autoremediator 0.18.0 → 0.19.0

package/dist/index.js

@@ -65,7 +65,10 @@ var OPTION_DESCRIPTIONS = {
   campaignMode: "Enable portfolio campaign mode to risk-rank targets before execution",
   escalationGraph: "Optional mapping from unresolved reasons to intended escalation actions",
   offlineIntelligence: "Skip all network calls to intelligence sources. Only local inventory and npm-registry version resolution proceed.",
-  intelligenceSnapshotPath: "Path to a local JSON snapshot of pre-fetched CVE intelligence (keyed by CVE ID) used when offline mode is active."
+  intelligenceSnapshotPath: "Path to a local JSON snapshot of pre-fetched CVE intelligence (keyed by CVE ID) used when offline mode is active.",
+  proofOfFix: "If true, enforce dual-stage exploit reproduction proof-of-fix verification (assert failure pre-patch, assert pass post-patch)",
+  requireProofOfFix: "If true, reject patches and roll back if proof-of-fix verification fails",
+  breakingChangeRefactor: "If true, attempt agentic call-site refactoring when major version upgrades introduce breaking API changes"
 };
 function createConstraintSchemaProperties() {
   return {
@@ -87,7 +90,12 @@ function createConstraintSchemaProperties() {
       type: "boolean",
       description: OPTION_DESCRIPTIONS.enforceFrozenLockfile
     },
-    workspace: { type: "string", description: OPTION_DESCRIPTIONS.workspace }
+    workspace: { type: "string", description: OPTION_DESCRIPTIONS.workspace },
+    requireProofOfFix: { type: "boolean", description: OPTION_DESCRIPTIONS.requireProofOfFix },
+    enableBreakingChangeRefactor: {
+      type: "boolean",
+      description: OPTION_DESCRIPTIONS.breakingChangeRefactor
+    }
   };
 }
 function createRemediateOptionSchemaProperties(options) {
@@ -306,6 +314,14 @@ function createRemediateOptionSchemaProperties(options) {
         "validation-failed": {
           type: "string",
           enum: ["open-issue", "notify-channel", "create-draft-pr", "hold-branch", "none"]
+        },
+        "proof-of-fix-failed": {
+          type: "string",
+          enum: ["open-issue", "notify-channel", "create-draft-pr", "hold-branch", "none"]
+        },
+        "breaking-change-unresolved": {
+          type: "string",
+          enum: ["open-issue", "notify-channel", "create-draft-pr", "hold-branch", "none"]
         }
       },
       additionalProperties: false
@@ -314,6 +330,12 @@ function createRemediateOptionSchemaProperties(options) {
     intelligenceSnapshotPath: {
       type: "string",
       description: OPTION_DESCRIPTIONS.intelligenceSnapshotPath
+    },
+    proofOfFix: { type: "boolean", description: OPTION_DESCRIPTIONS.proofOfFix },
+    requireProofOfFix: { type: "boolean", description: OPTION_DESCRIPTIONS.requireProofOfFix },
+    breakingChangeRefactor: {
+      type: "boolean",
+      description: OPTION_DESCRIPTIONS.breakingChangeRefactor
     }
   };
 }
@@ -3128,7 +3150,13 @@ function assessPackageReachability(cwd, packageName, targetSymbol) {
     } catch {
       continue;
     }
-    const refs = extractPackageReferences(filePath, content, packageName, tsconfig, importedDirectPackages);
+    const refs = extractPackageReferences(
+      filePath,
+      content,
+      packageName,
+      tsconfig,
+      importedDirectPackages
+    );
     if (refs.length > 0) {
       hasPackageImport = true;
     }
@@ -3362,8 +3390,8 @@ function buildSbom(packages, vulnerableNames, results) {
 
 // src/remediation/tools/apply-version-bump.ts
 import { z as z4 } from "zod";
-import { join as join14 } from "path";
-import { readFileSync as readFileSync11, writeFileSync as writeFileSync3 } from "fs";
+import { join as join15 } from "path";
+import { readFileSync as readFileSync13, writeFileSync as writeFileSync4 } from "fs";
 
 // src/platform/safe-exec.ts
 import { execa as execa6 } from "execa";
@@ -3429,7 +3457,7 @@ import semver3 from "semver";
 import { mkdir, rm as rm2 } from "fs/promises";
 import { join as join13 } from "path";
 async function sleep(ms) {
-  await new Promise((resolve5) => setTimeout(resolve5, ms));
+  await new Promise((resolve6) => setTimeout(resolve6, ms));
 }
 async function acquireRepoLock(cwd, options = {}) {
   const timeoutMs = options.timeoutMs ?? 15e3;
@@ -3464,6 +3492,380 @@ async function withRepoLock(cwd, fn, options) {
   }
 }
 
+// src/remediation/refactor/call-site-finder.ts
+import { readdirSync as readdirSync3, readFileSync as readFileSync11, statSync as statSync3 } from "fs";
+import { join as join14 } from "path";
+import { parseSync as parseSync2 } from "oxc-parser";
+var SOURCE_EXTENSIONS2 = /* @__PURE__ */ new Set([".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs", ".mts", ".cts"]);
+var IGNORED_DIRS2 = /* @__PURE__ */ new Set([
+  "node_modules",
+  ".git",
+  "dist",
+  "build",
+  "coverage",
+  ".next",
+  ".turbo",
+  ".pnpm-store"
+]);
+function* walkFiles(dir) {
+  let entries;
+  try {
+    entries = readdirSync3(dir);
+  } catch {
+    return;
+  }
+  for (const entry of entries) {
+    if (IGNORED_DIRS2.has(entry)) continue;
+    const full = join14(dir, entry);
+    let stat2;
+    try {
+      stat2 = statSync3(full);
+    } catch {
+      continue;
+    }
+    if (stat2.isDirectory()) {
+      yield* walkFiles(full);
+    } else {
+      const ext = full.slice(full.lastIndexOf("."));
+      if (SOURCE_EXTENSIONS2.has(ext)) {
+        yield full;
+      }
+    }
+  }
+}
+function findPackageCallSites(cwd, packageName) {
+  const callSites = [];
+  for (const filePath of walkFiles(cwd)) {
+    let content;
+    try {
+      content = readFileSync11(filePath, "utf8");
+    } catch {
+      continue;
+    }
+    if (!content.includes(packageName)) {
+      continue;
+    }
+    try {
+      const parseResult = parseSync2(filePath, content);
+      if (!parseResult.program) continue;
+      const program = parseResult.program;
+      const imports = [];
+      const importSources = [];
+      const localNames = /* @__PURE__ */ new Set();
+      for (const statement of program.body) {
+        if (statement.type === "ImportDeclaration" && statement.source?.value) {
+          const importSource = statement.source.value;
+          if (importSource === packageName || importSource.startsWith(`${packageName}/`)) {
+            importSources.push(importSource);
+            for (const spec of statement.specifiers || []) {
+              const localName = spec.local?.name || "";
+              if (!localName) continue;
+              localNames.add(localName);
+              if (spec.type === "ImportDefaultSpecifier") {
+                imports.push({
+                  localName,
+                  importedName: "default",
+                  isDefault: true,
+                  isNamespace: false
+                });
+              } else if (spec.type === "ImportNamespaceSpecifier") {
+                imports.push({
+                  localName,
+                  importedName: "*",
+                  isDefault: false,
+                  isNamespace: true
+                });
+              } else if (spec.type === "ImportSpecifier") {
+                imports.push({
+                  localName,
+                  importedName: spec.imported?.name || localName,
+                  isDefault: false,
+                  isNamespace: false
+                });
+              }
+            }
+          }
+        }
+      }
+      if (imports.length > 0 || importSources.length > 0) {
+        const lines = content.split("\n");
+        const referencedLines = [];
+        lines.forEach((line, index) => {
