@superblocksteam/vite-plugin-file-sync 1.99.99-next.2 → 2.0.0-SNAPSHOT.2143e2e95d0107ab

package/dist/ai-service/agent/prompts/build-base-system-prompt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-base-system-prompt.js","sourceRoot":"","sources":["../../../../src/ai-service/agent/prompts/build-base-system-prompt.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAChF,OAAO,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAC;AAEtE,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,EAAE,kCAAkC,EAAE,MAAM,yCAAyC,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,kCAAkC,CAAC;AAC9E,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE1D,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,kBAAkB,CAAC;AAE1B,MAAM,MAAM,GAAG,iBAAiB,CAAC,4BAA4B,CAAC,CAAC;AA4C/D;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,UAAmB;IACzD,OAAO,UAAU,KAAK,SAAS,CAAC;AAClC,CAAC;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACnC,MAAuB,EACvB,IAAa,EACb,YAAqB,EACrB,mBAA4B,EAC5B,sBAA+B,EAC/B,cAA+B,EAC/B,yBAAyB,GAAG,KAAK,EACjC,SAAyB,EACzB,8BAA8B,GAAG,KAAK,EACtC,OAA6B,EAC7B,EAAE;IACF,MAAM,qBAAqB,GAAG,OAAO,EAAE,OAAO,KAAK,iBAAiB,CAAC;IACrE,uEAAuE;IACvE,2EAA2E;IAC3E,2EAA2E;IAC3E,aAAa;IACb,MAAM,kBAAkB,GAA6C,CAAC,MAAM;SACzE,QAAQ,CAAC,gBAAgB;QAC1B,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,OAAO,EAAE,YAAY,KAAK,IAAI;YAC9B,CAAC,CAAC,WAAW;YACb,CAAC,CAAC,cAAc,CAAC;IACrB,MAAM,YAAY,GAAG,kBAAkB,KAAK,WAAW,CAAC;IACxD,MAAM,wBAAwB,GAAG,kCAAkC,CAAC,MAAM,CAAC,CAAC;IAC5E,MAAM,uBAAuB,GAAG,MAAM,CAAC,QAAQ,CAAC,yBAAyB;QACvE,CAAC,CAAC,snBAAsnB;QACxnB,CAAC,CAAC,8PAA8P,CAAC;IACnQ,MAAM,mCAAmC,GAAG,wBAAwB;QAClE,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,6XAA6X,CAAC;IAClY,MAAM,kBAAkB,GAAG,YAAY;QACrC,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,2CACE,kBAAkB,KAAK,cAAc;YACnC,CAAC,CAAC,6JAA6J;YAC/J,CAAC,CAAC,2EACN,4RAA4R,CAAC;IAEjS,IAAI,QAAQ,GAAG,EAAE,CAAC;IAElB,IAAI,qBAAqB,EAAE,CAAC;QAC1B,0EAA0E;QAC1E,oEAAoE;QACpE,sEAAsE;QACtE,qEAAqE;QACrE,uEAAuE;QACvE,aAAa;QACb,QAAQ,GAAG;;;;;;;;;;CAUd,CAAC;IACA,CAAC;SAAM,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,QAAQ,GAAG;;;;;;;;;;sHAUuG,MAAM,CAAC,QAAQ,CAAC,8BAA8B,CAAC,CAAC,CAAC,yHAAyH,CAAC,CAAC,CAAC,EAAE,oDAAoD,wBAAwB,CAAC,CAAC,CAAC,iLAAiL,CAAC,CAAC,CAAC,EAAE,wIAAwI,wBAAwB,CAAC,CAAC,CAAC,qGAAqG,CAAC,CAAC,CAAC,EAAE;;;;;;;;EASrzB,MAAM,CAAC,QAAQ,CAAC,uBAAuB;YACrC,CAAC,CAAC;;;;;;;;;;;qLAW+K;YACjL,CAAC,CAAC,EACN;;;;;;;;;;EAWE,wBAAwB;YACtB,CAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;CAsBL;YACG,CAAC,CAAC,EACN;oSACoS,wBAAwB,CAAC,CAAC,CAAC,mDAAmD,CAAC,CAAC,CAAC,EAAE;;;+CAGxU,wBAAwB,CAAC,CAAC,CAAC,wNAAwN,CAAC,CAAC,CAAC,WAAW;yGACvM,wBAAwB,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,EAAE;8LACqB,wBAAwB,CAAC,CAAC,CAAC,gLAAgL,CAAC,CAAC,CAAC,EAAE,GACxY,wBAAwB;YACtB,CAAC,CAAC;0HACgH;YAClH,CAAC,CAAC,EACN;;EAGF,YAAY;YACV,CAAC,CAAC;;;;;;;;;;sCAWE,MAAM,CAAC,QAAQ,CAAC,mBAAmB;gBACjC,CAAC,CAAC,oEAAoE;gBACtE,CAAC,CAAC,6BACN;uEAEE,MAAM,CAAC,QAAQ,CAAC,mBAAmB;gBACjC,CAAC,CAAC,uGAAuG;gBACzG,CAAC,CAAC,kFACN;2CAEE,MAAM,CAAC,QAAQ,CAAC,mBAAmB;gBACjC,CAAC,CAAC,2EAA2E;gBAC7E,CAAC,CAAC,uDACN;;;EAIJ,MAAM,CAAC,QAAQ,CAAC,mBAAmB;gBACjC,CAAC,CAAC;;;yFAGmF,2BAA2B;qEAC/C,2BAA2B;iJACiD,2BAA2B;;;wGAGpE,2BAA2B;;CAElI;gBACG,CAAC,CAAC;0PACoP,2BAA2B,sDAAsD,2BAA2B;CAEtW;CACC;YACG,CAAC,CAAC,kBAAkB,KAAK,cAAc;gBACrC,CAAC,CAAC;waAEE,MAAM,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OACtD;CACP;gBACK,CAAC,CAAC,EACR;;CAEC,CAAC;IACA,CAAC;IAED,MAAM,cAAc,GAClB,MAAM,CAAC,QAAQ,CAAC,oBAAoB,IAAI,uBAAuB,CAAC;IAClE,MAAM,aAAa,GAAG,8BAA8B;QAClD,CAAC,CAAC,iCAAiC,CAC/B,MAAM,CAAC,QAAQ,CAAC,uBAAuB,EACvC,SAAS,CACV;QACH,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,aAAa,GAAG,MAAM,CAAC,QAAQ,CAAC,aAAa,IAAI,KAAK,CAAC;IAC7D,MAAM,uBAAuB,GAC3B,MAAM,CAAC,QAAQ,CAAC,uBAAuB,IAAI,KAAK,CAAC;IAEnD,MAAM,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC;IAElD,8EAA8E;IAC9E,MAAM,cAAc,GAAG,SAAS;QAC9B,CAAC,CAAC,yBAAyB,CACvB,aAAa,EACb,uBAAuB,EACvB,yBAAyB,CAC1B;QACH,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,YAAY,GAAG,cAAc,KAAK,IAAI,CAAC;IAE7C,oFAAoF;IACpF,MAAM,gBAAgB,GAAG,YAAY;QACnC,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,6BAA6B,CAAC,aAAa,CAAC,CAAC;IAEjD,uCAAuC;IACvC,MAAM,CAAC,IAAI,CAAC,gDAAgD,EAAE;QAC5D,oBAAoB,EAAE,CAAC,CAAC,YAAY;QACpC,uBAAuB,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;QAClD,oBAAoB,EAAE,CAAC,CAAC,sBAAsB;QAC9C,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,IAAI,CAAC;KAC7D,CAAC,CAAC;IAEH,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,CAAC,IAAI,CAAC,gCAAgC,GAAG,YAAY,CAAC,CAAC;IAC/D,CAAC;IAED,IAAI,sBAAsB,EAAE,CAAC;QAC3B,MAAM,CAAC,IAAI,CAAC,8BAA8B,GAAG,sBAAsB,CAAC,CAAC;IACvE,CAAC;IAED,OAAO,CACL,QAAQ;QACR,MAAM,CAAC;;WAEA,WAAW;;;;;;;;;;;;EAYpB,mBAAmB,CAAC,YAAY,EAAE,mBAAmB,CAAC;EAEtD,qBAAqB;YACnB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;;;;CAKN;EAEE,qBAAqB;YACnB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,8BAA8B;gBAC9C,CAAC,CAAC;;;;;;;;;;;;;;;;6JAiBE,uBAAuB;oBACrB,CAAC,CAAC;sUACwT;oBAC1T,CAAC,CAAC,EACN;gIACwH;gBAC1H,CAAC,CAAC;;2FAGR;;EAGE,qBAAqB;YACnB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,mSACN;EACE,qBAAqB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,cAAc,IAAI,EAAE,CAAC;EACnD,CAAC,qBAAqB,IAAI,sBAAsB,CAAC,CAAC,CAAC,8BAA8B,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,EAAE;;EAG9G,qBAAqB;YACnB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;EAwBJ,uBAAuB;;;;EAIvB,4BAA4B,CAC5B,cAAc,EACd,MAAM,CAAC,QAAQ,CAAC,yBAAyB,KAAK,IAAI,CACnD,EACD;EAEE,qBAAqB;YACnB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;;;;;;;;;;;;;;CAeN;EACE,mCAAmC;EACnC,kBAAkB;;EAElB,cAAc;;EAEd,aAAa;;;;;;;;;;EAWb,qBAAqB;YACnB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;;CAGN;;;;;;0EAOK,qBAAqB;YACnB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;yFAEN;;;;;;;;;;;;6DAaE,qBAAqB;YACnB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;6FAEN;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA6BD,qBAAqB;YACnB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;;;;;;;;;;;;;;;;;;;oDAoBE,wBAAwB;gBACtB,CAAC,CAAC;6NACiN;gBACnN,CAAC,CAAC,EACN;;;;;;;;CASN;;;;EAIE,qBAAqB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,gBAAgB;EAC7C,CAAC,qBAAqB,IAAI,aAAa,CAAC,CAAC,CAAC,kBAAkB,CAAC,EAAE,yBAAyB,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE;EAEhG,qBAAqB;YACnB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;;;;;EAKJ,oBAAoB,CAAC,aAAa,CAAC;;CAGrC,EAAE,CACC,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,uBAAuB,GAAG,MAAM,CAAC;AAEvC;;;;;;;;;;;GAWG;AACH,SAAS,mBAAmB,CAC1B,YAAqB,EACrB,mBAA4B;IAE5B,MAAM,QAAQ,GAAG,CAAC,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC;IACxC,MAAM,eAAe,GAAG,CAAC,CAAC,mBAAmB,EAAE,IAAI,EAAE,CAAC;IAEtD,IAAI,CAAC,QAAQ,IAAI,CAAC,eAAe,EAAE,CAAC;QAClC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,QAAQ,EAAE,CAAC;QACb,KAAK,CAAC,IAAI,CAAC,YAAa,CAAC,IAAI,EAAE,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,eAAe,EAAE,CAAC;QACpB,KAAK,CAAC,IAAI,CAAC,mBAAoB,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1C,CAAC;IAED,IAAI,KAAK,GAAG,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;IAE7C,IAAI,KAAK,CAAC,MAAM,GAAG,uBAAuB,EAAE,CAAC;QAC3C,MAAM,CAAC,IAAI,CACT,kCAAkC,KAAK,CAAC,MAAM,OAAO,uBAAuB,aAAa,CAC1F,CAAC;QACF,MAAM,iBAAiB,GACrB,kGAAkG;YAClG,iGAAiG;YACjG,0GAA0G,CAAC;QAC7G,KAAK;YACH,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,uBAAuB,GAAG,iBAAiB,CAAC,MAAM,CAAC;gBAClE,iBAAiB,CAAC;IACtB,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,SAAS,yBAAyB,CAChC,aAAsB,EACtB,uBAAgC,EAChC,yBAAkC;IAElC,IAAI,CAAC;QACH,MAAM,aAAa,GAAG,0BAA0B,CAAC;YAC/C,aAAa;YACb,uBAAuB;YACvB,yBAAyB;SAC1B,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,iBAAiB,CACjC,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,SAAS,CACzD,CAAC;QAEF,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,MAAM,CAAC,IAAI,CACT,oEAAoE,CACrE,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;QAEjD,MAAM,gBAAgB,GAAG,aAAa;YACpC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,MAAM,CAAC;;;;;;;;;CASd,CAAC;QAEE,OAAO,MAAM,CAAC;;;;;;;EAOhB,SAAS;;;EAGT,gBAAgB;;;;;;;;;;;;;;;;CAgBjB,CAAC;IACA,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CACV,0EAA0E,EAC1E,YAAY,CAAC,KAAK,CAAC,CACpB,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,8BAA8B,CAAC,cAAsB;IAC5D,OAAO,MAAM,CAAC;;;;;;;;;EASd,cAAc;;;;;;;;CAQf,CAAC;AACF,CAAC;AAED;;;GAGG;AACH,SAAS,6BAA6B,CAAC,aAAsB;IAC3D,OAAO,MAAM,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA2Od,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,mBAAmB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4P3C,CAAC;AACF,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,iCAAiC,CAC/C,eAAmD,EACnD,SAAyB;IAEzB,IAAI,CAAC,SAAS,IAAI,CAAC,eAAe,EAAE,CAAC;QACnC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,wEAAwE;IACxE,6EAA6E;IAC7E,MAAM,QAAQ,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IAC5C,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;QACrD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO;EACP,QAAQ,CAAC,IAAI,EAAE;;;CAGhB,CAAC;AACF,CAAC;AAED,SAAS,8BAA8B;IACrC,OAAO;;;;;;gWAMuV,CAAC;AACjW,CAAC;AAED,SAAS,4BAA4B,CACnC,cAA0C,EAC1C,yBAAkC;IAElC,IAAI,CAAC,cAAc;QAAE,OAAO,EAAE,CAAC;IAC/B,MAAM,yBAAyB,GAAG,yBAAyB;QACzD,CAAC,CAAC,8BAA8B,EAAE;QAClC,CAAC,CAAC,EAAE,CAAC;IAEP,yEAAyE;IACzE,0EAA0E;IAC1E,2EAA2E;IAC3E,uEAAuE;IACvE,2EAA2E;IAC3E,sCAAsC;IACtC,IAAI,cAAc,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;QAC5C,OAAO,8VAA8V,yBAAyB;;CAEjY,CAAC;IACA,CAAC;IAED,IAAI,cAAc,CAAC,wBAAwB,EAAE,CAAC;QAC5C,yEAAyE;QACzE,sEAAsE;QACtE,qCAAqC;QACrC,MAAM,uBAAuB,GAAG,uBAAuB,CAAC,GAAG,CACzD,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,IAAI,CACxB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,OAAO,kcAAkc,uBAAuB,uHAAuH,yBAAyB;;CAEnnB,CAAC;IACA,CAAC;IAED,OAAO,yMAAyM,yBAAyB;;CAE1O,CAAC;AACF,CAAC;AAED,MAAM,uBAAuB,GAAG,MAAM,CAAC;;;;;;;;CAQtC,CAAC"}

