agent-bober 0.18.0 → 0.19.0

package/dist/orchestrator/security-verifier-agent.d.ts

@@ -0,0 +1,62 @@
+import type { BoberConfig } from "../config/schema.js";
+import type { SecurityFinding } from "./security-audit-types.js";
+import type { AuditDiff } from "./security-knowledge/diff-provider.js";
+/**
+ * Adversarial, fresh-context, contract-free finder->verifier stage
+ * (spec-20260714 sprint 8, ADR-2/ADR-6 default-off).
+ *
+ * Runs sequentially AFTER the security auditor ("finder") inside
+ * `runSecurityAudit`, fed ONLY the finder's `critical`+`important` findings
+ * (never `minor`/`approvedAreas`, never the sprint contract — that strips
+ * the sycophancy framing a favorably-worded contract creates). It is told
+ * to DISPROVE each finding and may only downgrade (`critical`->`important`)
+ * or drop a finding — never promote or manufacture a clean pass.
+ *
+ * Fail-closed, mirroring the finder's own `parsed:false => blocked`
+ * inversion: any parse failure, provider error, refusal, or abort resolves
+ * `ran:false`, and the caller (`runSecurityAudit`'s fold) KEEPS the finder's
+ * findings unchanged.
+ */
+/** Downgrade-only, fail-closed verifier result. `ran:false` => finder criticals kept. */
+export interface VerifierResult {
+    /** Confirmed by the verifier — stays at the finder's original severity. */
+    verified: SecurityFinding[];
+    /** Real but not critical-severity — moves critical->important in the fold. */
+    downgraded: SecurityFinding[];
+    /** Disproved against the evidence — removed entirely in the fold. */
+    dropped: SecurityFinding[];
+    /** False on parse-failure / provider error / refusal / abort (fail-closed). */
+    ran: boolean;
+}
+export interface VerifyParams {
+    /** The finder's critical + important findings ONLY — never minor/approvedAreas. */
+    findings: SecurityFinding[];
+    /** The SAME AuditDiff the finder saw; hunks are the re-check evidence. Undefined in estimated-files mode. */
+    diff: AuditDiff | undefined;
+    projectRoot: string;
+    config: BoberConfig;
+    /** Time-box for this stage, owned by the caller (keyed to config.security.timeoutMs). */
+    signal: AbortSignal;
+}
+/** Injectable seam so `runSecurityAudit` tests can stub the stage (mirrors `SecurityDiffProvider`). */
+export interface SecurityVerifier {
+    verify(params: VerifyParams): Promise<VerifierResult>;
+}
+export declare const runSecurityVerifier: SecurityVerifier;
+/**
+ * Parse the verifier's response into a `VerifierResult`.
+ *
+ * Reuses the same resilient extraction ladder as
+ * `security-auditor-agent.ts:parseSecurityAuditResult` (direct parse ->
+ * markdown-fence -> first-bracket-to-last-bracket slice), but INVERTS which
+ * JSON shape it accepts: the auditor rejects arrays (it wants a
+ * `ReviewResult` object); the verifier REQUIRES an array of per-finding
+ * verdicts — any non-array, truncated, or garbage response is fail-closed
+ * (`ran:false`).
+ *
+ * A finding present in `inputFindings` but never addressed by a matched,
+ * recognized verdict entry defaults to `verified` — fail-closed means an
+ * unaddressed finding is never silently dropped.
+ */
+export declare function parseVerifierResult(text: string, inputFindings: SecurityFinding[]): VerifierResult;
+//# sourceMappingURL=security-verifier-agent.d.ts.map

package/dist/orchestrator/security-verifier-agent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-verifier-agent.d.ts","sourceRoot":"","sources":["../../src/orchestrator/security-verifier-agent.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uCAAuC,CAAC;AASvE;;;;;;;;;;;;;;;GAeG;AAEH,yFAAyF;AACzF,MAAM,WAAW,cAAc;IAC7B,2EAA2E;IAC3E,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,8EAA8E;IAC9E,UAAU,EAAE,eAAe,EAAE,CAAC;IAC9B,qEAAqE;IACrE,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,+EAA+E;IAC/E,GAAG,EAAE,OAAO,CAAC;CACd;AAED,MAAM,WAAW,YAAY;IAC3B,mFAAmF;IACnF,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,6GAA6G;IAC7G,IAAI,EAAE,SAAS,GAAG,SAAS,CAAC;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,WAAW,CAAC;IACpB,yFAAyF;IACzF,MAAM,EAAE,WAAW,CAAC;CACrB;AAED,uGAAuG;AACvG,MAAM,WAAW,gBAAgB;IAC/B,MAAM,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CACvD;AAID,eAAO,MAAM,mBAAmB,EAAE,gBAgFjC,CAAC;AA8EF;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,eAAe,EAAE,GAAG,cAAc,CAuElG"}

package/dist/orchestrator/security-verifier-agent.js

@@ -0,0 +1,230 @@
+import { createClient } from "../providers/factory.js";
+import { resolveModel } from "./model-resolver.js";
+import { assembleSystemPrompt } from "./agent-loader.js";
+import { resolveRoleTools, getGraphState, getGraphDeps } from "./tools/index.js";
+import { runAgenticLoop } from "./agentic-loop.js";
+import { budgetFromMaxUsd } from "./workflow/budget.js";
+import { logger } from "../utils/logger.js";
+const FAIL_CLOSED_RESULT = { verified: [], downgraded: [], dropped: [], ran: false };
+export const runSecurityVerifier = {
+    async verify(params) {
+        const { findings, diff, projectRoot, config, signal } = params;
+        // Nothing to verify — a clean no-op. No LLM call needed, and there is
+        // nothing to fail-closed on: ran:true with all buckets empty is correct
+        // (the fold leaves the finder review completely unchanged either way).
