agenttwin 0.3.0 → 0.3.2

package/dist/api.js

@@ -91,33 +91,785 @@ var init_dashboard_transfer = __esm({
   }
 });
 
+// src/lib/files.ts
+import { readdir as readdir2, readFile as readFile4, stat } from "fs/promises";
+import { join as join4, relative, sep } from "path";
+function shouldIgnoreDir(name) {
+  return IGNORED_DIRS.has(name) || name === ".git";
+}
+async function walkDir(root, maxFiles, budgetMs) {
+  const out = [];
+  const limits = [];
+  const stack = [root];
+  const started = Date.now();
+  while (stack.length > 0 && out.length < maxFiles && Date.now() - started < budgetMs) {
+    const dir = stack.pop();
+    let entries;
+    try {
+      entries = await readdir2(dir, { withFileTypes: true });
+    } catch {
+      limits.push(`Directory could not be read: ${relative(root, dir) || "."}`);
+      continue;
+    }
+    entries.sort((a, b) => a.name.localeCompare(b.name));
+    for (const entry of entries) {
+      const full = join4(dir, entry.name);
+      if (entry.isDirectory()) {
+        if (!shouldIgnoreDir(entry.name)) stack.push(full);
+      } else if (entry.isFile()) {
+        out.push(relative(root, full).split(sep).join("/"));
+        if (out.length >= maxFiles) break;
+      }
+    }
+  }
+  if (out.length >= maxFiles) limits.push(`File scan limit reached (${maxFiles} files); additional files may be unscanned`);
+  if (stack.length && Date.now() - started >= budgetMs) limits.push(`File walk time budget reached (${budgetMs}ms); directories remain unscanned`);
+  return { files: out.sort(), limits };
+}
+async function createFileIndex(cwd) {
+  return new RepoFileIndex(cwd);
+}
+var IGNORED_DIRS, MAX_FILES, MAX_BYTES, WALK_BUDGET_MS, RepoFileIndex;
+var init_files = __esm({
+  "src/lib/files.ts"() {
+    "use strict";
+    IGNORED_DIRS = /* @__PURE__ */ new Set([
+      ".git",
+      ".agenttwin",
+      "node_modules",
+      "dist",
+      "build",
+      "out",
+      "coverage",
+      ".next",
+      ".nuxt",
+      ".venv",
+      "venv",
+      "env",
+      "site-packages",
+      "__pycache__",
+      ".pytest_cache",
+      ".mypy_cache",
+      ".ruff_cache",
+      ".tox",
+      "vendor",
+      "target",
+      ".turbo",
+      ".cache",
+      ".idea",
+      ".vscode",
+      ".terraform",
+      "models",
+      "data",
+      "datasets",
+      "media",
+      "uploads",
+      "tmp",
+      "logs",
+      "gen"
+    ]);
+    MAX_FILES = 2e4;
+    MAX_BYTES = 1e6;
+    WALK_BUDGET_MS = 8e3;
+    RepoFileIndex = class {
+      cwd;
+      cache = { contents: /* @__PURE__ */ new Map(), limits: [] };
+      bounds;
+      constructor(cwd, bounds = { maxFiles: MAX_FILES, budgetMs: WALK_BUDGET_MS }) {
+        this.cwd = cwd;
+        this.bounds = bounds;
+      }
+      async walk() {
+        if (!this.cache.files) {
+          const result = await walkDir(this.cwd, this.bounds.maxFiles, this.bounds.budgetMs);
+          this.cache.files = result.files;
+          this.cache.limits.push(...result.limits);
+        }
+        return this.cache.files;
+      }
+      scanLimits() {
+        return [...new Set(this.cache.limits)].sort();
+      }
+      async exists(path) {
+        try {
+          await stat(join4(this.cwd, path));
+          return true;
+        } catch {
+          return false;
+        }
+      }
+      async read(path, maxBytes = MAX_BYTES) {
+        const cached = this.cache.contents.get(path);
+        if (cached !== void 0) return cached;
+        const full = join4(this.cwd, path);
+        try {
+          const info = await stat(full);
+          if (!info.isFile()) return void 0;
+          if (info.size > maxBytes) {
+            this.cache.limits.push(`File excluded by size limit (${maxBytes} bytes): ${path}`);
+            return void 0;
+          }
+          const text = await readFile4(full, "utf8");
+          this.cache.contents.set(path, text);
+          return text;
+        } catch {
+          return void 0;
+        }
+      }
+      async byExt(...exts) {
+        const wanted = new Set(exts.map((e) => e.replace(/^\./, "").toLowerCase()));
+        const files = await this.walk();
+        return files.filter((f) => {
+          const dot = f.lastIndexOf(".");
+          if (dot < 0) return false;
+          return wanted.has(f.slice(dot + 1).toLowerCase());
+        });
+      }
+      async byName(pattern) {
+        const files = await this.walk();
+        return files.filter((f) => pattern.test(f));
+      }
+      line(ref) {
+        const idx = ref.lastIndexOf(":");
+        if (idx < 0) return void 0;
+        const path = ref.slice(0, idx);
+        const num = Number(ref.slice(idx + 1));
+        if (!Number.isInteger(num)) return void 0;
+        const text = this.cache.contents.get(path);
+        if (text === void 0) return void 0;
+        const lines = text.split(/\r?\n/);
+        return lines[num - 1];
+      }
+    };
+  }
+});
+
+// src/inventory/entrypoints.ts
+function codeOnly(source) {
+  return source.replace(/\/\*[\s\S]*?\*\/|\/\/[^\n]*|"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|`(?:\\.|[^`\\])*`/g, (part) => part.replace(/[^\n]/g, " "));
+}
+function exportedEntrypoints(source) {
+  const code = codeOnly(source);
+  const pattern = /\bexport\s+(?:default\s+)?(?:async\s+)?function\s+(\w+)\s*\([^)]*\)[^{;]*\{|\bexport\s+(?:const|let)\s+(\w+)\s*=\s*(?:async\s*)?\([^)]*\)\s*(?::[^=;]+)?=>\s*\{/g;