+          for (const local of localNames) {
+            const regex = new RegExp(`\\b${local}\\b`);
+            if (regex.test(line)) {
+              referencedLines.push(index + 1);
+              break;
+            }
+          }
+        });
+        callSites.push({
+          filePath,
+          sourceContent: content,
+          importSources,
+          imports,
+          referencedLines
+        });
+      }
+    } catch {
+    }
+  }
+  return callSites;
+}
+
+// src/remediation/refactor/refactor-agent.ts
+import { readFileSync as readFileSync12, writeFileSync as writeFileSync3 } from "fs";
+function parseCompilerDiagnostics(diagnosticError) {
+  const diagnostics = [];
+  const lines = diagnosticError.split("\n");
+  for (const line of lines) {
+    const trimmed = line.trim();
+    if (!trimmed) continue;
+    const match = trimmed.match(
+      /(?:([^\s:(]+)[:(](\d+)[:,](\d+)\)?:?\s*(?:-\s*)?(?:error\s+)?(TS\d+)?:?\s*(.*))/i
+    );
+    if (match) {
+      const [, filePath, lineStr, colStr, code, message] = match;
+      const diag = {
+        filePath,
+        line: lineStr ? parseInt(lineStr, 10) : void 0,
+        column: colStr ? parseInt(colStr, 10) : void 0,
+        code,
+        message: message || trimmed
+      };
+      const suggestionMatch = diag.message.match(/Did you mean ['"]([a-zA-Z0-9_$]+)['"]\?/i);
+      if (suggestionMatch) {
+        diag.suggestedSymbol = suggestionMatch[1];
+      }
+      const missingMatch = diag.message.match(/has no exported member ['"]([a-zA-Z0-9_$]+)['"]/i) || diag.message.match(/Property ['"]([a-zA-Z0-9_$]+)['"] does not exist/i);
+      if (missingMatch) {
+        diag.missingMember = missingMatch[1];
+      }
+      diagnostics.push(diag);
+    }
+  }
+  return diagnostics;
+}
+function revertRefactorSnapshots(snapshots) {
+  for (const [filePath, content] of Object.entries(snapshots)) {
+    try {
+      writeFileSync3(filePath, content, "utf8");
+    } catch {
+    }
+  }
+}
+var KNOWN_MIGRATIONS = {
+  rimraf: [
+    {
+      detect: (content, diag) => diag.includes("sync") && content.includes("rimraf.sync("),
+      transform: (content) => {
+        let res = content.replace(/import\s+rimraf\s+from\s+['"]rimraf['"];?/g, "");
+        res = `import { rimrafSync } from "rimraf";
+` + res;
+        return res.replace(/rimraf\.sync\(/g, "rimrafSync(");
+      }
+    }
+  ],
+  uuid: [
+    {
+      detect: (content, diag) => diag.includes("v4") && content.includes("uuid.v4("),
+      transform: (content) => {
+        let res = content.replace(/import\s+uuid\s+from\s+['"]uuid['"];?/g, "");
+        res = `import { v4 as uuidv4 } from "uuid";
+` + res;
+        return res.replace(/uuid\.v4\(/g, "uuidv4(");
+      }
+    },
+    {
+      // Subpath import migration: `import v4 from "uuid/v4"` -> `import { v4 } from "uuid"`
+      detect: (content) => /from\s+['"]uuid\/v4['"]/.test(content),
+      transform: (content) => content.replace(
+        /import\s+([a-zA-Z0-9_$]+)\s+from\s+['"]uuid\/v4['"];?/g,
+        `import { v4 as $1 } from "uuid";`
+      )
+    }
+  ],
+  glob: [
+    {
+      detect: (content, diag) => diag.includes("sync") && content.includes("glob.sync("),
+      transform: (content) => {
+        let res = content.replace(/import\s+glob\s+from\s+['"]glob['"];?/g, "");
+        res = `import { globSync } from "glob";
+` + res;
+        return res.replace(/glob\.sync\(/g, "globSync(");
+      }
+    }
+  ],
+  mkdirp: [
+    {
+      detect: (content, diag) => diag.includes("sync") && content.includes("mkdirp.sync("),
+      transform: (content) => {
+        let res = content.replace(/import\s+mkdirp\s+from\s+['"]mkdirp['"];?/g, "");
+        res = `import { mkdirpSync } from "mkdirp";
+` + res;
+        return res.replace(/mkdirp\.sync\(/g, "mkdirpSync(");
+      }
+    }
+  ]
+};
+function escapeRegex(str) {
+  return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function transformFileContent(content, packageName, diagnosticError, filePath) {
+  let modified = false;
+  let newContent = content;
+  const migrations = KNOWN_MIGRATIONS[packageName];
+  if (migrations) {
+    for (const mig of migrations) {
+      if (mig.detect(newContent, diagnosticError)) {
+        const transformed = mig.transform(newContent);
+        if (transformed !== newContent) {
+          newContent = transformed;
+          modified = true;
+        }
+      }
+    }
+  }
+  if (diagnosticError.includes("no default export") || diagnosticError.includes("has no exported member 'default'") || diagnosticError.includes("has no exported member default") || diagnosticError.includes("TS2614") || diagnosticError.includes("TS1192")) {
+    const defaultImportRegex = new RegExp(
+      `import\\s+([a-zA-Z0-9_$]+)\\s+from\\s+['"]${escapeRegex(packageName)}['"]`,
+      "g"
+    );
+    if (defaultImportRegex.test(newContent)) {
+      newContent = newContent.replace(
+        defaultImportRegex,
+        `import * as $1 from "${packageName}"`
+      );
+      modified = true;
+    }
+  }
+  if (diagnosticError.includes("can only be used with a default import") || diagnosticError.includes("only be used with a default import") || diagnosticError.includes("TS1259")) {
+    const starImportRegex = new RegExp(
+      `import\\s+\\*\\s+as\\s+([a-zA-Z0-9_$]+)\\s+from\\s+['"]${escapeRegex(packageName)}['"]`,
+      "g"
+    );
+    if (starImportRegex.test(newContent)) {
+      newContent = newContent.replace(
+        starImportRegex,
+        `import $1 from "${packageName}"`
+      );
+      modified = true;
+    }
+  }
+  const diagnostics = parseCompilerDiagnostics(diagnosticError);
+  for (const diag of diagnostics) {
+    if (diag.missingMember && diag.suggestedSymbol) {
+      const missingMember = diag.missingMember;
+      const suggestedSymbol = diag.suggestedSymbol;
+      if (filePath && diag.filePath && filePath.endsWith(diag.filePath) && diag.line && diag.line > 0) {
+        const fileLines = newContent.split("\n");
+        const idx = diag.line - 1;
+        if (idx >= 0 && idx < fileLines.length) {
+          const line = fileLines[idx];
+          const replaced = line.replace(new RegExp(`\\.${escapeRegex(missingMember)}\\b`, "g"), `.${suggestedSymbol}`).replace(new RegExp(`\\b${escapeRegex(missingMember)}\\b`, "g"), suggestedSymbol);
+          if (replaced !== line) {
+            fileLines[idx] = replaced;
+            newContent = fileLines.join("\n");
+            modified = true;
+          }
+        }
+      } else {
+        const memberRegex = new RegExp(`\\.${escapeRegex(missingMember)}\\b`, "g");
+        if (memberRegex.test(newContent)) {
+          newContent = newContent.replace(memberRegex, `.${suggestedSymbol}`);
+          modified = true;
+        }
+        const importPattern = new RegExp(
+          `import\\s*\\{[^}]*\\b${escapeRegex(missingMember)}\\b[^}]*\\}\\s*from\\s*['"]${escapeRegex(packageName)}['"]`,
+          "g"
+        );
+        if (importPattern.test(newContent)) {
+          newContent = newContent.replace(
+            importPattern,
+            (match) => match.replace(new RegExp(`\\b${escapeRegex(missingMember)}\\b`, "g"), suggestedSymbol)
+          );
+          modified = true;
+        }
+      }
+    }
+  }
+  const lineDiags = diagnostics.filter(
+    (d) => Boolean(filePath && d.filePath && filePath.endsWith(d.filePath) && typeof d.line === "number" && d.line > 0)
+  ).sort((a, b) => b.line - a.line);
+  const processedLines = /* @__PURE__ */ new Set();
+  for (const diag of lineDiags) {
+    if (processedLines.has(diag.line)) continue;