+        if (findings.length === 0) {
+            return { verified: [], downgraded: [], dropped: [], ran: true };
+        }
+        const verifierModel = config.security?.verifier?.model ?? "opus";
+        const model = resolveModel(verifierModel);
+        const maxTurns = config.security?.verifier?.maxTurns ?? 10;
+        // The verifier reuses the SAME "curator" read-only role as the finder —
+        // no bash/write/edit (nonGoals[0]). No new AgentRole is introduced.
+        const graphState = getGraphState(config);
+        const graphDeps = graphState.engineHealth === "ready" ? getGraphDeps() : undefined;
+        const toolSet = resolveRoleTools("curator", projectRoot, graphState, graphDeps ?? undefined);
+        const systemPrompt = await assembleSystemPrompt("curator", "bober-security-verifier", projectRoot, graphState);
+        const client = createClient(config.security?.provider ?? null, config.security?.endpoint ?? null, config.security?.providerConfig, verifierModel, "SecurityVerifier");
+        const budget = budgetFromMaxUsd(config.security?.budget?.maxUsd);
+        const userMessage = buildVerifierUserMessage(findings, diff);
+        let result;
+        try {
+            result = await runAgenticLoop({
+                client,
+                model,
+                systemPrompt,
+                userMessage,
+                tools: toolSet.schemas,
+                toolHandlers: toolSet.handlers,
+                maxTurns,
+                maxTokens: 16384,
+                ...(budget !== undefined ? { budget } : {}),
+                abortSignal: signal,
+                onToolUse: (name, input) => {
+                    const inp = input;
+                    const inputStr = JSON.stringify(inp).slice(0, 120);
+                    logger.debug(`  [security-verifier] ${name}(${inputStr})`);
+                },
+            });
+        }
+        catch (err) {
+            // Provider/network error — fail-closed, never propagate a crash out of
+            // an opt-in verification stage into the audit path.
+            logger.debug(`[security-verifier] runAgenticLoop threw: ${err instanceof Error ? err.message : String(err)} — fail-closed (ran:false)`);
+            return { ...FAIL_CLOSED_RESULT };
+        }
+        logger.debug(`Security verifier completed in ${result.turnsUsed} turns (${result.toolsCalled.length} tool calls)`);
+        // Abort/error/refusal stop reasons are all fail-closed — never treated
+        // as "confirmed everything" or "found nothing to disprove".
+        if (result.stopReason === "aborted" || result.stopReason === "error" || result.refused === true) {
+            return { ...FAIL_CLOSED_RESULT };
+        }
+        return parseVerifierResult(result.finalText, findings);
+    },
+};
+// ── Prompt assembly ────────────────────────────────────────────────
+/**
+ * Renders the "# Changed files (real diff)" section — deliberately the same
+ * shape as `security-auditor-agent.ts`'s file-local `renderChangedFilesSection`
+ * so the evidence the verifier re-checks against matches what the finder saw.
+ * Empty string when there's no diff (estimated-files mode / no changes).
+ */
+function renderChangedFilesSection(diff) {
+    if (!diff || diff.changedFiles.length === 0)
+        return "";
+    const filesText = diff.changedFiles
+        .map((f) => {
+        const hunksText = f.hunks.length > 0 ? f.hunks.map((h) => h.content).join("\n\n") : "(no hunks captured)";
+        return `## ${f.path} (${f.status})\n\n${hunksText}`;
+    })
+        .join("\n\n");
+    const neighborhoodText = diff.neighborhoodFiles.length > 0
+        ? `\n\nCall-graph neighborhood (files affected by the changes above):\n${diff.neighborhoodFiles.join("\n")}`
+        : "";
+    const truncatedText = diff.truncated
+        ? "\n\n(diff truncated — showing a bounded subset of changed files/hunks)"
+        : "";
+    return `# Changed files (real diff)\n\n${filesText}${neighborhoodText}${truncatedText}\n\n`;
+}
+/**
+ * Builds the verifier's user message from ONLY the findings + diff hunks.
+ * Deliberately excludes everything `security-auditor-agent.ts:buildUserMessage`
+ * folds in for the finder: no `# Sprint Contract` JSON, no
+ * `# Evaluation Result (Already Passed)` section, no priors section — this is
+ * the sycophancy-framing strip that makes the verifier a genuinely fresh,
+ * unbiased second opinion (sc-8-2).