+  const result = [];
+  let match;
+  while (match = pattern.exec(code)) {
+    let depth = 1, end = pattern.lastIndex;
+    while (end < code.length && depth) {
+      if (code[end] === "{") depth++;
+      if (code[end] === "}") depth--;
+      end++;
+    }
+    if (depth) continue;
+    result.push({ name: match[1] || match[2], startLine: code.slice(0, match.index).split("\n").length, endLine: code.slice(0, end).split("\n").length });
+    pattern.lastIndex = end;
+  }
+  return result;
+}
+var init_entrypoints = __esm({
+  "src/inventory/entrypoints.ts"() {
+    "use strict";
+  }
+});
+
+// src/discovery/masking.ts
+function maskSecret(value) {
+  return value.replace(TOKENISH, (match) => `${match.slice(0, 4)}***`);
+}
+function maskUrl(value) {
+  try {
+    const url = new URL(value);
+    return `${url.protocol}//${url.host}${url.pathname}`;
+  } catch {
+    return maskSecret(value);
+  }
+}
+var TOKENISH;
+var init_masking = __esm({
+  "src/discovery/masking.ts"() {
+    "use strict";
+    TOKENISH = /\b(sk|rk|pk|ghp|gho|ghs|xox[baprs]|AKIA|AIza)[A-Za-z0-9_-]{6,}\b/g;
+  }
+});
+
+// src/discovery/probes/providers/stripe.ts
+var stripeProbe;
+var init_stripe = __esm({
+  "src/discovery/probes/providers/stripe.ts"() {
+    "use strict";
+    init_masking();
+    stripeProbe = {
+      id: "stripe.readonly",
+      providerId: "stripe",
+      title: "Enumerate Stripe account configuration (read-only)",
+      description: "Reads products, prices and webhook endpoints. Read-only; issues no writes.",
+      readScope: {
+        endpoints: [
+          "GET /v1/products",
+          "GET /v1/prices",
+          "GET /v1/webhook_endpoints"
+        ],
+        methods: ["GET"]
+      },
+      credentials: [
+        {
+          envVar: "STRIPE_SECRET_KEY",
+          label: "Stripe restricted key (read scopes)",
+          required: true,
+          scopes: ["products:read", "prices:read", "webhook_endpoints:read"],
+          hint: "Prefer a restricted key (rk_...) with read scopes over a full sk_live_ key."
+        }
+      ],
+      async run(ctx) {
+        const spec = this.credentials[0];
+        const key = ctx.credential(spec);
+        if (!key) {
+          return {
+            providerId: this.providerId,
+            ok: false,
+            summary: "no credential present",
+            resources: [],
+            evidence: []
+          };
+        }
+        const get = async (path) => {
+          const response = await ctx.fetch(`https://api.stripe.com${path}`, {
+            method: "GET",
+            headers: { Authorization: `Bearer ${key}` },
+            signal: ctx.signal
+          });
+          if (!response.ok) {
+            throw new Error(`Stripe ${path} -> HTTP ${response.status}`);
+          }
+          return await response.json();
+        };
+        try {
+          const [products, prices, hooks] = await Promise.all([
+            get("/v1/products?limit=100"),
+            get("/v1/prices?limit=100"),
+            get("/v1/webhook_endpoints?limit=100")
+          ]);
+          return {
+            providerId: this.providerId,
+            ok: true,
+            summary: `${products.data.length} products, ${prices.data.length} prices, ${hooks.data.length} webhook endpoints`,
+            resources: [
+              {
+                kind: "products",
+                count: products.data.length,
+                sample: products.data.slice(0, 5).map((p) => ({
+                  id: p.id,
+                  name: p.name,
+                  active: p.active
+                }))
+              },
+              { kind: "prices", count: prices.data.length },
+              {
+                kind: "webhook_endpoints",
+                count: hooks.data.length,
+                sample: hooks.data.slice(0, 5).map((h) => ({
+                  url: typeof h.url === "string" ? maskUrl(h.url) : void 0,
+                  status: h.status
+                }))
+              }
+            ],
+            evidence: [
+              {
+                ref: "probe:stripe",
+                pass: "probe",
+                signal: "probe",
+                detail: "account reachable via read scopes"
+              }
+            ]
+          };
+        } catch (error) {
+          return {
+            providerId: this.providerId,
+            ok: false,
+            error: { message: error instanceof Error ? error.message : String(error) },
+            summary: "probe failed",
+            resources: [],
+            evidence: []
+          };
+        }
+      }
+    };
+  }
+});
+
+// src/discovery/probes/providers/github.ts
+var githubProbe;
+var init_github = __esm({
+  "src/discovery/probes/providers/github.ts"() {
+    "use strict";
+    githubProbe = {
+      id: "github.readonly",
+      providerId: "github",
+      title: "Enumerate GitHub account (read-only)",
+      description: "Reads the authenticated user and their repositories. Read-only.",
+      readScope: {
+        endpoints: ["GET /user", "GET /user/repos"],
+        methods: ["GET"]
+      },
+      credentials: [
+        {
+          envVar: "GITHUB_TOKEN",
+          label: "GitHub token (read:user, repo:read)",
+          required: true,
+          scopes: ["read:user", "public_repo"],
+          hint: "A fine-grained token with read-only repository access is sufficient."
