@syrin/cli 1.3.0

package/dist/runtime/analysis/rules/errors/e500-side-effect-detected.d.ts

@@ -0,0 +1,39 @@
+/**
+ * E500: Side Effect Detected
+ *
+ * Condition: Tool attempts filesystem writes to project files (not temp directory)
+ *
+ * Why this is fatal:
+ * - Tools should not mutate project state
+ * - Breaks isolation and testability
+ * - Makes behavior unpredictable
+ */
+import { BaseRule } from '../base.js';
+import type { AnalysisContext, Diagnostic } from '../../types.js';
+/**
+ * Context for behavioral validation results.
+ * This extends the static analysis context with runtime observation data.
+ */
+export interface BehavioralContext {
+    /** Tool name */
+    toolName: string;
+    /** Side effects detected */
+    sideEffects: Array<{
+        operation: string;
+        path: string;
+    }>;
+}
+declare class E500SideEffectDetectedRule extends BaseRule {
+    readonly id: "E500";
+    readonly severity: "error";
+    readonly ruleName = "Side Effect Detected";
+    readonly description = "Tool attempted filesystem write to project files. Tools should not mutate project state.";
+    check(_ctx: AnalysisContext): Diagnostic[];
+    /**
+     * Check with behavioral context (called from test orchestrator).
+     */
+    checkWithBehavioralContext(behavioralCtx: BehavioralContext): Diagnostic[];
+}
+export declare const E500SideEffectDetected: E500SideEffectDetectedRule;
+export {};
+//# sourceMappingURL=e500-side-effect-detected.d.ts.map

package/dist/runtime/analysis/rules/errors/e500-side-effect-detected.js

@@ -0,0 +1,40 @@
+/**
+ * E500: Side Effect Detected
+ *
+ * Condition: Tool attempts filesystem writes to project files (not temp directory)
+ *
+ * Why this is fatal:
+ * - Tools should not mutate project state
+ * - Breaks isolation and testability
+ * - Makes behavior unpredictable
+ */
+import { BaseRule } from '../base.js';
+import { ERROR_CODES } from '../error-codes.js';
+class E500SideEffectDetectedRule extends BaseRule {
+    id = ERROR_CODES.E500;
+    severity = 'error';
+    ruleName = 'Side Effect Detected';
+    description = 'Tool attempted filesystem write to project files. Tools should not mutate project state.';
+    check(_ctx) {
+        const diagnostics = [];
+        // This rule requires behavioral context (from runtime testing)
+        // It will be called with behavioral data from the test orchestrator
+        // For now, return empty - actual checking happens in test orchestrator
+        return diagnostics;
+    }
+    /**
+     * Check with behavioral context (called from test orchestrator).
+     */
+    checkWithBehavioralContext(behavioralCtx) {
+        const diagnostics = [];
+        if (behavioralCtx.sideEffects.length > 0) {
+            const sideEffectList = behavioralCtx.sideEffects
+                .map(se => `  - ${se.operation}: ${se.path}`)
+                .join('\n');
+            diagnostics.push(this.createDiagnostic(`Tool "${behavioralCtx.toolName}" attempted filesystem operations on project files:\n${sideEffectList}`, behavioralCtx.toolName, undefined, 'Remove filesystem writes or write only to temp directory. Tools should not mutate project state.'));
+        }
+        return diagnostics;
+    }
+}
+export const E500SideEffectDetected = new E500SideEffectDetectedRule();
+//# sourceMappingURL=e500-side-effect-detected.js.map