+ */
+function buildVerifierUserMessage(findings, diff) {
+    const findingsJson = JSON.stringify(findings.map((finding, index) => ({ index, ...finding })), null, 2);
+    const changedFilesSection = renderChangedFilesSection(diff);
+    return `# Findings To Verify
+
+${findingsJson}
+
+${changedFilesSection}# Your Task
+
+You have Read/Grep/Glob only (no Bash, no git). For each finding above:
+1. Read the cited path/line and confirm the snippet is genuine and current
+2. Check the "# Changed files (real diff)" section (when present) for the actual hunk touching that file
+3. Look for a sanitizer, parameterized query, access check, or input-validation guard the finder may have missed
+4. Decide whether there is a realistic, externally-triggerable exploit path
+
+Render one verdict per finding: "confirmed" (it holds — stays at its original severity),
+"downgraded" (real but not critical-severity — moves critical to important), or "disproved"
+(the evidence does not support it — dropped).
+
+Output ONLY a JSON array (no markdown fences, no surrounding prose), one entry per finding,
+in this exact shape:
+[
+  {
+    "index": 0,
+    "verdict": "confirmed",
+    "confidence": "high",
+    "reason": "<one-line reason citing what you actually checked>"
+  }
+]`;
+}
+// ── Fail-closed JSON parser (mirror image of the auditor's — expects an array) ──
+/**
+ * Parse the verifier's response into a `VerifierResult`.
+ *
+ * Reuses the same resilient extraction ladder as
+ * `security-auditor-agent.ts:parseSecurityAuditResult` (direct parse ->
+ * markdown-fence -> first-bracket-to-last-bracket slice), but INVERTS which
+ * JSON shape it accepts: the auditor rejects arrays (it wants a
+ * `ReviewResult` object); the verifier REQUIRES an array of per-finding
+ * verdicts — any non-array, truncated, or garbage response is fail-closed
+ * (`ran:false`).
+ *
+ * A finding present in `inputFindings` but never addressed by a matched,
+ * recognized verdict entry defaults to `verified` — fail-closed means an
+ * unaddressed finding is never silently dropped.
+ */
+export function parseVerifierResult(text, inputFindings) {
+    let parsedJson;
+    try {
+        parsedJson = JSON.parse(text.trim());
+    }
+    catch {
+        const fenceMatch = /```(?:json)?\s*\n?([\s\S]*?)\n?\s*```/.exec(text);
+        if (fenceMatch) {
+            try {
+                parsedJson = JSON.parse(fenceMatch[1].trim());
+            }
+            catch {
+                // Fall through
+            }
+        }
+        if (parsedJson === undefined) {
+            const bracketStart = text.indexOf("[");
+            const bracketEnd = text.lastIndexOf("]");
+            if (bracketStart !== -1 && bracketEnd > bracketStart) {
+                try {
+                    parsedJson = JSON.parse(text.slice(bracketStart, bracketEnd + 1));
+                }
+                catch {
+                    // Fall through to fail-closed default below
+                }
+            }
+        }
+    }
+    // The verifier is the mirror image of the auditor's parser: it EXPECTS a
+    // JSON array. A stray object, truncated JSON, or garbage text is
+    // fail-closed — never manufactured into "everything confirmed".
+    if (!Array.isArray(parsedJson)) {
+        return { ...FAIL_CLOSED_RESULT };
+    }
+    const verdictEntries = parsedJson.filter((item) => typeof item === "object" && item !== null);
+    const bucketed = new Set();
+    const verified = [];
+    const downgraded = [];
+    const dropped = [];
+    for (const entry of verdictEntries) {
+        const finding = resolveFindingRef(entry, inputFindings);
+        if (!finding || bucketed.has(finding))
+            continue;
+        const verdict = typeof entry.verdict === "string" ? entry.verdict : undefined;
+        if (verdict === "confirmed") {
+            verified.push(finding);
+            bucketed.add(finding);
+        }
+        else if (verdict === "downgraded") {
+            downgraded.push(finding);
+            bucketed.add(finding);
+        }
+        else if (verdict === "disproved") {
+            dropped.push(finding);
+            bucketed.add(finding);
+        }
+        // Any unrecognized/missing verdict value leaves the finding unaddressed —
+        // it falls through to the fail-closed default loop below (verified).
+    }
+    // Fail-closed: a finding never addressed by a matched, recognized verdict
+    // (missing entry, unmatched index/signature, unrecognized verdict string)
+    // defaults to `verified` — never silently dropped.
+    for (const finding of inputFindings) {
+        if (!bucketed.has(finding))
+            verified.push(finding);
+    }
+    return { verified, downgraded, dropped, ran: true };
+}
+/**
+ * Resolves a verdict entry back to the SAME `SecurityFinding` object
+ * reference from `inputFindings` (by 0-based `index`, then `signatureId`,
+ * then `path`+`line` in its evidence). Identity-preserving on purpose: the
+ * fold in `security-auditor-agent.ts` matches by object identity against the
+ * finder's own `critical`/`important` arrays.