+        }
+      ],
+      async run(ctx) {
+        const key = ctx.credential(this.credentials[0]);
+        if (!key) {
+          return {
+            providerId: this.providerId,
+            ok: false,
+            summary: "no credential present",
+            resources: [],
+            evidence: []
+          };
+        }
+        const headers = {
+          Authorization: `Bearer ${key}`,
+          Accept: "application/vnd.github+json",
+          "User-Agent": "agenttwin-discovery"
+        };
+        try {
+          const userResponse = await ctx.fetch("https://api.github.com/user", {
+            method: "GET",
+            headers,
+            signal: ctx.signal
+          });
+          if (!userResponse.ok) {
+            throw new Error(`GitHub /user -> HTTP ${userResponse.status}`);
+          }
+          const user = await userResponse.json();
+          const reposResponse = await ctx.fetch(
+            "https://api.github.com/user/repos?per_page=100&sort=updated",
+            { method: "GET", headers, signal: ctx.signal }
+          );
+          const repos = reposResponse.ok ? await reposResponse.json() : [];
+          return {
+            providerId: this.providerId,
+            ok: true,
+            summary: `${repos.length} repositories readable for @${user.login ?? "unknown"}`,
+            resources: [
+              {
+                kind: "repositories",
+                count: repos.length,
+                sample: repos.slice(0, 5).map((r) => ({
+                  name: r.name,
+                  private: r.private,
+                  archived: r.archived
+                }))
+              }
+            ],
+            evidence: [
+              {
+                ref: "probe:github",
+                pass: "probe",
+                signal: "probe",
+                detail: "account reachable via read scopes"
+              }
+            ]
+          };
+        } catch (error) {
+          return {
+            providerId: this.providerId,
+            ok: false,
+            error: { message: error instanceof Error ? error.message : String(error) },
+            summary: "probe failed",
+            resources: [],
+            evidence: []
+          };
+        }
+      }
+    };
+  }
+});
+
+// src/discovery/providers/catalog.ts
+function planned(unknown) {
+  return { supported: [], verified: [], unknown, implemented: false };
+}
+var NO_TWIN, PROVIDERS;
+var init_catalog = __esm({
+  "src/discovery/providers/catalog.ts"() {
+    "use strict";
+    init_stripe();
+    init_github();
+    NO_TWIN = ["all behavior (no twin implemented)"];
+    PROVIDERS = [
+      {
+        id: "stripe",
+        title: "Stripe",
+        category: "payments",
+        twin: planned(["refunds", "payouts", "disputes", "webhook ordering"]),
+        probe: stripeProbe,
+        signatures: {
+          packages: {
+            node: ["stripe"],
+            python: ["stripe"],
+            go: ["stripe-go"],
+            java: ["stripe-java"],
+            ruby: ["stripe"],
+            php: ["stripe/stripe-php"],
+            dotnet: ["Stripe.net"]
+          },
+          imports: ["new Stripe\\(", `from ["']stripe["']`, `require\\(['"]stripe['"]\\)`, "stripe-go"],
+          hosts: ["api.stripe.com"],
+          envPrefixes: ["STRIPE_"],
+          webhookPaths: ["/webhooks/stripe", "/stripe/webhook", "/webhook/stripe"]
+        },
+        docs: "https://stripe.com/docs/api"
+      },
+      {
+        id: "slack",
+        title: "Slack",
+        category: "comms",
+        twin: planned(NO_TWIN),
+        signatures: {
+          packages: {
+            node: ["@slack/web-api", "@slack/bolt", "@slack/events-api", "@slack/socket-mode"],
+            python: ["slack_sdk", "slack-bolt"],
+            go: ["slack-go"],
+            java: ["slack-java-sdk"],
+            ruby: ["slack-ruby-client"]
+          },
+          imports: ["@slack/web-api", "WebClient\\(", "slack_sdk"],
+          hosts: ["slack.com", "api.slack.com", "hooks.slack.com"],
+          envPrefixes: ["SLACK_"]
+        }
+      },
+      {
+        id: "github",
+        title: "GitHub",
+        category: "vcs",
+        twin: planned(NO_TWIN),
+        probe: githubProbe,
+        signatures: {
+          packages: {
+            node: ["@octokit/rest", "@octokit/core", "@octokit/auth", "octokit"],
+            python: ["PyGithub", "github"],
+            go: ["google/go-github"],
+            java: ["github-api"],
+            ruby: ["octokit"]
+          },
+          imports: ["Octokit", "@octokit/", "PyGithub"],
+          hosts: ["api.github.com"],
+          envPrefixes: ["GITHUB_", "GH_"],
+          webhookPaths: ["/webhooks/github", "/github/webhook"]
+        }
+      },
+      {
+        id: "aws",
+        title: "AWS",
+        category: "cloud",
+        twin: planned(["service coverage (LocalStack passthrough planned)"]),
+        envWeak: true,
+        signatures: {
+          packages: {
+            node: ["@aws-sdk/", "aws-sdk"],
+            python: ["boto3", "botocore"],
+            go: ["aws-sdk-go", "aws-sdk-go-v2"],
+            java: ["software.amazon.awssdk", "aws-java-sdk"],
+            ruby: ["aws-sdk-"],
+            php: ["aws/aws-sdk-php"],
+            dotnet: ["AWSSDK."]
