@yasserkhanorg/impact-gate 2.0.0

package/dist/openai_provider.js

@@ -0,0 +1,251 @@
+"use strict";
+// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+// See LICENSE.txt for license information.
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OpenAIProvider = void 0;
+exports.checkOpenAISetup = checkOpenAISetup;
+const openai_1 = __importDefault(require("openai"));
+const provider_interface_js_1 = require("./provider_interface.js");
+const provider_utils_js_1 = require("./provider_utils.js");
+const base_provider_js_1 = require("./base_provider.js");
+const logger_js_1 = require("./logger.js");
+function inferVisionSupport(model) {
+    const lower = model.toLowerCase();
+    return lower.includes('vision') || lower.includes('4o') || lower.includes('omni');
+}
+class OpenAIProvider extends base_provider_js_1.BaseProvider {
+    constructor(config) {
+        super();
+        this.name = 'openai';
+        if (!provider_utils_js_1.API_KEY_PATTERNS.openai.test(config.apiKey)) {
+            throw new Error('Invalid API key format. Expected sk-* format.');
+        }
+        if (config.baseUrl) {
+            const validation = (0, provider_utils_js_1.validateAndSanitizeUrl)(config.baseUrl);
+            if (!validation.valid) {
+                throw new Error(`Invalid base URL: ${validation.warning}`);
+            }
+            if (validation.warning) {
+                logger_js_1.logger.warn(`HTTPS required for remote URLs: ${validation.warning}`);
+            }
+        }
+        this.client = new openai_1.default({
+            apiKey: config.apiKey,
+            baseURL: config.baseUrl,
+            organization: config.organizationId,
+        });
+        this.model = config.model || 'gpt-4';
+        const maxTokens = config.maxTokens || 128000;
+        const costPer1MInputTokens = config.costPer1MInputTokens ?? 0;
+        const costPer1MOutputTokens = config.costPer1MOutputTokens ?? 0;
+        this.capabilities = {
+            vision: inferVisionSupport(this.model),
+            streaming: true,
+            maxTokens,
+            costPer1MInputTokens,
+            costPer1MOutputTokens,
+            supportsTools: true,
+            supportsPromptCaching: false,
+            typicalResponseTimeMs: 1200,
+        };
+    }
+    async generateText(prompt, options) {
+        this.checkBudget();
+        const startTime = Date.now();
+        try {
+            if (prompt.length > 10 * 1024 * 1024) {
+                throw new Error('Prompt exceeds maximum size (10MB)');
+            }
+            const messages = [];
+            if (options?.systemPrompt) {
+                messages.push({ role: 'system', content: options.systemPrompt });
+            }
+            messages.push({ role: 'user', content: prompt });
+            const response = await (0, provider_utils_js_1.withTimeout)(this.client.chat.completions.create({
+                model: this.model,
+                messages,
+                max_tokens: options?.maxTokens,
+                temperature: options?.temperature,
+                top_p: options?.topP,
+                stop: options?.stopSequences,
+            }), options?.timeout, 'generateText');
+            const responseTime = Date.now() - startTime;
+            const text = response.choices[0]?.message?.content || '';
+            const usage = this.extractUsage(response.usage);
+            const cost = this.calculateCost(usage, this.capabilities.costPer1MInputTokens, this.capabilities.costPer1MOutputTokens);
+            this.updateStats(usage, responseTime, cost);
+            return {
+                text,
+                usage,
+                cost,
+                metadata: {
+                    model: this.model,
+                    responseTimeMs: responseTime,
+                    finishReason: response.choices[0]?.finish_reason,
+                },
+            };
+        }
+        catch (error) {
+            this.stats.failedRequests++;
+            throw new provider_interface_js_1.LLMProviderError((0, provider_utils_js_1.sanitizeErrorMessage)(error, 'generateText'), this.name, this.extractStatusCode(error), error);
+        }
+    }
+    async analyzeImage(images, prompt, options) {
+        if (!this.capabilities.vision) {
+            throw new provider_interface_js_1.UnsupportedCapabilityError(this.name, 'vision');
+        }
+        const startTime = Date.now();
+        try {
+            if (images.length === 0 || images.length > 20) {
+                throw new Error('Image count must be between 1 and 20');
+            }
+            if (prompt.length > 10 * 1024 * 1024) {
+                throw new Error('Prompt exceeds maximum size (10MB)');
+            }
+            const content = [{ type: 'text', text: prompt }];
+            for (const image of images) {
+                const mediaType = (image.mimeType || image.mediaType || 'image/png');
+                if (!['image/png', 'image/jpeg', 'image/webp'].includes(mediaType)) {
+                    throw new Error(`Unsupported image type: ${mediaType}`);
+                }
+                const data = image.data || image.base64 || '';
+                if (data.length > 20 * 1024 * 1024) {
+                    throw new Error('Image data exceeds maximum size (20MB)');