package/dist/ai-service/agent/prompts/build-security-scan-prompt.d.ts

@@ -0,0 +1,17 @@
+import type { ScanScopeJson } from "@superblocksteam/shared";
+/**
+ * Three-layer prompt architecture for the Security Agent.
+ *
+ * Layer 1: System Skeleton — agent identity, behavioral rules, output contract, safety.
+ * Layer 2: App Context — dynamic, per-app metadata to prevent false positives.
+ * Layer 3: Admin Policy Prompt — what to look for (from template or IT admin).
+ */
+export interface SecurityAgentAppContext {
+    integrations: Array<{
+        name: string;
+        pluginType: string;
+    }>;
+}
+export declare function buildSecurityAgentSkeleton(): string;
+export declare function composeSecurityAgentPrompt(appContext: SecurityAgentAppContext, adminPrompt?: string, scanScopeJson?: ScanScopeJson): string;
+//# sourceMappingURL=build-security-scan-prompt.d.ts.map

package/dist/ai-service/agent/prompts/build-security-scan-prompt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-security-scan-prompt.d.ts","sourceRoot":"","sources":["../../../../src/ai-service/agent/prompts/build-security-scan-prompt.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAO7D;;;;;;GAMG;AAEH,MAAM,WAAW,uBAAuB;IACtC,YAAY,EAAE,KAAK,CAAC;QAClB,IAAI,EAAE,MAAM,CAAC;QACb,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC,CAAC;CACJ;AAsBD,wBAAgB,0BAA0B,IAAI,MAAM,CA2DnD;AA8JD,wBAAgB,0BAA0B,CACxC,UAAU,EAAE,uBAAuB,EACnC,WAAW,CAAC,EAAE,MAAM,EACpB,aAAa,CAAC,EAAE,aAAa,GAC5B,MAAM,CAaR"}