+          },
+          imports: ["@aws-sdk/", "boto3", "aws-sdk-go"],
+          hosts: ["amazonaws.com"],
+          envPrefixes: ["AWS_"]
+        }
+      },
+      {
+        id: "google",
+        title: "Google (Gmail / Calendar / Workspace)",
+        category: "comms",
+        twin: planned(NO_TWIN),
+        envWeak: true,
+        signatures: {
+          packages: {
+            node: ["googleapis", "google-auth-library"],
+            python: ["google-api-python-client", "google-cloud", "google-auth"],
+            go: ["google.golang.org/api"],
+            java: ["google-api-client"],
+            ruby: ["google-apis-"]
+          },
+          imports: ["googleapis", "google-api-python-client", "google.golang.org/api"],
+          hosts: ["googleapis.com", "gmail.googleapis.com", "www.googleapis.com"],
+          envPrefixes: ["GOOGLE_", "GCP_", "GMAIL_"]
+        }
+      },
+      {
+        id: "openai",
+        title: "OpenAI",
+        category: "ai",
+        twin: planned(NO_TWIN),
+        signatures: {
+          packages: {
+            node: ["openai"],
+            python: ["openai"],
+            go: ["go-openai"],
+            ruby: ["ruby-openai"]
+          },
+          imports: ["OpenAI\\(", `from ["']openai["']`, "go-openai"],
+          hosts: ["api.openai.com"],
+          envPrefixes: ["OPENAI_"]
+        }
+      },
+      {
+        id: "anthropic",
+        title: "Anthropic",
+        category: "ai",
+        twin: planned(NO_TWIN),
+        signatures: {
+          packages: {
+            node: ["@anthropic-ai/sdk"],
+            python: ["anthropic"],
+            go: ["anthropic-sdk-go"]
+          },
+          imports: ["@anthropic-ai/sdk", "Anthropic\\("],
+          hosts: ["api.anthropic.com"],
+          envPrefixes: ["ANTHROPIC_"]
+        }
+      },
+      {
+        id: "shopify",
+        title: "Shopify",
+        category: "commerce",
+        twin: planned(NO_TWIN),
+        signatures: {
+          packages: {
+            node: ["@shopify/", "shopify-api"],
+            python: ["ShopifyAPI"],
+            ruby: ["shopify_api"]
+          },
+          imports: ["@shopify/", "ShopifyAPI"],
+          hosts: ["myshopify.com", "shopify.com"],
+          envPrefixes: ["SHOPIFY_"]
+        }
+      },
+      {
+        id: "twilio",
+        title: "Twilio",
+        category: "comms",
+        twin: planned(NO_TWIN),
+        signatures: {
+          packages: {
+            node: ["twilio"],
+            python: ["twilio"],
+            java: ["twilio"],
+            ruby: ["twilio-ruby"],
+            php: ["twilio/sdk"]
+          },
+          imports: ["twilio"],
+          hosts: ["api.twilio.com"],
+          envPrefixes: ["TWILIO_"]
+        }
+      },
+      {
+        id: "sendgrid",
+        title: "SendGrid",
+        category: "comms",
+        twin: planned(NO_TWIN),
+        signatures: {
+          packages: {
+            node: ["@sendgrid/mail", "@sendgrid/client"],
+            python: ["sendgrid"],
+            ruby: ["sendgrid-ruby"]
+          },
+          imports: ["@sendgrid/", "sendgrid"],
+          hosts: ["api.sendgrid.com"],
+          envPrefixes: ["SENDGRID_"]
+        }
+      },
+      {
+        id: "hubspot",
+        title: "HubSpot",
+        category: "crm",
+        twin: planned(NO_TWIN),
+        signatures: {
+          packages: {
+            node: ["@hubspot/api-client"],
+            python: ["hubspot-api-client"],
+            ruby: ["hubspot-api-client"]
+          },
+          imports: ["@hubspot/api-client", "hubspot-api-client"],
+          hosts: ["api.hubapi.com"],
+          envPrefixes: ["HUBSPOT_"]
+        }
+      },
+      {
+        id: "salesforce",
+        title: "Salesforce",
+        category: "crm",
+        twin: planned(NO_TWIN),
+        signatures: {
+          packages: {
+            node: ["jsforce", "@salesforce/"],
+            python: ["simple-salesforce"],
+            java: ["force-wsc"]
+          },
+          imports: ["jsforce", "simple-salesforce"],
+          hosts: ["salesforce.com", "force.com"],
+          envPrefixes: ["SALESFORCE_", "SF_"]
+        }
+      },
+      {
+        id: "zendesk",
+        title: "Zendesk",
+        category: "support",
+        twin: planned(NO_TWIN),
+        signatures: {
+          packages: {
+            node: ["node-zendesk"],
+            python: ["zendesk", "zenpy"],
+            ruby: ["zendesk_api"]
+          },
+          imports: ["node-zendesk", "zenpy"],
+          hosts: ["zendesk.com"],
+          envPrefixes: ["ZENDESK_"]
+        }
+      },
+      {
+        id: "linear",
+        title: "Linear",
+        category: "pm",
+        twin: planned(NO_TWIN),
+        signatures: {
+          packages: { node: ["@linear/sdk"], python: ["linear"] },
+          imports: ["@linear/sdk"],
+          hosts: ["api.linear.app"],
+          envPrefixes: ["LINEAR_"]
+        }
+      },
+      {
+        id: "notion",
+        title: "Notion",
+        category: "docs",
+        twin: planned(NO_TWIN),
+        signatures: {
+          packages: { node: ["@notionhq/client"], python: ["notion-client"] },
+          imports: ["@notionhq/client", "notion-client"],
+          hosts: ["api.notion.com"],
+          envPrefixes: ["NOTION_"]
+        }
+      },
+      {
+        id: "resend",
+        title: "Resend",
+        category: "comms",
+        twin: planned(NO_TWIN),
+        signatures: {
+          packages: { node: ["resend"] },
+          imports: [`from ["']resend["']`],
+          hosts: ["api.resend.com"],
+          envPrefixes: ["RESEND_"]
+        }
+      }
+    ];
+    for (const [id, title, category, node, python, hosts] of [
