@vercel/factory 0.0.0 → 0.0.2

package/dist/eve/index.js

@@ -1,56 +1,476 @@
 import {
+  changeEvidenceSchema,
   changeIdSchema,
+  defaultApprovalPolicy,
+  dispatchTask,
+  findingFingerprint,
+  findingSchema,
   levelSchema,
   repositoryIdSchema,
+  requiresApproval,
   signalIdSchema,
   taskIdSchema,
   taskQuestionSchema,
   vocabularySchema
-} from "../chunk-BSDWPFKE.js";
+} from "../chunk-LBEYCOSR.js";
+import "../chunk-CEF6VJZC.js";
 
 // src/eve/index.ts
+import { defineHook } from "eve/hooks";
+import { defineTool as defineTool6 } from "eve/tools";
+import { z as z6 } from "zod";
+
+// src/eve/deepsec.ts
+import { defineTool as defineTool2 } from "eve/tools";
+import { z as z2 } from "zod";
+
+// src/eve/finding.ts
 import { defineTool } from "eve/tools";
 import { z } from "zod";
-var decidedOutcomeSchema = z.enum([
+async function recordFinding(stores, repositoryId, finding, options = {}) {
+  const source = options.source ?? "security_scan";
+  const policy = options.approval ?? defaultApprovalPolicy;
+  const repository = await stores.repositories.get(repositoryId);
+  if (repository === null) {
+    return { recorded: false, reason: `repository ${repositoryId} does not exist` };
+  }
+  const fingerprint = findingFingerprint(repositoryId, finding);
+  const signal = await stores.signals.create({
+    repositoryId,
+    source,
+    deliveryId: fingerprint,
+    replyTo: { channel: "finding", address: fingerprint },
+    payload: finding
+  });
+  if (signal.outcome !== "pending") {
+    return { recorded: false, duplicate: true, signalId: signal.id, reason: `already recorded as ${signal.id}` };
+  }
+  await stores.signals.decide(signal.id, "accepted", {
+    detail: finding.priority,
+    reason: `${finding.tool ?? "scanner"} reported it, ${finding.verification.level} by ${finding.verification.method}`
+  });
+  const approval = requiresApproval(policy, { source, kind: "code_change", priority: finding.priority });
+  const task = await stores.tasks.create({
+    repositoryIds: [repositoryId],
+    kind: "code_change",
+    origin: { signalId: signal.id },
+    replyTo: signal.replyTo,
+    ...approval ? { approval: "required" } : {}
+  });
+  return { recorded: true, signalId: signal.id, taskId: task.id, approval: approval ? "required" : "not_required" };
+}
+function recordFindingTool(stores, options = {}) {
+  return defineTool({
+    description: "Record one problem you found in the repository. Creates a fix task (which may wait for human approval) unless the same finding was already recorded. Report every finding separately; never batch.",
+    inputSchema: z.object({
+      repositoryId: repositoryIdSchema,
+      finding: findingSchema
+    }),
+    execute({ repositoryId, finding }) {
+      return recordFinding(stores, repositoryId, finding, options);
+    }
+  });
+}
+
+// src/eve/deepsec.ts
+var deepsecFindingSchema = z2.looseObject({
+  title: z2.string().min(1),
+  description: z2.string().min(1),
+  severity: z2.string().min(1),
+  metadata: z2.looseObject({
+    filePath: z2.string().min(1).optional(),
+    lineNumbers: z2.array(z2.number().int().min(1)).optional(),
+    vulnSlug: z2.string().min(1).optional(),
+    confidence: z2.string().optional(),
+    runId: z2.string().optional()
+  }).optional()
+});
+var deepsecExportSchema = z2.union([
+  z2.array(deepsecFindingSchema),
+  z2.looseObject({ findings: z2.array(deepsecFindingSchema) }).transform((value) => value.findings)
+]);
+var priorityBySeverity = {
+  CRITICAL: "P0",
+  HIGH: "P1",
+  MEDIUM: "P2",
+  HIGH_BUG: "P2",
+  BUG: "P3",
+  LOW: "P3"
+};
+function findingFromDeepsec(raw) {
+  const meta = raw.metadata ?? {};
+  const confidence = (meta.confidence ?? "").toLowerCase();
+  const line = meta.lineNumbers?.[0];
+  const endLine = meta.lineNumbers === void 0 ? void 0 : Math.max(...meta.lineNumbers);
+  return findingSchema.parse({
+    title: raw.title.replace(/^\[[A-Z_]+\]\s*/u, "").slice(0, 200),
+    body: raw.description.slice(0, 8e3),
+    ...meta.filePath === void 0 ? {} : { path: meta.filePath.slice(0, 500) },
+    ...line === void 0 ? {} : { line },
+    ...endLine === void 0 || endLine === line ? {} : { endLine },
+    priority: priorityBySeverity[raw.severity.toUpperCase()] ?? "P3",
+    category: "security",
+    verification: {
+      // deepsec's agent reads the code; it does not run it. Say so.
