }
+      }
+    }
+  }
+  return null;
+}
+async function detectProvider() {
+  const available = [];
+  for (const check of providerChecks) {
+    const commandPath = await findCommand(check);
+    if (commandPath) {
+      resolvedPaths.set(check.name, commandPath);
+      available.push(check.name);
+    }
+  }
+  return available;
+}
+async function isProviderAvailable(name) {
+  const check = providerChecks.find((c) => c.name === name);
+  if (!check) return false;
+  const commandPath = await findCommand(check);
+  if (commandPath) {
+    resolvedPaths.set(name, commandPath);
+    return true;
+  }
+  return false;
+}
+function getProviderCommand(name) {
+  return resolvedPaths.get(name) || name.replace("-code", "");
+}
+
+// src/core/utils.ts
+function generateBugId(index) {
+  return `WR-${String(index + 1).padStart(3, "0")}`;
+}
+function safeParseJson(json, schema) {
+  try {
+    const parsed = JSON.parse(json);
+    const result = schema.safeParse(parsed);
+    if (result.success) {
+      return { success: true, data: result.data };
+    }
+    return { success: false, error: formatZodError(result.error) };
+  } catch (error) {
+    return { success: false, error: error.message || "Invalid JSON" };
+  }
+}
+function formatZodError(error) {
+  return error.errors.map((e) => `${e.path.join(".")}: ${e.message}`).join(", ");
+}
+var PartialBugFromLLM = z.object({
+  file: z.string(),
+  line: z.number(),
+  endLine: z.number().optional(),
+  title: z.string(),
+  description: z.string().optional().default(""),
+  severity: BugSeverity.optional().default("medium"),
+  category: BugCategory.optional().default("logic-error"),
+  codePath: z.array(z.object({
+    step: z.number().optional(),
+    file: z.string().optional(),
+    line: z.number().optional(),
+    code: z.string().optional().default(""),
+    explanation: z.string().optional().default("")
+  })).optional().default([]),
+  evidence: z.array(z.string()).optional().default([]),
+  suggestedFix: z.string().optional(),
+  confidence: z.object({
+    overall: ConfidenceLevel.optional().default("medium"),
+    codePathValidity: z.number().min(0).max(1).optional().default(0.5),
+    reachability: z.number().min(0).max(1).optional().default(0.5),
+    intentViolation: z.boolean().optional().default(false),
+    staticToolSignal: z.boolean().optional().default(false),
+    adversarialSurvived: z.boolean().optional().default(false)
+  }).optional().default({})
+});
+var PartialUnderstandingFromLLM = z.object({
+  summary: z.object({
+    type: z.string().optional().default("unknown"),
+    framework: z.string().optional(),
+    language: z.string().optional().default("unknown"),
+    description: z.string().optional().default("")
+  }).optional().default({}),
+  features: z.array(z.object({
+    name: z.string(),
+    description: z.string(),
+    priority: z.enum(["critical", "high", "medium", "low", "ignore"]).optional().default("medium"),
+    constraints: z.array(z.string()).optional().default([]),
+    relatedFiles: z.array(z.string()).optional().default([])
+  })).optional().default([]),
+  contracts: z.array(z.object({
+    function: z.string(),
+    file: z.string(),
+    inputs: z.array(z.object({
+      name: z.string(),
+      type: z.string(),
+      constraints: z.string().optional()
+    })).optional().default([]),
+    outputs: z.object({
+      type: z.string(),
+      constraints: z.string().optional()
+    }).optional().default({ type: "unknown" }),
+    invariants: z.array(z.string()).optional().default([]),
+    sideEffects: z.array(z.string()).optional().default([]),
+    throws: z.array(z.string()).optional()
+  })).optional().default([]),
+  dependencies: z.record(z.string(), z.string()).optional().default({})
+});
+var AdversarialResultSchema = z.object({
+  survived: z.boolean(),
+  counterArguments: z.array(z.string()).optional().default([]),
+  confidence: ConfidenceLevel.optional()
+});
+z.object({
+  $schema: z.string().optional(),
+  version: z.string(),
+  runs: z.array(z.object({
+    tool: z.object({
+      driver: z.object({
+        name: z.string(),
+        version: z.string().optional(),
+        informationUri: z.string().optional(),
+        rules: z.array(z.any()).optional()
+      })
+    }),
+    results: z.array(z.object({
+      ruleId: z.string().optional(),
+      level: z.enum(["none", "note", "warning", "error"]).optional(),
+      message: z.object({
+        text: z.string()
+      }),
+      locations: z.array(z.object({
+        physicalLocation: z.object({
+          artifactLocation: z.object({
+            uri: z.string()
+          }),
+          region: z.object({
+            startLine: z.number(),
+            endLine: z.number().optional()
+          }).optional()
+        })
+      })).optional()
+    })).optional().default([])
+  }))
+});
+z.object({
+  number: z.number(),
+  title: z.string(),
+  body: z.string().nullable(),
+  state: z.string(),
+  labels: z.array(z.object({
+    name: z.string()
+  })).optional().default([]),
+  url: z.string().optional()
+});
+z.array(z.object({
+  filePath: z.string(),
+  messages: z.array(z.object({
+    ruleId: z.string().nullable(),
+    severity: z.number(),
+    message: z.string(),
+    line: z.number(),
+    column: z.number()
+  })),
+  errorCount: z.number(),
+  warningCount: z.number()
+}));
+z.object({
+  name: z.string().optional(),
+  version: z.string().optional(),
+  description: z.string().optional(),
+  scripts: z.record(z.string(), z.string()).optional(),
+  dependencies: z.record(z.string(), z.string()).optional(),
+  devDependencies: z.record(z.string(), z.string()).optional(),
+  workspaces: z.union([
+    z.array(z.string()),
+    z.object({ packages: z.array(z.string()) })
+  ]).optional()
+});
+
+// src/providers/adapters/claude-code.ts
+var MARKERS = {
+  SCANNING: "###SCANNING:",
+  BUG: "###BUG:",
+  UNDERSTANDING: "###UNDERSTANDING:",
+  COMPLETE: "###COMPLETE",
+  ERROR: "###ERROR:"
+};
+var ClaudeCodeProvider = class {
+  name = "claude-code";
+  progressCallback;
+  bugFoundCallback;
+  currentProcess;
+  unsafeMode = false;
+  async detect() {
+    return isProviderAvailable("claude-code");
+  }
+  async isAvailable() {
+    return isProviderAvailable("claude-code");
+  }
+  /**
+   * Enable unsafe mode (--dangerously-skip-permissions).
+   * WARNING: This bypasses Claude's permission prompts and should only be used
+   * when you trust the codebase being analyzed.
+   */
+  setUnsafeMode(enabled) {
+    this.unsafeMode = enabled;
+  }
+  isUnsafeMode() {
+    return this.unsafeMode;
+  }
+  setProgressCallback(callback) {
+    this.progressCallback = callback;
+  }
+  setBugFoundCallback(callback) {
+    this.bugFoundCallback = callback;
+  }
+  reportProgress(message) {
+    if (this.progressCallback) {
+      this.progressCallback(message);
+    }
+  }
+  reportBug(bug) {
+    if (this.bugFoundCallback) {
+      this.bugFoundCallback(bug);
+    }
+  }
+  // Cancel any running analysis
+  cancel() {
+    if (this.currentProcess) {
+      this.currentProcess.kill();
+      this.currentProcess = void 0;
+    }
+  }
+  async analyze(context) {
+    const { files, understanding } = context;
+    if (files.length === 0) {
+      return [];
+    }
+    const cwd = process.cwd();
+    const bugs = [];
+    let bugIndex = 0;
+    const prompt = this.buildAgenticAnalysisPrompt(understanding);
+    this.reportProgress("Starting agentic analysis...");
+    try {
+      await this.runAgenticClaude(prompt, cwd, {
+        onScanning: (file) => {
+          this.reportProgress(`Scanning: ${file}`);
+        },
+        onBugFound: (bugData) => {
+          const bug = this.parseBugData(bugData, bugIndex++, files);
+          if (bug) {
+            bugs.push(bug);
+            this.reportBug(bug);
+            this.reportProgress(`Found: ${bug.title} (${bug.severity})`);
+          }
+        },
+        onComplete: () => {
+          this.reportProgress(`Analysis complete. Found ${bugs.length} bugs.`);
+        },
+        onError: (error) => {
+          this.reportProgress(`Error: ${error}`);
+        }
+      });
+    } catch (error) {
+      if (error.message?.includes("ENOENT")) {
+        throw new Error("Claude CLI not found. Install it with: npm install -g @anthropic-ai/claude-code");
+      }
+      throw error;
+    }
+    return bugs;
+  }
+  async adversarialValidate(bug, _context) {
+    let fileContent = "";
+    try {
+      if (existsSync(bug.file)) {
+        fileContent = readFileSync(bug.file, "utf-8");
+        const lines = fileContent.split("\n");
+        const start = Math.max(0, bug.line - 20);
+        const end = Math.min(lines.length, (bug.endLine || bug.line) + 20);
+        fileContent = lines.slice(start, end).join("\n");
+      }
+    } catch {
+    }
+    const prompt = this.buildAdversarialPrompt(bug, fileContent);
+    const result = await this.runSimpleClaude(prompt, process.cwd());
+    return this.parseAdversarialResponse(result, bug);
+  }
+  async generateUnderstanding(files, existingDocsSummary) {
+    const cwd = process.cwd();
+    this.reportProgress(`Starting codebase analysis (${files.length} files)...`);
+    const prompt = this.buildAgenticUnderstandingPrompt(existingDocsSummary);
+    let understandingJson = "";
+    try {
+      await this.runAgenticClaude(prompt, cwd, {
+        onScanning: (file) => {
+          this.reportProgress(`Examining: ${file}`);
+        },
+        onUnderstanding: (json) => {
+          understandingJson = json;
+        },
+        onComplete: () => {
+          this.reportProgress("Understanding complete.");
+        },
+        onError: (error) => {
+          this.reportProgress(`Error: ${error}`);
+        }
+      });
+      return this.parseUnderstandingResponse(understandingJson, files);
+    } catch (error) {
+      if (error.message?.includes("ENOENT")) {
+        throw new Error("Claude CLI not found. Install it with: npm install -g @anthropic-ai/claude-code");
+      }
+      throw error;
+    }
+  }
+  // ─────────────────────────────────────────────────────────────
+  // Agentic Prompts
+  // ─────────────────────────────────────────────────────────────
+  buildAgenticAnalysisPrompt(understanding) {
+    return `You are whiterose, an expert bug hunter. Your task is to explore this codebase and find real bugs.