+      ["composio", "Composio", "integration", ["@composio/core", "@composio/client"], ["composio", "composio-core"], ["backend.composio.dev"]],
+      ["kernel", "Kernel", "browser", ["@onkernel/sdk"], ["kernel"], ["api.onkernel.com"]],
+      ["e2b", "E2B", "runtime", ["e2b", "@e2b/code-interpreter"], ["e2b", "e2b-code-interpreter"], ["api.e2b.dev"]],
+      ["mem0", "Mem0", "ai", ["mem0ai"], ["mem0ai"], ["api.mem0.ai"]],
+      ["ollama", "Ollama", "ai", ["ollama"], ["ollama"], []],
+      ["onepassword", "1Password", "security", ["@1password/sdk"], ["onepassword-sdk"], []]
+    ]) PROVIDERS.push({ id, title, category, twin: planned(NO_TWIN), signatures: { packages: { node: [...node], python: [...python] }, imports: [...node, ...python], hosts: [...hosts] } });
+  }
+});
+
+// src/inventory/project-products.ts
+async function projectProducts(cwd, data, base) {
+  const current = new Set(base.tools.map((t) => t.id));
+  const known = new Set(PROVIDERS.map((p) => p.title));
+  const tools = data.tools.filter((t) => current.has(t.id) || !known.has(t.title) && t.category !== "access" && t.category !== "tooling");
+  const ids = new Set(tools.map((t) => t.id));
+  const workflows = data.workflows.map((w) => ({ ...w, tools: w.tools.filter((id) => ids.has(id)), steps: w.steps.filter((s) => ids.has(s.tool)) }));
+  const google = tools.find((t) => /Google \(Gmail/.test(t.title));
+  if (!google) return discoveryTransfer({ ...data, tools, workflows });
+  const products = [
+    { key: "gmail", title: "Gmail", pattern: /(?:gmail\.googleapis\.com|\/gmail\/v\d|\bgoogle\.gmail\s*\()/i },
+    { key: "calendar", title: "Google Calendar", pattern: /(?:\/calendar\/v\d|\bgoogle\.calendar\s*\()/i },
+    { key: "drive", title: "Google Drive", pattern: /(?:\/drive\/v\d|\bgoogle\.drive\s*\()/i },
+    { key: "docs", title: "Google Docs", pattern: /(?:docs\.googleapis\.com|\/documents\/|\bgoogle\.docs\s*\()/i },
+    { key: "sheets", title: "Google Sheets", pattern: /(?:sheets\.googleapis\.com|\/spreadsheets\/|\bgoogle\.sheets\s*\()/i }
+  ];
+  const files = await createFileIndex(cwd);
+  const paths = (await files.walk()).filter((p) => /\.(?:ts|tsx|js|mjs|py)$/.test(p) && !/(?:^|\/)(?:artifacts|tests?|testbed|docs?|fixtures?|examples?|public|assets)(?:\/|$)|\.(?:test|spec)\.|fixtures?\./i.test(p)).slice(0, 2500);
+  const found = /* @__PURE__ */ new Set();
+  for (const path of paths) {
+    const source = await files.read(path, 2e5);
+    if (!source) continue;
+    for (const p of products) if (p.pattern.test(source)) found.add(p.key);
+  }
+  const mapped = workflows.map((w) => {
+    if (!w.tools.includes(google.id)) return w;
+    const [path, fn] = (w.entrypoint ?? "").split("#");
+    return { w, path, fn };
+  });
+  const finalWorkflows = [];
+  let unresolved = false;
+  for (const value of mapped) {
+    if (!("w" in value)) {
+      finalWorkflows.push(value);
+      continue;
+    }
+    const { w, path, fn } = value;
+    const source = path ? await files.read(path, 2e5) : void 0;
+    const entry = source && fn ? exportedEntrypoints(source).find((e) => e.name === fn) : void 0;
+    const body2 = source && entry ? source.split("\n").slice(entry.startLine - 1, entry.endLine).join("\n") : source ?? "";
+    const matches = products.filter((p) => found.has(p.key) && p.pattern.test(body2)).map((p) => google.id + ":" + p.key);
+    if (!matches.length) {
+      unresolved = true;
+      finalWorkflows.push(w);
+      continue;
+    }
+    finalWorkflows.push({ ...w, tools: [...new Set(w.tools.flatMap((id) => id === google.id ? matches : [id]))], steps: w.steps.flatMap((s) => s.tool === google.id ? matches.map((tool) => ({ ...s, tool })) : [s]) });
+  }
+  const productTools = products.filter((p) => found.has(p.key)).map((p) => ({ ...google, id: google.id + ":" + p.key, title: p.title }));
+  return discoveryTransfer({ ...data, tools: [...tools.filter((t) => t.id !== google.id || unresolved || !productTools.length).map((t) => t.id === google.id ? { ...t, title: "Google API (unspecified)" } : t), ...productTools], workflows: finalWorkflows });
+}
+var init_project_products = __esm({
+  "src/inventory/project-products.ts"() {
+    "use strict";
+    init_files();
+    init_entrypoints();
+    init_catalog();
+    init_dashboard_transfer();
+  }
+});
+
 // src/inspect/sanitize.ts
 function stripUrlCredentials(value) {
   return value.replace(URL_CREDENTIALS, "$1");
 }
 function sanitizeOutput(value) {
-  return stripUrlCredentials(value).replace(TOKENISH, (m) => `${m.slice(0, 4)}***`).replace(EMAIL, "$1***$2");
+  return stripUrlCredentials(value).replace(TOKENISH2, (m) => `${m.slice(0, 4)}***`).replace(EMAIL, "$1***$2");
 }
-var URL_CREDENTIALS, TOKENISH, EMAIL;
+var URL_CREDENTIALS, TOKENISH2, EMAIL;
 var init_sanitize = __esm({
   "src/inspect/sanitize.ts"() {
     "use strict";
     URL_CREDENTIALS = /(https?:\/\/)([^/@\s:]+)(:[^/@\s]+)?@/gi;
-    TOKENISH = /\b(sk|rk|pk|ghp|gho|ghs|glpat|xox[baprs]|AKIA|AIza)[A-Za-z0-9_-]{6,}\b/g;
+    TOKENISH2 = /\b(sk|rk|pk|ghp|gho|ghs|glpat|xox[baprs]|AKIA|AIza)[A-Za-z0-9_-]{6,}\b/g;
     EMAIL = /([A-Za-z0-9._%+-])[A-Za-z0-9._%+-]*(@[A-Za-z0-9.-]+\.[A-Za-z]{2,})/g;
   }
 });
 
 // src/commands/dashboard.ts
-import { cp, mkdir, readFile as readFile4, writeFile } from "fs/promises";
-import { basename, join as join4 } from "path";
+import { cp, mkdir, readFile as readFile5, writeFile } from "fs/promises";
+import { basename, join as join5 } from "path";
 import { fileURLToPath } from "url";
 function dashboardInventory(cwd, inventory) {
   return JSON.parse(sanitizeOutput(JSON.stringify({
     schema: "company-inventory/v1",
     generatedAt: inventory.generatedAt,