package/dist/runtime/analysis/rules/errors/e501-hidden-dependency.d.ts

@@ -0,0 +1,47 @@
+/**
+ * E501: Hidden Dependency
+ *
+ * Condition: Tool calls other tools during execution without declaring them in contract
+ *
+ * Why this is fatal:
+ * - Breaks isolation assumption
+ * - Creates hidden coupling
+ * - Makes tool behavior unpredictable
+ */
+import { BaseRule } from '../base.js';
+import type { AnalysisContext, Diagnostic } from '../../types.js';
+/**
+ * Context for hidden dependency detection.
+ */
+export interface HiddenDependencyContext {
+    /** Tool name */
+    toolName: string;
+    /** List of tool calls that are not declared */
+    hiddenDependencies: Array<{
+        toolName: string;
+        timestamp: number;
+    }>;
+    /** List of declared dependencies that don't exist in the MCP server */
+    missingDependencies?: string[];
+    /**
+     * Declared dependencies from contract.
+     * @todo Reserved for future validation/consumer use.
+     * Currently unused by checkWithBehavioralContext() but retained for potential
+     * future enhancements such as dependency validation or consumer tool analysis.
+     */
+    declaredDependencies: string[];
+}
+declare class E501HiddenDependencyRule extends BaseRule {
+    readonly id: "E501";
+    readonly severity: "error";
+    readonly ruleName = "Hidden Dependency";
+    readonly description = "Tool calls other tools during execution without declaring them in contract. This breaks isolation.";
+    check(_ctx: AnalysisContext): Diagnostic[];
+    /**
+     * Check with behavioral context (called from test orchestrator).
+     */
+    checkWithBehavioralContext(behavioralCtx: HiddenDependencyContext): Diagnostic[];
+}
+export declare const E501HiddenDependency: E501HiddenDependencyRule;
+export {};
+//# sourceMappingURL=e501-hidden-dependency.d.ts.map

package/dist/runtime/analysis/rules/errors/e501-hidden-dependency.js

@@ -0,0 +1,46 @@
+/**
+ * E501: Hidden Dependency
+ *
+ * Condition: Tool calls other tools during execution without declaring them in contract
+ *
+ * Why this is fatal:
+ * - Breaks isolation assumption
+ * - Creates hidden coupling
+ * - Makes tool behavior unpredictable
+ */
+import { BaseRule } from '../base.js';
+import { ERROR_CODES } from '../error-codes.js';
+class E501HiddenDependencyRule extends BaseRule {
+    id = ERROR_CODES.E501;
+    severity = 'error';
+    ruleName = 'Hidden Dependency';
+    description = 'Tool calls other tools during execution without declaring them in contract. This breaks isolation.';
+    check(_ctx) {
+        // This rule requires behavioral context
+        return [];
+    }
+    /**
+     * Check with behavioral context (called from test orchestrator).
+     */
+    checkWithBehavioralContext(behavioralCtx) {
+        const diagnostics = [];
+        // Check for hidden dependencies (tools called but not declared)
+        if (behavioralCtx.hiddenDependencies.length > 0) {
+            const dependencyList = behavioralCtx.hiddenDependencies
+                .map(dep => `  - ${dep.toolName}`)
+                .join('\n');
+            diagnostics.push(this.createDiagnostic(`Tool "${behavioralCtx.toolName}" called other tools without declaring them:\n${dependencyList}`, behavioralCtx.toolName, undefined, `Declare dependencies in contract (guarantees.dependencies: [${behavioralCtx.hiddenDependencies.map(d => `"${d.toolName}"`).join(', ')}]) or remove the tool calls.`));
+        }
+        // Check for missing dependencies (declared but don't exist in MCP server)
+        if (behavioralCtx.missingDependencies &&
+            behavioralCtx.missingDependencies.length > 0) {
+            const missingList = behavioralCtx.missingDependencies
+                .map(dep => `  - ${dep}`)
+                .join('\n');
+            diagnostics.push(this.createDiagnostic(`Tool "${behavioralCtx.toolName}" declares dependencies that don't exist in the MCP server:\n${missingList}`, behavioralCtx.toolName, undefined, `Remove non-existent dependencies from contract (guarantees.dependencies) or ensure these tools are implemented: [${behavioralCtx.missingDependencies.map(d => `"${d}"`).join(', ')}]`));
+        }
+        return diagnostics;
+    }
+}
+export const E501HiddenDependency = new E501HiddenDependencyRule();
+//# sourceMappingURL=e501-hidden-dependency.js.map