+                }
+                const url = `data:${mediaType};base64,${data}`;
+                content.push({ type: 'image_url', image_url: { url } });
+                if (image.description) {
+                    content.push({ type: 'text', text: `[Image: ${image.description}]` });
+                }
+            }
+            const messages = [];
+            if (options?.systemPrompt) {
+                messages.push({ role: 'system', content: options.systemPrompt });
+            }
+            messages.push({ role: 'user', content });
+            const response = await (0, provider_utils_js_1.withTimeout)(this.client.chat.completions.create({
+                model: this.model,
+                messages,
+                max_tokens: options?.maxTokens,
+                temperature: options?.temperature,
+                top_p: options?.topP,
+                stop: options?.stopSequences,
+            }), options?.timeout, 'analyzeImage');
+            const responseTime = Date.now() - startTime;
+            const text = response.choices[0]?.message?.content || '';
+            const usage = this.extractUsage(response.usage);
+            const cost = this.calculateCost(usage, this.capabilities.costPer1MInputTokens, this.capabilities.costPer1MOutputTokens);
+            this.updateStats(usage, responseTime, cost);
+            return {
+                text,
+                usage,
+                cost,
+                metadata: {
+                    model: this.model,
+                    responseTimeMs: responseTime,
+                    finishReason: response.choices[0]?.finish_reason,
+                    imageCount: images.length,
+                },
+            };
+        }
+        catch (error) {
+            this.stats.failedRequests++;
+            throw new provider_interface_js_1.LLMProviderError((0, provider_utils_js_1.sanitizeErrorMessage)(error, 'analyzeImage'), this.name, this.extractStatusCode(error), error);
+        }
+    }
+    async *streamText(prompt, options) {
+        try {
+            if (prompt.length > 10 * 1024 * 1024) {
+                throw new Error('Prompt exceeds maximum size (10MB)');
+            }
+            const messages = [];
+            if (options?.systemPrompt) {
+                messages.push({ role: 'system', content: options.systemPrompt });
+            }
+            messages.push({ role: 'user', content: prompt });
+            const stream = await (0, provider_utils_js_1.withTimeout)(this.client.chat.completions.create({
+                model: this.model,
+                messages,
+                max_tokens: options?.maxTokens,
+                temperature: options?.temperature,
+                top_p: options?.topP,
+                stop: options?.stopSequences,
+                stream: true,
+            }), options?.timeout, 'streamText');
+            for await (const chunk of stream) {
+                const content = chunk.choices[0]?.delta?.content;
+                if (content) {
+                    yield content;
+                }
+            }
+            this.stats.requestCount++;
+            this.stats.lastUpdated = new Date();
+        }
+        catch (error) {
+            this.stats.failedRequests++;
+            throw new provider_interface_js_1.LLMProviderError((0, provider_utils_js_1.sanitizeErrorMessage)(error, 'streamText'), this.name, this.extractStatusCode(error), error);
+        }
+    }
+    extractUsage(usage) {
+        return {
+            inputTokens: usage?.prompt_tokens || 0,
+            outputTokens: usage?.completion_tokens || 0,
+            totalTokens: usage?.total_tokens || 0,
+        };
+    }
+    extractStatusCode(error) {
+        if (error && typeof error === 'object') {
+            const err = error;
+            const status = err.status;
+            if (typeof status === 'number') {
+                return status;
+            }
+        }
+        return undefined;
+    }
+    async checkHealth() {
+        try {
+            await (0, provider_utils_js_1.withTimeout)(this.client.chat.completions.create({
+                model: this.model,
+                max_tokens: 5,
+                messages: [{ role: 'user', content: 'Hi' }],
+            }), 5000, 'health check');
+            return {
+                healthy: true,
+                message: 'OpenAI API is accessible',
+            };
+        }
+        catch (error) {
+            return {
+                healthy: false,
+                message: `OpenAI API error: ${(0, provider_utils_js_1.sanitizeErrorMessage)(error, 'health check')}`,
+            };
+        }
+    }
+}
+exports.OpenAIProvider = OpenAIProvider;
+async function checkOpenAISetup(apiKey) {
+    if (!apiKey) {
+        return {
+            valid: false,
+            message: 'No API key provided',
+        };
+    }
+    try {
+        const provider = new OpenAIProvider({ apiKey });
+        const health = await provider.checkHealth();
+        return {
+            valid: health.healthy,
+            message: health.message,
+        };
+    }
+    catch (error) {
+        return {
+            valid: false,
+            message: `Setup check failed: ${(0, provider_utils_js_1.sanitizeErrorMessage)(error, 'setup check')}`,
+        };
+    }
+}