+ */
+function resolveFindingRef(entry, inputFindings) {
+    if (typeof entry.index === "number" && Number.isInteger(entry.index)) {
+        return inputFindings[entry.index];
+    }
+    if (typeof entry.signatureId === "string" && entry.signatureId.length > 0) {
+        return inputFindings.find((f) => f.signatureId === entry.signatureId);
+    }
+    if (typeof entry.path === "string" && typeof entry.line === "number") {
+        return inputFindings.find((f) => f.evidence.some((e) => e.path === entry.path && e.line === entry.line));
+    }
+    return undefined;
+}
+//# sourceMappingURL=security-verifier-agent.js.map

package/dist/orchestrator/security-verifier-agent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-verifier-agent.js","sourceRoot":"","sources":["../../src/orchestrator/security-verifier-agent.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACjF,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AA+C5C,MAAM,kBAAkB,GAAmB,EAAE,QAAQ,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;AAErG,MAAM,CAAC,MAAM,mBAAmB,GAAqB;IACnD,KAAK,CAAC,MAAM,CAAC,MAAM;QACjB,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;QAE/D,sEAAsE;QACtE,wEAAwE;QACxE,uEAAuE;QACvE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;QAClE,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,IAAI,MAAM,CAAC;QACjE,MAAM,KAAK,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,IAAI,EAAE,CAAC;QAE3D,wEAAwE;QACxE,oEAAoE;QACpE,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;QACzC,MAAM,SAAS,GAAG,UAAU,CAAC,YAAY,KAAK,OAAO,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QACnF,MAAM,OAAO,GAAG,gBAAgB,CAAC,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,IAAI,SAAS,CAAC,CAAC;QAC7F,MAAM,YAAY,GAAG,MAAM,oBAAoB,CAC7C,SAAS,EACT,yBAAyB,EACzB,WAAW,EACX,UAAU,CACX,CAAC;QAEF,MAAM,MAAM,GAAG,YAAY,CACzB,MAAM,CAAC,QAAQ,EAAE,QAAQ,IAAI,IAAI,EACjC,MAAM,CAAC,QAAQ,EAAE,QAAQ,IAAI,IAAI,EACjC,MAAM,CAAC,QAAQ,EAAE,cAAc,EAC/B,aAAa,EACb,kBAAkB,CACnB,CAAC;QAEF,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QACjE,MAAM,WAAW,GAAG,wBAAwB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAE7D,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,cAAc,CAAC;gBAC5B,MAAM;gBACN,KAAK;gBACL,YAAY;gBACZ,WAAW;gBACX,KAAK,EAAE,OAAO,CAAC,OAAO;gBACtB,YAAY,EAAE,OAAO,CAAC,QAAQ;gBAC9B,QAAQ;gBACR,SAAS,EAAE,KAAK;gBAChB,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3C,WAAW,EAAE,MAAM;gBACnB,SAAS,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;oBACzB,MAAM,GAAG,GAAG,KAAgC,CAAC;oBAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;oBACnD,MAAM,CAAC,KAAK,CAAC,yBAAyB,IAAI,IAAI,QAAQ,GAAG,CAAC,CAAC;gBAC7D,CAAC;aACF,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,uEAAuE;YACvE,oDAAoD;YACpD,MAAM,CAAC,KAAK,CACV,6CACE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,4BAA4B,CAC7B,CAAC;YACF,OAAO,EAAE,GAAG,kBAAkB,EAAE,CAAC;QACnC,CAAC;QAED,MAAM,CAAC,KAAK,CACV,kCAAkC,MAAM,CAAC,SAAS,WAAW,MAAM,CAAC,WAAW,CAAC,MAAM,cAAc,CACrG,CAAC;QAEF,uEAAuE;QACvE,4DAA4D;QAC5D,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,MAAM,CAAC,UAAU,KAAK,OAAO,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YAChG,OAAO,EAAE,GAAG,kBAAkB,EAAE,CAAC;QACnC,CAAC;QAED,OAAO,mBAAmB,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACzD,CAAC;CACF,CAAC;AAEF,sEAAsE;AAEtE;;;;;GAKG;AACH,SAAS,yBAAyB,CAAC,IAA2B;IAC5D,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEvD,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY;SAChC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACT,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC;QAC1G,OAAO,MAAM,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,MAAM,QAAQ,SAAS,EAAE,CAAC;IACtD,CAAC,CAAC;SACD,IAAI,CAAC,MAAM,CAAC,CAAC;IAEhB,MAAM,gBAAgB,GACpB,IAAI,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC;QAC/B,CAAC,CAAC,uEAAuE,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QAC5G,CAAC,CAAC,EAAE,CAAC;IAET,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS;QAClC,CAAC,CAAC,wEAAwE;QAC1E,CAAC,CAAC,EAAE,CAAC;IAEP,OAAO,kCAAkC,SAAS,GAAG,gBAAgB,GAAG,aAAa,MAAM,CAAC;AAC9F,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,wBAAwB,CAAC,QAA2B,EAAE,IAA2B;IACxF,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CACjC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC,EACzD,IAAI,EACJ,CAAC,CACF,CAAC;IACF,MAAM,mBAAmB,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;IAE5D,OAAO;;EAEP,YAAY;;EAEZ,mBAAmB;;;;;;;;;;;;;;;;;;;;;EAqBnB,CAAC;AACH,CAAC;AAED,mFAAmF;AAEnF;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,aAAgC;IAChF,IAAI,UAAmB,CAAC;IAExB,IAAI,CAAC;QACH,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,UAAU,GAAG,uCAAuC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtE,IAAI,UAAU,EAAE,CAAC;YACf,IAAI,CAAC;gBACH,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAChD,CAAC;YAAC,MAAM,CAAC;gBACP,eAAe;YACjB,CAAC;QACH,CAAC;QAED,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACvC,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