+      level: confidence === "high" ? "supported" : "unverified",
+      method: "static_analysis",
+      summary: `deepsec ${meta.vulnSlug ?? "finding"} with ${confidence || "unknown"} confidence${meta.runId === void 0 ? "" : ` (run ${meta.runId})`}.`,
+      limitations: "AI-assisted static analysis of the checkout; not reproduced at runtime."
+    },
+    tool: "deepsec",
+    ...meta.vulnSlug === void 0 ? {} : { ruleId: meta.vulnSlug }
+  });
+}
+var findingsPath = "/tmp/deepsec-findings.json";
+function candidateCount(output) {
+  const match = /(\d+)\s+file\(s\) with candidates/u.exec(output);
+  return match?.[1] === void 0 ? null : Number(match[1]);
+}
+function tail(output, lines = 4) {
+  const ansi = /\u001b\[[0-9;]*m/gu;
+  return output.replaceAll(ansi, "").split("\n").map((line) => line.trim()).filter((line) => line !== "").slice(-lines).join(" | ").slice(0, 600);
+}
+function deepsecScanTool(stores, options) {
+  const repoPath = options.repoPath ?? "repo";
+  const workspace = options.workspacePath ?? "deepsec";
+  const version = options.version ?? "2.3.8";
+  const agent = options.agent ?? "claude";
+  const model = options.model ?? "claude-sonnet-4-6";
+  const thinkingLevel = options.thinkingLevel ?? "medium";
+  const concurrency = options.concurrency ?? 4;
+  const prefix = options.commandPrefix === void 0 ? [] : [options.commandPrefix];
+  const filesPerRun = options.filesPerRun ?? 40;
+  return defineTool2({
+    description: "Run deepsec, the AI-powered vulnerability scanner, over the repository checkout and record every finding it reports as a fix task. Takes minutes. Call once per scan; then summarize the result.",
+    inputSchema: z2.object({
+      repositoryId: repositoryIdSchema,
+      limit: z2.number().int().min(1).max(500).optional().describe("Candidate files to investigate this run (default 40; deepsec resumes where it left off next time).")
+    }),
+    async execute({ repositoryId, limit }, ctx) {
+      const repository = await stores.repositories.get(repositoryId);
+      if (repository === null) {
+        return { scanned: false, reason: `repository ${repositoryId} does not exist` };
+      }
+      const sandbox = await ctx.getSandbox();
+      const projectId = repository.slug.replace(/[^a-z0-9]+/gu, "-");
+      const startedAt = Date.now();
+      const phase = async (state, reason) => {
+        await stores.receipts.append({
+          repositoryIds: [repositoryId],
+          kind: "deepsec",
+          state,
+          phase: "security_scan",
+          reason: `${reason} (${Math.round((Date.now() - startedAt) / 1e3)}s in)`
+        });
+      };
+      await phase("started", `deepsec ${version} on ${repository.slug}, ${agent}/${model}`);
+      const prepare = await sandbox.run({
+        command: [
+          ...prefix,
+          "set -e",
+          `if [ ! -f ${workspace}/deepsec.config.ts ]; then`,
+          `  npx -y deepsec@${version} init ./${workspace} ./${repoPath} --id ${projectId} --scaffold-only --headless --yes --skip-install`,
+          `  (cd ${workspace} && npm install --no-audit --no-fund --loglevel=error)`,
+          "fi",
+          // deepsec resolves deepsec.config.ts from the current directory, so
+          // every deepsec command runs inside the workspace. No --root: it is a
+          // one-off override that skips the project's file records, leaving
+          // `process` with nothing to investigate.