+
+CODEBASE CONTEXT:
+- Type: ${understanding.summary.type}
+- Framework: ${understanding.summary.framework || "Unknown"}
+- Description: ${understanding.summary.description}
+
+YOUR TASK:
+1. Explore the codebase by reading files
+2. Look for bugs in these categories:
+   - Logic errors (off-by-one, wrong operators, incorrect conditions)
+   - Null/undefined dereference
+   - Security vulnerabilities (injection, auth bypass, XSS)
+   - Async/race conditions (missing await, unhandled promises)
+   - Edge cases (empty arrays, zero values, boundaries)
+   - Resource leaks (unclosed connections)
+
+PROTOCOL - You MUST output these markers:
+- Before reading each file, output: ${MARKERS.SCANNING}<filepath>
+- When you find a bug, output: ${MARKERS.BUG}<json>
+- When completely done, output: ${MARKERS.COMPLETE}
+- If you encounter an error, output: ${MARKERS.ERROR}<message>
+
+BUG JSON FORMAT:
+${MARKERS.BUG}{"file":"src/api/users.ts","line":42,"title":"Null dereference in getUserById","description":"...","severity":"high","category":"null-reference","evidence":["..."],"suggestedFix":"..."}
+
+IMPORTANT:
+- Only report bugs you have HIGH confidence in
+- Include exact line numbers
+- Focus on real bugs, not style issues
+- Explore systematically - check API routes, data handling, auth flows
+
+Now explore this codebase and find bugs. Start by reading the main entry points.`;
+  }
+  buildAgenticUnderstandingPrompt(existingDocsSummary) {
+    const docsSection = existingDocsSummary ? `
+
+EXISTING DOCUMENTATION (merge this with your exploration):
+${existingDocsSummary}
+` : "";
+    return `You are whiterose. Your task is to understand this codebase.
+${docsSection}
+YOUR TASK:
+1. Review the existing documentation above (if any)
+2. Explore the codebase structure to fill in gaps
+3. Read key files (main entry points, config files, core modules)
+4. Build a comprehensive understanding merging docs + code exploration
+5. Identify main features, business rules, and behavioral contracts
+
+PROTOCOL - You MUST output these markers:
+- Before reading each file, output: ${MARKERS.SCANNING}<filepath>
+- When you have full understanding, output: ${MARKERS.UNDERSTANDING}<json>
+- When completely done, output: ${MARKERS.COMPLETE}
+
+UNDERSTANDING JSON FORMAT:
+${MARKERS.UNDERSTANDING}{
+  "summary": {
+    "type": "api|web-app|cli|library|etc",
+    "framework": "next.js|express|react|etc",
+    "language": "typescript|javascript",
+    "description": "2-3 sentence description"
+  },
+  "features": [
+    {"name": "Feature", "description": "What it does", "priority": "critical|high|medium|low", "constraints": ["business rule 1", "invariant 2"], "relatedFiles": ["path/to/file.ts"]}
+  ],
+  "contracts": [
+    {"function": "functionName", "file": "path/to/file.ts", "inputs": [], "outputs": {}, "invariants": ["must do X before Y"], "sideEffects": [], "throws": []}
+  ]
+}
+
+IMPORTANT:
+- Merge existing documentation with what you discover in the code
+- Focus on business rules and invariants (what MUST be true)
+- Identify critical paths (checkout, auth, payments, etc.)
+- Document behavioral contracts for important functions
+
+Now explore this codebase and build understanding.`;
+  }
+  buildAdversarialPrompt(bug, fileContent) {
+    return `You are a skeptical code reviewer. Try to DISPROVE this bug report.
+
+REPORTED BUG:
+- File: ${bug.file}:${bug.line}
+- Title: ${bug.title}
+- Description: ${bug.description}
+- Severity: ${bug.severity}
+
+CODE CONTEXT:
+${fileContent}
+
+Try to prove this is NOT a bug by finding:
+1. Guards or validation that prevents this
+2. Type system guarantees
+3. Framework behavior that handles this
+4. Unreachable code paths
+
+OUTPUT AS JSON:
+{"survived": true/false, "counterArguments": ["reason 1"], "confidence": "high/medium/low", "explanation": "..."}
+
+Set "survived": true if you CANNOT disprove it (it's a real bug).`;
+  }
+  // ─────────────────────────────────────────────────────────────
+  // Claude CLI Execution (Agentic Mode)
+  // ─────────────────────────────────────────────────────────────
+  async runAgenticClaude(prompt, cwd, callbacks) {
+    const claudeCommand = getProviderCommand("claude-code");
+    const args = ["--verbose", "-p", prompt];
+    if (this.unsafeMode) {
+      args.unshift("--dangerously-skip-permissions");
+    }
+    this.currentProcess = execa(
+      claudeCommand,
+      args,
+      {
+        cwd,
+        env: {
+          ...process.env,
+          NO_COLOR: "1"
+        },
+        reject: false
+      }
+    );
+    let buffer = "";
+    this.currentProcess.stdout?.on("data", (chunk) => {
+      buffer += chunk.toString();
+      const lines = buffer.split("\n");
+      buffer = lines.pop() || "";
+      for (const line of lines) {
+        this.processAgentOutput(line, callbacks);
+      }
+    });
+    this.currentProcess.stderr?.on("data", (chunk) => {
+      const text = chunk.toString().trim();
+      if (text && !text.includes("Loading")) ;
+    });
+    await this.currentProcess;
+    if (buffer.trim()) {
+      this.processAgentOutput(buffer, callbacks);
+    }
+    this.currentProcess = void 0;
+  }
+  processAgentOutput(line, callbacks) {
+    const trimmed = line.trim();
+    if (trimmed.startsWith(MARKERS.SCANNING)) {
+      const file = trimmed.slice(MARKERS.SCANNING.length).trim();
+      callbacks.onScanning?.(file);
+    } else if (trimmed.startsWith(MARKERS.BUG)) {
+      const json = trimmed.slice(MARKERS.BUG.length).trim();
+      callbacks.onBugFound?.(json);
+    } else if (trimmed.startsWith(MARKERS.UNDERSTANDING)) {
+      const json = trimmed.slice(MARKERS.UNDERSTANDING.length).trim();
+      callbacks.onUnderstanding?.(json);
+    } else if (trimmed.startsWith(MARKERS.COMPLETE)) {
+      callbacks.onComplete?.();
+    } else if (trimmed.startsWith(MARKERS.ERROR)) {
+      const error = trimmed.slice(MARKERS.ERROR.length).trim();
+      callbacks.onError?.(error);
+    }
+  }
+  // Simple non-agentic mode for short prompts (adversarial validation)
+  async runSimpleClaude(prompt, cwd) {
+    const claudeCommand = getProviderCommand("claude-code");
+    try {
+      const { stdout } = await execa(
+        claudeCommand,
+        ["-p", prompt, "--output-format", "text"],
+        {
+          cwd,
+          timeout: 12e4,
+          // 2 min for simple prompts
+          env: { ...process.env, NO_COLOR: "1" }
+        }
+      );
+      return stdout;
+    } catch (error) {
+      if (error.stdout) return error.stdout;
+      throw error;
+    }
+  }
+  // ─────────────────────────────────────────────────────────────
+  // Response Parsers
+  // ─────────────────────────────────────────────────────────────
+  parseBugData(json, index, files) {
+    const result = safeParseJson(json, PartialBugFromLLM);
+    if (!result.success) {
+      return null;
+    }
+    const data = result.data;
+    let filePath = data.file;
+    if (!filePath.startsWith("/")) {
+      const match = files.find((f) => f.endsWith(filePath) || f.includes(filePath));
+      if (match) filePath = match;
+    }
+    return {
+      id: generateBugId(index),
+      title: String(data.title).slice(0, 100),
+      description: String(data.description || ""),
+      file: filePath,
+      line: data.line,
+      endLine: data.endLine,
+      severity: data.severity ?? "medium",
+      category: data.category ?? "logic-error",
+      confidence: {
+        overall: data.confidence?.overall || "medium",
+        codePathValidity: data.confidence?.codePathValidity ?? 0.8,
+        reachability: data.confidence?.reachability ?? 0.8,
+        intentViolation: data.confidence?.intentViolation ?? false,
+        staticToolSignal: data.confidence?.staticToolSignal ?? false,
+        adversarialSurvived: data.confidence?.adversarialSurvived ?? false
+      },
+      codePath: (data.codePath || []).map((step, idx) => ({
+        step: idx + 1,
+        file: step.file || filePath,
+        line: step.line || data.line,
+        code: step.code || "",
+        explanation: step.explanation || ""
+      })),
+      evidence: data.evidence || [],
+      suggestedFix: data.suggestedFix,
+      createdAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+  }
+  parseAdversarialResponse(response, bug) {
+    const json = this.extractJson(response);
+    if (!json) {
+      return { survived: true, counterArguments: [] };
+    }
+    const result = safeParseJson(json, AdversarialResultSchema);
+    if (!result.success) {
+      return { survived: true, counterArguments: [] };
+    }
+    const parsed = result.data;
+    const survived = parsed.survived !== false;
+    return {
+      survived,
+      counterArguments: parsed.counterArguments || [],
+      adjustedConfidence: survived ? {
+        ...bug.confidence,
+        overall: parsed.confidence || bug.confidence.overall,
+        adversarialSurvived: true
+      } : void 0
+    };
+  }
+  parseUnderstandingResponse(response, files) {
+    let totalLines = 0;
+    for (const file of files.slice(0, 50)) {