+    processedLines.add(diag.line);
+    const fileLines = newContent.split("\n");
+    const targetLineIdx = diag.line - 1;
+    if (targetLineIdx >= 0 && targetLineIdx < fileLines.length) {
+      const prevLine = targetLineIdx > 0 ? fileLines[targetLineIdx - 1] : "";
+      if (!prevLine?.includes("@ts-expect-error") && !fileLines[targetLineIdx]?.includes("@ts-expect-error")) {
+        const indent = fileLines[targetLineIdx]?.match(/^\s*/)?.[0] || "";
+        fileLines.splice(
+          targetLineIdx,
+          0,
+          `${indent}// @ts-expect-error [autoremediator-refactor]: breaking change in ${packageName}`
+        );
+        newContent = fileLines.join("\n");
+        modified = true;
+      }
+    }
+  }
+  return { modified, newContent };
+}
+async function refactorConsumerCallSites(params) {
+  const { packageName, diagnosticError, callSites } = params;
+  if (callSites.length === 0) {
+    return {
+      applied: false,
+      refactoredFiles: [],
+      snapshots: {},
+      error: `No consumer call sites found for "${packageName}".`
+    };
+  }
+  const snapshots = {};
+  const refactoredFiles = [];
+  try {
+    for (const site of callSites) {
+      const originalContent = site.sourceContent || readFileSync12(site.filePath, "utf8");
+      snapshots[site.filePath] = originalContent;
+      const { modified, newContent } = transformFileContent(
+        originalContent,
+        packageName,
+        diagnosticError,
+        site.filePath
+      );
+      if (modified && newContent !== originalContent) {
+        writeFileSync3(site.filePath, newContent, "utf8");
+        refactoredFiles.push(site.filePath);
+      }
+    }
+    if (refactoredFiles.length === 0) {
+      return {
+        applied: false,
+        refactoredFiles: [],
+        snapshots,
+        error: "No automated codemod pattern matched the diagnostic error."
+      };
+    }
+    return {
+      applied: true,
+      refactoredFiles,
+      snapshots
+    };
+  } catch (err) {
+    revertRefactorSnapshots(snapshots);
+    const message = err instanceof Error ? err.message : String(err);
+    return {
+      applied: false,
+      refactoredFiles: [],
+      snapshots: {},
+      error: `Failed to apply breaking change refactoring: ${message}`
+    };
+  }
+}
+
 // src/remediation/tools/apply-version-bump.ts
 var applyVersionBumpTool = defineTool({
   description: "Update package.json to use the safe version of a vulnerable package and run the project's package manager install. In dry-run mode, only reports what would change.",
@@ -3480,7 +3882,8 @@ var applyVersionBumpTool = defineTool({
     installMode: z4.enum(["standard", "prefer-offline", "deterministic"]).optional(),
     installPreferOffline: z4.boolean().optional(),
     enforceFrozenLockfile: z4.boolean().optional(),
-    workspace: z4.string().optional()
+    workspace: z4.string().optional(),
+    breakingChangeRefactor: z4.boolean().optional().describe("If true, attempt agentic call-site refactoring when validation fails after major upgrade")
   }),
   execute: async ({
     cwd,
@@ -3495,10 +3898,11 @@ var applyVersionBumpTool = defineTool({
     installMode,
     installPreferOffline,
     enforceFrozenLockfile,
-    workspace
+    workspace,
+    breakingChangeRefactor
   }) => {
     const pm = packageManager ?? detectPackageManager(cwd);
-    let pkgPath = join14(cwd, "package.json");
+    let pkgPath = join15(cwd, "package.json");
     const loadedPolicy = loadPolicy(cwd, policy);
     const commandConstraints = {
       ...loadedPolicy.constraints,
@@ -3533,10 +3937,10 @@ var applyVersionBumpTool = defineTool({
         message: `Policy blocked major bump for "${packageName}" (${fromVersion} -> ${toVersion}).`
       };
     }
-    pkgPath = join14(cwd, "package.json");
+    pkgPath = join15(cwd, "package.json");
     let pkgJson;
     try {
-      pkgJson = JSON.parse(readFileSync11(pkgPath, "utf8"));
+      pkgJson = JSON.parse(readFileSync13(pkgPath, "utf8"));
     } catch {
       return {
         packageName,
@@ -3597,7 +4001,7 @@ var applyVersionBumpTool = defineTool({
     }
     return withRepoLock(cwd, async () => {
       pkgJson[depField][packageName] = newRange;
-      writeFileSync3(pkgPath, JSON.stringify(pkgJson, null, 2) + "\n", "utf8");
+      writeFileSync4(pkgPath, JSON.stringify(pkgJson, null, 2) + "\n", "utf8");
       try {
         const [installCmd, ...installArgs] = effectiveInstallCommand;
         await safeExeca(installCmd, installArgs, {
@@ -3606,7 +4010,7 @@ var applyVersionBumpTool = defineTool({
         });
       } catch (err) {
         pkgJson[depField][packageName] = currentRange;
-        writeFileSync3(pkgPath, JSON.stringify(pkgJson, null, 2) + "\n", "utf8");
+        writeFileSync4(pkgPath, JSON.stringify(pkgJson, null, 2) + "\n", "utf8");
         const message = err instanceof Error ? err.message : String(err);
         return {
           packageName,
@@ -3619,67 +4023,98 @@ var applyVersionBumpTool = defineTool({
           message: `${effectiveInstallCommand.join(" ")} failed after updating "${packageName}" to ${toVersion}. Reverted. Error: ${message}`
         };
       }
-      if (runTests) {
-        try {
-          const [testCmd, ...testArgs] = effectiveTestCommand;
-          await safeExeca(testCmd, testArgs, {
-            cwd,
-            stdio: "pipe"
-          });
-        } catch (err) {
-          pkgJson[depField][packageName] = currentRange;
-          writeFileSync3(pkgPath, JSON.stringify(pkgJson, null, 2) + "\n", "utf8");
+      const shouldAttemptRefactor = Boolean(
+        breakingChangeRefactor ?? loadedPolicy.constraints?.enableBreakingChangeRefactor
+      );
+      async function runValidationSteps() {
+        if (runTests) {
           try {
-            const [rollbackCmd, ...rollbackArgs] = effectiveInstallCommand;
-            await safeExeca(rollbackCmd, rollbackArgs, {
-              cwd,
-              stdio: "pipe"
-            });
-          } catch {
+            const [testCmd, ...testArgs] = effectiveTestCommand;
+            await safeExeca(testCmd, testArgs, { cwd, stdio: "pipe" });
+          } catch (err) {
+            const execErr = err;
+            const fullOutput = [execErr.stdout, execErr.stderr, execErr.message].filter(Boolean).join("\n");
+            return {
+              passed: false,
+              error: fullOutput || (err instanceof Error ? err.message : String(err))
+            };
           }
-          const message = err instanceof Error ? err.message : String(err);
-          return {
+        }
+        if (shouldTypecheck && effectiveTypecheckCommand.length > 0) {
+          try {
+            const [tcCmd, ...tcArgs] = effectiveTypecheckCommand;
+            await safeExeca(tcCmd, tcArgs, { cwd, stdio: "pipe" });
+          } catch (err) {
+            const execErr = err;
+            const fullOutput = [execErr.stdout, execErr.stderr, execErr.message].filter(Boolean).join("\n");
+            return {
+              passed: false,
+              isTypecheck: true,
+              error: fullOutput || (err instanceof Error ? err.message : String(err))
+            };
+          }
+        }
+        return { passed: true };
+      }
+      let validationResult = await runValidationSteps();
+      let refactoredFilesList;
+      if (!validationResult.passed && shouldAttemptRefactor) {
+        const callSites = findPackageCallSites(cwd, packageName);
+        if (callSites.length > 0) {
+          const refactorAttempt = await refactorConsumerCallSites({