package/dist/pipeline/orchestrator.d.ts

@@ -0,0 +1,33 @@
+import { type ImpactConfig } from './stage1_impact.js';
+import { type CoverageConfig } from './stage2_coverage.js';
+import { type GenerationConfig, type GeneratedSpec } from './stage3_generation.js';
+import { type HealConfig, type HealResult } from './stage4_heal.js';
+import { type FlowDecisionReport } from '../validation/output_schema.js';
+import type { RouteFamilyConfig } from '../knowledge/route_families.js';
+import type { ApiSurfaceConfig } from '../knowledge/api_surface.js';
+import type { GenerationProfile } from '../prompts/generation_profile.js';
+export interface PipelineConfig {
+    appPath: string;
+    testsRoot: string;
+    gitSince: string;
+    gitIncludeUncommitted?: boolean;
+    routeFamilies?: RouteFamilyConfig;
+    apiSurface?: ApiSurfaceConfig;
+    profile?: GenerationProfile;
+    impact?: ImpactConfig;
+    coverage?: CoverageConfig;
+    generation?: GenerationConfig;
+    heal?: HealConfig;
+    /** Path to a Playwright JSON report for heal-from-report mode */
+    playwrightReportPath?: string;
+    stages?: Array<'preprocess' | 'impact' | 'coverage' | 'generation' | 'heal'>;
+}
+export interface PipelineResult {
+    report: FlowDecisionReport;
+    reportPath: string;
+    warnings: string[];
+    generated?: GeneratedSpec[];
+    healResult?: HealResult;
+}
+export declare function runPipeline(config: PipelineConfig): Promise<PipelineResult>;
+//# sourceMappingURL=orchestrator.d.ts.map

package/dist/pipeline/orchestrator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"orchestrator.d.ts","sourceRoot":"","sources":["../../src/pipeline/orchestrator.ts"],"names":[],"mappings":"AAQA,OAAO,EAAiB,KAAK,YAAY,EAAC,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAAmB,KAAK,cAAc,EAAC,MAAM,sBAAsB,CAAC;AAC3E,OAAO,EAAqB,KAAK,gBAAgB,EAAE,KAAK,aAAa,EAAC,MAAM,wBAAwB,CAAC;AACrG,OAAO,EAAuD,KAAK,UAAU,EAAE,KAAK,UAAU,EAAC,MAAM,kBAAkB,CAAC;AACxH,OAAO,EAAe,KAAK,kBAAkB,EAAoB,MAAM,gCAAgC,CAAC;AAExG,OAAO,KAAK,EAAC,iBAAiB,EAAC,MAAM,gCAAgC,CAAC;AACtE,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,6BAA6B,CAAC;AAClE,OAAO,KAAK,EAAC,iBAAiB,EAAC,MAAM,kCAAkC,CAAC;AAGxE,MAAM,WAAW,cAAc;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,aAAa,CAAC,EAAE,iBAAiB,CAAC;IAClC,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,iEAAiE;IACjE,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,MAAM,CAAC,EAAE,KAAK,CAAC,YAAY,GAAG,QAAQ,GAAG,UAAU,GAAG,YAAY,GAAG,MAAM,CAAC,CAAC;CAChF;AAED,MAAM,WAAW,cAAc;IAC3B,MAAM,EAAE,kBAAkB,CAAC;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,SAAS,CAAC,EAAE,aAAa,EAAE,CAAC;IAC5B,UAAU,CAAC,EAAE,UAAU,CAAC;CAC3B;AAYD,wBAAsB,WAAW,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC,CA8IjF"}