+      try {
+        const content = readFileSync(file, "utf-8");
+        totalLines += content.split("\n").length;
+      } catch {
+      }
+    }
+    const json = this.extractJson(response);
+    if (!json) {
+      return {
+        version: "1",
+        generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        summary: {
+          type: "unknown",
+          language: "unknown",
+          description: "Failed to analyze codebase: No JSON found in response"
+        },
+        features: [],
+        contracts: [],
+        dependencies: {},
+        structure: { totalFiles: files.length, totalLines }
+      };
+    }
+    const result = safeParseJson(json, PartialUnderstandingFromLLM);
+    if (!result.success) {
+      return {
+        version: "1",
+        generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        summary: {
+          type: "unknown",
+          language: "unknown",
+          description: `Failed to analyze codebase: ${result.error}`
+        },
+        features: [],
+        contracts: [],
+        dependencies: {},
+        structure: { totalFiles: files.length, totalLines }
+      };
+    }
+    const parsed = result.data;
+    return {
+      version: "1",
+      generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      summary: {
+        type: parsed.summary?.type || "unknown",
+        framework: parsed.summary?.framework || void 0,
+        language: parsed.summary?.language || "typescript",
+        description: parsed.summary?.description || "No description available"
+      },
+      features: (parsed.features || []).map((f) => ({
+        name: f.name || "Unknown",
+        description: f.description || "",
+        priority: f.priority || "medium",
+        constraints: f.constraints || [],
+        relatedFiles: f.relatedFiles || []
+      })),
+      contracts: (parsed.contracts || []).map((c) => ({
+        function: c.function || "unknown",
+        file: c.file || "unknown",
+        inputs: c.inputs || [],
+        outputs: c.outputs || { type: "unknown" },
+        invariants: c.invariants || [],
+        sideEffects: c.sideEffects || [],
+        throws: c.throws
+      })),
+      dependencies: {},
+      structure: {
+        totalFiles: files.length,
+        totalLines
+      }
+    };
+  }
+  // ─────────────────────────────────────────────────────────────
+  // Utilities
+  // ─────────────────────────────────────────────────────────────
+  extractJson(text) {
+    const codeBlockMatch = text.match(/```(?:json)?\s*([\s\S]*?)```/);
+    if (codeBlockMatch) {
+      return codeBlockMatch[1].trim();
+    }
+    const arrayMatch = text.match(/\[[\s\S]*\]/);
+    if (arrayMatch) {
+      return arrayMatch[0];
+    }
+    const objectMatch = text.match(/\{[\s\S]*\}/);
+    if (objectMatch) {
+      return objectMatch[0];
+    }
+    return null;
+  }
+};
+var MAX_FILE_SIZE = 5e4;
+var MAX_TOTAL_CONTEXT = 2e5;
+var AIDER_TIMEOUT = 3e5;
+var AiderProvider = class {
+  name = "aider";
+  async detect() {
+    return isProviderAvailable("aider");
+  }
+  async isAvailable() {
+    return isProviderAvailable("aider");
+  }
+  async analyze(context) {
+    const { files, understanding, staticAnalysisResults } = context;
+    if (files.length === 0) {
+      return [];
+    }
+    const fileContents = this.readFilesWithLimit(files, MAX_TOTAL_CONTEXT);
+    const prompt = this.buildAnalysisPrompt(fileContents, understanding, staticAnalysisResults);
+    const result = await this.runAider(prompt, files, dirname(files[0]));
+    return this.parseAnalysisResponse(result, files);
+  }
+  async adversarialValidate(bug, _context) {
+    let fileContent = "";
+    try {
+      if (existsSync(bug.file)) {
+        fileContent = readFileSync(bug.file, "utf-8");
+        const lines = fileContent.split("\n");
+        const start = Math.max(0, bug.line - 20);
+        const end = Math.min(lines.length, (bug.endLine || bug.line) + 20);
+        fileContent = lines.slice(start, end).join("\n");
+      }
+    } catch {
+    }
+    const prompt = this.buildAdversarialPrompt(bug, fileContent);
+    const result = await this.runAider(prompt, [bug.file], dirname(bug.file));
+    return this.parseAdversarialResponse(result, bug);
+  }
+  async generateUnderstanding(files, _existingDocsSummary) {
+    const sampledFiles = this.prioritizeFiles(files, 40);
+    const fileContents = this.readFilesWithLimit(sampledFiles, MAX_TOTAL_CONTEXT);
+    let packageJson = null;
+    const packageJsonPath = files.find((f) => f.endsWith("package.json"));
+    if (packageJsonPath) {
+      try {
+        packageJson = JSON.parse(readFileSync(packageJsonPath, "utf-8"));
+      } catch {
+      }
+    }
+    const prompt = this.buildUnderstandingPrompt(files.length, fileContents, packageJson);
+    const result = await this.runAider(prompt, sampledFiles.slice(0, 5), process.cwd());
+    return this.parseUnderstandingResponse(result, files);
+  }
+  // ─────────────────────────────────────────────────────────────
+  // File Reading Helpers
+  // ─────────────────────────────────────────────────────────────
+  readFilesWithLimit(files, maxTotal) {
+    const result = [];
+    let totalSize = 0;
+    for (const file of files) {
+      if (totalSize >= maxTotal) break;
+      try {
+        if (!existsSync(file)) continue;
+        let content = readFileSync(file, "utf-8");
+        if (content.length > MAX_FILE_SIZE) {
+          content = content.slice(0, MAX_FILE_SIZE) + "\n// ... truncated ...";
+        }
+        if (totalSize + content.length > maxTotal) {
+          const remaining = maxTotal - totalSize;
+          content = content.slice(0, remaining) + "\n// ... truncated ...";
+        }
+        result.push({ path: file, content });
+        totalSize += content.length;
+      } catch {
+      }
+    }
+    return result;
+  }
+  prioritizeFiles(files, count) {
+    if (files.length <= count) return files;
+    const priorityPatterns = [
+      { pattern: /package\.json$/, priority: 100 },
+      { pattern: /tsconfig\.json$/, priority: 90 },
+      { pattern: /README\.md$/i, priority: 80 },
+      { pattern: /\/index\.(ts|js|tsx|jsx)$/, priority: 70 },
+      { pattern: /\/app\.(ts|js|tsx|jsx)$/, priority: 70 },
+      { pattern: /\/main\.(ts|js|tsx|jsx)$/, priority: 70 },
+      { pattern: /\/api\//, priority: 60 },
+      { pattern: /\/routes?\//, priority: 55 },
+      { pattern: /\/pages\//, priority: 55 },
+      { pattern: /\/services?\//, priority: 50 },
+      { pattern: /\.(ts|tsx)$/, priority: 30 },
+      { pattern: /\.(js|jsx)$/, priority: 20 }
+    ];
+    const scored = files.map((file) => {
+      let score = 0;
+      for (const { pattern, priority } of priorityPatterns) {
+        if (pattern.test(file)) {
+          score = Math.max(score, priority);
+        }
+      }
+      return { file, score };
+    });
+    scored.sort((a, b) => b.score - a.score);
+    return scored.slice(0, count).map((s) => s.file);
+  }
+  // ─────────────────────────────────────────────────────────────
+  // Prompt Builders (similar to Claude Code but adapted for Aider)
+  // ─────────────────────────────────────────────────────────────
+  buildAnalysisPrompt(fileContents, understanding, staticResults) {
+    const filesSection = fileContents.map((f) => `=== ${f.path} ===
+${f.content}`).join("\n\n");
+    const staticSignals = staticResults.length > 0 ? `
+Static analysis signals:
+${staticResults.slice(0, 50).map((r) => `- ${r.file}:${r.line}: ${r.message}`).join("\n")}` : "";
+    return `Analyze the following code for bugs. This is a ${understanding.summary.type} application using ${understanding.summary.framework || "no specific framework"}.
+
+${filesSection}
+${staticSignals}
+
+Find bugs in these categories:
+1. Logic errors (off-by-one, wrong operators)
+2. Null/undefined dereference
+3. Security vulnerabilities
+4. Async/race conditions
+5. Edge cases not handled
+
+Output as JSON array ONLY:
+[{"file": "path", "line": 42, "title": "Bug title", "description": "Description", "severity": "high", "category": "null-reference", "codePath": [{"step": 1, "file": "path", "line": 40, "code": "code", "explanation": "explanation"}], "evidence": ["evidence1"], "suggestedFix": "fix code"}]
+
+If no bugs found, output: []`;
+  }
+  buildAdversarialPrompt(bug, fileContent) {
+    return `Try to DISPROVE this bug report:
+
+Bug: ${bug.title}
+File: ${bug.file}:${bug.line}
+Description: ${bug.description}
+
+Code context:
+${fileContent}
+
+Find reasons this is NOT a bug (guards, type checks, etc).
+
+Output JSON ONLY:
+{"survived": true/false, "counterArguments": ["reason1", "reason2"], "confidence": "high/medium/low"}`;
+  }
+  buildUnderstandingPrompt(totalFiles, fileContents, packageJson) {
+    const filesSection = fileContents.map((f) => `=== ${f.path} ===
+${f.content}`).join("\n\n");
+    const depsSection = packageJson ? `
+Dependencies: ${JSON.stringify(packageJson.dependencies || {})}` : "";
+    return `Analyze this codebase (${totalFiles} total files).