YACzC,IAAI,YAAY,KAAK,CAAC,CAAC,IAAI,UAAU,GAAG,YAAY,EAAE,CAAC;gBACrD,IAAI,CAAC;oBACH,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC;gBACpE,CAAC;gBAAC,MAAM,CAAC;oBACP,4CAA4C;gBAC9C,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,iEAAiE;IACjE,gEAAgE;IAChE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,GAAG,kBAAkB,EAAE,CAAC;IACnC,CAAC;IAED,MAAM,cAAc,GAAI,UAAwB,CAAC,MAAM,CACrD,CAAC,IAAI,EAAmC,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,CACrF,CAAC;IAEF,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAmB,CAAC;IAC5C,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,MAAM,UAAU,GAAsB,EAAE,CAAC;IACzC,MAAM,OAAO,GAAsB,EAAE,CAAC;IAEtC,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO,IAAI,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,SAAS;QAEhD,MAAM,OAAO,GAAG,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9E,IAAI,OAAO,KAAK,WAAW,EAAE,CAAC;YAC5B,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvB,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;aAAM,IAAI,OAAO,KAAK,YAAY,EAAE,CAAC;YACpC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACzB,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;aAAM,IAAI,OAAO,KAAK,WAAW,EAAE,CAAC;YACnC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACtB,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;QACD,0EAA0E;QAC1E,qEAAqE;IACvE,CAAC;IAED,0EAA0E;IAC1E,0EAA0E;IAC1E,mDAAmD;IACnD,KAAK,MAAM,OAAO,IAAI,aAAa,EAAE,CAAC;QACpC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACrD,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;AACtD,CAAC;AAED;;;;;;GAMG;AACH,SAAS,iBAAiB,CACxB,KAA8B,EAC9B,aAAgC;IAEhC,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACrE,OAAO,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ,IAAI,KAAK,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1E,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACrE,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAC9B,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC,CACvE,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/orchestrator/session-store.d.ts

@@ -0,0 +1,95 @@
+import { z } from "zod";
+import type { Message } from "../providers/types.js";
+/**
+ * Mirrors the `Message` union (providers/types.ts:135-139). Variant order
+ * matters — see the ordering note above. Keep this schema in sync if the
+ * `Message` union ever changes shape.
+ */
+export declare const MessageSchema: z.ZodType<Message>;
+export declare const SessionRecordSchema: z.ZodObject<{
+    sessionId: z.ZodString;
+    model: z.ZodString;
+    createdAt: z.ZodString;
+    updatedAt: z.ZodString;
+    turnsUsed: z.ZodNumber;
+    messages: z.ZodArray<z.ZodType<Message, z.ZodTypeDef, Message>, "many">;
+}, "strip", z.ZodTypeAny, {
+    createdAt: string;
+    model: string;
+    updatedAt: string;
+    messages: Message[];
+    turnsUsed: number;
+    sessionId: string;
+}, {
+    createdAt: string;
+    model: string;
+    updatedAt: string;
+    messages: Message[];
+    turnsUsed: number;
+    sessionId: string;
+}>;
+export type SessionRecord = z.infer<typeof SessionRecordSchema>;
+/**
+ * Input to `SessionStore.save` — `createdAt`/`updatedAt` are stamped
+ * internally from the store's injected clock, so callers never read the
+ * clock themselves (no argless `new Date()` in core).
+ */
+export type SessionSaveInput = Omit<SessionRecord, "createdAt" | "updatedAt">;
+/**
+ * Derive a deterministic fork id from a source `sessionId` + an injected
+ * timestamp. Mirrors `job-store.ts`'s `jobId()` content-hash pattern — no
+ * argless `randomUUID()`/`Date.now()`. Used by `forkSession()`
+ * (agentic-loop.ts) when the caller omits an explicit `newId`.
+ */
+export declare function sessionForkId(sessionId: string, now: string): string;
+export interface SessionStoreOptions {
+    /** Absolute project root; sessions are written under `<projectRoot>/.bober/sessions/`. */
+    projectRoot: string;
+    /** Clock injection. Defaults to `() => new Date().toISOString()`. No argless `new Date()` in core. */
+    now?: () => string;
+}
+/**
+ * Persists agentic-loop transcripts to `.bober/sessions/<sessionId>.json`.
+ * Mirrors `src/research/job-store.ts`: validates with Zod before every
+ * write; reads return `null` on both missing AND malformed JSON (never
+ * throws) — this is what lets `resumeSession` fail soft (sc-6-5).
+ */
+export declare class SessionStore {
+    private readonly projectRoot;
+    private readonly clock;
+    constructor(opts: SessionStoreOptions);
+    /** Current time from the injected clock — exposed for deterministic fork-id derivation. */
+    now(): string;
+    /** Absolute path to the session file for `sessionId`. */
+    path(sessionId: string): string;
+    /**
+     * Persist a session record. Validates with `SessionRecordSchema` before
+     * writing so an invalid record never reaches disk (mirrors job-store.ts).