package/dist/pipeline/orchestrator.js

@@ -0,0 +1,231 @@
+"use strict";
+// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+// See LICENSE.txt for license information.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runPipeline = runPipeline;
+const fs_1 = require("fs");
+const path_1 = require("path");
+const git_js_1 = require("../agent/git.js");
+const logger_js_1 = require("../logger.js");
+const stage0_preprocess_js_1 = require("./stage0_preprocess.js");
+const stage1_impact_js_1 = require("./stage1_impact.js");
+const stage2_coverage_js_1 = require("./stage2_coverage.js");
+const stage3_generation_js_1 = require("./stage3_generation.js");
+const stage4_heal_js_1 = require("./stage4_heal.js");
+const output_schema_js_1 = require("../validation/output_schema.js");
+const guardrails_js_1 = require("../validation/guardrails.js");
+const generation_profile_js_1 = require("../prompts/generation_profile.js");
+function createRunId() {
+    const ciRunId = process.env.GITHUB_RUN_ID;
+    const entropy = Math.random().toString(36).slice(2, 8);
+    const ts = Date.now().toString(36);
+    if (ciRunId) {
+        return `pipeline-gh-${ciRunId}-${ts}-${entropy}`;
+    }
+    return `pipeline-local-${ts}-${entropy}`;
+}
+async function runPipeline(config) {
+    const runId = createRunId();
+    const startedAt = new Date().toISOString();
+    const allWarnings = [];
+    const stages = config.stages || ['preprocess', 'impact', 'coverage'];
+    const profile = config.profile || (0, generation_profile_js_1.resolveGenerationProfile)();
+    let generatedSpecs;
+    let healResult;
+    // Step 1: Get changed files
+    const gitResult = (0, git_js_1.getChangedFiles)(config.appPath, config.gitSince, {
+        includeUncommitted: config.gitIncludeUncommitted,
+    });
+    if (gitResult.error) {
+        allWarnings.push(`Git diff warning: ${gitResult.error}`);
+    }
+    const changedFiles = gitResult.files
+        .map((f) => f.replace(/\\/g, '/'))
+        .filter((f) => !(0, git_js_1.isTestFile)(f));
+    if (changedFiles.length === 0) {
+        allWarnings.push('No changed application files detected.');
+        const emptyReport = {
+            runId,
+            timestamp: startedAt,
+            gitRef: config.gitSince,
+            summary: (0, output_schema_js_1.buildSummary)([]),
+            decisions: [],
+            warnings: allWarnings,
+            model: {},
+        };
+        const reportPath = writeReport(config.testsRoot, emptyReport);
+        return { report: emptyReport, reportPath, warnings: allWarnings };
+    }
+    const timings = {};
+    // Step 2: Preprocess — deterministic file classification + route family binding
+    const preprocessTimer = logger_js_1.logger.timer('preprocess');
+    const preprocessResult = (0, stage0_preprocess_js_1.preprocess)(changedFiles, {
+        appPath: config.appPath,
+        testsRoot: config.testsRoot,
+        routeFamilies: config.routeFamilies,
+        apiSurface: config.apiSurface,
+    });
+    timings.preprocess = preprocessTimer.end();
+    allWarnings.push(...preprocessResult.warnings);
+    let decisions = [];
+    // Step 3: Impact stage — AI-powered flow identification per family
+    if (stages.includes('impact')) {
+        const impactTimer = logger_js_1.logger.timer('impact');
+        const impactResult = await (0, stage1_impact_js_1.runImpactStage)(preprocessResult.familyGroups, preprocessResult.manifest, preprocessResult.specIndex, preprocessResult.apiSurface, preprocessResult.context, config.impact || {});
+        decisions = impactResult.decisions;
+        allWarnings.push(...impactResult.warnings);
+        timings.impact = impactTimer.end();