+${depsSection}
+
+${filesSection}
+
+Output JSON ONLY describing:
+{
+  "summary": {"type": "app-type", "framework": "framework", "language": "typescript", "description": "description"},
+  "features": [{"name": "Feature", "description": "desc", "priority": "critical", "constraints": ["constraint"], "relatedFiles": ["file"]}],
+  "contracts": [{"function": "funcName", "file": "file.ts", "inputs": [{"name": "param", "type": "string"}], "outputs": {"type": "Result"}, "invariants": ["rule"], "sideEffects": ["effect"]}]
+}`;
+  }
+  // ─────────────────────────────────────────────────────────────
+  // Aider CLI Execution
+  // ─────────────────────────────────────────────────────────────
+  async runAider(prompt, files, cwd) {
+    const tempDir = mkdtempSync(join(tmpdir(), "whiterose-"));
+    const promptFile = join(tempDir, "prompt.txt");
+    try {
+      writeFileSync(promptFile, prompt, "utf-8");
+      const args = [
+        "--no-auto-commits",
+        "--no-git",
+        "--yes",
+        "--message-file",
+        promptFile
+      ];
+      for (const file of files.slice(0, 10)) {
+        if (existsSync(file)) {
+          args.push(file);
+        }
+      }
+      const aiderCommand = getProviderCommand("aider");
+      const { stdout, stderr } = await execa(aiderCommand, args, {
+        cwd,
+        timeout: AIDER_TIMEOUT,
+        env: {
+          ...process.env,
+          NO_COLOR: "1"
+        },
+        reject: false
+      });
+      return stdout || stderr || "";
+    } catch (error) {
+      if (error.stdout) {
+        return error.stdout;
+      }
+      if (error.message?.includes("ENOENT")) {
+        throw new Error("Aider not found. Install it with: pip install aider-chat");
+      }
+      throw new Error(`Aider failed: ${error.message}`);
+    } finally {
+      try {
+        rmSync(tempDir, { recursive: true, force: true });
+      } catch {
+      }
+    }
+  }
+  // ─────────────────────────────────────────────────────────────
+  // Response Parsers
+  // ─────────────────────────────────────────────────────────────
+  parseAnalysisResponse(response, files) {
+    try {
+      const json = this.extractJson(response);
+      if (!json) return [];
+      const parsed = JSON.parse(json);
+      if (!Array.isArray(parsed)) return [];
+      const bugs = [];
+      for (let i = 0; i < parsed.length; i++) {
+        const item = parsed[i];
+        if (!item.file || !item.line || !item.title) continue;
+        let filePath = item.file;
+        if (!filePath.startsWith("/")) {
+          const match = files.find((f) => f.endsWith(filePath) || f.includes(filePath));
+          if (match) filePath = match;
+        }
+        const codePath = (item.codePath || []).map(
+          (step, idx) => ({
+            step: step.step || idx + 1,
+            file: step.file || filePath,
+            line: step.line || item.line,
+            code: step.code || "",
+            explanation: step.explanation || ""
+          })
+        );
+        bugs.push({
+          id: generateBugId(i),
+          title: String(item.title).slice(0, 100),
+          description: String(item.description || ""),
+          file: filePath,
+          line: Number(item.line) || 0,
+          endLine: item.endLine ? Number(item.endLine) : void 0,
+          severity: this.parseSeverity(item.severity),
+          category: this.parseCategory(item.category),
+          confidence: {
+            overall: "medium",
+            codePathValidity: 0.75,
+            reachability: 0.75,
+            intentViolation: false,
+            staticToolSignal: false,
+            adversarialSurvived: false
+          },
+          codePath,
+          evidence: Array.isArray(item.evidence) ? item.evidence.map(String) : [],
+          suggestedFix: item.suggestedFix ? String(item.suggestedFix) : void 0,
+          createdAt: (/* @__PURE__ */ new Date()).toISOString()
+        });
+      }
+      return bugs;
+    } catch {
+      return [];
+    }
+  }
+  parseAdversarialResponse(response, bug) {
+    try {
+      const json = this.extractJson(response);
+      if (!json) return { survived: true, counterArguments: [] };
+      const parsed = JSON.parse(json);
+      const survived = parsed.survived !== false;
+      return {
+        survived,
+        counterArguments: Array.isArray(parsed.counterArguments) ? parsed.counterArguments.map(String) : [],
+        adjustedConfidence: survived ? {
+          ...bug.confidence,
+          overall: this.parseConfidence(parsed.confidence),
+          adversarialSurvived: true
+        } : void 0
+      };
+    } catch {
+      return { survived: true, counterArguments: [] };
+    }
+  }
+  parseUnderstandingResponse(response, files) {
+    try {
+      const json = this.extractJson(response);
+      if (!json) throw new Error("No JSON found");
+      const parsed = JSON.parse(json);
+      let totalLines = 0;
+      for (const file of files.slice(0, 50)) {
+        try {
+          totalLines += readFileSync(file, "utf-8").split("\n").length;
+        } catch {
+        }
+      }
+      return {
+        version: "1",
+        generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        summary: {
+          type: parsed.summary?.type || "unknown",
+          framework: parsed.summary?.framework,
+          language: parsed.summary?.language || "typescript",
+          description: parsed.summary?.description || "No description available"
+        },
+        features: (parsed.features || []).map((f) => ({
+          name: f.name || "Unknown",
+          description: f.description || "",
+          priority: f.priority || "medium",
+          constraints: Array.isArray(f.constraints) ? f.constraints : [],
+          relatedFiles: Array.isArray(f.relatedFiles) ? f.relatedFiles : []
+        })),
+        contracts: (parsed.contracts || []).map((c) => ({
+          function: c.function || "unknown",
+          file: c.file || "unknown",
+          inputs: Array.isArray(c.inputs) ? c.inputs : [],
+          outputs: c.outputs || { type: "unknown" },
+          invariants: Array.isArray(c.invariants) ? c.invariants : [],
+          sideEffects: Array.isArray(c.sideEffects) ? c.sideEffects : []
+        })),
+        dependencies: {},
+        structure: {
+          totalFiles: files.length,
+          totalLines
+        }
+      };
+    } catch {
+      return {
+        version: "1",
+        generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        summary: {
+          type: "unknown",
+          language: "typescript",
+          description: "Failed to analyze codebase"
+        },
+        features: [],
+        contracts: [],
+        dependencies: {},
+        structure: {
+          totalFiles: files.length,
+          totalLines: 0
+        }
+      };
+    }
+  }
+  // ─────────────────────────────────────────────────────────────
+  // Utilities
+  // ─────────────────────────────────────────────────────────────
+  extractJson(text) {
+    const codeBlockMatch = text.match(/```(?:json)?\s*([\s\S]*?)```/);
+    if (codeBlockMatch) return codeBlockMatch[1].trim();
+    const arrayMatch = text.match(/\[[\s\S]*\]/);
+    if (arrayMatch) return arrayMatch[0];
+    const objectMatch = text.match(/\{[\s\S]*\}/);
+    if (objectMatch) return objectMatch[0];
+    return null;
+  }
+  parseSeverity(value) {
+    const str = String(value).toLowerCase();
+    if (["critical", "high", "medium", "low"].includes(str)) {
+      return str;
+    }
+    return "medium";
+  }
+  parseCategory(value) {
+    const str = String(value).toLowerCase().replace(/_/g, "-");
+    const validCategories = [
+      "logic-error",
+      "security",
+      "async-race-condition",
+      "edge-case",
+      "null-reference",
+      "type-coercion",
+      "resource-leak",
+      "intent-violation"
+    ];
+    if (validCategories.includes(str)) {
+      return str;
+    }
+    if (str.includes("null") || str.includes("undefined")) return "null-reference";
+    if (str.includes("security")) return "security";
+    if (str.includes("async") || str.includes("race")) return "async-race-condition";
+    return "logic-error";
+  }
+  parseConfidence(value) {
+    const str = String(value).toLowerCase();
+    if (["high", "medium", "low"].includes(str)) {
+      return str;
+    }
+    return "medium";
+  }
+};
+
+// src/providers/index.ts
+var providers = {
+  "claude-code": () => new ClaudeCodeProvider(),
+  aider: () => new AiderProvider(),
+  codex: () => {
+    throw new Error("Codex provider not yet implemented");
+  },
+  opencode: () => {
+    throw new Error("OpenCode provider not yet implemented");
+  },
+  ollama: () => {
+    throw new Error("Ollama provider not yet implemented");
+  },
+  gemini: () => {
+    throw new Error("Gemini provider not yet implemented");
+  }
+};
+async function getProvider(name) {
+  const factory = providers[name];
+  if (!factory) {
+    throw new Error(`Unknown provider: ${name}`);
+  }
+  const provider = factory();
+  const available = await provider.isAvailable();
+  if (!available) {
+    throw new Error(`Provider ${name} is not available. Make sure it's installed and configured.`);
+  }
+  return provider;
+}
+async function runStaticAnalysis(cwd, files, config) {
+  const results = [];
+  if (config.staticAnalysis.typescript) {
+    const tscResults = await runTypeScript(cwd);
+    results.push(...tscResults);
+  }