+            cwd,
             packageName,
-            strategy: "version-bump",
             fromVersion,
             toVersion,
-            applied: false,
-            dryRun: false,
-            unresolvedReason: "validation-failed",
-            message: `${effectiveTestCommand.join(" ")} failed after upgrading "${packageName}" to ${toVersion}. Rolled back to ${currentRange}. Error: ${message}`
-          };
+            diagnosticError: validationResult.error || "",
+            callSites
+          });
+          if (refactorAttempt.applied) {
+            const postRefactorValidation = await runValidationSteps();
+            if (postRefactorValidation.passed) {
+              validationResult = { passed: true };
+              refactoredFilesList = refactorAttempt.refactoredFiles;
+            } else {
+              revertRefactorSnapshots(refactorAttempt.snapshots);
+            }
+          }
         }
       }
-      if (shouldTypecheck && effectiveTypecheckCommand.length > 0) {
+      if (!validationResult.passed) {
+        pkgJson[depField][packageName] = currentRange;
+        writeFileSync4(pkgPath, JSON.stringify(pkgJson, null, 2) + "\n", "utf8");
         try {
-          const [tcCmd, ...tcArgs] = effectiveTypecheckCommand;
-          await safeExeca(tcCmd, tcArgs, {
+          const [rollbackCmd, ...rollbackArgs] = effectiveInstallCommand;
+          await safeExeca(rollbackCmd, rollbackArgs, {
             cwd,
             stdio: "pipe"
           });
-        } catch (err) {
-          pkgJson[depField][packageName] = currentRange;
-          writeFileSync3(pkgPath, JSON.stringify(pkgJson, null, 2) + "\n", "utf8");
-          try {
-            const [rollbackCmd, ...rollbackArgs] = effectiveInstallCommand;
-            await safeExeca(rollbackCmd, rollbackArgs, {
-              cwd,
-              stdio: "pipe"
-            });
-          } catch {
-          }
-          const message = err instanceof Error ? err.message : String(err);
-          return {
-            packageName,
-            strategy: "version-bump",
-            fromVersion,
-            toVersion,
-            applied: false,
-            dryRun: false,
-            unresolvedReason: "validation-failed",
-            message: `TypeCheck validation failed (${effectiveTypecheckCommand.join(" ")}) after upgrading "${packageName}" to ${toVersion}. Rolled back to ${currentRange}. Error: ${message}`
-          };
+        } catch {
         }
+        const failureMessage = validationResult.error || "Unknown validation error";
+        const prefix2 = validationResult.isTypecheck ? `TypeCheck validation failed (${effectiveTypecheckCommand.join(" ")})` : `${effectiveTestCommand.join(" ")} failed`;
+        return {
+          packageName,
+          strategy: "version-bump",
+          fromVersion,
+          toVersion,
+          applied: false,
+          dryRun: false,
+          unresolvedReason: shouldAttemptRefactor ? "breaking-change-unresolved" : "validation-failed",
+          message: `${prefix2} after upgrading "${packageName}" to ${toVersion}. Rolled back to ${currentRange}. Error: ${failureMessage}`
+        };
+      }
+      if (refactoredFilesList && refactoredFilesList.length > 0) {
+        return {
+          packageName,
+          strategy: "breaking-change-refactor",
+          fromVersion,
+          toVersion,
+          applied: true,
+          dryRun: false,
+          refactoredFiles: refactoredFilesList,
+          message: `Upgraded "${packageName}" from ${fromVersion} to ${toVersion} and refactored ${refactoredFilesList.length} call-site file(s) across breaking API changes.`
+        };
       }
       let dedupeNote = "";
       if (effectiveDedupeCommand.length > 0) {
@@ -3709,8 +4144,8 @@ var applyVersionBumpTool = defineTool({
 
 // src/remediation/tools/apply-package-override/index.ts
 import { z as z5 } from "zod";
-import { join as join15 } from "path";
-import { existsSync as existsSync11, readFileSync as readFileSync12, writeFileSync as writeFileSync4 } from "fs";
+import { join as join16 } from "path";
+import { existsSync as existsSync12, readFileSync as readFileSync14, writeFileSync as writeFileSync5 } from "fs";
 import semver4 from "semver";
 
 // src/remediation/tools/apply-package-override/helpers.ts
@@ -3853,9 +4288,9 @@ var applyPackageOverrideTool = defineTool({
     workspace
   }) => {
     const pm = packageManager ?? detectPackageManager(cwd);
-    const pkgPath = join15(cwd, "package.json");
-    const denoJsonPath = join15(cwd, "deno.json");
-    const isDenoNative = pm === "deno" && !existsSync11(pkgPath);
+    const pkgPath = join16(cwd, "package.json");
+    const denoJsonPath = join16(cwd, "deno.json");
+    const isDenoNative = pm === "deno" && !existsSync12(pkgPath);
     const loadedPolicy = loadPolicy(cwd, policy);
     const commandConstraints = {
       ...loadedPolicy.constraints,
@@ -3897,7 +4332,7 @@ var applyPackageOverrideTool = defineTool({
     if (isDenoNative) {
       let denoJson;
       try {
-        denoJson = JSON.parse(readFileSync12(denoJsonPath, "utf8"));
+        denoJson = JSON.parse(readFileSync14(denoJsonPath, "utf8"));
       } catch {
         return {
           packageName,
@@ -3943,13 +4378,13 @@ var applyPackageOverrideTool = defineTool({
       }
       return withRepoLock(cwd, async () => {
         setDenoJsonImportValue(denoJson, overrideSelector, toVersion);
-        writeFileSync4(denoJsonPath, JSON.stringify(denoJson, null, 2) + "\n", "utf8");
+        writeFileSync5(denoJsonPath, JSON.stringify(denoJson, null, 2) + "\n", "utf8");
         try {
           const [installCmd, ...installArgs] = installCommand;
           await safeExeca(installCmd, installArgs, { cwd, stdio: "pipe" });
         } catch (err) {
           restoreDenoJsonImportValue(denoJson, overrideSelector, existingEntry);
-          writeFileSync4(denoJsonPath, JSON.stringify(denoJson, null, 2) + "\n", "utf8");
+          writeFileSync5(denoJsonPath, JSON.stringify(denoJson, null, 2) + "\n", "utf8");
           const message = err instanceof Error ? err.message : String(err);
           return {
             packageName,
@@ -3968,7 +4403,7 @@ var applyPackageOverrideTool = defineTool({
             await safeExeca(testCmd, testArgs, { cwd, stdio: "pipe" });
           } catch (err) {
             restoreDenoJsonImportValue(denoJson, overrideSelector, existingEntry);
-            writeFileSync4(denoJsonPath, JSON.stringify(denoJson, null, 2) + "\n", "utf8");
+            writeFileSync5(denoJsonPath, JSON.stringify(denoJson, null, 2) + "\n", "utf8");
             try {
               const [rollbackCmd, ...rollbackArgs] = installCommand;
               await safeExeca(rollbackCmd, rollbackArgs, { cwd, stdio: "pipe" });
@@ -4000,7 +4435,7 @@ var applyPackageOverrideTool = defineTool({
     }
     let pkgJson;
     try {
-      pkgJson = JSON.parse(readFileSync12(pkgPath, "utf8"));
+      pkgJson = JSON.parse(readFileSync14(pkgPath, "utf8"));
     } catch {
       return {
         packageName,
@@ -4030,13 +4465,13 @@ var applyPackageOverrideTool = defineTool({
     }
     return withRepoLock(cwd, async () => {
       setOverrideValue(pkgJson, pm, overrideSelector, toVersion);
-      writeFileSync4(pkgPath, JSON.stringify(pkgJson, null, 2) + "\n", "utf8");
+      writeFileSync5(pkgPath, JSON.stringify(pkgJson, null, 2) + "\n", "utf8");
       try {
         const [installCmd, ...installArgs] = installCommand;
         await safeExeca(installCmd, installArgs, { cwd, stdio: "pipe" });