package/dist/ai-service/agent/prompts/build-security-scan-prompt.js

@@ -0,0 +1,285 @@
+import { findingFiles, isInDiffPriorFinding, } from "../../../scan-scope-merge.js";
+// Policy of the Superblocks-managed security agent, used whenever a review carries no admin prompt.
+// Admin-authored agents replace it with their own; keep this text in sync with the General Security
+// Review starting template in review_policy_agent_template.
+const DEFAULT_ADMIN_PROMPT = [
+    "Perform a comprehensive security review of this application.",
+    "Look for all common vulnerability categories including:",
+    "",
+    "- Hardcoded secrets, API keys, tokens, or passwords in source code",
+    "- SQL injection, code injection (eval, dynamic execution), command injection, SSRF, or template injection",
+    "- XSS via user-controlled data rendered as raw HTML without sanitization",
+    "- Missing or broken authentication and authorization checks",
+    "- Sensitive data (PII, credentials) logged, leaked in responses, or stored insecurely",
+    "- Weak or deprecated cryptographic algorithms",
+    "- Insecure network configuration (wildcard CORS, disabled TLS verification, open redirects)",
+    "- Insecure deserialization or unrestricted file uploads",
+    "- API endpoints that return excessive data or expose internal details",
+    "",
+    "Report any security concern you find, even if it doesn't fit neatly into these categories.",
+].join("\n");
+export function buildSecurityAgentSkeleton() {
+    const today = new Date().toISOString().split("T")[0];
+    return `## Role
+
+You are a policy enforcement agent for a Superblocks application. Your sole purpose is to
+analyze the application's source files against the provided policy and produce a
+structured findings report. You are NOT a builder — you must never modify files.
+
+Today is ${today}.
+
+## Scanning Procedure
+
+IMPORTANT: to explore the application structure, use tools:
+- 'ls' to browse directories and see file metadata (sizes, timestamps)
+- 'glob' to find files matching patterns across the directory tree (e.g., "**/*.tsx")
+- 'grep' to search for specific code patterns or text within files
+
+1. **List files** — Use the file listing tools to enumerate application files.
+2. **Triage** — Prioritize files relevant to the provided policy, such as server-side code, API definitions, auth logic, config files, files that handle user input, UI components, styles, and design tokens. Only skip styling files when the policy is unrelated to styling. Skip auto-generated files and large JSON data fixtures unless the policy explicitly requires them.
+3. **Read priority files** — Read the prioritized files. For large applications, use grep with a path or glob to search for specific suspicious patterns (secrets, eval, dangerouslySetInnerHTML, etc.) inside the triaged areas, then read the files those searches flag. Prefer narrow patterns and scoped paths over whole-repo searches.
+4. **Analyze integrations** — Inspect integration configurations for leaked credentials or insecure settings.
+5. **Deep dive** — Read additional files as needed based on grep results and cross-references.
+6. **Report findings** — Call the \`reportReviewRun\` tool with your structured findings. Do NOT output JSON as text — always use the tool.
+
+## Output Contract
+
+You MUST call the \`reportReviewRun\` tool exactly once as your final action. The tool enforces the required schema. Example input:
+
+{
+  "findings": [
+    {
+      "id": "finding-1",
+      "category": "secret",
+      "clarkRemediable": true,
+      "severity": "critical",
+      "title": "Hardcoded API key in config",
+      "description": "An API key is hardcoded in the configuration file.",
+      "location": { "file": "config.ts", "line": 42 },
+      "evidence": "const API_KEY = '***'",
+      "suggestedFix": "Move the API key to an environment variable or integration secret.",
+      "confidence": "high"
+    }
+  ],
+  "summary": { "critical": 1, "high": 0, "medium": 0, "low": 0, "info": 0, "total": 1 },
+  "scannedFiles": 12,
+  "scanComplete": true
+}
+
+## Critical Rules
+
+- **ALWAYS call \`reportReviewRun\`** to submit your results. Never output findings as raw text or JSON.
+- **NEVER include raw secret values** in your output. Redact them with \`***\` (e.g., \`"const API_KEY = '***'"\`).
+- **NEVER modify files.** You are a read-only reviewer. Do not call any write, edit, or delete tools.
+- **NEVER hallucinate findings.** Only report issues backed by evidence you found in the source code. If a file is clean, do not invent problems.
+- Set \`clarkRemediable\` to \`true\` only when Clark can reasonably fix the issue by editing application source/configuration files, such as removing a hardcoded secret, adding validation, or changing unsafe UI/API code. Set it to \`false\` for issues requiring external account changes, credential rotation, infrastructure changes, or human policy decisions.
+- **Respect developer comments explaining security decisions.** If a comment explains why a particular pattern is used (e.g., a platform limitation, a deliberate trade-off), acknowledge it in your finding, adjust severity accordingly, and do NOT suggest a fix the comment already says does not work.
+- **Severity must match actual exploitability.** "critical" means an attacker can exploit it with no mitigations. If the code has mitigations (input validation, escaping, platform-level access control), lower the severity. Manual SQL escaping with a documented platform limitation is NOT "critical" — it is "medium" or "low".
+- If no issues are found, call \`reportReviewRun\` with an empty findings array, all summary counts at zero, and \`scanComplete: true\`.`;
+}
+function buildSecurityAgentAppContext(context) {
+    const sections = [
+        `## Superblocks Application Context
+
+This is a Superblocks application. Superblocks is a low-code platform where applications
+are built with React components on the client side and server-side API steps that run in
+a sandboxed environment. Understanding the platform's architecture is critical to avoid
+false positives.
+
+**Authentication and authorization are handled by the platform.** Users must be authenticated
+to access any Superblocks application, and each application has its own access control list.
+Only users who have been granted access to an application can view it or call its APIs.
+Do NOT flag APIs for "missing authentication" or "missing authorization" simply because
+the API code does not contain explicit auth checks — the platform enforces these before
+any application code runs. Only flag authorization issues when an API accepts a sensitive
+identifier (like a user ID or role) from client input and uses it for access decisions
+instead of reading the authenticated user from the server-side context (\`Global.user\`
+or \`ctx.user\`).`,
+    ];
+    sections.push(`### Execution Model
+
+- **Client code** runs in the browser (React components, pages, custom components).
+- **Server code** runs in a sandboxed environment (API steps, backend logic). Console output
+  from server steps is internal and not exposed to end users.
+- **Bindings** use \`{{ }}\` syntax (e.g., \`{{ Input1.value }}\`). These are NOT eval-style
+  injection — they are evaluated in a controlled sandbox.
+- Each API step runs in isolation. Variables do not leak between steps unless explicitly passed.`);
+    sections.push(`### Integration Model
+
+Superblocks manages database and API connections through **integrations**. Integrations are
+configured via the platform's UI and referenced in code by their UUID. Important:
+
+- **Integration UUIDs are NOT hardcoded secrets.** They are internal references to managed
+  connections. Do NOT flag them as hardcoded credentials.
+- Credentials for integrations (passwords, API keys, connection strings) are stored securely
+  by the platform and injected at runtime — they never appear in application source code.
+- If you see a UUID like \`228d92c5-d4e3-44d2-824c-7fd0674351d3\` used as an integration
+  reference, this is expected platform behavior.`);
+    if (context.integrations.length > 0) {