+  if (config.staticAnalysis.eslint) {
+    const eslintResults = await runEslint(cwd, files);
+    results.push(...eslintResults);
+  }
+  return results;
+}
+async function runTypeScript(cwd) {
+  const results = [];
+  const tsconfigPath = join(cwd, "tsconfig.json");
+  if (!existsSync(tsconfigPath)) {
+    return results;
+  }
+  try {
+    await execa("npx", ["tsc", "--noEmit", "--pretty", "false"], {
+      cwd,
+      timeout: 6e4
+    });
+  } catch (error) {
+    const output = error.stdout || "";
+    const lines = output.split("\n");
+    for (const line of lines) {
+      const match = line.match(/^(.+)\((\d+),(\d+)\):\s+(error|warning)\s+TS\d+:\s+(.+)$/);
+      if (match) {
+        results.push({
+          tool: "typescript",
+          file: match[1],
+          line: parseInt(match[2], 10),
+          message: match[5],
+          severity: match[4] === "error" ? "error" : "warning",
+          code: `TS${match[4]}`
+        });
+      }
+    }
+  }
+  return results;
+}
+async function runEslint(cwd, files) {
+  const results = [];
+  const hasEslint = existsSync(join(cwd, ".eslintrc")) || existsSync(join(cwd, ".eslintrc.js")) || existsSync(join(cwd, ".eslintrc.json")) || existsSync(join(cwd, ".eslintrc.yml")) || existsSync(join(cwd, "eslint.config.js")) || existsSync(join(cwd, "eslint.config.mjs"));
+  if (!hasEslint) {
+    return results;
+  }
+  try {
+    const { stdout } = await execa(
+      "npx",
+      ["eslint", "--format", "json", "--no-error-on-unmatched-pattern", ...files.slice(0, 50)],
+      {
+        cwd,
+        timeout: 6e4,
+        reject: false
+      }
+    );
+    const eslintResults = JSON.parse(stdout || "[]");
+    for (const fileResult of eslintResults) {
+      for (const message of fileResult.messages || []) {
+        results.push({
+          tool: "eslint",
+          file: fileResult.filePath,
+          line: message.line || 0,
+          message: message.message,
+          severity: message.severity === 2 ? "error" : "warning",
+          code: message.ruleId
+        });
+      }
+    }
+  } catch {
+  }
+  return results;
+}
+
+// src/output/sarif.ts
+function outputSarif(result) {
+  const rules = [];
+  const results = [];
+  const seenRules = /* @__PURE__ */ new Set();
+  for (const bug of result.bugs) {
+    if (!seenRules.has(bug.category)) {
+      seenRules.add(bug.category);
+      rules.push({
+        id: bug.category,
+        name: formatRuleName(bug.category),
+        shortDescription: { text: getCategoryDescription(bug.category) },
+        fullDescription: { text: getCategoryDescription(bug.category) },
+        defaultConfiguration: { level: "warning" },
+        properties: { category: bug.category }
+      });
+    }
+    results.push(bugToSarifResult(bug));
+  }
+  return {
+    $schema: "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
+    version: "2.1.0",
+    runs: [
+      {
+        tool: {
+          driver: {
+            name: "whiterose",
+            version: "0.1.0",
+            informationUri: "https://github.com/shakecodeslikecray/whiterose",
+            rules
+          }
+        },
+        results
+      }
+    ]
+  };
+}
+function bugToSarifResult(bug) {
+  const result = {
+    ruleId: bug.id,
+    level: severityToLevel(bug.severity),
+    message: {
+      text: bug.title,
+      markdown: `**${bug.title}**
+
+${bug.description}
+
+**Evidence:**
+${bug.evidence.map((e) => `- ${e}`).join("\n")}`
+    },
+    locations: [
+      {
+        physicalLocation: {
+          artifactLocation: { uri: bug.file },
+          region: { startLine: bug.line, endLine: bug.endLine }
+        }
+      }
+    ]
+  };
+  if (bug.codePath.length > 0) {
+    result.codeFlows = [
+      {
+        threadFlows: [
+          {
+            locations: bug.codePath.map((step) => ({
+              location: {
+                physicalLocation: {
+                  artifactLocation: { uri: step.file },
+                  region: { startLine: step.line }
+                }
+              },
+              message: { text: step.explanation }
+            }))
+          }
+        ]
+      }
+    ];
+  }
+  return result;
+}
+function severityToLevel(severity) {
+  switch (severity) {
+    case "critical":
+      return "error";
+    case "high":
+      return "error";
+    case "medium":
+      return "warning";
+    case "low":
+      return "note";
+    default:
+      return "warning";
+  }
+}
+function formatRuleName(category) {
+  return category.split("-").map((word) => word.charAt(0).toUpperCase() + word.slice(1)).join(" ");
+}
+function getCategoryDescription(category) {
+  const descriptions = {
+    "logic-error": "Logic errors such as off-by-one, wrong operators, or incorrect conditions",
+    security: "Security vulnerabilities including injection, auth bypass, and data exposure",
+    "async-race-condition": "Async/concurrency issues like race conditions and missing awaits",
+    "edge-case": "Edge cases that are not properly handled",
+    "null-reference": "Potential null or undefined reference issues",
+    "type-coercion": "Type coercion bugs that may cause unexpected behavior",
+    "resource-leak": "Resource leaks such as unclosed handles or connections",
+    "intent-violation": "Violations of documented behavioral contracts or business rules"
+  };
+  return descriptions[category] || "Unknown bug category";
+}
+
+// src/output/markdown.ts
+function outputMarkdown(result) {
+  const lines = [];
+  lines.push("# Bug Report");
+  lines.push("");
+  lines.push(`> Generated by [whiterose](https://github.com/shakecodeslikecray/whiterose) on ${(/* @__PURE__ */ new Date()).toISOString()}`);
+  lines.push("");
+  lines.push("## Summary");
+  lines.push("");
+  lines.push(`| Severity | Count |`);
+  lines.push(`|----------|-------|`);
+  lines.push(`| Critical | ${result.summary.critical} |`);
+  lines.push(`| High | ${result.summary.high} |`);
+  lines.push(`| Medium | ${result.summary.medium} |`);
+  lines.push(`| Low | ${result.summary.low} |`);
+  lines.push(`| **Total** | **${result.summary.total}** |`);
+  lines.push("");
+  lines.push(`- **Scan Type:** ${result.scanType}`);
+  lines.push(`- **Files Scanned:** ${result.filesScanned}`);
+  if (result.filesChanged !== void 0) {
+    lines.push(`- **Files Changed:** ${result.filesChanged}`);
+  }
+  lines.push("");
+  if (result.bugs.length === 0) {
+    lines.push("No bugs found.");
+    return lines.join("\n");
+  }
+  const bySeverity = {
+    critical: [],
+    high: [],
+    medium: [],
+    low: []
+  };
+  for (const bug of result.bugs) {
+    bySeverity[bug.severity].push(bug);
+  }
+  if (bySeverity.critical.length > 0) {
+    lines.push("## Critical");
+    lines.push("");
+    for (const bug of bySeverity.critical) {
+      lines.push(formatBug(bug));
+    }
+  }
+  if (bySeverity.high.length > 0) {
+    lines.push("## High");
+    lines.push("");
+    for (const bug of bySeverity.high) {
+      lines.push(formatBug(bug));
+    }
+  }
+  if (bySeverity.medium.length > 0) {
+    lines.push("## Medium");
+    lines.push("");
+    for (const bug of bySeverity.medium) {
+      lines.push(formatBug(bug));
+    }
+  }
+  if (bySeverity.low.length > 0) {
+    lines.push("## Low");
+    lines.push("");
+    for (const bug of bySeverity.low) {
+      lines.push(formatBug(bug));
+    }
+  }
+  return lines.join("\n");
+}
+function formatBug(bug) {
+  const lines = [];
+  const confidenceBadge = getConfidenceBadge(bug.confidence.overall);
+  lines.push(`### ${bug.id}: ${bug.title} ${confidenceBadge}`);
+  lines.push("");
+  lines.push(`**Location:** \`${bug.file}:${bug.line}\``);
+  lines.push(`**Category:** ${formatCategory(bug.category)}`);
+  lines.push("");
+  lines.push(bug.description);
+  lines.push("");
+  if (bug.codePath.length > 0) {
+    lines.push("<details>");
+    lines.push("<summary>Code Path</summary>");
+    lines.push("");
+    for (const step of bug.codePath) {
+      lines.push(`${step.step}. \`${step.file}:${step.line}\``);
+      lines.push(`   \`\`\`${getLanguage(step.file)}`);
+      lines.push(`   ${step.code}`);
+      lines.push("   ```");
+      lines.push(`   ${step.explanation}`);
+      lines.push("");
+    }
+    lines.push("</details>");
+    lines.push("");
+  }
+  if (bug.evidence.length > 0) {
+    lines.push("**Evidence:**");
+    for (const e of bug.evidence) {
+      lines.push(`- ${e}`);
+    }
+    lines.push("");
+  }
+  if (bug.suggestedFix) {
+    lines.push("**Suggested Fix:**");
+    lines.push("```");
+    lines.push(bug.suggestedFix);
+    lines.push("```");
+    lines.push("");
+  }
+  lines.push("---");
+  lines.push("");
+  return lines.join("\n");
+}
+function getConfidenceBadge(confidence) {
+  switch (confidence) {
+    case "high":
+      return "`[HIGH CONFIDENCE]`";
+    case "medium":
+      return "`[MEDIUM CONFIDENCE]`";
+    case "low":
+      return "`[LOW CONFIDENCE]`";
+    default:
+      return "";
+  }
+}
+function formatCategory(category) {
+  return category.split("-").map((word) => word.charAt(0).toUpperCase() + word.slice(1)).join(" ");
+}
+function getLanguage(file) {
+  if (file.endsWith(".ts") || file.endsWith(".tsx")) return "typescript";
+  if (file.endsWith(".js") || file.endsWith(".jsx")) return "javascript";
+  if (file.endsWith(".py")) return "python";
+  if (file.endsWith(".go")) return "go";
+  return "";
+}
+
+// src/core/contracts/intent.ts
+function generateIntentDocument(understanding) {