       } catch (err) {
         restoreOverrideValue(pkgJson, pm, overrideSelector, previousValue);
-        writeFileSync4(pkgPath, JSON.stringify(pkgJson, null, 2) + "\n", "utf8");
+        writeFileSync5(pkgPath, JSON.stringify(pkgJson, null, 2) + "\n", "utf8");
         const message = err instanceof Error ? err.message : String(err);
         return {
           packageName,
@@ -4055,7 +4490,7 @@ var applyPackageOverrideTool = defineTool({
           await safeExeca(testCmd, testArgs, { cwd, stdio: "pipe" });
         } catch (err) {
           restoreOverrideValue(pkgJson, pm, overrideSelector, previousValue);
-          writeFileSync4(pkgPath, JSON.stringify(pkgJson, null, 2) + "\n", "utf8");
+          writeFileSync5(pkgPath, JSON.stringify(pkgJson, null, 2) + "\n", "utf8");
           try {
             const [rollbackCmd, ...rollbackArgs] = installCommand;
             await safeExeca(rollbackCmd, rollbackArgs, { cwd, stdio: "pipe" });
@@ -4139,7 +4574,9 @@ async function verifyPackageTrust(packageName, targetVersion, policy) {
   }
   const versionData = packument.versions?.[targetVersion];
   const scripts = versionData?.scripts ?? {};
-  const installScriptKeys = ["preinstall", "install", "postinstall"].filter((k) => Boolean(scripts[k]));
+  const installScriptKeys = ["preinstall", "install", "postinstall"].filter(
+    (k) => Boolean(scripts[k])
+  );
   const hasInstallScripts = installScriptKeys.length > 0;
   if (policy.blockInstallScripts && hasInstallScripts) {
     return {
@@ -4149,7 +4586,9 @@ async function verifyPackageTrust(packageName, targetVersion, policy) {
       reason: `Target release "${packageName}@${targetVersion}" defines risky lifecycle scripts (${installScriptKeys.join(", ")}).`
     };
   }
-  const hasProvenance = Boolean(versionData?.dist?.attestations?.provenance || versionData?.dist?.attestations?.url);
+  const hasProvenance = Boolean(
+    versionData?.dist?.attestations?.provenance || versionData?.dist?.attestations?.url
+  );
   if (policy.requireProvenance && !hasProvenance) {
     return {
       trusted: false,
@@ -4237,7 +4676,11 @@ async function resolvePrimaryResult(params) {
         }
       };
     }
-    const trust2 = await verifyPackageTrust(pkg.name, safeUpgrade2.safeVersion, constraints.supplyChainPolicy);
+    const trust2 = await verifyPackageTrust(
+      pkg.name,
+      safeUpgrade2.safeVersion,
+      constraints.supplyChainPolicy
+    );
     if (!trust2.trusted) {
       return {
         steps: 1,
@@ -4308,7 +4751,11 @@ async function resolvePrimaryResult(params) {
       }
     };
   }
-  const trust = await verifyPackageTrust(pkg.name, safeUpgrade.safeVersion, constraints.supplyChainPolicy);
+  const trust = await verifyPackageTrust(
+    pkg.name,
+    safeUpgrade.safeVersion,
+    constraints.supplyChainPolicy
+  );
   if (!trust.trusted) {
     return {
       steps: 1,
@@ -4337,7 +4784,8 @@ async function resolvePrimaryResult(params) {
     installMode: constraints.installMode,
     installPreferOffline: constraints.installPreferOffline,
     enforceFrozenLockfile: constraints.enforceFrozenLockfile,
-    workspace: constraints.workspace
+    workspace: constraints.workspace,
+    breakingChangeRefactor: constraints.enableBreakingChangeRefactor
   });
   return {
     steps: 2,
@@ -4348,7 +4796,7 @@ async function resolvePrimaryResult(params) {
 // src/remediation/tools/fetch-package-source.ts
 import { z as z6 } from "zod";
 import { mkdir as mkdir2, mkdtemp, readdir as readdir2, readFile as readFile4, rm as rm3 } from "fs/promises";
-import { join as join16 } from "path";
+import { join as join17 } from "path";
 import { tmpdir } from "os";
 import { execa as execa7 } from "execa";
 var fetchPackageSourceTool = defineTool({
@@ -4368,25 +4816,25 @@ var fetchPackageSourceTool = defineTool({
     if (safePatterns.length === 0) {
       return { success: false, error: "No valid file patterns provided." };
     }
-    const tempBaseDir = await mkdtemp(join16(tmpdir(), "autoremediator-pkg-"));
-    const extractDir = join16(tempBaseDir, "out");
+    const tempBaseDir = await mkdtemp(join17(tmpdir(), "autoremediator-pkg-"));
+    const extractDir = join17(tempBaseDir, "out");
     try {
       const scopedName = packageName.split("/").pop();
       const npmUrl = `https://registry.npmjs.org/${packageName}/-/${scopedName}-${version}.tgz`;
       await mkdir2(tempBaseDir, { recursive: true });
-      const tarballPath = join16(tempBaseDir, "package.tgz");
+      const tarballPath = join17(tempBaseDir, "package.tgz");
       await execa7("curl", ["-L", "-o", tarballPath, npmUrl]);
       await mkdir2(extractDir, { recursive: true });
       await execa7("tar", ["-xzf", tarballPath, "-C", extractDir]);
       const extractedContents = await readdir2(extractDir);
-      const packageRootDir = extractedContents.includes("package") ? join16(extractDir, "package") : extractDir;
+      const packageRootDir = extractedContents.includes("package") ? join17(extractDir, "package") : extractDir;
       const sourceCode = {};
       async function walkDir(dir, relativeBase) {
         try {
           const files = await readdir2(dir, { withFileTypes: true });
           for (const file of files) {
-            const fullPath = join16(dir, file.name);
-            const relPath = join16(relativeBase, file.name);
+            const fullPath = join17(dir, file.name);
+            const relPath = join17(relativeBase, file.name);
             if (file.isDirectory()) {
               if (!["node_modules", ".git", "dist", "build", "coverage", ".next", "out"].includes(
                 file.name
@@ -4516,7 +4964,7 @@ Important:
 }
 
 // src/remediation/tools/generate-patch/helpers.ts
-import { parseSync as parseSync2 } from "oxc-parser";
+import { parseSync as parseSync3 } from "oxc-parser";
 import YAML from "yaml";
 function parseLlmAnalysisResponse(text) {
   try {
@@ -4539,7 +4987,7 @@ function validatePatchedCodeSyntax(filePath, code) {
   const lowerPath = filePath.toLowerCase();
   if (/\.[cm]?[jt]sx?$/i.test(lowerPath)) {
     try {
-      const res = parseSync2(filePath, code);
+      const res = parseSync3(filePath, code);
       if (res.errors && res.errors.length > 0) {
         const errorMsg = res.errors.map((e) => e.message).join("; ");
         return {
@@ -4811,15 +5259,124 @@ var generatePatchTool = defineTool({
 // src/remediation/tools/apply-patch-file/index.ts
 import { z as z8 } from "zod";
 import { mkdir as mkdir3, writeFile as writeFile3 } from "fs/promises";
-import { join as join18 } from "path";
+import { existsSync as existsSync14 } from "fs";
+import { isAbsolute as isAbsolute4, join as join19 } from "path";
 import { execa as execa9 } from "execa";
 
+// src/remediation/proof-of-fix/runner.ts
+async function runProofOfFixPhase(options) {
+  const { stage, testFilePath, cwd, timeoutMs = 15e3 } = options;
+  const started = Date.now();
+  const isTs = testFilePath.endsWith(".ts");
+  const nodeArgs = isTs ? ["--experimental-strip-types", testFilePath] : [testFilePath];
+  try {
+    const result = await safeExeca("node", nodeArgs, {
+      cwd,
+      timeoutMs,
+      stdio: "pipe"
+    });
+    const durationMs = Date.now() - started;
+    const output = `${result.stdout || ""}
+${result.stderr || ""}`.trim();
+    if (stage === "negative") {
+      return {
+        executed: true,
+        passed: false,
+        exitCode: 0,
+        output,
+        durationMs,
+        error: "Exploit reproduction test passed on vulnerable target (failed to reproduce vulnerability)."