+        const integrationList = context.integrations
+            .map((i) => `- **${i.name}** (${i.pluginType})`)
+            .join("\n");
+        sections.push(`### Integrations In Use
+
+This application has the following integrations configured:
+
+${integrationList}
+
+These are managed connections. Their presence in code as references is expected.`);
+    }
+    sections.push(`### Server-Side API Model
+
+Server-side logic is defined as **API steps** — TypeScript (or YAML) functions that run
+in a sandboxed Node.js environment on the server. Key points:
+
+- Client code calls APIs via hooks from \`@superblocksteam/library\`:
+  - \`useApiData("GetUsers", { email })\` — declarative, auto-fetches on mount and when inputs change.
+  - \`useApi("CreateOrder")\` — imperative, call \`run()\` manually for event-driven actions.
+  - \`executeApi("MyApi", { param })\` — plain Promise outside React (utility functions, event handlers).
+  These are standard, platform-sanctioned patterns — not security concerns.
+- Each API step runs in isolation. Variables do not leak between steps unless explicitly
+  passed via \`return\` / \`output\`.
+- Console output from API steps is internal (visible to the developer in the editor) and
+  NOT exposed to end users in deployed apps.
+- API steps can reference integrations by UUID to execute queries against databases or
+  external services. The platform injects credentials at runtime.
+
+#### SQL Parameterization
+
+Superblocks SQL blocks support **parameterized queries** using \`parameters: "[var1, var2]"\`
+with database-specific placeholders (e.g., \`$1\` for PostgreSQL, \`?\` for MySQL/Snowflake,
+\`@PARAM_1\` for MSSQL). When reviewing SQL code:
+
+- **Parameterized queries are safe.** If a query uses placeholders and a \`parameters\` array,
+  it is NOT vulnerable to SQL injection — do not flag it.
+- **Binding functions for dynamic SQL elements** (table names, column names) are acceptable
+  platform patterns: \`statement: ({ tableName }) => \\\`SELECT * FROM \\\${tableName}\\\`\`.
+  These run in the sandbox and cannot be manipulated by end users unless the input originates
+  from unvalidated user input.
+- **Flag as injection risk** only when raw user input is interpolated directly into SQL
+  without parameterization or validation.
+
+#### Permissions (Global Object)
+
+Server-side API steps have access to a \`Global\` object injected by the platform:
+
+\`\`\`typescript
+Global.user   // { email, username, id, name, groups }
+Global.groups // Group[] — organization groups
+\`\`\`
+
+The standard authorization pattern is \`Global.groups.some(g => g.name === "Admin")\`.
+This is the correct way to implement RBAC in Superblocks APIs — it is NOT a security
+concern. However, DO flag authorization checks that rely solely on frontend data
+(e.g., a user role passed as an API input from the client) instead of \`Global\`.`);
+    sections.push(`### Platform Hooks (Safe Patterns)
+
+Superblocks provides built-in React hooks that are part of the platform. Their usage is
+expected and should NOT be flagged as security concerns:
+
+- \`useSuperblocksUser()\` — returns current user info (name, email, id, groups). This is
+  the standard way to access the authenticated user. It is NOT PII leakage.
+- \`useSuperblocksGroups()\` — returns organization groups. Standard RBAC pattern.
+- \`useSuperblocksDataTags()\` / \`setDataTag()\` — switches between data environments
+  (e.g., staging vs production data). This is a platform feature, not a config leak.
+- \`getAppMode()\` — returns "EDIT", "PREVIEW", or "PUBLISHED". Safe runtime context.
+- \`useEmbedProperties()\` — reads properties from a parent iframe embedder. This is
+  the standard Superblocks embed SDK pattern, not a postMessage injection risk.
+- \`useEmbedEvent()\` / \`useEmitEmbedEvent()\` — bidirectional event communication with
+  the embedding page. Part of the official embed SDK.
+- \`logoutIntegrations()\` — clears OAuth tokens for integrations. Standard logout pattern.`);
+    sections.push(`### Environments & Data Tags
+
+Superblocks apps run in three environments: **Edit** (developer), **Preview** (testing),
+and **Production** (deployed). Each environment can have different **data tags** (also
+called "profiles") that control which data sources, credentials, and configurations are
+active.
+
+- Superblocks does NOT use traditional feature flags or environment variables. Instead,
+  apps use \`getAppMode()\` to branch behavior by environment, and \`useSuperblocksDataTags()\`
+  to switch between data contexts (e.g., staging vs production databases).
+- When suggesting fixes that require environment-specific behavior (e.g., "enable this
+  only in development"), recommend using \`getAppMode()\` or data tags — not feature flags
+  or environment variables, which are not available in the Superblocks runtime.`);
+    sections.push(`### Framework & Runtime
+
+- UI is built with **React** and **Tailwind CSS v4** with shadcn/Radix UI components.
+- Routing uses **react-router v7** in data mode.
+- Custom components are sandboxed — they can use React hooks and local state but cannot
+  call APIs directly (data must be passed via props).
+- The design system uses semantic tokens defined in \`index.css\`.`);
+    sections.push(`### Additional Platform Documentation
+
+For deeper understanding of Superblocks patterns, you can read the platform skill files
+using \`build_readFile\`:
+
+- \`skills/system/superblocks-frontend/SKILL.md\` — frontend patterns, hooks, component model.
+- \`skills/system/superblocks-api/SKILL.md\` — API block types, SQL patterns, control flow.
+- \`skills/system/superblocks-api/references/sql-databases.md\` — database-specific parameterization syntax.
+
+Read these if you encounter code patterns you do not recognize and need to determine
+whether they are safe platform conventions or genuine security concerns.`);
+    return sections.join("\n\n");
+}
+export function composeSecurityAgentPrompt(appContext, adminPrompt, scanScopeJson) {
+    const skeleton = buildSecurityAgentSkeleton();
+    const context = buildSecurityAgentAppContext(appContext);
+    const policy = adminPrompt?.trim() ? adminPrompt : DEFAULT_ADMIN_PROMPT;
+    const scopeSection = buildDiffScopedReviewSection(scanScopeJson);
+    return `${skeleton}
+
+${context}${scopeSection}
+
+## Policy: What to Review
+
+${policy}`;
+}
+function buildDiffScopedReviewSection(scanScopeJson) {
+    if (!scanScopeJson) {
+        return "";
+    }
+    const inDiffPaths = new Set(scanScopeJson.changedFiles.map((file) => file.path));
+    const inDiffFindings = scanScopeJson.priorFindings.filter((finding) => isInDiffPriorFinding(finding, inDiffPaths));
+    const changedFileList = scanScopeJson.changedFiles
+        .map((file) => `- ${file.changeType} ${file.path}`)
+        .join("\n");
+    const priorFindingList = inDiffFindings.length === 0
+        ? "- None"
+        : inDiffFindings
+            .map((finding) => {
+            const paths = findingFiles(finding.locations);
+            const pathSuffix = paths.length === 0 ? "" : ` (${paths.join(", ")})`;
+            return `- ${finding.severity} ${finding.category}: ${finding.title}${pathSuffix}`;
+        })
+            .join("\n");
+    const truncatedNote = scanScopeJson.diffTruncated
+        ? "\nThe unified diff was truncated. Use tools for files listed by name only."
+        : "";
+    const unifiedDiffFence = markdownFence(scanScopeJson.unifiedDiff);
+    return `
+
+## Diff-scoped review
+
+Treat the changed files and unified diff as the priority scope. Confirm or drop prior findings that sit in those files. Integration configurations stay in scope. The rest of the tree stays reachable through tools; follow references into unchanged files when needed.
+${truncatedNote}
+
+### Changed files
+
+${changedFileList}
+
+### Prior findings in the diff
+
+${priorFindingList}
+
+### Unified diff
+
+${unifiedDiffFence}`;
+}
+function markdownFence(content) {
+    let fence = "```";
+    while (content.includes(fence)) {
+        fence += "`";
+    }
+    return `${fence}\n${content}\n${fence}`;
+}
+//# sourceMappingURL=build-security-scan-prompt.js.map