package/dist/runtime/analysis/rules/errors/e600-unexpected-test-result.d.ts

@@ -0,0 +1,65 @@
+/**
+ * E600: Unexpected Test Result
+ *
+ * Condition: Test's actual outcome doesn't match its expectation
+ *
+ * Why this is fatal:
+ * - Test contract is inaccurate
+ * - Tool behavior doesn't match declared guarantees
+ * - Can cause false positives/negatives in validation
+ * - Indicates mismatch between expectations and reality
+ */
+import { BaseRule } from '../base.js';
+import type { AnalysisContext, Diagnostic } from '../../types.js';
+/**
+ * Context for unexpected test result detection.
+ */
+export interface UnexpectedTestResultContext {
+    /** Tool name */
+    toolName: string;
+    /** Test name */
+    testName: string;
+    /** Test input */
+    testInput?: Record<string, unknown>;
+    /** Expected outcome (success/error/timeout) */
+    expectedOutcome: 'success' | 'error' | 'timeout';
+    /** Actual outcome (success/error/timeout) */
+    actualOutcome: 'success' | 'error' | 'timeout';
+    /** Expected error code (if expecting error) */
+    expectedErrorCode?: string;
+    /** Expected error type (if expecting error) */
+    expectedErrorType?: string;
+    /** Actual error code (if actual outcome is error) */
+    actualErrorCode?: string;
+    /** Actual error type (if actual outcome is error) */
+    actualErrorType?: string;
+    /** Expected error details (if expecting specific error) */
+    expectedError?: {
+        type?: string;
+        details?: Record<string, unknown>;
+    };
+    /** Actual error details (if actual outcome is error) */
+    actualError?: {
+        code?: string;
+        type?: string;
+        message?: string;
+    };
+}
+declare class E600UnexpectedTestResultRule extends BaseRule {
+    readonly id: "E600";
+    readonly severity: "error";
+    readonly ruleName = "Unexpected Test Result";
+    readonly description = "Test's actual outcome doesn't match its expectation. Tool behavior doesn't match declared guarantees.";
+    check(_ctx: AnalysisContext): Diagnostic[];
+    /**
+     * Determine if a diagnostic should be created based on behavioral context.
+     */
+    private shouldCreateDiagnostic;
+    /**
+     * Check with behavioral context (called from test orchestrator).
+     */
+    checkWithBehavioralContext(behavioralCtx: UnexpectedTestResultContext): Diagnostic[];
+}
+export declare const E600UnexpectedTestResult: E600UnexpectedTestResultRule;
+export {};
+//# sourceMappingURL=e600-unexpected-test-result.d.ts.map