+      };
+    }
+    return {
+      executed: true,
+      passed: true,
+      exitCode: 0,
+      output,
+      durationMs
+    };
+  } catch (err) {
+    const durationMs = Date.now() - started;
+    const execaErr = err;
+    const exitCode = typeof execaErr.exitCode === "number" ? execaErr.exitCode : 1;
+    const errorMsg = execaErr.message || String(err);
+    const output = [execaErr.stdout, execaErr.stderr, errorMsg].filter(Boolean).join("\n").trim();
+    if (stage === "negative") {
+      if (execaErr.timedOut || errorMsg.includes("timed out")) {
+        return {
+          executed: true,
+          passed: false,
+          exitCode,
+          output,
+          durationMs,
+          error: "Exploit reproduction test timed out (execution hung)."
+        };
+      }
+      const isHarnessFailure = exitCode === 127 || errorMsg.includes("ENOENT") || output.includes("bad option:") || output.includes("Cannot find module") && output.includes(testFilePath);
+      if (isHarnessFailure) {
+        return {
+          executed: false,
+          passed: false,
+          exitCode,
+          output,
+          durationMs,
+          error: `Reproduction test failed to execute (harness error): ${errorMsg}`
+        };
+      }
+      return {
+        executed: true,
+        passed: true,
+        exitCode,
+        output,
+        durationMs
+      };
+    }
+    return {
+      executed: true,
+      passed: false,
+      exitCode,
+      output,
+      durationMs,
+      error: `Reproduction test failed on patched target: ${errorMsg}`
+    };
+  }
+}
+function assembleProofOfFixVerification(params) {
+  const { reproductionTestPath, negativePhase, positivePhase, regressionPhase } = params;
+  const regPhase = regressionPhase ?? {
+    executed: false,
+    passed: true
+  };
+  let status = "verified";
+  let failureReason;
+  if (!negativePhase.passed) {
+    status = "failed";
+    failureReason = negativePhase.error || "negative-phase-failed";
+  } else if (!positivePhase.passed) {
+    status = "failed";
+    failureReason = positivePhase.error || "positive-phase-failed";
+  } else if (regPhase.executed && !regPhase.passed) {
+    status = "failed";
+    failureReason = regPhase.error || "regression-phase-failed";
+  }
+  const durationMs = (negativePhase.durationMs || 0) + (positivePhase.durationMs || 0) + (regPhase.durationMs || 0);
+  return {
+    status,
+    reproductionTestPath,
+    negativePhase,
+    positivePhase,
+    regressionPhase: regPhase,
+    durationMs,
+    failureReason
+  };
+}
+
 // src/remediation/tools/apply-patch-file/helpers.ts
-import { existsSync as existsSync12 } from "fs";
+import { existsSync as existsSync13 } from "fs";
 import { mkdtemp as mkdtemp2, readFile as readFile5, rm as rm4, writeFile as writeFile2 } from "fs/promises";
 import { createHash } from "crypto";
 import { tmpdir as tmpdir2 } from "os";
-import { join as join17 } from "path";
+import { join as join18 } from "path";
 import { execa as execa8 } from "execa";
 async function resolvePatchMode(packageManager, cwd) {
   if (packageManager === "npm" || packageManager === "bun" || packageManager === "deno")
@@ -4854,7 +5411,7 @@ async function writePatchManifest(manifestFilePath, artifact) {
   await writeFile2(manifestFilePath, JSON.stringify(artifact, null, 2) + "\n", "utf8");
 }
 async function configurePatchPackagePostinstall(cwd, packageManager) {
-  const pkgJsonPath = join17(cwd, "package.json");
+  const pkgJsonPath = join18(cwd, "package.json");
   let pkgJson;
   try {
     pkgJson = JSON.parse(await readFile5(pkgJsonPath, "utf8"));
@@ -4894,7 +5451,7 @@ async function configurePatchPackagePostinstall(cwd, packageManager) {
   return { success: true };
 }
 async function capturePackageJsonSnapshot(cwd) {
-  const path = join17(cwd, "package.json");
+  const path = join18(cwd, "package.json");
   try {
     const content = await readFile5(path, "utf8");
     return { path, content };
@@ -4966,8 +5523,8 @@ ${createResult.stderr}`);
       error: `Could not determine native patch directory for ${packageSpec}.`
     };
   }
-  const tempPatchDir = await mkdtemp2(join17(tmpdir2(), "autoremediator-native-patch-"));
-  const tempPatchFile = join17(tempPatchDir, "change.patch");
+  const tempPatchDir = await mkdtemp2(join18(tmpdir2(), "autoremediator-native-patch-"));
+  const tempPatchFile = join18(tempPatchDir, "change.patch");
   try {
     await writeFile2(tempPatchFile, patchContent, "utf8");
     await execa8("patch", ["-p1", "-i", tempPatchFile], {
@@ -4998,12 +5555,12 @@ ${createResult.stderr}`);
 function extractPatchDirectory(output) {
   const lines = output.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
   for (const line of lines) {
-    if (existsSync12(line)) {
+    if (existsSync13(line)) {
       return line;
     }
     const tokens = line.split(/\s+/).map((token) => token.replace(/^['"]|['"]$/g, ""));
     for (const token of tokens) {
-      if (token.startsWith("/") && existsSync12(token)) {
+      if (token.startsWith("/") && existsSync13(token)) {
         return token;
       }
     }
@@ -5074,6 +5631,10 @@ var applyPatchFileTool = defineTool({
     workspace: z8.string().optional(),
     validateWithTests: z8.boolean().optional().default(true).describe("Run package manager test command to validate patch doesn't break anything"),
     reproductionTest: z8.string().optional().describe("Optional synthesized reproduction test script verifying fix"),
+    proofOfFix: z8.union([z8.boolean(), z8.string()]).optional().describe(
+      "If true or script path/content, enforce dual-stage exploit reproduction (assert failure pre-patch, assert pass post-patch)"
+    ),
+    requireProofOfFix: z8.boolean().optional().describe("If true, fail and roll back patch if proof-of-fix verification fails"),
     dryRun: z8.boolean().optional().default(false).describe("If true, report but do not mutate files")
   }).refine((value) => Boolean(value.patchContent || value.patches && value.patches.length > 0), {
     message: "Either patchContent or patches must be provided"
@@ -5096,6 +5657,8 @@ var applyPatchFileTool = defineTool({
     riskLevel,
     validateWithTests,
     reproductionTest,
+    proofOfFix,
+    requireProofOfFix,
     dryRun
   }) => {
     try {
@@ -5146,7 +5709,7 @@ var applyPatchFileTool = defineTool({
         };
       }
       const patchFileName = buildPatchFileName(packageName, vulnerableVersion);
-      const patchFilePath = join18(cwd, patchesDir, patchFileName);
+      const patchFilePath = join19(cwd, patchesDir, patchFileName);
       const manifestFilePath = `${patchFilePath}.json`;
       const generatedAt = (/* @__PURE__ */ new Date()).toISOString();
       const baseArtifact = {
@@ -5185,7 +5748,7 @@ var applyPatchFileTool = defineTool({
       }
       return withRepoLock(cwd, async () => {
         const packageJsonSnapshot = patchModeRequiresPackageJsonSnapshot(pm) ? await capturePackageJsonSnapshot(cwd) : void 0;
-        const patchesDirPath = join18(cwd, patchesDir);
+        const patchesDirPath = join19(cwd, patchesDir);
         await mkdir3(patchesDirPath, { recursive: true });
         await writeFile3(patchFilePath, selectedPatch, "utf8");
         validationPhases.push({
@@ -5208,6 +5771,101 @@ var applyPatchFileTool = defineTool({
         });
         artifact.validationPhases = validationPhases;