package/dist/ai-service/agent/prompts/build-security-scan-prompt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-security-scan-prompt.js","sourceRoot":"","sources":["../../../../src/ai-service/agent/prompts/build-security-scan-prompt.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,YAAY,EACZ,oBAAoB,GACrB,MAAM,8BAA8B,CAAC;AAiBtC,oGAAoG;AACpG,oGAAoG;AACpG,4DAA4D;AAC5D,MAAM,oBAAoB,GAAG;IAC3B,8DAA8D;IAC9D,yDAAyD;IACzD,EAAE;IACF,oEAAoE;IACpE,2GAA2G;IAC3G,0EAA0E;IAC1E,6DAA6D;IAC7D,uFAAuF;IACvF,+CAA+C;IAC/C,6FAA6F;IAC7F,yDAAyD;IACzD,uEAAuE;IACvE,EAAE;IACF,4FAA4F;CAC7F,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEb,MAAM,UAAU,0BAA0B;IACxC,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAErD,OAAO;;;;;;WAME,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yIAiDyH,CAAC;AAC1I,CAAC;AAED,SAAS,4BAA4B,CACnC,OAAgC;IAEhC,MAAM,QAAQ,GAAa;QACzB;;;;;;;;;;;;;;;kBAec;KACf,CAAC;IAEF,QAAQ,CAAC,IAAI,CAAC;;;;;;;iGAOiF,CAAC,CAAC;IAEjG,QAAQ,CAAC,IAAI,CAAC;;;;;;;;;;iDAUiC,CAAC,CAAC;IAEjD,IAAI,OAAO,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,MAAM,eAAe,GAAG,OAAO,CAAC,YAAY;aACzC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,UAAU,GAAG,CAAC;aAC/C,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,QAAQ,CAAC,IAAI,CAAC;;;;EAIhB,eAAe;;iFAEgE,CAAC,CAAC;IACjF,CAAC;IAED,QAAQ,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kFA4CkE,CAAC,CAAC;IAElF,QAAQ,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;4FAe4E,CAAC,CAAC;IAE5F,QAAQ,CAAC,IAAI,CAAC;;;;;;;;;;;;gFAYgE,CAAC,CAAC;IAEhF,QAAQ,CAAC,IAAI,CAAC;;;;;;mEAMmD,CAAC,CAAC;IAEnE,QAAQ,CAAC,IAAI,CAAC;;;;;;;;;;yEAUyD,CAAC,CAAC;IAEzE,OAAO,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,UAAmC,EACnC,WAAoB,EACpB,aAA6B;IAE7B,MAAM,QAAQ,GAAG,0BAA0B,EAAE,CAAC;IAC9C,MAAM,OAAO,GAAG,4BAA4B,CAAC,UAAU,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,oBAAoB,CAAC;IACxE,MAAM,YAAY,GAAG,4BAA4B,CAAC,aAAa,CAAC,CAAC;IAEjE,OAAO,GAAG,QAAQ;;EAElB,OAAO,GAAG,YAAY;;;;EAItB,MAAM,EAAE,CAAC;AACX,CAAC;AAED,SAAS,4BAA4B,CAAC,aAA6B;IACjE,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,GAAG,CACzB,aAAa,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CACpD,CAAC;IACF,MAAM,cAAc,GAAG,aAAa,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CACpE,oBAAoB,CAAC,OAAO,EAAE,WAAW,CAAC,CAC3C,CAAC;IACF,MAAM,eAAe,GAAG,aAAa,CAAC,YAAY;SAC/C,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;SAClD,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,MAAM,gBAAgB,GACpB,cAAc,CAAC,MAAM,KAAK,CAAC;QACzB,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,cAAc;aACX,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;YACf,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAC9C,MAAM,UAAU,GACd,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;YACrD,OAAO,KAAK,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,KAAK,GAAG,UAAU,EAAE,CAAC;QACpF,CAAC,CAAC;aACD,IAAI,CAAC,IAAI,CAAC,CAAC;IACpB,MAAM,aAAa,GAAG,aAAa,CAAC,aAAa;QAC/C,CAAC,CAAC,4EAA4E;QAC9E,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,gBAAgB,GAAG,aAAa,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;IAElE,OAAO;;;;;EAKP,aAAa;;;;EAIb,eAAe;;;;EAIf,gBAAgB;;;;EAIhB,gBAAgB,EAAE,CAAC;AACrB,CAAC;AAED,SAAS,aAAa,CAAC,OAAe;IACpC,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,OAAO,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,KAAK,IAAI,GAAG,CAAC;IACf,CAAC;IACD,OAAO,GAAG,KAAK,KAAK,OAAO,KAAK,KAAK,EAAE,CAAC;AAC1C,CAAC"}