package/dist/runtime/analysis/rules/errors/e600-unexpected-test-result.js

@@ -0,0 +1,109 @@
+/**
+ * E600: Unexpected Test Result
+ *
+ * Condition: Test's actual outcome doesn't match its expectation
+ *
+ * Why this is fatal:
+ * - Test contract is inaccurate
+ * - Tool behavior doesn't match declared guarantees
+ * - Can cause false positives/negatives in validation
+ * - Indicates mismatch between expectations and reality
+ */
+import { BaseRule } from '../base.js';
+import { ERROR_CODES } from '../error-codes.js';
+class E600UnexpectedTestResultRule extends BaseRule {
+    id = ERROR_CODES.E600;
+    severity = 'error';
+    ruleName = 'Unexpected Test Result';
+    description = "Test's actual outcome doesn't match its expectation. Tool behavior doesn't match declared guarantees.";
+    check(_ctx) {
+        // This rule requires behavioral context
+        return [];
+    }
+    /**
+     * Determine if a diagnostic should be created based on behavioral context.
+     */
+    shouldCreateDiagnostic(behavioralCtx) {
+        // If outcomes don't match, create diagnostic
+        if (behavioralCtx.expectedOutcome !== behavioralCtx.actualOutcome) {
+            return true;
+        }
+        // Outcomes match - check if error details also match (for error cases)
+        if (behavioralCtx.expectedOutcome === 'error') {
+            const expectedType = behavioralCtx.expectedErrorType?.toLowerCase();
+            const actualType = behavioralCtx.actualErrorType?.toLowerCase();
+            if (expectedType && actualType && expectedType !== actualType) {
+                return true; // Type mismatch
+            }
+            if (expectedType && !actualType) {
+                return true; // Expected type but no actual type
+            }
+            const expectedCode = behavioralCtx.expectedErrorCode;
+            const actualCode = behavioralCtx.actualErrorCode;
+            if (expectedCode && actualCode && expectedCode !== actualCode) {
+                return true; // Code mismatch
+            }
+        }
+        return false; // Everything matches
+    }
+    /**
+     * Check with behavioral context (called from test orchestrator).
+     */
+    checkWithBehavioralContext(behavioralCtx) {
+        const diagnostics = [];
+        if (!this.shouldCreateDiagnostic(behavioralCtx)) {
+            return diagnostics;
+        }
+        // If we reach here, there's a mismatch - create diagnostic
+        let message = `Test "${behavioralCtx.testName}" in tool "${behavioralCtx.toolName}" expected `;
+        // Build expected description
+        if (behavioralCtx.expectedOutcome === 'success') {
+            message += 'success but got ';
+            if (behavioralCtx.actualOutcome === 'error') {
+                message += `error (${behavioralCtx.actualErrorCode || behavioralCtx.actualErrorType || 'unknown error'})`;
+            }
+            else if (behavioralCtx.actualOutcome === 'timeout') {
+                message += 'timeout';
+            }
+            else {
+                message += behavioralCtx.actualOutcome;
+            }
+        }
+        else if (behavioralCtx.expectedOutcome === 'error') {
+            message += `error`;
+            if (behavioralCtx.expectedErrorType) {
+                message += ` of type "${behavioralCtx.expectedErrorType}"`;
+            }
+            if (behavioralCtx.expectedErrorCode) {
+                message += ` (code: ${behavioralCtx.expectedErrorCode})`;
+            }
+            message += ' but got ';
+            if (behavioralCtx.actualOutcome === 'success') {
+                message += 'success';
+            }
+            else {
+                message += `${behavioralCtx.actualOutcome} (${behavioralCtx.actualErrorCode || behavioralCtx.actualErrorType || 'unknown error'})`;
+            }
+            if (behavioralCtx.actualErrorType &&
+                behavioralCtx.expectedErrorType &&
+                behavioralCtx.actualErrorType.toLowerCase() !==
+                    behavioralCtx.expectedErrorType.toLowerCase()) {
+                message += ' with different type';
+            }
+        }
+        else {
+            message += `${behavioralCtx.expectedOutcome} but got ${behavioralCtx.actualOutcome}`;
+        }
+        diagnostics.push(this.createDiagnostic(message, behavioralCtx.toolName, undefined, 'Update test expectation to match actual tool behavior, or fix tool implementation to match declared guarantees. Ensure test expectations accurately reflect tool behavior.', {
+            testName: behavioralCtx.testName,
+            testInput: behavioralCtx.testInput,
+            expectedOutcome: behavioralCtx.expectedOutcome,
+            actualOutcome: behavioralCtx.actualOutcome,
+            expectedError: behavioralCtx.expectedError,
+            actualError: behavioralCtx.actualError,
+        }));
+        return diagnostics;
+    }
+}
+export const E600UnexpectedTestResult = new E600UnexpectedTestResultRule();
+//# sourceMappingURL=e600-unexpected-test-result.js.map

package/dist/runtime/analysis/rules/index.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Rule registry.
+ * Exports all analysis rules.
+ */
+import type { Rule } from './base.js';
+/**
+ * All registered rules.
+ */
+export declare const ALL_RULES: Rule[];
+/**
+ * Get all error rules.
+ */
+export declare function getErrorRules(): Rule[];
+/**
+ * Get all warning rules.
+ */
+export declare function getWarningRules(): Rule[];
+//# sourceMappingURL=index.d.ts.map