     name: basename(cwd),
-    tools: inventory.tools.map((t) => ({
+    tools: inventory.tools.filter((t) => !t.facts?.length || !t.facts.every((f) => f.evidence.every((e) => /^(?:credential:|command:)/.test(e.ref)))).map((t) => ({
       id: t.id,
       title: t.title,
       kind: t.kind,
@@ -146,8 +898,8 @@ __export(session_exports, {
   writeSessionTask: () => writeSessionTask
 });
 import { spawn as spawn2, spawnSync } from "child_process";
-import { writeFile as writeFile2, readFile as readFile5 } from "fs/promises";
-import { join as join5 } from "path";
+import { writeFile as writeFile2, readFile as readFile6 } from "fs/promises";
+import { join as join6 } from "path";
 function sessionTask() {
   return `# Prepare this repository for AgentTwin
 
@@ -172,7 +924,7 @@ function installedOpenCode() {
   return spawnSync("opencode", ["--version"], { stdio: "ignore", timeout: 5e3 }).status === 0;
 }
 async function writeSessionTask(cwd) {
-  const path = join5(cwd, ".agenttwin/AGENT-TASK.md");
+  const path = join6(cwd, ".agenttwin/AGENT-TASK.md");
   await writeFile2(path, sessionTask(), "utf8");
   return path;
 }
@@ -189,9 +941,9 @@ async function loadDashboardDiscovery(cwd, inventory) {
   const base = discoveryTransfer(dashboardInventory(cwd, inventory));
   let raw;
   try {
-    raw = await readFile5(join5(cwd, ".agenttwin/agent-discovery.json"), "utf8");
+    raw = await readFile6(join6(cwd, ".agenttwin/agent-discovery.json"), "utf8");
   } catch (error) {
-    if (error.code === "ENOENT") return base;
+    if (error.code === "ENOENT") return projectProducts(cwd, base, base);
     throw error;
   }
   if (Buffer.byteLength(raw) > 2 * 1024 * 1024) throw new Error("Agent discovery exceeds 2 MiB");
@@ -203,11 +955,12 @@ async function loadDashboardDiscovery(cwd, inventory) {
   const result = discoveryTransfer({ ...base, tools: [...tools.values()], workflows: [...workflows.values()] });
   const ids = new Set(result.tools.map((t) => t.id));
   if (result.workflows.some((w) => w.tools.some((id) => !ids.has(id)) || w.steps.some((s) => !ids.has(s.tool)))) throw new Error("Agent discovery references unknown tools. Correct .agenttwin/agent-discovery.json before syncing.");
-  return result;
+  return projectProducts(cwd, result, base);
 }
 var init_session = __esm({
   "src/commands/session.ts"() {
     "use strict";
+    init_project_products();
     init_dashboard_transfer();
     init_dashboard();
   }
@@ -217,8 +970,8 @@ var init_session = __esm({
 init_dashboard_transfer();
 import { createServer as createServer2 } from "http";
 import { createHash as createHash2, randomBytes as randomBytes3, randomUUID as randomUUID2, timingSafeEqual } from "crypto";
-import { mkdir as mkdir3, readFile as readFile7, writeFile as writeFile4, rename, mkdtemp as mkdtemp2, rm as rm2 } from "fs/promises";
-import { resolve as resolve2, join as join7, dirname as dirname2, extname } from "path";
+import { mkdir as mkdir3, readFile as readFile8, writeFile as writeFile4, rename, mkdtemp as mkdtemp2, rm as rm2 } from "fs/promises";
+import { resolve as resolve2, join as join8, dirname as dirname2, extname } from "path";
 import { tmpdir as tmpdir2 } from "os";
 
 // src/runtime/chat.ts
@@ -329,9 +1082,9 @@ function portableLocalReceipt(value) {
 }
 
 // src/commands/run.ts
-import { mkdtemp, mkdir as mkdir2, readFile as readFile6, writeFile as writeFile3, realpath, lstat, rm, copyFile } from "fs/promises";
+import { mkdtemp, mkdir as mkdir2, readFile as readFile7, writeFile as writeFile3, realpath, lstat, rm, copyFile } from "fs/promises";
 import { tmpdir } from "os";
-import { basename as basename2, dirname, isAbsolute, join as join6, relative, resolve, sep } from "path";
+import { basename as basename2, dirname, isAbsolute, join as join7, relative as relative2, resolve, sep as sep2 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { createHash, randomUUID } from "crypto";
 
@@ -741,12 +1494,12 @@ async function stageApplication(root, files, destination) {
   for (const file of files) {
     if (isAbsolute(file) || file.includes("\\") || file.split("/").some((p) => p === ".." || /^(\.env.*|\.git|\.ssh|\.aws|\.azure|\.config|\.npmrc|\.netrc|credentials.*)$/i.test(p)) || /\.(pem|key|p12|pfx)$/i.test(file)) throw new CliError(`Unsafe application file: ${file}`, { code: EXIT.USAGE });
     const source = await realpath(resolve(canonicalRoot, file));
-    const rel = relative(canonicalRoot, source);
-    if (rel.startsWith(`..${sep}`) || rel === ".." || isAbsolute(rel) || source !== resolve(canonicalRoot, file) || !(await lstat(source)).isFile()) throw new CliError(`Files must be regular files within the project, without symlinks: ${file}`, { code: EXIT.USAGE });
-    const contents = await readFile6(source);
+    const rel = relative2(canonicalRoot, source);
+    if (rel.startsWith(`..${sep2}`) || rel === ".." || isAbsolute(rel) || source !== resolve(canonicalRoot, file) || !(await lstat(source)).isFile()) throw new CliError(`Files must be regular files within the project, without symlinks: ${file}`, { code: EXIT.USAGE });
+    const contents = await readFile7(source);
     bytes += contents.length;
     if (bytes > 20 * 1024 * 1024) throw new CliError("Application files exceed 20 MiB; supply a smaller built bundle", { code: EXIT.USAGE });
-    const target = join6(destination, file);
+    const target = join7(destination, file);
     await mkdir2(dirname(target), { recursive: true });
     await writeFile3(target, contents, { mode: 420 });
     digests[file] = createHash("sha256").update(contents).digest("hex");
@@ -757,14 +1510,14 @@ async function runWorld(cwd, opts) {
   const file = resolve(cwd, opts.file ?? "agenttwin.world.json");