+     * `createdAt` is preserved from the existing file on disk when one exists
+     * (first save for a given `sessionId` stamps it fresh); `updatedAt` is
+     * always stamped fresh from the injected clock.
+     *
+     * bober: re-reads the existing file on every save to preserve `createdAt`
+     * — an O(1) extra read per turn, fine at this scale. If this ever needs to
+     * avoid the extra read, cache `createdAt` in-memory in the caller (the
+     * loop already holds a `session` handle across turns) and pass it through
+     * explicitly instead.
+     */
+    save(record: SessionSaveInput): Promise<void>;
+    /**
+     * Load a session record by id. Returns `null` if not found or malformed —
+     * NEVER throws. This null-on-corrupt result is what `resumeSession` maps
+     * to its typed `{ error }` result (sc-6-5); a corrupt file is never
+     * silently overwritten with an empty session.
+     */
+    load(sessionId: string): Promise<SessionRecord | null>;
+    /**
+     * Copy the transcript at `sessionId` into a new session file under
+     * `newId`. Writes ONLY the new file — the source is only ever read, never
+     * rewritten, so continuing the fork leaves the original byte-identical
+     * (sc-6-3). Throws if the source session does not exist or is corrupt
+     * (nothing to fork).
+     */
+    fork(sessionId: string, newId: string): Promise<string>;
+}
+//# sourceMappingURL=session-store.d.ts.map

package/dist/orchestrator/session-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-store.d.ts","sourceRoot":"","sources":["../../src/orchestrator/session-store.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AA+CrD;;;;GAIG;AACH,eAAO,MAAM,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAK3C,CAAC;AAIH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;EAO9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG,IAAI,CAAC,aAAa,EAAE,WAAW,GAAG,WAAW,CAAC,CAAC;AAgB9E;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAKpE;AAID,MAAM,WAAW,mBAAmB;IAClC,0FAA0F;IAC1F,WAAW,EAAE,MAAM,CAAC;IACpB,sGAAsG;IACtG,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED;;;;;GAKG;AACH,qBAAa,YAAY;IACvB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;gBAEzB,IAAI,EAAE,mBAAmB;IAKrC,2FAA2F;IAC3F,GAAG,IAAI,MAAM;IAIb,yDAAyD;IACzD,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;IAI/B;;;;;;;;;;;;OAYG;IACG,IAAI,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;IA0BnD;;;;;OAKG;IACG,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAY5D;;;;;;OAMG;IACG,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CAiB9D"}

package/dist/orchestrator/session-store.js

@@ -0,0 +1,186 @@
+// ── session-store.ts ────────────────────────────────────────────────────
+//
+// Persists the own agentic loop's provider-agnostic transcript (`Message[]`)
+// to `.bober/sessions/<sessionId>.json`, opt-in via `AgenticLoopParams.session`
+// (agent-loop-capability-port sprint 6). Mirrors `src/research/job-store.ts`:
+// `ensureDir`, Zod `safeParse`-before-write, `JSON.parse`+`safeParse`-on-read
+// returning `null` on missing OR malformed (never throws), async fs only.
+//
+// NOT the same layer as `src/chat/conversation-store.ts` (`.bober/chat/`,
+// chat `/resume`) or do-bridge's `sessionId` (a spawned-run id,
+// `do-<findingId>`) — this store is model-context transcript resume/fork for
+// the own loop. Keep the names distinct (see this sprint's contract nonGoals).
+import { readFile, writeFile } from "node:fs/promises";
+import { createHash } from "node:crypto";
+import { join } from "node:path";
+import { z } from "zod";
+import { ensureDir } from "../state/helpers.js";
+// ── Zod mirror of the Message union (providers/types.ts:135-139) ──────
+//
+// There is no existing Zod schema for `Message` in the codebase — authored
+// here. IMPORTANT: `z.union` tries variants in order and returns the FIRST
+// match. `AssistantMessage {role:"assistant",content,toolCalls}` and
+// `TextMessage {role:"assistant",content}` overlap on `{role,content}` (zod
+// objects are non-strict by default, so an extra key like `toolCalls` is
+// simply allowed/stripped by the less-specific schema). `AssistantMessageSchema`
+// MUST come before `TextMessageSchema` in the union below, or an assistant
+// message WITH `toolCalls` silently loses them on round-trip.
+const ToolCallSchema = z.object({
+    id: z.string(),
+    name: z.string(),
+    input: z.record(z.string(), z.unknown()),
+});
+const ToolResultSchema = z.object({
+    toolUseId: z.string(),
+    content: z.string(),
+    isError: z.boolean().optional(),
+});
+const AssistantMessageSchema = z.object({
+    role: z.literal("assistant"),
+    content: z.string(),
+    toolCalls: z.array(ToolCallSchema),
+});
+const ToolResultMessageSchema = z.object({
+    role: z.literal("user"),
+    toolResults: z.array(ToolResultSchema),
+});
+const SystemUpdateMessageSchema = z.object({
+    role: z.literal("user"),
+    systemUpdate: z.string(),
+    cacheTtl: z.enum(["5m", "1h"]).optional(),
+});
+const TextMessageSchema = z.object({
+    role: z.enum(["user", "assistant"]),
+    content: z.string(),
+});
+/**
+ * Mirrors the `Message` union (providers/types.ts:135-139). Variant order
+ * matters — see the ordering note above. Keep this schema in sync if the
+ * `Message` union ever changes shape.