         await writePatchManifest(manifestFilePath, artifact);
+        let reproductionTestPath;
+        let negativePhaseResult;
+        if (typeof proofOfFix === "string" && proofOfFix.trim().length > 0) {
+          const resolvedPath = isAbsolute4(proofOfFix) ? proofOfFix : join19(cwd, proofOfFix);
+          if (existsSync14(resolvedPath)) {
+            reproductionTestPath = resolvedPath;
+          } else {
+            const safeName = packageName.replace(/^@/, "").replace(/\//g, "+");
+            reproductionTestPath = join19(patchesDirPath, `${safeName}+${vulnerableVersion}.test.cjs`);
+            await writeFile3(reproductionTestPath, proofOfFix, "utf8");
+          }
+        } else if (reproductionTest) {
+          const safeName = packageName.replace(/^@/, "").replace(/\//g, "+");
+          reproductionTestPath = join19(patchesDirPath, `${safeName}+${vulnerableVersion}.test.cjs`);
+          await writeFile3(reproductionTestPath, reproductionTest, "utf8");
+        }
+        const isProofOfFixActive = Boolean(proofOfFix || requireProofOfFix);
+        if (isProofOfFixActive) {
+          if (!reproductionTestPath) {
+            if (requireProofOfFix) {
+              await cleanupPatchArtifacts({
+                cwd,
+                patchFilePath,
+                manifestFilePath,
+                patchMode,
+                packageJsonSnapshot,
+                installCommand,
+                rerunInstall: false
+              });
+              return {
+                success: false,
+                packageName,
+                vulnerableVersion,
+                applied: false,
+                dryRun: false,
+                message: "Proof-of-fix verification required, but no reproduction test or script was supplied.",
+                patchFilePath,
+                manifestFilePath,
+                patchPath: patchFilePath,
+                patchMode,
+                postinstallConfigured: false,
+                patchArtifact: {
+                  ...artifact,
+                  applied: false,
+                  validationPhases
+                },
+                validationPhases,
+                error: "Proof-of-fix verification required, but no reproduction test or script was supplied."
+              };
+            }
+          } else {
+            negativePhaseResult = await runProofOfFixPhase({
+              stage: "negative",
+              testFilePath: reproductionTestPath,
+              cwd
+            });
+            validationPhases.push({
+              phase: "proof-of-fix-negative",
+              passed: negativePhaseResult.passed,
+              message: negativePhaseResult.passed ? "Reproduction test reproduced vulnerability on unpatched code." : void 0,
+              error: negativePhaseResult.passed ? void 0 : negativePhaseResult.error
+            });
+            if (!negativePhaseResult.passed && requireProofOfFix) {
+              await cleanupPatchArtifacts({
+                cwd,
+                patchFilePath,
+                manifestFilePath,
+                patchMode,
+                packageJsonSnapshot,
+                installCommand,
+                rerunInstall: false
+              });
+              return {
+                success: false,
+                packageName,
+                vulnerableVersion,
+                applied: false,
+                dryRun: false,
+                message: `Proof-of-fix negative phase failed: ${negativePhaseResult.error}`,
+                patchFilePath,
+                manifestFilePath,
+                patchPath: patchFilePath,
+                patchMode,
+                postinstallConfigured: false,
+                patchArtifact: {
+                  ...artifact,
+                  applied: false,
+                  validationPhases
+                },
+                validationPhases,
+                error: `Proof-of-fix negative phase failed: ${negativePhaseResult.error}`
+              };
+            }
+          }
+        }
         const applyResult = patchMode === "patch-package" ? await configurePatchPackagePostinstall(cwd, pm) : await applyNativePatch({
           cwd,
           packageName,
@@ -5348,34 +6006,90 @@ var applyPatchFileTool = defineTool({
             message: "Patch validation tests passed."
           });
         }
-        let reproductionTestPath;
-        if (reproductionTest) {
-          const safeName = packageName.replace(/^@/, "").replace(/\//g, "+");
-          reproductionTestPath = join18(patchesDirPath, `${safeName}+${vulnerableVersion}.test.cjs`);
-          await writeFile3(reproductionTestPath, reproductionTest, "utf8");
-          try {
-            const reproRun = await execa9("node", [reproductionTestPath], { cwd, stdio: "pipe" });
-            validationPhases.push({
-              phase: "reproduction-test",
-              passed: reproRun.exitCode === 0,
-              message: "Reproduction test verified fix successfully."
+        let positivePhaseResult;
+        if (reproductionTestPath) {
+          if (isProofOfFixActive) {
+            positivePhaseResult = await runProofOfFixPhase({
+              stage: "positive",
+              testFilePath: reproductionTestPath,
+              cwd
             });
-          } catch (err) {
-            const reproErr = err instanceof Error ? err.message : String(err);
             validationPhases.push({
-              phase: "reproduction-test",
-              passed: false,
-              error: `Reproduction test failed: ${reproErr}`
+              phase: "proof-of-fix-positive",
+              passed: positivePhaseResult.passed,
+              message: positivePhaseResult.passed ? "Reproduction test passed on patched code (vulnerability mitigated)." : void 0,
+              error: positivePhaseResult.passed ? void 0 : positivePhaseResult.error
             });
+            if (!positivePhaseResult.passed && (requireProofOfFix || validateWithTests)) {
+              await cleanupPatchArtifacts({
+                cwd,
+                patchFilePath,
+                manifestFilePath,
+                patchMode,
+                packageJsonSnapshot,
+                installCommand,
+                rerunInstall: patchMode === "patch-package"
+              });
+              return {
+                success: false,
+                packageName,
+                vulnerableVersion,
+                applied: false,
+                dryRun: false,
+                message: `Proof-of-fix positive phase failed: ${positivePhaseResult.error}`,
+                patchFilePath,
+                manifestFilePath,
+                patchPath: patchFilePath,
+                patchMode,
+                postinstallConfigured: false,
+                patchArtifact: {
+                  ...artifact,
+                  applied: false,
+                  validationPhases
+                },
+                validationPhases,
+                error: `Proof-of-fix positive phase failed: ${positivePhaseResult.error}`
+              };
+            }
+          } else {
+            try {
+              const reproRun = await execa9("node", [reproductionTestPath], { cwd, stdio: "pipe" });
+              validationPhases.push({
+                phase: "reproduction-test",
+                passed: reproRun.exitCode === 0,
+                message: "Reproduction test verified fix successfully."