+        // Check cannot_determine ratio
+        const cannotDetermineRatio = (0, guardrails_js_1.computeCannotDetermineRatio)(decisions);
+        if (cannotDetermineRatio > 0.3) {
+            allWarnings.push(`High cannot_determine ratio (${(cannotDetermineRatio * 100).toFixed(0)}%). Consider updating route-families.json or running with MCP exploration.`);
+        }
+    }
+    // Step 4: Coverage stage — AI-powered spec coverage evaluation
+    if (stages.includes('coverage') && decisions.length > 0) {
+        const coverageTimer = logger_js_1.logger.timer('coverage');
+        const coverageResult = await (0, stage2_coverage_js_1.runCoverageStage)(decisions, preprocessResult.specIndex, preprocessResult.context, config.testsRoot, { ...(config.coverage || {}), profile });
+        decisions = coverageResult.decisions;
+        timings.coverage = coverageTimer.end();
+        allWarnings.push(...coverageResult.warnings);
+    }
+    // Step 5: Generation stage — AI-powered spec generation for create_spec / add_scenarios
+    if (stages.includes('generation') && decisions.length > 0) {
+        const generationTimer = logger_js_1.logger.timer('generation');
+        const generationResult = await (0, stage3_generation_js_1.runGenerationStage)(decisions, preprocessResult.apiSurface, config.testsRoot, { ...(config.generation || {}), profile });
+        generatedSpecs = generationResult.generated;
+        timings.generation = generationTimer.end();
+        allWarnings.push(...generationResult.warnings);
+    }
+    // Step 6: Heal stage — MCP-backed playwright-test-healer for failing/flaky specs
+    if (stages.includes('heal')) {
+        const healTimer = logger_js_1.logger.timer('heal');
+        const healTargets = (0, stage4_heal_js_1.resolveHealTargets)(config.testsRoot, {
+            playwrightReportPath: config.playwrightReportPath,
+            generatedSpecs,
+        }, decisions);
+        if (healTargets.length > 0) {
+            healResult = await (0, stage4_heal_js_1.runHealStage)(config.testsRoot, healTargets, { ...(config.heal || { mcp: true }), profile });
+            allWarnings.push(...healResult.warnings);
+        }
+        else {
+            allWarnings.push('Heal stage: no targets found (no failing specs in report, no generated specs).');
+        }
+        timings.heal = healTimer.end();
+    }
+    // Build report
+    const report = {
+        runId,
+        timestamp: startedAt,
+        gitRef: config.gitSince,
+        summary: (0, output_schema_js_1.buildSummary)(decisions),
+        decisions,
+        warnings: allWarnings,
+        model: {
+            impactAgent: config.impact?.provider || 'auto',
+            coverageAgent: config.coverage?.provider || 'auto',
+            generationAgent: stages.includes('generation') ? (config.generation?.provider || 'auto') : undefined,
+        },
+    };
+    const reportPath = writeReport(config.testsRoot, report, healResult, timings);
+    return { report, reportPath, warnings: allWarnings, generated: generatedSpecs, healResult };
+}
+function writeReport(testsRoot, report, healResult, timings) {
+    const outputDir = (0, path_1.join)(testsRoot, '.e2e-ai-agents');
+    if (!(0, fs_1.existsSync)(outputDir)) {
+        (0, fs_1.mkdirSync)(outputDir, { recursive: true });
+    }
+    // Include timings in the JSON report if available
+    const reportWithTimings = timings ? { ...report, timings } : report;
+    const jsonPath = (0, path_1.join)(outputDir, 'pipeline-report.json');
+    (0, fs_1.writeFileSync)(jsonPath, JSON.stringify(reportWithTimings, null, 2), 'utf-8');
+    const mdPath = (0, path_1.join)(outputDir, 'pipeline-report.md');