+  const lines = [];
+  lines.push(`# App Intent: ${understanding.summary.type}`);
+  lines.push("");
+  lines.push(`> Generated by whiterose on ${(/* @__PURE__ */ new Date()).toISOString()}`);
+  lines.push("> Edit the sections above the line. Contracts below are auto-generated.");
+  lines.push("");
+  lines.push("## Overview");
+  lines.push("");
+  lines.push(understanding.summary.description);
+  lines.push("");
+  lines.push(`- **Framework:** ${understanding.summary.framework || "None detected"}`);
+  lines.push(`- **Language:** ${understanding.summary.language}`);
+  lines.push(`- **Files:** ${understanding.structure.totalFiles}`);
+  if (understanding.structure.packages?.length) {
+    lines.push(`- **Packages:** ${understanding.structure.packages.join(", ")}`);
+  }
+  lines.push("");
+  if (understanding.features.length > 0) {
+    lines.push("## Critical Features");
+    lines.push("");
+    const criticalFeatures = understanding.features.filter((f) => f.priority === "critical");
+    const highFeatures = understanding.features.filter((f) => f.priority === "high");
+    const otherFeatures = understanding.features.filter(
+      (f) => f.priority !== "critical" && f.priority !== "high"
+    );
+    for (const feature of criticalFeatures) {
+      lines.push(formatFeature(feature, "CRITICAL"));
+    }
+    if (highFeatures.length > 0) {
+      lines.push("## High Priority Features");
+      lines.push("");
+      for (const feature of highFeatures) {
+        lines.push(formatFeature(feature, "HIGH"));
+      }
+    }
+    if (otherFeatures.length > 0) {
+      lines.push("## Other Features");
+      lines.push("");
+      for (const feature of otherFeatures) {
+        lines.push(formatFeature(feature));
+      }
+    }
+  }
+  lines.push("## Known Constraints");
+  lines.push("");
+  lines.push("<!-- Add any known constraints or business rules here -->");
+  lines.push("");
+  lines.push("- (Add your constraints here)");
+  lines.push("");
+  lines.push("## Areas of Concern");
+  lines.push("");
+  lines.push("<!-- Add files or areas that need extra scrutiny -->");
+  lines.push("");
+  lines.push("- (Add files that have had bugs before)");
+  lines.push("");
+  lines.push("---");
+  lines.push("");
+  lines.push("<!-- \u26A0\uFE0F DO NOT EDIT BELOW THIS LINE - Auto-generated contracts -->");
+  lines.push("");
+  if (understanding.contracts.length > 0) {
+    lines.push("## Behavioral Contracts");
+    lines.push("");
+    for (const contract of understanding.contracts) {
+      lines.push(formatContract(contract));
+    }
+  }
+  return lines.join("\n");
+}
+function formatFeature(feature, badge) {
+  const lines = [];
+  const badgeStr = badge ? ` [${badge}]` : "";
+  lines.push(`### ${feature.name}${badgeStr}`);
+  lines.push("");
+  lines.push(feature.description);
+  lines.push("");
+  if (feature.constraints.length > 0) {
+    lines.push("**Constraints:**");
+    for (const constraint of feature.constraints) {
+      lines.push(`- ${constraint}`);
+    }
+    lines.push("");
+  }
+  if (feature.relatedFiles.length > 0) {
+    lines.push(`**Files:** \`${feature.relatedFiles.join("`, `")}\``);
+    lines.push("");
+  }
+  return lines.join("\n");
+}
+function formatContract(contract) {
+  const lines = [];
+  lines.push(`### \`${contract.file}:${contract.function}()\``);
+  lines.push("");
+  if (contract.inputs.length > 0) {
+    lines.push("**Inputs:**");
+    for (const input of contract.inputs) {
+      const constraints = input.constraints ? ` (${input.constraints})` : "";
+      lines.push(`- \`${input.name}\`: ${input.type}${constraints}`);
+    }
+    lines.push("");
+  }
+  lines.push("**Returns:** `" + contract.outputs.type + "`");
+  if (contract.outputs.constraints) {
+    lines.push(`  - ${contract.outputs.constraints}`);
+  }
+  lines.push("");
+  if (contract.invariants.length > 0) {
+    lines.push("**Invariants:**");
+    for (const invariant of contract.invariants) {
+      lines.push(`- ${invariant}`);
+    }
+    lines.push("");
+  }
+  if (contract.sideEffects.length > 0) {
+    lines.push("**Side Effects:**");
+    for (const effect of contract.sideEffects) {
+      lines.push(`- ${effect}`);
+    }
+    lines.push("");
+  }
+  if (contract.throws && contract.throws.length > 0) {
+    lines.push("**Throws:**");
+    for (const t of contract.throws) {
+      lines.push(`- ${t}`);
+    }
+    lines.push("");
+  }
+  return lines.join("\n");
+}
+function parseIntentDocument(content) {
+  const result = {
+    knownConstraints: [],
+    areasOfConcern: [],
+    customFeatures: [],
+    overrides: {}
+  };
+  const sections = splitIntoSections(content);
+  const constraintsSection = sections.find((s) => s.title.includes("Known Constraints"));
+  if (constraintsSection) {
+    result.knownConstraints = parseListItems(constraintsSection.content);
+  }
+  const concernsSection = sections.find((s) => s.title.includes("Areas of Concern"));
+  if (concernsSection) {
+    result.areasOfConcern = parseListItems(concernsSection.content);
+  }
+  const overviewSection = sections.find((s) => s.title.includes("Overview"));
+  if (overviewSection) {
+    const frameworkMatch = overviewSection.content.match(/\*\*Framework:\*\*\s*(.+)/);
+    if (frameworkMatch && !frameworkMatch[1].includes("None detected")) {
+      result.overrides.framework = frameworkMatch[1].trim();
+    }
+    const paragraphs = overviewSection.content.split(/\n\n+/);
+    const firstParagraph = paragraphs[0]?.trim();
+    if (firstParagraph && !firstParagraph.startsWith("-") && !firstParagraph.startsWith("*")) {
+      result.overrides.description = firstParagraph;
+    }
+  }
+  const editableSections = content.split(/---+/)[0] || "";
+  const featureSections = editableSections.match(/###\s+([^\n]+)\n([\s\S]*?)(?=###|##|$)/g);
+  if (featureSections) {
+    for (const section of featureSections) {
+      const feature = parseFeatureSection(section);
+      if (feature && isUserAddedFeature(feature)) {
+        result.customFeatures.push(feature);
+      }
+    }
+  }
+  return result;
+}
+function splitIntoSections(content) {
+  const sections = [];
+  const sectionRegex = /^##\s+([^\n]+)\n([\s\S]*?)(?=^##\s|$)/gm;
+  let match;
+  while ((match = sectionRegex.exec(content)) !== null) {
+    sections.push({
+      title: match[1].trim(),
+      content: match[2].trim()
+    });
+  }
+  return sections;
+}
+function parseListItems(content) {
+  const items = [];
+  const lines = content.split("\n");
+  for (const line of lines) {
+    const match = line.match(/^[-*]\s+(.+)/);
+    if (match) {
+      const item = match[1].trim();
+      if (!item.includes("Add your") && !item.includes("Add files") && item !== "") {
+        items.push(item);
+      }
+    }
+  }
+  return items;
+}
+function parseFeatureSection(section) {
+  const titleMatch = section.match(/###\s+([^\[\n]+)(?:\s*\[([^\]]+)\])?/);
+  if (!titleMatch) return null;
+  const name = titleMatch[1].trim();
+  const badge = titleMatch[2]?.trim().toLowerCase();
+  let priority = "medium";
+  if (badge === "critical") priority = "critical";
+  else if (badge === "high") priority = "high";
+  else if (badge === "low") priority = "low";
+  const contentAfterTitle = section.replace(/###\s+[^\n]+\n/, "").trim();
+  const paragraphs = contentAfterTitle.split(/\n\n+/);
+  const description = paragraphs[0]?.trim() || "";
+  const constraints = [];
+  const constraintsMatch = section.match(/\*\*Constraints:\*\*\n((?:[-*]\s+[^\n]+\n?)+)/);
+  if (constraintsMatch) {
+    const constraintLines = constraintsMatch[1].split("\n");
+    for (const line of constraintLines) {
+      const match = line.match(/^[-*]\s+(.+)/);
+      if (match) {
+        constraints.push(match[1].trim());
+      }
+    }
+  }
+  const relatedFiles = [];
+  const filesMatch = section.match(/\*\*Files:\*\*\s*`([^`]+)`/);
+  if (filesMatch) {
+    const files = filesMatch[1].split(/`,\s*`/);
+    relatedFiles.push(...files.map((f) => f.replace(/`/g, "").trim()));
+  }
+  return {
+    name,
+    description,
+    priority,
+    constraints,
+    relatedFiles
+  };
+}
+function isUserAddedFeature(feature) {
+  return feature.constraints.length > 0 || feature.description.length > 50 || feature.relatedFiles.length > 0;
+}
+function mergeIntentWithUnderstanding(understanding, parsedIntent) {
+  const merged = { ...understanding };
+  if (parsedIntent.overrides.description) {
+    merged.summary = {
+      ...merged.summary,
+      description: parsedIntent.overrides.description
+    };
+  }
+  if (parsedIntent.overrides.framework) {
+    merged.summary = {
+      ...merged.summary,
+      framework: parsedIntent.overrides.framework
+    };
+  }
+  if (parsedIntent.customFeatures.length > 0) {
+    merged.features = [
+      ...parsedIntent.customFeatures,
+      ...merged.features.filter(
+        (f) => !parsedIntent.customFeatures.some((cf) => cf.name === f.name)
+      )
+    ];
+  }
+  if (parsedIntent.knownConstraints.length > 0) {
+    merged.globalConstraints = parsedIntent.knownConstraints;
+  }
+  if (parsedIntent.areasOfConcern.length > 0) {
+    merged.areasOfConcern = parsedIntent.areasOfConcern;
+  }
+  return merged;
+}
+var GIT_TIMEOUT = 3e4;
+async function isGitRepo(cwd = process.cwd()) {
+  try {
+    await execa("git", ["rev-parse", "--git-dir"], { cwd, timeout: GIT_TIMEOUT });
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function getCurrentBranch(cwd = process.cwd()) {