package/dist/runtime/analysis/rules/index.js

@@ -0,0 +1,94 @@
+/**
+ * Rule registry.
+ * Exports all analysis rules.
+ */
+// Error rules (will be imported as we create them)
+import { E000ToolNotFound } from './errors/e000-tool-not-found.js';
+import { E100MissingOutputSchema } from './errors/e100-missing-output-schema.js';
+import { E102UnderspecifiedRequiredInput } from './errors/e102-underspecified-input.js';
+import { E103TypeMismatch } from './errors/e103-type-mismatch.js';
+import { E105FreeTextPropagation } from './errors/e105-free-text-propagation.js';
+import { E110ToolAmbiguity } from './errors/e110-tool-ambiguity.js';
+import { E104ParamNotInDescription } from './errors/e104-param-not-in-description.js';
+import { E106OutputNotGuaranteed } from './errors/e106-output-not-guaranteed.js';
+import { E107CircularDependency } from './errors/e107-circular-dependency.js';
+import { E108ImplicitUserInput } from './errors/e108-implicit-user-input.js';
+import { E109NonSerializable } from './errors/e109-non-serializable.js';
+import { E101MissingToolDescription } from './errors/e101-missing-tool-description.js';
+import { E500SideEffectDetected } from './errors/e500-side-effect-detected.js';
+import { E301OutputExplosion } from './errors/e301-output-explosion.js';
+import { E501HiddenDependency } from './errors/e501-hidden-dependency.js';
+import { E403UnboundedExecution } from './errors/e403-unbounded-execution.js';
+import { E300OutputValidationFailed } from './errors/e300-output-validation-failed.js';
+import { E200InputValidationFailed } from './errors/e200-input-validation-failed.js';
+import { E400ToolExecutionFailed } from './errors/e400-tool-execution-failed.js';
+import { E600UnexpectedTestResult } from './errors/e600-unexpected-test-result.js';
+// Warning rules
+import { W100ImplicitDependency } from './warnings/w100-implicit-dependency.js';
+import { W101FreeTextWithoutNormalization } from './warnings/w101-free-text-without-normalization.js';
+import { W102MissingExamples } from './warnings/w102-missing-examples.js';
+import { W103OverloadedResponsibility } from './warnings/w103-overloaded-responsibility.js';
+import { W104GenericDescription } from './warnings/w104-generic-description.js';
+import { W105OptionalAsRequired } from './warnings/w105-optional-as-required.js';
+import { W106BroadOutputSchema } from './warnings/w106-broad-output-schema.js';
+import { W107MultipleEntryPoints } from './warnings/w107-multiple-entry-points.js';
+import { W108HiddenSideEffects } from './warnings/w108-hidden-side-effects.js';
+import { W109OutputNotReusable } from './warnings/w109-output-not-reusable.js';
+import { W110WeakSchema } from './warnings/w110-weak-schema.js';
+import { W300HighEntropyOutput } from './warnings/w300-high-entropy-output.js';
+import { W301UnstableDefaults } from './warnings/w301-unstable-defaults.js';
+/**
+ * All registered rules.
+ */
+export const ALL_RULES = [
+    // Error rules (blocking)
+    E000ToolNotFound,
+    E100MissingOutputSchema,
+    E102UnderspecifiedRequiredInput,
+    E103TypeMismatch,
+    E105FreeTextPropagation,
+    E110ToolAmbiguity,
+    E104ParamNotInDescription,
+    E106OutputNotGuaranteed,
+    E107CircularDependency,
+    E108ImplicitUserInput,
+    E109NonSerializable,
+    E101MissingToolDescription,
+    // Behavioral error rules (v1.3.0)
+    E500SideEffectDetected,
+    E301OutputExplosion,
+    E501HiddenDependency,
+    E403UnboundedExecution,
+    E300OutputValidationFailed,
+    E200InputValidationFailed,
+    E400ToolExecutionFailed,
+    E600UnexpectedTestResult,
+    // Warning rules (non-blocking)
+    W100ImplicitDependency,
+    W101FreeTextWithoutNormalization,
+    W102MissingExamples,
+    W103OverloadedResponsibility,
+    W104GenericDescription,
+    W105OptionalAsRequired,
+    W106BroadOutputSchema,
+    W107MultipleEntryPoints,
+    W108HiddenSideEffects,
+    W109OutputNotReusable,
+    // Behavioral warning rules (v1.3.0)
+    W110WeakSchema,
+    W300HighEntropyOutput,
+    W301UnstableDefaults,
+];
+/**
+ * Get all error rules.
+ */
+export function getErrorRules() {
+    return ALL_RULES.filter(rule => rule.severity === 'error');
+}
+/**
+ * Get all warning rules.
+ */
+export function getWarningRules() {
+    return ALL_RULES.filter(rule => rule.severity === 'warning');
+}
+//# sourceMappingURL=index.js.map