+          `cd ${workspace}`,
+          `./node_modules/.bin/deepsec scan --project-id ${projectId}`
+        ].join("\n")
+      });
+      if (typeof prepare.exitCode === "number" && prepare.exitCode !== 0) {
+        const detail = (prepare.stderr ?? prepare.stdout).trim().slice(-1500);
+        await phase("failed", `scan phase failed: ${detail.slice(-300)}`);
+        return { scanned: false, reason: `deepsec scan failed: ${detail}` };
+      }
+      const candidates = candidateCount(prepare.stdout);
+      await phase(
+        "scanned",
+        `${candidates === null ? "scan output" : `${candidates} files with candidates`}: ${tail(`${prepare.stdout}
+${prepare.stderr ?? ""}`)}`
+      );
+      const investigate = await options.withModelCredential(
+        sandbox,
+        [
+          ...prefix,
+          "set -e",
+          `cd ${workspace}`,
+          `./node_modules/.bin/deepsec process --project-id ${projectId} --agent ${agent} --model ${model} --thinking-level ${thinkingLevel} --concurrency ${concurrency} --limit ${limit ?? filesPerRun}`,
+          `./node_modules/.bin/deepsec export --project-id ${projectId} --format json --out ${findingsPath}`
+        ].join("\n")
+      );
+      if (typeof investigate.exitCode === "number" && investigate.exitCode !== 0) {
+        const detail = (investigate.stderr ?? investigate.stdout).trim().slice(-1500);
+        await phase("failed", `process phase failed: ${detail.slice(-300)}`);
+        return { scanned: false, reason: `deepsec process failed: ${detail}` };
+      }
+      const exported = await sandbox.run({ command: `cat ${findingsPath}` });
+      let parsed;
+      try {
+        parsed = JSON.parse(exported.stdout);
+      } catch {
+        return { scanned: false, reason: "deepsec export was not valid JSON" };
+      }
+      const raw = deepsecExportSchema.safeParse(parsed);
+      if (!raw.success) {
+        return { scanned: false, reason: `deepsec export had an unexpected shape: ${raw.error.issues[0]?.message ?? "unknown"}` };
+      }
+      const results = [];
+      for (const entry of raw.data) {
+        const finding = findingFromDeepsec(entry);
+        results.push({ finding, result: await recordFinding(stores, repositoryId, finding, options) });
+      }
+      const recorded = results.filter(({ result }) => result.recorded);
+      await phase(
+        "completed",
+        `${results.length} findings, ${recorded.length} new. process output: ${tail(`${investigate.stdout}
+${investigate.stderr ?? ""}`, 6)}`
+      );
+      return {
+        scanned: true,
+        tool: "deepsec",
+        found: results.length,
+        recorded: recorded.length,
+        duplicates: results.length - recorded.length,
+        awaitingApproval: recorded.filter(({ result }) => result.recorded && result.approval === "required").length,
+        findings: results.map(({ finding, result }) => ({
+          title: finding.title,
+          priority: finding.priority,
+          path: finding.path,
+          line: finding.line,
+          ...result.recorded ? { taskId: result.taskId, approval: result.approval } : { duplicate: true }
+        }))
+      };
+    }
+  });
+}
+
+// src/eve/fetch.ts
+import { defineTool as defineTool3 } from "eve/tools";
+import { z as z3 } from "zod";
+function fetchPullRequestTool(stores, options) {
+  const repoPath = options.repoPath ?? "repo";
+  const depth = options.depth ?? 50;
+  return defineTool3({
+    description: "Fetch the pull request under review into the checkout and check it out as the local branch `pr`. Call this after get_task, before inspecting or testing the change. Returns the PR number, URL, and the commit you are now on.",
+    inputSchema: z3.object({
+      changeId: changeIdSchema.describe("The change under review, from your starting message.")