+    (0, fs_1.writeFileSync)(mdPath, renderMarkdown(report, healResult), 'utf-8');
+    return jsonPath;
+}
+function renderMarkdown(report, healResult) {
+    const lines = [
+        `# Impact Analysis Pipeline Report`,
+        '',
+        `**Run ID:** ${report.runId}`,
+        `**Timestamp:** ${report.timestamp}`,
+        `**Git Ref:** ${report.gitRef}`,
+        '',
+        `## Summary`,
+        '',
+        `| Metric | Value |`,
+        `|--------|-------|`,
+        `| Changed Files | ${report.summary.changedFiles} |`,
+        `| Route Families Impacted | ${report.summary.routeFamiliesImpacted.join(', ') || 'none'} |`,
+        `| Flows Identified | ${report.summary.flowsIdentified} |`,
+        `| Covered | ${report.summary.flowsCovered} |`,
+        `| Partial | ${report.summary.flowsPartial} |`,
+        `| Uncovered | ${report.summary.flowsUncovered} |`,
+        `| Cannot Determine | ${report.summary.actionsRequired.cannot_determine} |`,
+        `| Overall Confidence | ${report.summary.overallConfidence} |`,
+        '',
+    ];
+    if (report.decisions.length > 0) {
+        lines.push('## Decisions', '');
+        for (const d of report.decisions) {
+            lines.push(`### ${d.flowName} (${d.priority})`);
+            lines.push('');
+            lines.push(`- **Action:** ${d.action}`);
+            lines.push(`- **Route Family:** ${d.routeFamily}${d.featureId ? ` / ${d.featureId}` : ''}`);
+            if (d.specificRoute) {
+                lines.push(`- **Route:** ${d.specificRoute}`);
+            }
+            lines.push(`- **Confidence:** ${d.confidence}%`);
+            lines.push(`- **Evidence:** ${d.evidence}`);
+            lines.push(`- **Changed Files:** ${d.changedFiles.join(', ')}`);
+            if (d.userActions.length > 0) {
+                lines.push(`- **User Actions:** ${d.userActions.join('; ')}`);
+            }
+            if (d.existingSpecs.length > 0) {
+                lines.push('- **Existing Coverage:**');
+                for (const spec of d.existingSpecs) {
+                    lines.push(`  - ${spec.path} (${spec.coverageLevel})`);
+                    if (spec.testTitles.length > 0) {
+                        for (const title of spec.testTitles) {
+                            lines.push(`    - \`${title}\``);
+                        }
+                    }
+                    if (spec.missingScenarios && spec.missingScenarios.length > 0) {
+                        lines.push('    - Missing:');
+                        for (const scenario of spec.missingScenarios) {
+                            lines.push(`      - ${scenario}`);
+                        }
+                    }
+                }
+            }
+            if (d.scenariosToAdd && d.scenariosToAdd.length > 0) {
+                lines.push('- **Scenarios to Add:**');
+                for (const s of d.scenariosToAdd) {
+                    lines.push(`  - ${s}`);
+                }
+            }
+            if (d.targetSpec) {
+                lines.push(`- **Target Spec:** ${d.targetSpec}`);
+            }
+            if (d.newSpecPath) {
+                lines.push(`- **New Spec Path:** ${d.newSpecPath}`);
+            }
+            if (d.blockingReason) {
+                lines.push(`- **Blocking Reason:** ${d.blockingReason}`);
+            }
+            lines.push('');
+        }
+    }
+    if (healResult) {
+        lines.push('');
+        lines.push((0, stage4_heal_js_1.renderHealMarkdown)(healResult));
+    }
+    if (report.warnings.length > 0) {
+        lines.push('## Warnings', '');
+        for (const w of report.warnings) {
+            lines.push(`- ${w}`);
+        }
+        lines.push('');
+    }
+    return lines.join('\n');
+}