+  try {
+    const { stdout } = await execa("git", ["branch", "--show-current"], {
+      cwd,
+      timeout: GIT_TIMEOUT
+    });
+    return stdout.trim();
+  } catch {
+    return "main";
+  }
+}
+async function hasUncommittedChanges(cwd = process.cwd()) {
+  try {
+    const { stdout } = await execa("git", ["status", "--porcelain"], {
+      cwd,
+      timeout: GIT_TIMEOUT
+    });
+    return stdout.trim().length > 0;
+  } catch {
+    return false;
+  }
+}
+async function createFixBranch(branchName, bug, cwd = process.cwd()) {
+  const safeBugId = bug.id.toLowerCase().replace(/[^a-z0-9]/g, "-");
+  const safeTitle = bug.title.toLowerCase().replace(/[^a-z0-9\s]/g, "").replace(/\s+/g, "-").slice(0, 30);
+  const fullBranchName = branchName || `whiterose/fix-${safeBugId}-${safeTitle}`;
+  try {
+    try {
+      await execa("git", ["rev-parse", "--verify", fullBranchName], {
+        cwd,
+        timeout: GIT_TIMEOUT
+      });
+      await execa("git", ["checkout", fullBranchName], { cwd, timeout: GIT_TIMEOUT });
+    } catch {
+      await execa("git", ["checkout", "-b", fullBranchName], { cwd, timeout: GIT_TIMEOUT });
+    }
+    return fullBranchName;
+  } catch (error) {
+    throw new Error(`Failed to create branch: ${error.message}`);
+  }
+}
+async function commitFix(bug, cwd = process.cwd()) {
+  try {
+    await execa("git", ["add", bug.file], { cwd, timeout: GIT_TIMEOUT });
+    const { stdout: diff } = await execa("git", ["diff", "--cached", "--name-only"], {
+      cwd,
+      timeout: GIT_TIMEOUT
+    });
+    if (!diff.trim()) {
+      return "";
+    }
+    const commitMessage = `fix(${bug.category}): ${bug.title}
+
+Bug ID: ${bug.id}
+File: ${bug.file}:${bug.line}
+Severity: ${bug.severity}
+
+${bug.description}
+
+Fixed by whiterose`;
+    await execa("git", ["commit", "-m", commitMessage], {
+      cwd,
+      timeout: GIT_TIMEOUT
+    });
+    const { stdout: hash } = await execa("git", ["rev-parse", "HEAD"], {
+      cwd,
+      timeout: GIT_TIMEOUT
+    });
+    return hash.trim();
+  } catch (error) {
+    throw new Error(`Failed to commit fix: ${error.message}`);
+  }
+}
+async function stashChanges(cwd = process.cwd()) {
+  try {
+    const hasChanges = await hasUncommittedChanges(cwd);
+    if (!hasChanges) {
+      return false;
+    }
+    await execa("git", ["stash", "push", "-m", "whiterose: stash before fix"], {
+      cwd,
+      timeout: GIT_TIMEOUT
+    });
+    return true;
+  } catch (error) {
+    throw new Error(`Failed to stash changes: ${error.message}`);
+  }
+}
+async function popStash(cwd = process.cwd()) {
+  try {
+    await execa("git", ["stash", "pop"], { cwd, timeout: GIT_TIMEOUT });
+  } catch (error) {
+    throw new Error(`Failed to pop stash: ${error.message}`);
+  }
+}
+async function getDiff(file, cwd = process.cwd()) {
+  try {
+    const { stdout } = await execa("git", ["diff", file], { cwd, timeout: GIT_TIMEOUT });
+    return stdout;
+  } catch {
+    return "";
+  }
+}
+async function getStagedDiff(cwd = process.cwd()) {
+  try {
+    const { stdout } = await execa("git", ["diff", "--cached"], { cwd, timeout: GIT_TIMEOUT });
+    return stdout;
+  } catch {
+    return "";
+  }
+}
+async function resetFile(file, cwd = process.cwd()) {
+  try {
+    await execa("git", ["checkout", "--", file], { cwd, timeout: GIT_TIMEOUT });
+  } catch (error) {
+    throw new Error(`Failed to reset file: ${error.message}`);
+  }
+}
+async function getFileAtHead(file, cwd = process.cwd()) {
+  try {
+    const { stdout } = await execa("git", ["show", `HEAD:${file}`], {
+      cwd,
+      timeout: GIT_TIMEOUT
+    });
+    return stdout;
+  } catch {
+    return "";
+  }
+}
+async function getGitStatus(cwd = process.cwd()) {
+  const isRepo = await isGitRepo(cwd);
+  if (!isRepo) {
+    return {
+      isRepo: false,
+      branch: "",
+      hasChanges: false,
+      staged: [],
+      modified: [],
+      untracked: []
+    };
+  }
+  const branch = await getCurrentBranch(cwd);
+  try {
+    const { stdout } = await execa("git", ["status", "--porcelain"], {
+      cwd,
+      timeout: GIT_TIMEOUT
+    });
+    const staged = [];
+    const modified = [];
+    const untracked = [];
+    for (const line of stdout.split("\n")) {
+      if (!line.trim()) continue;
+      const status = line.slice(0, 2);
+      const file = line.slice(3);
+      if (status[0] !== " " && status[0] !== "?") {
+        staged.push(file);
+      }
+      if (status[1] === "M") {
+        modified.push(file);
+      }
+      if (status === "??") {
+        untracked.push(file);
+      }
+    }
+    return {
+      isRepo: true,
+      branch,
+      hasChanges: staged.length > 0 || modified.length > 0,
+      staged,
+      modified,
+      untracked
+    };
+  } catch {
+    return {
+      isRepo: true,
+      branch,
+      hasChanges: false,
+      staged: [],
+      modified: [],
+      untracked: []
+    };
+  }
+}
+
+// src/core/fixer.ts
+function isPathWithinProject(filePath, projectDir) {
+  const resolvedPath = resolve(projectDir, filePath);
+  const relativePath = relative(projectDir, resolvedPath);
+  return !relativePath.startsWith("..") && !isAbsolute(relativePath);
+}
+function validateFilePath(filePath, projectDir) {
+  const resolvedPath = isAbsolute(filePath) ? filePath : resolve(projectDir, filePath);
+  if (!isPathWithinProject(resolvedPath, projectDir)) {
+    throw new Error(`Security: Refusing to access file outside project directory: ${filePath}`);
+  }
+  if (filePath.includes("\0") || filePath.includes("..")) {
+    throw new Error(`Security: Invalid file path contains suspicious characters: ${filePath}`);
+  }
+  return resolvedPath;
+}
+async function applyFix(bug, config, options) {
+  const { dryRun, branch } = options;
+  const projectDir = process.cwd();
+  let safePath;
+  try {
+    safePath = validateFilePath(bug.file, projectDir);
+  } catch (error) {
+    return {
+      success: false,
+      error: error.message
+    };
+  }
+  if (!existsSync(safePath)) {
+    return {
+      success: false,
+      error: `File not found: ${bug.file}`
+    };
+  }
+  const originalContent = readFileSync(safePath, "utf-8");
+  const lines = originalContent.split("\n");
+  let fixedContent;
+  let diff;
+  if (bug.suggestedFix) {
+    const result = applySimpleFix(lines, bug.line, bug.endLine || bug.line, bug.suggestedFix);
+    if (result.success) {
+      fixedContent = result.content;
+      diff = result.diff;
+    } else {
+      const llmResult = await generateAndApplyFix(bug, config, originalContent, safePath);
+      if (!llmResult.success) {
+        return llmResult;
+      }
+      fixedContent = llmResult.content;
+      diff = llmResult.diff;
+    }
+  } else {
+    const llmResult = await generateAndApplyFix(bug, config, originalContent, safePath);
+    if (!llmResult.success) {
+      return llmResult;
+    }
+    fixedContent = llmResult.content;
+    diff = llmResult.diff;
+  }
+  if (dryRun) {
+    console.log("\n--- Dry Run: Proposed changes ---");
+    console.log(diff);
+    console.log("--- End of proposed changes ---\n");
+    return {
+      success: true,
+      diff
+    };
+  }
+  let branchName;
+  if (branch) {
+    branchName = await createFixBranch(branch, bug);
+  }
+  writeFileSync(safePath, fixedContent, "utf-8");
+  if (branchName || !branch) {
+    await commitFix(bug);
+  }
+  return {
+    success: true,
+    diff,
+    branchName
+  };
+}
+function applySimpleFix(lines, startLine, endLine, fix) {
+  const lineIndex = startLine - 1;
+  const endIndex = endLine - 1;
+  if (lineIndex < 0 || lineIndex >= lines.length) {
+    return { success: false, content: "", diff: "" };
+  }
+  const originalLine = lines[lineIndex];
+  const indentMatch = originalLine.match(/^(\s*)/);
+  const indent = indentMatch ? indentMatch[1] : "";
+  const fixLines = fix.split("\n").map((line, i) => {
+    if (i === 0 || line.trim() === "") return line;
+    return indent + line.trimStart();
+  });
+  const removedLines = lines.slice(lineIndex, endIndex + 1);
+  const diff = [
+    `--- ${lines[lineIndex]}`,
+    ...removedLines.map((l) => `- ${l}`),
+    ...fixLines.map((l) => `+ ${l}`)
+  ].join("\n");
+  const newLines = [...lines.slice(0, lineIndex), ...fixLines, ...lines.slice(endIndex + 1)];
+  return {
+    success: true,
+    content: newLines.join("\n"),
+    diff
+  };
+}
+async function generateAndApplyFix(bug, _config, originalContent, safePath) {
+  try {
+    const prompt = buildFixPrompt(bug, originalContent);
+    const workingDir = safePath ? dirname(safePath) : process.cwd();
+    const { stdout } = await execa(
+      "claude",
+      ["-p", prompt, "--output-format", "text"],
+      {
+        cwd: workingDir,
+        timeout: 12e4,
+        env: { ...process.env, NO_COLOR: "1" }
+      }
+    );
+    const fixedContent = parseFixResponse(stdout, originalContent);
+    if (!fixedContent) {
+      return {
+        success: false,
+        error: "Failed to parse fix from LLM response"
+      };
+    }
+    const diff = generateDiff(originalContent, fixedContent, bug.file);
+    return {
+      success: true,
+      content: fixedContent,
+      diff
+    };
+  } catch (error) {
+    return {
+      success: false,
+      error: error.message || "Unknown error generating fix"
+    };
+  }
+}
+function buildFixPrompt(bug, originalContent) {
+  return `Fix the following bug in the code.