   let spec;
   try {
-    spec = parseWorld(JSON.parse(await readFile6(file, "utf8")));
+    spec = parseWorld(JSON.parse(await readFile7(file, "utf8")));
   } catch (error) {
     throw new CliError(String(error), { code: EXIT.USAGE, action: "Create agenttwin.world.json; run agenttwin example --out ./agenttwin-example for a working example." });
   }
   if (spec.workflowId) {
     let inventory;
     try {
-      inventory = JSON.parse(await readFile6(join6(cwd, ".agenttwin/inventory.json"), "utf8"));
+      inventory = JSON.parse(await readFile7(join7(cwd, ".agenttwin/inventory.json"), "utf8"));
     } catch {
       throw new CliError("Linked workflow needs discovery inventory; run init first", { code: EXIT.BLOCKED });
     }
@@ -777,24 +1530,24 @@ async function runWorld(cwd, opts) {
   const runtime = opts.runtime ?? "local";
   if (!["local", "e2b", "hosted"].includes(runtime)) throw new CliError("runtime must be local, hosted or e2b", { code: EXIT.USAGE });
   if (runtime === "e2b" && !process.env.E2B_API_KEY) throw new CliError("E2B_API_KEY is not configured", { code: EXIT.BLOCKED, action: "Configure your E2B key in the shell; it will not be uploaded." });
-  const stage = await mkdtemp(join6(tmpdir(), "agenttwin-world-"));
+  const stage = await mkdtemp(join7(tmpdir(), "agenttwin-world-"));
   try {
-    const sourceDigests = await stageApplication(dirname(file), spec.files, join6(stage, "app"));
-    await writeFile3(join6(stage, "world.json"), JSON.stringify(spec), { mode: 420 });
+    const sourceDigests = await stageApplication(dirname(file), spec.files, join7(stage, "app"));
+    await writeFile3(join7(stage, "world.json"), JSON.stringify(spec), { mode: 420 });
     const git = await captureGit(cwd);
     let project;
     try {
-      project = JSON.parse(await readFile6(join6(cwd, ".agenttwin/inventory.json"), "utf8")).name ?? basename2(cwd);
+      project = JSON.parse(await readFile7(join7(cwd, ".agenttwin/inventory.json"), "utf8")).name ?? basename2(cwd);
     } catch {
     }
     if (runtime === "local") {
       opts.log("Testing through the CLI with in-process service twins. No cloud VM or containers.");
-      const report2 = await executeLocal(join6(stage, "app"), spec, opts.signal);
+      const report2 = await executeLocal(join7(stage, "app"), spec, opts.signal);
       const runId2 = randomUUID();
       const receipt2 = { ...report2, runId: runId2, runtime, project, git, createdAt: (/* @__PURE__ */ new Date()).toISOString(), sourceDigests, specDigest: createHash("sha256").update(JSON.stringify(spec)).digest("hex"), provenance: "CLI-reported execution" };
       const out2 = resolve(cwd, opts.out ?? `.agenttwin/runs/${runId2}`);
       await mkdir2(out2, { recursive: true });
-      const evidencePath = join6(out2, "run.json"), reportPath = join6(out2, "report.md");
+      const evidencePath = join7(out2, "run.json"), reportPath = join7(out2, "report.md");
       await writeFile3(evidencePath, JSON.stringify(receipt2, null, 2) + "\n", { mode: 384 });
       await writeFile3(reportPath, `# ${spec.name}: ${receipt2.status}
 
@@ -804,8 +1557,8 @@ Git: ${git?.head ?? "unavailable"}
 ` + receipt2.assertions.map((a) => `- ${a.passed ? "PASS" : "FAIL"} ${a.service}${a.path}: expected ${a.count}, observed ${a.actual}`).join("\n") + "\n\nSee run.json for activities, fault and initial/final state.\n");
       return { ...receipt2, reportPath, evidencePath };
     }
-    const worker = join6(dirname(fileURLToPath2(import.meta.url)), "worker.js");
-    await copyFile(worker, join6(stage, "worker.js"));
+    const worker = join7(dirname(fileURLToPath2(import.meta.url)), "worker.js");
+    await copyFile(worker, join7(stage, "worker.js"));
     if (runtime === "hosted") {
       const receipt2 = await executeRemote(stage, spec, opts.log, { git, project });
       if (receipt2.schema !== "agenttwin/run-v1" || typeof receipt2.runId !== "string" || !/^[a-f0-9-]{36}$/.test(receipt2.runId) || !["passed", "failed", "error", "incomplete"].includes(String(receipt2.status))) throw new CliError("Invalid hosted receipt");
@@ -814,8 +1567,8 @@ Git: ${git?.head ?? "unavailable"}
       if (receipt2.specDigest !== expectedSpec || !reportedSources || Object.keys(reportedSources).length !== Object.keys(sourceDigests).length || Object.entries(sourceDigests).some(([path, digest]) => reportedSources[path] !== digest)) throw new CliError("Hosted receipt does not match the submitted source/specification");
       const out2 = resolve(cwd, opts.out ?? `.agenttwin/runs/${receipt2.runId}`);
       await mkdir2(out2, { recursive: true });
-      const evidencePath = join6(out2, "run.json");
-      const reportPath = join6(out2, "report.md");
+      const evidencePath = join7(out2, "run.json");
+      const reportPath = join7(out2, "report.md");
       await writeFile3(evidencePath, JSON.stringify(receipt2, null, 2) + "\n", { mode: 384 });
       await writeFile3(reportPath, `# ${spec.name}: ${receipt2.status}
 
@@ -852,11 +1605,11 @@ See run.json for assertions, service state, application output and isolation met
     };
     const out = resolve(cwd, opts.out ?? `.agenttwin/runs/${runId}`);
     await mkdir2(out, { recursive: true });
-    await writeFile3(join6(out, "run.json"), JSON.stringify(receipt, null, 2) + "\n", { mode: 384 });
-    await writeFile3(join6(out, "world.json"), JSON.stringify(spec, null, 2) + "\n", { mode: 384 });
+    await writeFile3(join7(out, "run.json"), JSON.stringify(receipt, null, 2) + "\n", { mode: 384 });
+    await writeFile3(join7(out, "world.json"), JSON.stringify(spec, null, 2) + "\n", { mode: 384 });