package/dist/pipeline/spec_verifier.d.ts

@@ -0,0 +1,20 @@
+export interface CompileCheckResult {
+    success: boolean;
+    errors: string[];
+}
+/**
+ * Compile-check a generated spec file using tsc --noEmit.
+ * Returns success: true if compilation succeeds, or errors array on failure.
+ */
+export declare function compileCheckSpec(specPath: string, testsRoot: string): CompileCheckResult;
+export interface SmokeRunResult {
+    success: boolean;
+    error?: string;
+}
+/**
+ * Smoke-run a generated spec against a running app.
+ * Runs in a restricted environment with sensitive env vars stripped.
+ * Returns success: true if the test passes with retries.
+ */
+export declare function smokeRunSpec(specPath: string, testsRoot: string, playwrightBinary: string): SmokeRunResult;
+//# sourceMappingURL=spec_verifier.d.ts.map

package/dist/pipeline/spec_verifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"spec_verifier.d.ts","sourceRoot":"","sources":["../../src/pipeline/spec_verifier.ts"],"names":[],"mappings":"AAyCA,MAAM,WAAW,kBAAkB;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,kBAAkB,CAuBxF;AAED,MAAM,WAAW,cAAc;IAC3B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CACxB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,gBAAgB,EAAE,MAAM,GACzB,cAAc,CAuBhB"}

package/dist/pipeline/spec_verifier.js

@@ -0,0 +1,79 @@
+"use strict";
+// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+// See LICENSE.txt for license information.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.compileCheckSpec = compileCheckSpec;
+exports.smokeRunSpec = smokeRunSpec;
+const path_1 = require("path");
+const process_runner_js_1 = require("../agent/process_runner.js");
+/** Env var prefixes/names stripped when running LLM-generated specs */
+const SENSITIVE_ENV_PREFIXES = [
+    'AWS_', 'AZURE_', 'GCP_', 'GOOGLE_', 'ANTHROPIC_', 'OPENAI_',
+    'GITHUB_TOKEN', 'NPM_TOKEN', 'SSH_', 'SECRET_', 'PRIVATE_',
+    'DATABASE_URL', 'DB_', 'REDIS_', 'POSTGRES_', 'MYSQL_', 'MONGO_',
+    'API_KEY', 'API_SECRET', 'AUTH_', 'JWT_', 'STRIPE_', 'TWILIO_',
+    'SENDGRID_', 'SLACK_TOKEN', 'SLACK_BOT', 'MATTERMOST_',
+];
+/**
+ * Build a restricted environment for running LLM-generated spec files.
+ * Strips credentials and secrets to limit damage from malicious generated code.
+ */
+function buildRestrictedEnv() {
+    const env = {};
+    for (const [key, value] of Object.entries(process.env)) {
+        const isSensitive = SENSITIVE_ENV_PREFIXES.some((prefix) => key.startsWith(prefix));
+        if (!isSensitive) {
+            env[key] = value;
+        }
+    }
+    return env;
+}
+/**
+ * Validate and normalize a spec path to prevent argument injection.
+ * Rejects raw input that starts with '-' (could be interpreted as flags by tsc/playwright).
+ */
+function sanitizeSpecPath(specPath) {
+    if (specPath.startsWith('-')) {
+        throw new Error(`Invalid spec path: "${specPath}" — path must not start with a dash`);
+    }
+    return (0, path_1.resolve)(specPath);
+}
+/**
+ * Compile-check a generated spec file using tsc --noEmit.
+ * Returns success: true if compilation succeeds, or errors array on failure.
+ */
+function compileCheckSpec(specPath, testsRoot) {
+    const safeSpecPath = sanitizeSpecPath(specPath);
+    const result = (0, process_runner_js_1.runCommand)('npx', ['tsc', '--noEmit', '--esModuleInterop', '--resolveJsonModule', '--moduleResolution', 'node', '--target', 'ES2020', safeSpecPath], testsRoot, 30000, buildRestrictedEnv());
+    if (result.status === 0) {
+        return { success: true, errors: [] };
+    }
+    const output = [result.stdout, result.stderr].filter(Boolean).join('\n');
+    const errorLines = output.split('\n')
+        .filter((l) => l.includes('error TS') || l.includes('Error:'))
+        .slice(0, 10);
+    return {
+        success: false,
+        errors: errorLines.length > 0 ? errorLines : [output.slice(0, 500) || 'Compilation failed'],
+    };
+}
+/**
+ * Smoke-run a generated spec against a running app.
+ * Runs in a restricted environment with sensitive env vars stripped.
+ * Returns success: true if the test passes with retries.
+ */
+function smokeRunSpec(specPath, testsRoot, playwrightBinary) {
+    const safeSpecPath = sanitizeSpecPath(specPath);
+    const result = (0, process_runner_js_1.runCommand)(playwrightBinary, ['test', safeSpecPath, '--retries', '2', '--reporter', 'list'], testsRoot, 120000, buildRestrictedEnv());
+    if (result.status === 0) {
+        return { success: true };
+    }
+    const output = [result.stdout, result.stderr].filter(Boolean).join('\n');
+    const errorLines = output.split('\n')
+        .filter((l) => l.includes('Error') || l.includes('FAILED') || l.includes('Timeout'))
+        .slice(0, 5);
+    return {
+        success: false,
+        error: errorLines.join('\n') || result.error || 'Smoke run failed',
+    };
+}