+    }),
+    async execute({ changeId }, ctx) {
+      const change = await stores.changes.get(changeId);
+      if (change === null) {
+        return { fetched: false, reason: `change ${changeId} does not exist` };
+      }
+      if (change.state !== "verifying") {
+        return { fetched: false, reason: `change is ${change.state}, not verifying; nothing to fetch` };
+      }
+      const repository = await stores.repositories.get(change.repositoryId);
+      if (repository === null) {
+        return { fetched: false, reason: `repository ${change.repositoryId} does not exist` };
+      }
+      const sandbox = await ctx.getSandbox();
+      const tracking = `refs/remotes/origin/pr-${change.prNumber}`;
+      const git = `git -C ${repoPath}`;
+      const result = await options.withCredential(
+        sandbox,
+        repository.slug,
+        `${git} fetch --depth ${depth} origin +refs/pull/${change.prNumber}/head:${tracking} && ${git} checkout -B pr ${tracking}`
+      );
+      if (typeof result.exitCode === "number" && result.exitCode !== 0) {
+        return {
+          fetched: false,
+          reason: `git fetch of pull request ${change.prNumber} failed: ${(result.stderr ?? "").trim()}`
+        };
+      }
+      const head = await sandbox.run({ command: `${git} rev-parse HEAD` });
+      return {
+        fetched: true,
+        prNumber: change.prNumber,
+        prUrl: change.prUrl,
+        branch: "pr",
+        headSha: head.stdout.trim()
+      };
+    }
+  });
+}
+
+// src/eve/invoke.ts
+import { defineTool as defineTool4 } from "eve/tools";
+import { z as z4 } from "zod";
+function invokeAgentTool(stores, options) {
+  const doFetch = options.fetch ?? fetch;
+  return defineTool4({
+    description: `${options.description} Hands the work to a separate agent in a fresh session; you will not see its reasoning. Returns the handoff task id.`,
+    inputSchema: z4.object({
+      repositoryIds: z4.array(repositoryIdSchema).min(1),
+      parentTaskId: taskIdSchema.optional().describe("Your own task, when this work continues it."),
+      changeId: changeIdSchema.optional().describe("The change the target agent should work on."),
+      channel: z4.string().min(1).describe("Reply connector, e.g. github."),
+      address: z4.string().min(1).describe("Reply address, e.g. acme/web#41."),
+      brief: z4.string().min(1).max(4e3).describe("What the target agent needs to know. Facts and references only, not your reasoning.")
+    }),
+    async execute(input) {
+      const task = await stores.tasks.create({
+        repositoryIds: input.repositoryIds,
+        kind: options.kind,
+        origin: input.parentTaskId === void 0 ? { operator: "factory" } : { parentTaskId: input.parentTaskId },
+        replyTo: { channel: input.channel, address: input.address }
+      });
+      const running = await dispatchTask(stores, task.id, {
+        launch: async (dispatched) => {
+          const headers = {
+            "content-type": "application/json",
+            ...await options.headers?.()
+          };
+          const token = await options.token?.();
+          if (token !== void 0) {
+            headers.authorization = `Bearer ${token}`;
+          }
+          const message = [
+            `You are assigned factory task ${dispatched.id}.`,
+            input.changeId === void 0 ? null : `Change under review: ${input.changeId}.`,
+            `Reply address: ${input.channel} ${input.address}.`,
+            "",
+            input.brief,
+            "",
+            "Read the task with get_task first, do the work, and record the outcome with your factory tools."
+          ].filter((line) => line !== null).join("\n");
+          const response = await doFetch(`${options.targetUrl()}/eve/v1/session`, {
+            method: "POST",
+            headers,
+            body: JSON.stringify({ message, operationId: `factory-task:${dispatched.id}` })
+          });
+          if (!response.ok) {
+            throw new Error(`target agent refused the session: ${response.status}`);
+          }
+        }
+      });
+      return { taskId: running.id, kind: running.kind, state: running.state };
+    }
+  });
+}
+
+// src/eve/verification.ts
+import { defineTool as defineTool5 } from "eve/tools";
+import { z as z5 } from "zod";
+function recordVerificationTool(stores) {
+  return defineTool5({
+    description: "Record the outcome of a verification task: the evidence you gathered and whether the change passed. Pass moves the change to ready for human review; fail keeps it out of review.",
+    inputSchema: z5.object({
+      taskId: taskIdSchema.describe("Your verification task."),
+      changeId: changeIdSchema.describe("The change you verified."),
+      verdict: z5.enum(["pass", "fail"]),
+      evidence: changeEvidenceSchema,
+      confidence: levelSchema.describe("How certain you are in the verdict."),
+      summary: z5.string().min(1).max(2e3).describe("What you checked and what you found.")