+ */
+export const MessageSchema = z.union([
+    AssistantMessageSchema,
+    ToolResultMessageSchema,
+    SystemUpdateMessageSchema,
+    TextMessageSchema,
+]);
+// ── SessionRecord ───────────────────────────────────────────────────────
+export const SessionRecordSchema = z.object({
+    sessionId: z.string().min(1),
+    model: z.string(),
+    createdAt: z.string().datetime(),
+    updatedAt: z.string().datetime(),
+    turnsUsed: z.number().int().nonnegative(),
+    messages: z.array(MessageSchema),
+});
+// ── Path helpers ──────────────────────────────────────────────────────
+const SESSIONS_DIR = ".bober/sessions";
+function sessionsDir(projectRoot) {
+    return join(projectRoot, SESSIONS_DIR);
+}
+function sanitizeId(id) {
+    return id.replace(/[^a-zA-Z0-9_-]/g, "_");
+}
+// ── Deterministic fork id ───────────────────────────────────────────────
+/**
+ * Derive a deterministic fork id from a source `sessionId` + an injected
+ * timestamp. Mirrors `job-store.ts`'s `jobId()` content-hash pattern — no
+ * argless `randomUUID()`/`Date.now()`. Used by `forkSession()`
+ * (agentic-loop.ts) when the caller omits an explicit `newId`.
+ */
+export function sessionForkId(sessionId, now) {
+    return createHash("sha256")
+        .update(`${sessionId}|fork|${now}`)
+        .digest("hex")
+        .slice(0, 16);
+}
+/**
+ * Persists agentic-loop transcripts to `.bober/sessions/<sessionId>.json`.
+ * Mirrors `src/research/job-store.ts`: validates with Zod before every
+ * write; reads return `null` on both missing AND malformed JSON (never
+ * throws) — this is what lets `resumeSession` fail soft (sc-6-5).
+ */
+export class SessionStore {
+    projectRoot;
+    clock;
+    constructor(opts) {
+        this.projectRoot = opts.projectRoot;
+        this.clock = opts.now ?? (() => new Date().toISOString());
+    }
+    /** Current time from the injected clock — exposed for deterministic fork-id derivation. */
+    now() {
+        return this.clock();
+    }
+    /** Absolute path to the session file for `sessionId`. */
+    path(sessionId) {
+        return join(sessionsDir(this.projectRoot), `${sanitizeId(sessionId)}.json`);
+    }
+    /**
+     * Persist a session record. Validates with `SessionRecordSchema` before
+     * writing so an invalid record never reaches disk (mirrors job-store.ts).
+     * `createdAt` is preserved from the existing file on disk when one exists
+     * (first save for a given `sessionId` stamps it fresh); `updatedAt` is
+     * always stamped fresh from the injected clock.
+     *
+     * bober: re-reads the existing file on every save to preserve `createdAt`
+     * — an O(1) extra read per turn, fine at this scale. If this ever needs to
+     * avoid the extra read, cache `createdAt` in-memory in the caller (the
+     * loop already holds a `session` handle across turns) and pass it through
+     * explicitly instead.
+     */
+    async save(record) {
+        await ensureDir(sessionsDir(this.projectRoot));
+        const existing = await this.load(record.sessionId);
+        const now = this.clock();
+        const full = {
+            ...record,
+            createdAt: existing?.createdAt ?? now,
+            updatedAt: now,
+        };
+        const validation = SessionRecordSchema.safeParse(full);
+        if (!validation.success) {
+            const issues = validation.error.issues
+                .map((i) => `  - ${i.path.join(".")}: ${i.message}`)
+                .join("\n");
+            throw new Error(`Invalid session record:\n${issues}`);
+        }
+        await writeFile(this.path(record.sessionId), JSON.stringify(validation.data, null, 2) + "\n", "utf-8");
+    }
+    /**
+     * Load a session record by id. Returns `null` if not found or malformed —
+     * NEVER throws. This null-on-corrupt result is what `resumeSession` maps
+     * to its typed `{ error }` result (sc-6-5); a corrupt file is never
+     * silently overwritten with an empty session.
+     */
+    async load(sessionId) {
+        try {
+            const raw = JSON.parse(await readFile(this.path(sessionId), "utf-8"));
+            const result = SessionRecordSchema.safeParse(raw);
+            return result.success ? result.data : null;
+        }
+        catch {
+            return null;
+        }
+    }
+    /**
+     * Copy the transcript at `sessionId` into a new session file under
+     * `newId`. Writes ONLY the new file — the source is only ever read, never
+     * rewritten, so continuing the fork leaves the original byte-identical
+     * (sc-6-3). Throws if the source session does not exist or is corrupt
+     * (nothing to fork).