package/dist/pipeline/stage0_preprocess.d.ts

@@ -0,0 +1,31 @@
+import { type FileBinding, type RouteFamilyConfig, type RouteFamilyManifest } from '../knowledge/route_families.js';
+import { type ApiSurfaceCatalog, type ApiSurfaceConfig } from '../knowledge/api_surface.js';
+import { type SpecIndex } from '../knowledge/spec_index.js';
+import { type LoadedContext } from '../knowledge/context_loader.js';
+export interface PreprocessConfig {
+    appPath: string;
+    testsRoot: string;
+    routeFamilies?: RouteFamilyConfig;
+    apiSurface?: ApiSurfaceConfig;
+}
+export interface FamilyGroup {
+    familyId: string;
+    featureId?: string;
+    files: Array<{
+        path: string;
+        snippet?: string;
+    }>;
+}
+export interface PreprocessResult {
+    changedFiles: string[];
+    fileBindings: FileBinding[];
+    unboundFiles: string[];
+    familyGroups: FamilyGroup[];
+    manifest: RouteFamilyManifest | null;
+    apiSurface: ApiSurfaceCatalog;
+    specIndex: SpecIndex;
+    context: LoadedContext;
+    warnings: string[];
+}
+export declare function preprocess(changedFiles: string[], config: PreprocessConfig): PreprocessResult;
+//# sourceMappingURL=stage0_preprocess.d.ts.map

package/dist/pipeline/stage0_preprocess.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stage0_preprocess.d.ts","sourceRoot":"","sources":["../../src/pipeline/stage0_preprocess.ts"],"names":[],"mappings":"AAKA,OAAO,EAIH,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EAC3B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAwB,KAAK,iBAAiB,EAAE,KAAK,gBAAgB,EAAC,MAAM,6BAA6B,CAAC;AACjH,OAAO,EAAiB,KAAK,SAAS,EAAC,MAAM,4BAA4B,CAAC;AAC1E,OAAO,EAAuB,KAAK,aAAa,EAAC,MAAM,gCAAgC,CAAC;AAExF,MAAM,WAAW,gBAAgB;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,iBAAiB,CAAC;IAClC,UAAU,CAAC,EAAE,gBAAgB,CAAC;CACjC;AAED,MAAM,WAAW,WAAW;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,KAAK,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAC,CAAC,CAAC;CAClD;AAED,MAAM,WAAW,gBAAgB;IAC7B,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,YAAY,EAAE,WAAW,EAAE,CAAC;IAC5B,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,YAAY,EAAE,WAAW,EAAE,CAAC;IAC5B,QAAQ,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACrC,UAAU,EAAE,iBAAiB,CAAC;IAC9B,SAAS,EAAE,SAAS,CAAC;IACrB,OAAO,EAAE,aAAa,CAAC;IACvB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACtB;AA0BD,wBAAgB,UAAU,CAAC,YAAY,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,gBAAgB,GAAG,gBAAgB,CAmF7F"}