+    }),
+    async execute({ taskId, changeId, verdict, evidence, confidence, summary }) {
+      const change = await stores.changes.get(changeId);
+      if (change === null) {
+        return { recorded: false, reason: `change ${changeId} does not exist` };
+      }
+      if (change.state !== "verifying") {
+        return {
+          recorded: false,
+          reason: `change is ${change.state}, not verifying; nothing to record`
+        };
+      }
+      const task = await stores.tasks.get(taskId);
+      if (task === null || task.kind !== "verification") {
+        return { recorded: false, reason: `${taskId} is not a verification task` };
+      }
+      let updatedChange = change;
+      if (verdict === "pass") {
+        updatedChange = await stores.changes.transition(changeId, "ready", {
+          patch: { evidence, confidence },
+          reason: summary
+        });
+      }
+      let finished;
+      if (verdict === "pass") {
+        await stores.tasks.transition(taskId, "verifying", { reason: summary });
+        finished = await stores.tasks.transition(taskId, "succeeded");
+      } else {
+        finished = await stores.tasks.transition(taskId, "failed", { reason: summary });
+      }
+      if (change.taskId !== void 0) {
+        const parent = await stores.tasks.get(change.taskId);
+        if (parent?.state === "verifying") {
+          await stores.tasks.transition(
+            change.taskId,
+            verdict === "pass" ? "succeeded" : "failed",
+            verdict === "pass" ? {} : { reason: `verification failed: ${summary}` }
+          ).catch(() => void 0);
+        }
+      }
+      return {
+        recorded: true,
+        verdict,
+        changeState: updatedChange.state,
+        taskState: finished.state
+      };
+    }
+  });
+}
+
+// src/eve/index.ts
+var decidedOutcomeSchema = z6.enum([
   "accepted",
   "duplicate",
   "unactionable",
   "low_confidence",
   "ignored"
 ]);
-function factoryTools(stores) {
+var recordChangeInputSchema = z6.object({
+  taskId: taskIdSchema,
+  repositoryId: repositoryIdSchema,
+  prNumber: z6.number().int().min(1),
+  prUrl: z6.url(),
+  risk: levelSchema.describe("Blast radius of the change if it is wrong."),
+  confidence: levelSchema.describe("How certain you are the change is correct."),
+  summary: z6.string().min(1).describe("One-sentence description of the change.")
+});
+function factoryTools(stores, options = {}) {
+  const recordChangeGate = options.recordChangeGate;
   return {
-    get_task: defineTool({
+    get_task: defineTool6({
       description: "Read one factory task by id: its kind, state, repositories, origin, and results.",
-      inputSchema: z.object({ taskId: taskIdSchema }),
+      inputSchema: z6.object({ taskId: taskIdSchema }),
       async execute({ taskId }) {
         const task = await stores.tasks.get(taskId);
         return task ?? { found: false, taskId };
       }
     }),
-    decide_signal: defineTool({
+    decide_signal: defineTool6({
       description: "Record the triage decision for a pending signal. A signal is decided exactly once.",
-      inputSchema: z.object({
+      inputSchema: z6.object({
         signalId: signalIdSchema,
         outcome: decidedOutcomeSchema,
-        reason: z.string().min(1).describe("Why this outcome was chosen."),
-        detail: z.string().min(1).optional().describe("Severity if accepted, or the duplicate-of signal id.")
+        reason: z6.string().min(1).describe("Why this outcome was chosen."),
+        detail: z6.string().min(1).optional().describe("Severity if accepted, or the duplicate-of signal id.")
       }),
       execute({ signalId, outcome, reason, detail }) {
         return stores.signals.decide(signalId, outcome, { reason, detail });
       }
     }),
-    record_change: defineTool({
+    record_change: defineTool6({
       description: "Record the pull request produced for a code_change task. Creates the change, links it to the task, and moves the task to verifying.",
-      inputSchema: z.object({
-        taskId: taskIdSchema,
-        repositoryId: repositoryIdSchema,
-        prNumber: z.number().int().min(1),
-        prUrl: z.url(),
-        risk: levelSchema.describe("Blast radius of the change if it is wrong."),
-        confidence: levelSchema.describe("How certain you are the change is correct."),
-        summary: z.string().min(1).describe("One-sentence description of the change.")
-      }),
+      inputSchema: recordChangeInputSchema,
+      ...recordChangeGate === void 0 ? {} : {
+        approval: async ({ toolInput }) => {
+          const parsed = recordChangeInputSchema.safeParse(toolInput);
+          if (!parsed.success) {
+            return {
+              type: "denied",
+              reason: "record_change input is malformed; fix the arguments and retry"
+            };
+          }
+          const verdict = await recordChangeGate(parsed.data);
+          return verdict.ok ? "not-applicable" : { type: "denied", reason: verdict.reason };
+        }
+      },
       async execute({ taskId, repositoryId, prNumber, prUrl, risk, confidence, summary }) {
         const change = await stores.changes.create({
           repositoryId,
@@ -75,23 +495,45 @@ function factoryTools(stores) {
         return { change, task };
       }
     }),
-    report_blocked: defineTool({
+    finish_task: defineTool6({
+      description: "Mark your task finished with a summary, for task kinds that have no other outcome tool (for example a security_scan). Not for code_change or verification tasks: those end with record_change and record_verification.",
+      inputSchema: z6.object({
+        taskId: taskIdSchema,
+        summary: z6.string().min(1).max(4e3).describe("What you did and found, for the ledger.")