package/dist/runtime/analysis/rules/warnings/w001-implicit-dependency.d.ts

@@ -0,0 +1,22 @@
+/**
+ * W001: Implicit Tool Dependency
+ *
+ * Condition:
+ * - High confidence dependency inferred
+ * - Not stated explicitly in description
+ *
+ * Why:
+ * - LLM may not chain tools reliably
+ */
+import { BaseRule } from '../base.js';
+import type { AnalysisContext, Diagnostic } from '../../types.js';
+declare class W001ImplicitDependencyRule extends BaseRule {
+    readonly id = "W001";
+    readonly severity: "warning";
+    readonly ruleName = "Implicit Tool Dependency";
+    readonly description = "Tool appears to depend on another tool, but the dependency is implicit.";
+    check(ctx: AnalysisContext): Diagnostic[];
+}
+export declare const W001ImplicitDependency: W001ImplicitDependencyRule;
+export {};
+//# sourceMappingURL=w001-implicit-dependency.d.ts.map

package/dist/runtime/analysis/rules/warnings/w001-implicit-dependency.js

@@ -0,0 +1,39 @@
+/**
+ * W001: Implicit Tool Dependency
+ *
+ * Condition:
+ * - High confidence dependency inferred
+ * - Not stated explicitly in description
+ *
+ * Why:
+ * - LLM may not chain tools reliably
+ */
+import { BaseRule } from '../base.js';
+class W001ImplicitDependencyRule extends BaseRule {
+    id = 'W001';
+    severity = 'warning';
+    ruleName = 'Implicit Tool Dependency';
+    description = 'Tool appears to depend on another tool, but the dependency is implicit.';
+    check(ctx) {
+        const diagnostics = [];
+        // Check medium to high confidence dependencies (0.6-0.8)
+        const implicitDeps = ctx.dependencies.filter(d => d.confidence >= 0.6 && d.confidence < 0.8);
+        for (const dep of implicitDeps) {
+            // Find the toTool to check its description
+            const toTool = ctx.indexes.toolIndex.get(dep.toTool.toLowerCase());
+            if (!toTool) {
+                continue;
+            }
+            const description = toTool.description || '';
+            // Check if fromTool is mentioned in description
+            const fromToolNameLower = dep.fromTool.toLowerCase();
+            const descLower = description.toLowerCase();
+            if (!descLower.includes(fromToolNameLower)) {
+                diagnostics.push(this.createDiagnostic(`Tool "${dep.toTool}" appears to depend on "${dep.fromTool}", but the dependency is implicit.`, dep.toTool, dep.toField, `Mention "${dep.fromTool}" in the description of "${dep.toTool}" to make the dependency explicit.`));
+            }
+        }
+        return diagnostics;
+    }
+}
+export const W001ImplicitDependency = new W001ImplicitDependencyRule();
+//# sourceMappingURL=w001-implicit-dependency.js.map

package/dist/runtime/analysis/rules/warnings/w002-free-text-without-normalization.d.ts