     const summary = [`# ${spec.name}: ${report.status}`, "", `Run: ${runId}`, `Image: ${image}`, "", "## Assertions", "", ...report.assertions.map((a) => `- ${a.passed ? "PASS" : "FAIL"} ${a.service}${a.path}: expected ${a.count}, observed ${a.actual}`), "", "## Infrastructure assertions", "", ...(report.infrastructureAssertions ?? []).map((a) => `- ${a.passed ? "PASS" : "FAIL"} ${a.service}: ${JSON.stringify(a.actual)}`), "", "## Coverage", "", report.coverage, "", "External networking disabled. Only explicitly listed source files were uploaded. New state and tokens are created for each run.", "", "See run.json for application output, faults, events, and initial/final state.", ""].join("\n");
-    await writeFile3(join6(out, "report.md"), summary);
-    return { ...receipt, reportPath: join6(out, "report.md"), evidencePath: join6(out, "run.json") };
+    await writeFile3(join7(out, "report.md"), summary);
+    return { ...receipt, reportPath: join7(out, "report.md"), evidencePath: join7(out, "run.json") };
   } finally {
     await rm(stage, { recursive: true, force: true });
   }
@@ -898,10 +1651,10 @@ async function startGateway(opts) {
   const chatControllers = /* @__PURE__ */ new Map();
   const directory = resolve2(opts.directory);
   await mkdir3(directory, { recursive: true, mode: 448 });
-  const storePath = join7(directory, "state.json");
+  const storePath = join8(directory, "state.json");
   let store;
   try {
-    store = JSON.parse(await readFile7(storePath, "utf8"));
+    store = JSON.parse(await readFile8(storePath, "utf8"));
     if (store.schema !== "agenttwin/gateway-v1") throw new Error("Invalid store");
   } catch (error) {
     if (error.code !== "ENOENT") throw error;
@@ -916,7 +1669,7 @@ async function startGateway(opts) {
   const save = () => {
     const snapshot = JSON.stringify(store);
     writes = writes.then(async () => {
-      const path = join7(directory, `state-${randomUUID2()}.tmp`);
+      const path = join8(directory, `state-${randomUUID2()}.tmp`);
       await writeFile4(path, snapshot, { mode: 384 });
       await rename(path, storePath);
     }).catch((error) => {
@@ -951,16 +1704,16 @@ async function startGateway(opts) {
           if (!store.accounts.some((a) => a.id === item.job.accountId && a.active)) throw new Error("Account revoked before execution");
           item.job.status = "running";
           await save();
-          workspace = await mkdtemp2(join7(tmpdir2(), "agenttwin-api-run-"));
+          workspace = await mkdtemp2(join8(tmpdir2(), "agenttwin-api-run-"));
           for (const [file, encoded] of Object.entries(item.files)) {
-            const destination = join7(workspace, uploadPath(file));
+            const destination = join8(workspace, uploadPath(file));
             await mkdir3(dirname2(destination), { recursive: true });
             await writeFile4(destination, Buffer.from(encoded, "base64"), { mode: 384 });
           }
-          await writeFile4(join7(workspace, "agenttwin.world.json"), JSON.stringify(item.spec));
+          await writeFile4(join8(workspace, "agenttwin.world.json"), JSON.stringify(item.spec));
           if (item.spec.workflowId) {
-            await mkdir3(join7(workspace, ".agenttwin"));
-            await writeFile4(join7(workspace, ".agenttwin/inventory.json"), JSON.stringify({ workflows: [{ id: item.spec.workflowId }] }));
+            await mkdir3(join8(workspace, ".agenttwin"));
+            await writeFile4(join8(workspace, ".agenttwin/inventory.json"), JSON.stringify({ workflows: [{ id: item.spec.workflowId }] }));
           }
           const receipt = await runWorld(workspace, { runtime: "e2b", signal: controllers.get(item.job.id)?.signal, log: () => {
           } });
@@ -998,14 +1751,14 @@ async function startGateway(opts) {
           res.end();
           return;
         }
-        const relative2 = decodeURIComponent(path.slice("/dashboard/".length)) || "index.html";
-        const root = resolve2(opts.dashboardDirectory), file = resolve2(root, relative2);
-        if (!file.startsWith(root + "/") || relative2 !== "index.html" && !relative2.startsWith("assets/")) {
+        const relative3 = decodeURIComponent(path.slice("/dashboard/".length)) || "index.html";
+        const root = resolve2(opts.dashboardDirectory), file = resolve2(root, relative3);
+        if (!file.startsWith(root + "/") || relative3 !== "index.html" && !relative3.startsWith("assets/")) {
           send(res, 404, { error: "not_found" });
           return;
         }
         try {
-          const bytes = await readFile7(file);
+          const bytes = await readFile8(file);
           const types = { ".html": "text/html; charset=utf-8", ".js": "text/javascript; charset=utf-8", ".css": "text/css; charset=utf-8", ".json": "application/json", ".svg": "image/svg+xml", ".png": "image/png", ".jpg": "image/jpeg", ".ico": "image/x-icon", ".woff2": "font/woff2" };
           res.writeHead(200, { "content-type": types[extname(file)] ?? "application/octet-stream", "cache-control": "no-store", "x-content-type-options": "nosniff", "referrer-policy": "no-referrer" });
           res.end(bytes);
@@ -1147,7 +1900,7 @@ async function startGateway(opts) {
         return;
       }
       if (path === "/v1/runs" && req.method === "GET") {
-        send(res, 200, { jobs: store.jobs.filter((j) => j.accountId === account.id).slice(-100).reverse().map(({ id, status, createdAt }) => ({ id, status, createdAt })) });
+        send(res, 200, { jobs: store.jobs.filter((j) => j.accountId === account.id).sort((a, b) => Date.parse(b.createdAt) - Date.parse(a.createdAt)).slice(0, 100).map(({ id, status, createdAt }) => ({ id, status, createdAt })) });
         return;
       }
       if (path === "/v1/runs" && req.method === "POST") {