+      }),
+      async execute({ taskId, summary }) {
+        const task = await stores.tasks.get(taskId);
+        if (task === null) {
+          return { finished: false, reason: `${taskId} does not exist` };
+        }
+        if (task.kind === "code_change" || task.kind === "verification") {
+          return { finished: false, reason: `${task.kind} tasks end with their own outcome tool` };
+        }
+        if (task.state !== "running") {
+          return { finished: false, reason: `task is ${task.state}, not running` };
+        }
+        await stores.tasks.transition(taskId, "verifying", { reason: summary });
+        const finished = await stores.tasks.transition(taskId, "succeeded", { reason: summary });
+        return { finished: true, taskState: finished.state };
+      }
+    }),
+    report_blocked: defineTool6({
       description: "Mark a running task as needing a human because the work cannot continue without help.",
-      inputSchema: z.object({
+      inputSchema: z6.object({
         taskId: taskIdSchema,
-        reason: z.string().min(1).describe("What is blocking, written for the human.")
+        reason: z6.string().min(1).describe("What is blocking, written for the human.")
       }),
       execute({ taskId, reason }) {
         return stores.tasks.transition(taskId, "needs_human", { reason });
       }
     }),
-    ask_question: defineTool({
+    ask_question: defineTool6({
       description: "Raise a question a human operator must answer. Creates a question task that waits for the answer.",
-      inputSchema: z.object({
-        repositoryIds: z.array(repositoryIdSchema).min(1),
+      inputSchema: z6.object({
+        repositoryIds: z6.array(repositoryIdSchema).min(1),
         parentTaskId: taskIdSchema.optional().describe("Task the answer unblocks, when there is one."),
-        channel: z.string().min(1).describe("Reply connector, e.g. github."),
-        address: z.string().min(1).describe("Reply address, e.g. acme/web#41."),
+        channel: z6.string().min(1).describe("Reply connector, e.g. github."),
+        address: z6.string().min(1).describe("Reply address, e.g. acme/web#41."),
         question: taskQuestionSchema.omit({ answer: true, answeredBy: true })
       }),
       async execute({ repositoryIds, parentTaskId, channel, address, question }) {
@@ -105,16 +547,16 @@ function factoryTools(stores) {
         return stores.tasks.transition(task.id, "needs_human");
       }
     }),
-    append_receipt: defineTool({
+    append_receipt: defineTool6({
       description: "Append one immutable audit receipt for an event worth remembering. Receipts can never be edited or deleted.",
-      inputSchema: z.object({
-        repositoryIds: z.array(repositoryIdSchema).min(1),
+      inputSchema: z6.object({
+        repositoryIds: z6.array(repositoryIdSchema).min(1),
         taskId: taskIdSchema.optional(),
         changeId: changeIdSchema.optional(),
         kind: vocabularySchema.describe("What the receipt is about, e.g. investigation."),
         state: vocabularySchema.describe("What happened, e.g. flag_ramped."),
-        reason: z.string().min(1).max(2e3).optional(),
-        dedupeKey: z.string().min(1).optional().describe("Same key twice records one receipt instead of two.")
+        reason: z6.string().min(1).max(2e3).optional(),
+        dedupeKey: z6.string().min(1).optional().describe("Same key twice records one receipt instead of two.")
       }),
       execute(input) {
         return stores.receipts.append(input);
@@ -122,7 +564,38 @@ function factoryTools(stores) {
     })
   };
 }
+function factoryHooks(stores) {
+  return {
+    factory: defineHook({
+      events: {
+        async "turn.completed"(_event, ctx) {
+          const address = ctx.channel.continuationToken;
+          if (address === void 0) {
+            return;
+          }
+          const tasks = await stores.tasks.list();
+          const abandoned = tasks.filter(
+            (task) => task.state === "running" && task.replyTo.address === address
+          );
+          for (const task of abandoned) {
+            await stores.tasks.transition(task.id, "needs_human", {
+              reason: "agent turn ended without recording an outcome"
+            }).catch(() => void 0);
+          }
+        }
+      }
+    })
+  };
+}
 export {
-  factoryTools
+  deepsecScanTool,
+  factoryHooks,
+  factoryTools,
+  fetchPullRequestTool,
+  findingFromDeepsec,
+  invokeAgentTool,
+  recordFinding,
+  recordFindingTool,
+  recordVerificationTool
 };
 //# sourceMappingURL=index.js.map