@@ -0,0 +1,24 @@
+/**
+ * W002: Free-Text Output Without Normalization
+ *
+ * Condition:
+ * - Output is string
+ * - Not constrained or normalized
+ * - Even if not chained
+ *
+ * Why:
+ * - Hard to reuse
+ * - Hard to evolve
+ */
+import { BaseRule } from '../base.js';
+import type { AnalysisContext, Diagnostic } from '../../types.js';
+declare class W002FreeTextWithoutNormalizationRule extends BaseRule {
+    readonly id = "W002";
+    readonly severity: "warning";
+    readonly ruleName = "Free-Text Output Without Normalization";
+    readonly description = "Tool returns unconstrained free text. Consider normalizing output.";
+    check(ctx: AnalysisContext): Diagnostic[];
+}
+export declare const W002FreeTextWithoutNormalization: W002FreeTextWithoutNormalizationRule;
+export {};
+//# sourceMappingURL=w002-free-text-without-normalization.d.ts.map

package/dist/runtime/analysis/rules/warnings/w002-free-text-without-normalization.js

@@ -0,0 +1,40 @@
+/**
+ * W002: Free-Text Output Without Normalization
+ *
+ * Condition:
+ * - Output is string
+ * - Not constrained or normalized
+ * - Even if not chained
+ *
+ * Why:
+ * - Hard to reuse
+ * - Hard to evolve
+ */
+import { BaseRule } from '../base.js';
+class W002FreeTextWithoutNormalizationRule extends BaseRule {
+    id = 'W002';
+    severity = 'warning';
+    ruleName = 'Free-Text Output Without Normalization';
+    description = 'Tool returns unconstrained free text. Consider normalizing output.';
+    check(ctx) {
+        const diagnostics = [];
+        for (const tool of ctx.tools) {
+            for (const output of tool.outputs) {
+                // Check if output is unconstrained string
+                if (output.type !== 'string') {
+                    continue;
+                }
+                const hasEnum = Boolean(output.enum && output.enum.length > 0);
+                const hasPattern = Boolean(output.pattern);
+                const hasDescription = Boolean(output.description && output.description.trim());
+                // If it's a string with no constraints, it's unconstrained free text
+                if (!hasEnum && !hasPattern && !hasDescription) {
+                    diagnostics.push(this.createDiagnostic(`Tool "${tool.name}" returns unconstrained free text (field: "${output.name}"). Consider normalizing output.`, tool.name, output.name, `Add constraints to the output: enum values, regex pattern, or a clear description of the expected format.`));
+                }
+            }
+        }
+        return diagnostics;
+    }
+}
+export const W002FreeTextWithoutNormalization = new W002FreeTextWithoutNormalizationRule();
+//# sourceMappingURL=w002-free-text-without-normalization.js.map

package/dist/runtime/analysis/rules/warnings/w003-missing-examples.d.ts

@@ -0,0 +1,22 @@
+/**
+ * W003: Missing Examples for User-Facing Inputs
+ *
+ * Condition:
+ * - Tool takes user-provided input
+ * - No examples provided
+ *
+ * Why:
+ * - LLM guessing increases error rate
+ */
+import { BaseRule } from '../base.js';
+import type { AnalysisContext, Diagnostic } from '../../types.js';
+declare class W003MissingExamplesRule extends BaseRule {
+    readonly id = "W003";
+    readonly severity: "warning";
+    readonly ruleName = "Missing Examples for User-Facing Inputs";
+    readonly description = "Tool accepts user-provided input but has no examples. LLM accuracy may be reduced.";
+    check(ctx: AnalysisContext): Diagnostic[];
+}
+export declare const W003MissingExamples: W003MissingExamplesRule;
+export {};
+//# sourceMappingURL=w003-missing-examples.d.ts.map