+     */
+    async fork(sessionId, newId) {
+        const source = await this.load(sessionId);
+        if (!source) {
+            throw new Error(`Cannot fork session '${sessionId}': not found or corrupt.`);
+        }
+        await this.save({
+            sessionId: newId,
+            model: source.model,
+            turnsUsed: source.turnsUsed,
+            messages: source.messages,
+        });
+        return newId;
+    }
+}
+//# sourceMappingURL=session-store.js.map

package/dist/orchestrator/session-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-store.js","sourceRoot":"","sources":["../../src/orchestrator/session-store.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,EAAE;AACF,6EAA6E;AAC7E,gFAAgF;AAChF,8EAA8E;AAC9E,8EAA8E;AAC9E,0EAA0E;AAC1E,EAAE;AACF,0EAA0E;AAC1E,gEAAgE;AAChE,6EAA6E;AAC7E,+EAA+E;AAE/E,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAGhD,yEAAyE;AACzE,EAAE;AACF,2EAA2E;AAC3E,2EAA2E;AAC3E,qEAAqE;AACrE,4EAA4E;AAC5E,yEAAyE;AACzE,iFAAiF;AACjF,2EAA2E;AAC3E,8DAA8D;AAE9D,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;CACzC,CAAC,CAAC;AAEH,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AAEH,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;IAC5B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC;CACnC,CAAC,CAAC;AAEH,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACvB,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC;CACvC,CAAC,CAAC;AAEH,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACvB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC;AAEH,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACnC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;CACpB,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAuB,CAAC,CAAC,KAAK,CAAC;IACvD,sBAAsB;IACtB,uBAAuB;IACvB,yBAAyB;IACzB,iBAAiB;CAClB,CAAC,CAAC;AAEH,2EAA2E;AAE3E,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACzC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC;CACjC,CAAC,CAAC;AAWH,yEAAyE;AAEzE,MAAM,YAAY,GAAG,iBAAiB,CAAC;AAEvC,SAAS,WAAW,CAAC,WAAmB;IACtC,OAAO,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,UAAU,CAAC,EAAU;IAC5B,OAAO,EAAE,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;AAC5C,CAAC;AAED,2EAA2E;AAE3E;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,SAAiB,EAAE,GAAW;IAC1D,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,GAAG,SAAS,SAAS,GAAG,EAAE,CAAC;SAClC,MAAM,CAAC,KAAK,CAAC;SACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAClB,CAAC;AAWD;;;;;GAKG;AACH,MAAM,OAAO,YAAY;IACN,WAAW,CAAS;IACpB,KAAK,CAAe;IAErC,YAAY,IAAyB;QACnC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QACpC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,2FAA2F;IAC3F,GAAG;QACD,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;IAED,yDAAyD;IACzD,IAAI,CAAC,SAAiB;QACpB,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,GAAG,UAAU,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IAC9E,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,IAAI,CAAC,MAAwB;QACjC,MAAM,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;QAE/C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACnD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAkB;YAC1B,GAAG,MAAM;YACT,SAAS,EAAE,QAAQ,EAAE,SAAS,IAAI,GAAG;YACrC,SAAS,EAAE,GAAG;SACf,CAAC;QAEF,MAAM,UAAU,GAAG,mBAAmB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACvD,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;YACxB,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,MAAM;iBACnC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;iBACnD,IAAI,CAAC,IAAI,CAAC,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,4BAA4B,MAAM,EAAE,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,SAAS,CACb,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAC3B,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAC/C,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,IAAI,CAAC,SAAiB;QAC1B,IAAI,CAAC;YACH,MAAM,GAAG,GAAY,IAAI,CAAC,KAAK,CAC7B,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,CAC9C,CAAC;YACF,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YAClD,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,IAAI,CAAC,SAAiB,EAAE,KAAa;QACzC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CACb,wBAAwB,SAAS,0BAA0B,CAC5D,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,CAAC,IAAI,CAAC;YACd,SAAS,EAAE,KAAK;YAChB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ;SAC1B,CAAC,CAAC;QAEH,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}

package/dist/orchestrator/stack-knowledge.d.ts

@@ -0,0 +1,17 @@
+import type { VulnClass } from "./security-audit-types.js";
+/**
+ * Every VulnClass value (security-audit-types.ts:9-25, widened sprint-1 of
+ * spec-20260714-security-auditor-per-stack-skills). The taxonomy does not
+ * vary by stack — it is the fixed classification backbone every audit is
+ * organised against. Must stay in lockstep with the VulnClass union — see
+ * security-audit-types.test.ts's lockstep assertion.
+ *
+ * The stack -> skill resolver that used to live in this file (detectStack,
+ * extractSecurityExcerpt, readSkillSecurityExcerpt, resolveStackSecurityContext,
+ * STACK_SKILL_MAP) has moved to src/orchestrator/security-knowledge/ (registry.ts,
+ * index.ts, selector.ts, resolver.ts) — a retrieval pipeline over the 8 authored
+ * skill files, replacing the old head-excerpt approach (G3). This constant is
+ * kept here because several unrelated modules import it from this path.
+ */
+export declare const ALL_VULN_CLASSES: VulnClass[];
+//# sourceMappingURL=stack-knowledge.d.ts.map

package/dist/orchestrator/stack-knowledge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stack-knowledge.d.ts","sourceRoot":"","sources":["../../src/orchestrator/stack-knowledge.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAI3D;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,gBAAgB,EAAE,SAAS,EAkBvC,CAAC"}