package/dist/ai-service/agent/subagents/apis/example-selector.d.ts

@@ -0,0 +1,24 @@
+import { type ValidTag } from "./examples.js";
+interface ExampleMetadata {
+    id: string;
+    tags: ValidTag[];
+    complexity: "simple" | "intermediate" | "complex";
+    category: "positive" | "negative";
+    estimatedTokens: number;
+}
+interface SelectExamplesOptions {
+    maxExamples?: number;
+    includeNegative?: boolean;
+    maxTokenBudget?: number;
+}
+/**
+ * Select examples based on provided tags.
+ * Returns the most relevant examples ordered by relevance.
+ */
+export declare function selectExamplesByTags(tags: ValidTag[] | string[] | undefined, options?: SelectExamplesOptions): ExampleMetadata[];
+/**
+ * Format selected examples for inclusion in the system prompt.
+ */
+export declare function formatSelectedExamples(selectedMetadata: ExampleMetadata[]): string;
+export {};
+//# sourceMappingURL=example-selector.d.ts.map

package/dist/ai-service/agent/subagents/apis/example-selector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"example-selector.d.ts","sourceRoot":"","sources":["../../../../../src/ai-service/agent/subagents/apis/example-selector.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,QAAQ,EAEd,MAAM,eAAe,CAAC;AAEvB,UAAU,eAAe;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,QAAQ,EAAE,CAAC;IACjB,UAAU,EAAE,QAAQ,GAAG,cAAc,GAAG,SAAS,CAAC;IAClD,QAAQ,EAAE,UAAU,GAAG,UAAU,CAAC;IAClC,eAAe,EAAE,MAAM,CAAC;CACzB;AAKD,UAAU,qBAAqB;IAC7B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAQD;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,QAAQ,EAAE,GAAG,MAAM,EAAE,GAAG,SAAS,EACvC,OAAO,GAAE,qBAA0B,GAClC,eAAe,EAAE,CAqHnB;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CACpC,gBAAgB,EAAE,eAAe,EAAE,GAClC,MAAM,CAgBR"}

package/dist/ai-service/agent/subagents/apis/example-selector.js

@@ -0,0 +1,104 @@
+import { getAllExampleMetadata, formatExamplesByIds, VALID_TAGS, } from "./examples.js";
+// Create a Set for efficient tag validation
+const VALID_TAGS_SET = new Set(VALID_TAGS);
+/**
+ * Select examples based on provided tags.
+ * Returns the most relevant examples ordered by relevance.
+ */
+export function selectExamplesByTags(tags, options = {}) {
+    const { maxExamples = 2, includeNegative = false, maxTokenBudget = 2000, } = options;
+    // Get all example metadata
+    const EXAMPLE_METADATA = getAllExampleMetadata();
+    // If no tags provided, return one simple baseline example
+    if (!tags || tags.length === 0) {
+        const baseline = EXAMPLE_METADATA.find((e) => e.id === "getUsersByStatusApi");
+        return baseline ? [baseline] : [];
+    }
+    // Normalize tags
+    const tagSet = new Set(tags.map((t) => t.toLowerCase().trim()));
+    // Filter out invalid tags
+    const validTagSet = new Set(Array.from(tagSet).filter((t) => VALID_TAGS_SET.has(t)));
+    // If no valid tags, return baseline
+    if (validTagSet.size === 0) {
+        const baseline = EXAMPLE_METADATA.find((e) => e.id === "getUsersByStatusApi");
+        return baseline ? [baseline] : [];
+    }
+    // Add some tags by default
+    validTagSet.add("global-context");
+    validTagSet.add("error-scope-violation");
+    // Filter examples based on category preference
+    const candidateExamples = includeNegative
+        ? EXAMPLE_METADATA
+        : EXAMPLE_METADATA.filter((e) => e.category === "positive");
+    // Score each example by tag overlap
+    const scored = candidateExamples.map((metadata) => {
+        const exampleTagSet = new Set(metadata.tags.map((t) => t.toLowerCase()));
+        const matchedTags = Array.from(validTagSet).filter((t) => exampleTagSet.has(t));
+        // Base score: number of matching tags
+        let score = matchedTags.length;
+        // Boost for complexity match with nesting tags
+        if (validTagSet.has("nested-control-flow")) {
+            if (metadata.complexity === "complex") {
+                score += 2;
+            }
+        }
+        // Boost for negative examples when explicitly requested
+        if (metadata.category === "negative") {
+            score += 3;
+        }
+        // Boost for scope-related examples (high error rate)
+        if (validTagSet.has("scope-access") ||
+            validTagSet.has("error-scope-violation")) {
+            if (metadata.tags.includes("scope-access") ||
+                metadata.tags.includes("error-scope-violation")) {
+                score += 2;
+            }
+        }
+        return { metadata, score, matchedTags };
+    });
+    // Sort by score (descending)
+    scored.sort((a, b) => b.score - a.score);
+    // Select top examples within token budget
+    const selected = [];
+    let currentTokens = 0;
+    for (const { metadata, score } of scored) {
+        // Only include if it has at least one matching tag
+        if (score === 0)
+            continue;
+        // Check token budget
+        if (currentTokens + metadata.estimatedTokens > maxTokenBudget) {
+            break;
+        }
+        selected.push(metadata);
+        currentTokens += metadata.estimatedTokens;
+        // Stop if we've reached max examples
+        if (selected.length >= maxExamples) {
+            break;
+        }
+    }
+    // If no examples matched, return one simple baseline
+    if (selected.length === 0) {
+        const baseline = EXAMPLE_METADATA.find((e) => e.id === "getUsersByStatusApi");
+        if (baseline) {
+            selected.push(baseline);
+        }
+    }
+    return selected;
+}
+/**
+ * Format selected examples for inclusion in the system prompt.
+ */
+export function formatSelectedExamples(selectedMetadata) {
+    if (selectedMetadata.length === 0) {
+        return "";
+    }
+    const ids = selectedMetadata.map((m) => m.id);
+    const extractedExamples = formatExamplesByIds(ids);
+    if (!extractedExamples) {
+        return "";
+    }
+    // Add a header explaining these are selected examples
+    const header = `The following examples demonstrate relevant patterns for this API task:\n\n`;
+    return header + extractedExamples;
+}
+//# sourceMappingURL=example-selector.js.map