+
+BUG DETAILS:
+- Title: ${bug.title}
+- Description: ${bug.description}
+- File: ${bug.file}
+- Line: ${bug.line}${bug.endLine ? `-${bug.endLine}` : ""}
+- Category: ${bug.category}
+- Severity: ${bug.severity}
+
+EVIDENCE:
+${bug.evidence.map((e) => `- ${e}`).join("\n")}
+
+CODE PATH:
+${bug.codePath.map((s) => `${s.step}. ${s.file}:${s.line} - ${s.explanation}`).join("\n")}
+
+ORIGINAL FILE CONTENT:
+\`\`\`
+${originalContent}
+\`\`\`
+
+${bug.suggestedFix ? `SUGGESTED FIX APPROACH:
+${bug.suggestedFix}
+
+` : ""}
+
+Please provide the COMPLETE fixed file content. Output ONLY the fixed code, no explanations.
+Wrap the code in \`\`\` code blocks.
+
+IMPORTANT:
+- Fix ONLY the identified bug
+- Do not refactor or change anything else
+- Preserve all formatting and style
+- Ensure the fix actually addresses the bug`;
+}
+function parseFixResponse(response, originalContent) {
+  const codeBlockMatch = response.match(/```(?:\w+)?\s*([\s\S]*?)```/);
+  if (codeBlockMatch) {
+    const extracted = codeBlockMatch[1].trim();
+    const originalLines = originalContent.split("\n").slice(0, 5);
+    const extractedLines = extracted.split("\n").slice(0, 5);
+    let matchCount = 0;
+    for (const origLine of originalLines) {
+      if (extractedLines.some((l) => l.trim() === origLine.trim())) {
+        matchCount++;
+      }
+    }
+    if (matchCount >= 2 || extracted.length > originalContent.length * 0.5) {
+      return extracted;
+    }
+  }
+  if (response.includes("function") || response.includes("const ") || response.includes("import ")) {
+    return response.trim();
+  }
+  return null;
+}
+function generateDiff(original, fixed, filename) {
+  const origLines = original.split("\n");
+  const fixedLines = fixed.split("\n");
+  const diff = [`--- a/${basename(filename)}`, `+++ b/${basename(filename)}`];
+  const maxLen = Math.max(origLines.length, fixedLines.length);
+  for (let i = 0; i < maxLen; i++) {
+    const origLine = origLines[i];
+    const fixedLine = fixedLines[i];
+    if (origLine === void 0) {
+      diff.push(`+ ${fixedLine}`);
+    } else if (fixedLine === void 0) {
+      diff.push(`- ${origLine}`);
+    } else if (origLine !== fixedLine) {
+      diff.push(`- ${origLine}`);
+      diff.push(`+ ${fixedLine}`);
+    }
+  }
+  return diff.join("\n");
+}
+async function batchFix(bugs, config, options) {
+  const results = /* @__PURE__ */ new Map();
+  for (const bug of bugs) {
+    const result = await applyFix(bug, config, options);
+    results.set(bug.id, result);
+    if (!result.success && !options.dryRun) {
+      break;
+    }
+  }
+  return results;
+}
+async function detectMonorepo(cwd) {
+  const packageJsonPath = join(cwd, "package.json");
+  if (!existsSync(packageJsonPath)) {
+    return {
+      isMonorepo: false,
+      type: "none",
+      rootPath: cwd,
+      packages: []
+    };
+  }
+  let packageJson;
+  try {
+    packageJson = JSON.parse(readFileSync(packageJsonPath, "utf-8"));
+  } catch {
+    return {
+      isMonorepo: false,
+      type: "none",
+      rootPath: cwd,
+      packages: []
+    };
+  }
+  if (packageJson.workspaces) {
+    const workspacePatterns = Array.isArray(packageJson.workspaces) ? packageJson.workspaces : packageJson.workspaces.packages || [];
+    const packages = await findPackages(cwd, workspacePatterns);
+    const type = existsSync(join(cwd, "yarn.lock")) ? "yarn-workspaces" : "npm-workspaces";
+    return {
+      isMonorepo: packages.length > 0,
+      type,
+      rootPath: cwd,
+      packages
+    };
+  }
+  const pnpmWorkspacePath = join(cwd, "pnpm-workspace.yaml");
+  if (existsSync(pnpmWorkspacePath)) {
+    const pnpmWorkspace = readFileSync(pnpmWorkspacePath, "utf-8");
+    const packagesMatch = pnpmWorkspace.match(/packages:\s*([\s\S]*?)(?=\n\w|$)/);
+    if (packagesMatch) {
+      const patterns = packagesMatch[1].split("\n").map((line) => line.replace(/^\s*-\s*['"]?/, "").replace(/['"]?\s*$/, "")).filter((line) => line && !line.startsWith("#"));
+      const packages = await findPackages(cwd, patterns);
+      return {
+        isMonorepo: packages.length > 0,
+        type: "pnpm-workspaces",
+        rootPath: cwd,
+        packages
+      };
+    }
+  }
+  const lernaJsonPath = join(cwd, "lerna.json");
+  if (existsSync(lernaJsonPath)) {
+    try {
+      const lernaConfig = JSON.parse(readFileSync(lernaJsonPath, "utf-8"));
+      const patterns = lernaConfig.packages || ["packages/*"];
+      const packages = await findPackages(cwd, patterns);
+      return {
+        isMonorepo: packages.length > 0,
+        type: "lerna",
+        rootPath: cwd,
+        packages
+      };
+    } catch {
+    }
+  }
+  const nxJsonPath = join(cwd, "nx.json");
+  if (existsSync(nxJsonPath)) {
+    const nxPatterns = ["apps/*", "libs/*", "packages/*"];
+    const packages = await findPackages(cwd, nxPatterns);
+    return {
+      isMonorepo: packages.length > 0,
+      type: "nx",
+      rootPath: cwd,
+      packages
+    };
+  }
+  const turboJsonPath = join(cwd, "turbo.json");
+  if (existsSync(turboJsonPath)) {
+    const workspacePatterns = packageJson.workspaces ? Array.isArray(packageJson.workspaces) ? packageJson.workspaces : packageJson.workspaces.packages || [] : ["packages/*", "apps/*"];
+    const packages = await findPackages(cwd, workspacePatterns);
+    return {
+      isMonorepo: packages.length > 0,
+      type: "turborepo",
+      rootPath: cwd,
+      packages
+    };
+  }
+  return {
+    isMonorepo: false,
+    type: "none",
+    rootPath: cwd,
+    packages: []
+  };
+}
+async function findPackages(cwd, patterns) {
+  const packages = [];
+  const globPatterns = patterns.map((pattern) => {
+    pattern = pattern.replace(/\/$/, "");
+    if (pattern.endsWith("*")) {
+      return `${pattern}/package.json`;
+    }
+    return `${pattern}/package.json`;
+  });
+  const packageJsonPaths = await fg3(globPatterns, {
+    cwd,
+    absolute: true,
+    ignore: ["**/node_modules/**"]
+  });
+  for (const pkgJsonPath of packageJsonPaths) {
+    try {
+      const pkgJson = JSON.parse(readFileSync(pkgJsonPath, "utf-8"));
+      const pkgDir = dirname(pkgJsonPath);
+      packages.push({
+        name: pkgJson.name || relative(cwd, pkgDir),
+        path: pkgDir,
+        relativePath: relative(cwd, pkgDir),
+        packageJson: pkgJson
+      });
+    } catch {
+    }
+  }
+  return packages.sort((a, b) => a.name.localeCompare(b.name));
+}
+async function getPackageFiles(pkg, patterns = ["**/*.{ts,tsx,js,jsx}"], ignore = ["node_modules/**", "dist/**", "build/**"]) {
+  return fg3(patterns, {
+    cwd: pkg.path,
+    absolute: true,
+    ignore,
+    onlyFiles: true
+  });
+}
+function getPackageForFile(file, packages) {
+  for (const pkg of packages) {
+    if (file.startsWith(pkg.path)) {
+      return pkg;
+    }
+  }
+  return null;
+}
+function groupFilesByPackage(files, packages) {
+  const grouped = /* @__PURE__ */ new Map();
+  for (const file of files) {
+    const pkg = getPackageForFile(file, packages);
+    const existing = grouped.get(pkg) || [];
+    existing.push(file);
+    grouped.set(pkg, existing);
+  }
+  return grouped;
+}
+async function getCrossPackageDependencies(packages) {
+  const deps = /* @__PURE__ */ new Map();
+  for (const pkg of packages) {
+    const pkgDeps = [];
+    const allDeps = {
+      ...pkg.packageJson.dependencies,
+      ...pkg.packageJson.devDependencies,
+      ...pkg.packageJson.peerDependencies
+    };
+    for (const depName of Object.keys(allDeps)) {
+      if (packages.some((p) => p.name === depName)) {
+        pkgDeps.push(depName);
+      }
+    }
+    if (pkgDeps.length > 0) {
+      deps.set(pkg.name, pkgDeps);
+    }
+  }
+  return deps;
+}
+
+export { AiderProvider, BehavioralContract, Bug, BugCategory, BugSeverity, CacheState, ClaudeCodeProvider, CodePathStep, CodebaseUnderstanding, ConfidenceLevel, ConfidenceScore, FeatureIntent, FileHash, MonorepoConfig, PackageConfig, PriorityLevel, ProviderType, ScanResult, WhiteroseConfig, applyFix, batchFix, buildDependencyGraph, commitFix, createFixBranch, dependsOn, detectMonorepo, detectProvider, findCircularDependencies, generateIntentDocument, getChangedFiles, getCrossPackageDependencies, getCurrentBranch, getDependentFiles2 as getDependentFiles, getDiff, getFileAtHead, getGitStatus, getImportsOf, getPackageFiles, getPackageForFile, getProvider, getStagedDiff, groupFilesByPackage, hasUncommittedChanges, isGitRepo, isProviderAvailable, loadConfig, loadUnderstanding, mergeIntentWithUnderstanding, outputMarkdown, outputSarif, parseIntentDocument, popStash, resetFile, runStaticAnalysis, saveConfig, scanCodebase, stashChanges };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map