package/dist/ai-service/agent/subagents/apis/example-selector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"example-selector.js","sourceRoot":"","sources":["../../../../../src/ai-service/agent/subagents/apis/example-selector.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EAEnB,UAAU,GACX,MAAM,eAAe,CAAC;AAUvB,4CAA4C;AAC5C,MAAM,cAAc,GAAG,IAAI,GAAG,CAAS,UAAU,CAAC,CAAC;AAcnD;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAAuC,EACvC,UAAiC,EAAE;IAEnC,MAAM,EACJ,WAAW,GAAG,CAAC,EACf,eAAe,GAAG,KAAK,EACvB,cAAc,GAAG,IAAI,GACtB,GAAG,OAAO,CAAC;IAEZ,2BAA2B;IAC3B,MAAM,gBAAgB,GAAG,qBAAqB,EAAE,CAAC;IAEjD,0DAA0D;IAC1D,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CACpC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,qBAAqB,CACtC,CAAC;QACF,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpC,CAAC;IAED,iBAAiB;IACjB,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAEhE,0BAA0B;IAC1B,MAAM,WAAW,GAAG,IAAI,GAAG,CACzB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CACvC,CAAC;IAEnB,oCAAoC;IACpC,IAAI,WAAW,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CACpC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,qBAAqB,CACtC,CAAC;QACF,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpC,CAAC;IAED,2BAA2B;IAC3B,WAAW,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAClC,WAAW,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IAEzC,+CAA+C;IAC/C,MAAM,iBAAiB,GAAG,eAAe;QACvC,CAAC,CAAC,gBAAgB;QAClB,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC;IAE9D,oCAAoC;IACpC,MAAM,MAAM,GAAoB,iBAAiB,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;QACjE,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QACzE,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CACvD,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CACrB,CAAC;QAEF,sCAAsC;QACtC,IAAI,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC;QAE/B,+CAA+C;QAC/C,IAAI,WAAW,CAAC,GAAG,CAAC,qBAAqB,CAAC,EAAE,CAAC;YAC3C,IAAI,QAAQ,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;gBACtC,KAAK,IAAI,CAAC,CAAC;YACb,CAAC;QACH,CAAC;QAED,wDAAwD;QACxD,IAAI,QAAQ,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;YACrC,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;QAED,qDAAqD;QACrD,IACE,WAAW,CAAC,GAAG,CAAC,cAAc,CAAC;YAC/B,WAAW,CAAC,GAAG,CAAC,uBAAuB,CAAC,EACxC,CAAC;YACD,IACE,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC;gBACtC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,uBAAuB,CAAC,EAC/C,CAAC;gBACD,KAAK,IAAI,CAAC,CAAC;YACb,CAAC;QACH,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,6BAA6B;IAC7B,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;IAEzC,0CAA0C;IAC1C,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,IAAI,aAAa,GAAG,CAAC,CAAC;IAEtB,KAAK,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,MAAM,EAAE,CAAC;QACzC,mDAAmD;QACnD,IAAI,KAAK,KAAK,CAAC;YAAE,SAAS;QAE1B,qBAAqB;QACrB,IAAI,aAAa,GAAG,QAAQ,CAAC,eAAe,GAAG,cAAc,EAAE,CAAC;YAC9D,MAAM;QACR,CAAC;QAED,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxB,aAAa,IAAI,QAAQ,CAAC,eAAe,CAAC;QAE1C,qCAAqC;QACrC,IAAI,QAAQ,CAAC,MAAM,IAAI,WAAW,EAAE,CAAC;YACnC,MAAM;QACR,CAAC;IACH,CAAC;IAED,qDAAqD;IACrD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CACpC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,qBAAqB,CACtC,CAAC;QACF,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CACpC,gBAAmC;IAEnC,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC9C,MAAM,iBAAiB,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAEnD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,sDAAsD;IACtD,MAAM,MAAM,GAAG,6EAA6E,CAAC;IAE7F,OAAO,MAAM,GAAG,iBAAiB,CAAC;AACpC,CAAC"}

package/dist/ai-service/agent/subagents/apis/examples.d.ts

@@ -0,0 +1,38 @@
+import { type PageEntity, type AvailableIntegration, type IntegrationMetadata } from "./prompt-builder.js";
+export declare const VALID_TAGS: readonly ["loop", "conditional", "trycatch", "nested-control-flow", "snowflake", "databricks", "scope-access", "variable-access", "error-handling", "validation", "data-transformation", "batch-processing", "global-context", "multi-integration", "data-science", "sql-query", "aggregation", "error-scope-violation", "error-execution-order"];
+export type ValidTag = (typeof VALID_TAGS)[number];
+interface ApiExampleMetadata {
+    tags: ValidTag[];
+    complexity: "simple" | "intermediate" | "complex";
+    category: "positive" | "negative";
+    estimatedTokens: number;
+}
+interface ApiInputContext {
+    pageEntities?: PageEntity[];
+    availableIntegrations?: AvailableIntegration[];
+    integrationMetadata?: IntegrationMetadata[];
+}
+interface PositiveApiExample {
+    id: string;
+    metadata: ApiExampleMetadata;
+    inputContext?: ApiInputContext;
+    userPrompt: string;
+    code: string;
+}
+export declare const POSITIVE_EXAMPLES: PositiveApiExample[];
+/**
+ * Get all example metadata for selection purposes
+ */
+export declare function getAllExampleMetadata(): Array<{
+    id: string;
+    tags: ValidTag[];
+    complexity: "simple" | "intermediate" | "complex";
+    category: "positive" | "negative";
+    estimatedTokens: number;
+}>;
+/**
+ * Get examples by IDs and format as XML
+ */
+export declare function formatExamplesByIds(ids: string[]): string;
+export {};
+//# sourceMappingURL=examples.d.ts.map

package/dist/ai-service/agent/subagents/apis/examples.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"examples.d.ts","sourceRoot":"","sources":["../../../../../src/ai-service/agent/subagents/apis/examples.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,UAAU,EACf,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACzB,MAAM,qBAAqB,CAAC;AAE7B,eAAO,MAAM,UAAU,mVAwBb,CAAC;AAEX,MAAM,MAAM,QAAQ,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC;AAEnD,UAAU,kBAAkB;IAC1B,IAAI,EAAE,QAAQ,EAAE,CAAC;IACjB,UAAU,EAAE,QAAQ,GAAG,cAAc,GAAG,SAAS,CAAC;IAClD,QAAQ,EAAE,UAAU,GAAG,UAAU,CAAC;IAClC,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,UAAU,eAAe;IACvB,YAAY,CAAC,EAAE,UAAU,EAAE,CAAC;IAC5B,qBAAqB,CAAC,EAAE,oBAAoB,EAAE,CAAC;IAC/C,mBAAmB,CAAC,EAAE,mBAAmB,EAAE,CAAC;CAC7C;AAED,UAAU,kBAAkB;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,YAAY,CAAC,EAAE,eAAe,CAAC;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;CACd;AAWD,eAAO,MAAM,iBAAiB,EAAE,kBAAkB,EA87BjD,CAAC;AA6UF;;GAEG;AACH,wBAAgB,qBAAqB,IAAI,KAAK,CAAC;IAC7C,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,QAAQ,EAAE,CAAC;IACjB,UAAU,EAAE,QAAQ,GAAG,cAAc,GAAG,SAAS,CAAC;IAClD,QAAQ,EAAE,UAAU,GAAG,UAAU,CAAC;IAClC,eAAe,EAAE,MAAM,CAAC;CACzB,CAAC,CAYD;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,CA8CzD"}