+              });
+            } catch (err) {
+              const reproErr = err instanceof Error ? err.message : String(err);
+              validationPhases.push({
+                phase: "reproduction-test",
+                passed: false,
+                error: `Reproduction test failed: ${reproErr}`
+              });
+            }
           }
         }
+        let proofOfFixVerification;
+        if (negativePhaseResult && positivePhaseResult) {
+          proofOfFixVerification = assembleProofOfFixVerification({
+            reproductionTestPath,
+            negativePhase: negativePhaseResult,
+            positivePhase: positivePhaseResult,
+            regressionPhase: validationResult ? {
+              executed: true,
+              passed: validationResult.passed,
+              error: validationResult.error
+            } : void 0
+          });
+        }
         const finalArtifact = {
           ...artifact,
           applied: true,
           dryRun: false,
           reproductionTest,
           reproductionTestPath,
-          validationPhases
+          validationPhases,
+          proofOfFix: proofOfFixVerification
         };
         await writePatchManifest(manifestFilePath, finalArtifact);
         return {
@@ -5392,7 +6106,8 @@ var applyPatchFileTool = defineTool({
           postinstallConfigured: patchMode === "patch-package",
           patchArtifact: finalArtifact,
           validation: validationResult,
-          validationPhases
+          validationPhases,
+          proofOfFix: proofOfFixVerification
         };
       });
     } catch (err) {
@@ -5636,6 +6351,9 @@ async function tryLocalPatchFallback(params) {
     workspace: params.workspace,
     riskLevel: patchResult.riskLevel,
     validateWithTests: params.runTests,
+    reproductionTest: patchResult.reproductionTest,
+    proofOfFix: params.proofOfFix,
+    requireProofOfFix: params.requireProofOfFix,
     dryRun: params.dryRun
   });
   steps += 1;
@@ -5684,12 +6402,14 @@ function resolveLocalRunOptions(options) {
   const runTests = options.runTests ?? false;
   const policy = options.policy ?? "";
   const patchesDir = options.patchesDir || "./patches";
+  const loadedPolicy = loadPolicy(cwd, options.policy);
   const constraints = {
     ...options.constraints,
-    typecheck: options.typecheck ?? options.constraints?.typecheck,
-    supplyChainPolicy: options.supplyChainPolicy ?? options.constraints?.supplyChainPolicy
+    typecheck: options.typecheck ?? options.constraints?.typecheck ?? loadedPolicy.constraints?.typecheck,
+    supplyChainPolicy: options.supplyChainPolicy ?? options.constraints?.supplyChainPolicy ?? loadedPolicy.constraints?.supplyChainPolicy,
+    enableBreakingChangeRefactor: options.breakingChangeRefactor ?? options.constraints?.enableBreakingChangeRefactor ?? loadedPolicy.constraints?.enableBreakingChangeRefactor,
+    requireProofOfFix: options.requireProofOfFix ?? options.constraints?.requireProofOfFix ?? loadedPolicy.constraints?.requireProofOfFix
   };
-  const loadedPolicy = loadPolicy(cwd, options.policy);
   const llmProvider = resolveProvider(options);
   return {
     cwd,
@@ -5720,7 +6440,10 @@ function resolveLocalRunOptions(options) {
     regressionCheck: options.regressionCheck ?? false,
     escalationGraph: options.escalationGraph ?? loadedPolicy.escalationGraph,
     offlineIntelligence: options.offlineIntelligence ?? false,
-    intelligenceSnapshotPath: options.intelligenceSnapshotPath
+    intelligenceSnapshotPath: options.intelligenceSnapshotPath,
+    proofOfFix: options.proofOfFix,
+    requireProofOfFix: options.requireProofOfFix ?? constraints.requireProofOfFix,
+    breakingChangeRefactor: options.breakingChangeRefactor ?? constraints.enableBreakingChangeRefactor
   };
 }
 
@@ -5888,7 +6611,9 @@ async function runLocalRemediationPipeline(cveId, options = {}) {
     regressionCheck,
     escalationGraph,
     offlineIntelligence,
-    intelligenceSnapshotPath
+    intelligenceSnapshotPath,
+    proofOfFix,
+    requireProofOfFix
   } = resolved;
   const correlation = {
     requestId: options.requestId,
@@ -6065,7 +6790,9 @@ async function runLocalRemediationPipeline(cveId, options = {}) {
         installPreferOffline: constraints.installPreferOffline,
         enforceFrozenLockfile: constraints.enforceFrozenLockfile,
         workspace: constraints.workspace,
-        vulnerableRange: vulnerable.affected.vulnerableRange
+        vulnerableRange: vulnerable.affected.vulnerableRange,
+        proofOfFix,
+        requireProofOfFix
       });
       agentSteps += fallback.steps;
       collectedResults.push(finalizePatchResult(fallback.result));
@@ -6171,8 +6898,8 @@ function accumulateStepResults(params) {
 }
 
 // src/remediation/orchestration-prompt.ts
-import { existsSync as existsSync13, readFileSync as readFileSync13 } from "fs";
-import { join as join19 } from "path";
+import { existsSync as existsSync15, readFileSync as readFileSync15 } from "fs";
+import { join as join20 } from "path";
 function buildProviderAddendum(provider, personality = "balanced") {
   const personalityDirective = personality === "analytical" ? "Use concise, explicit rationale for tool decisions and unresolved outcomes." : personality === "pragmatic" ? "Prefer the smallest safe remediation path while preserving policy and validation gates." : "Balance concise execution with brief rationale for risky or unresolved outcomes.";
   const providerDirective = provider === "remote" ? "Use strict structured output and deterministic reporting fields." : "Use deterministic-first behavior and only rely on remote model fallback when required by patch generation.";
@@ -6183,13 +6910,13 @@ Provider profile:
 - ${personalityDirective}`;
 }
 function loadOrchestrationPrompt(ctx) {
-  const promptPath = join19(
+  const promptPath = join20(
     process.cwd(),
     ".github",
     "instructions",
     "orchestration.instructions.md"
   );
-  if (!existsSync13(promptPath)) {
+  if (!existsSync15(promptPath)) {
     return `You are autoremediator, an agentic security remediation system for Node.js package dependencies.
 Working directory: ${ctx.cwd}
   Package manager: ${ctx.packageManager}
@@ -6215,7 +6942,7 @@ Fallback sequence (when neither version bump nor override can be applied):
 
 Always respect dryRun and policy constraints.`;
   }
-  const template = readFileSync13(promptPath, "utf8");
+  const template = readFileSync15(promptPath, "utf8");
   return template.replaceAll("{{cveId}}", ctx.cveId).replaceAll("{{cwd}}", ctx.cwd).replaceAll("{{packageManager}}", ctx.packageManager).replaceAll("{{dryRun}}", String(ctx.dryRun)).replaceAll("{{runTests}}", String(ctx.runTests)).replaceAll("{{policy}}", ctx.policy || "undefined").replaceAll("{{patchesDir}}", ctx.patchesDir).replaceAll(
     "{{directDependenciesOnly}}",
     String(ctx.constraints.directDependenciesOnly ?? false)
@@ -6694,6 +7421,8 @@ function createRuntimeToolsForRun(options) {
       installPreferOffline: constraints.installPreferOffline,
       enforceFrozenLockfile: constraints.enforceFrozenLockfile,
       workspace: constraints.workspace,
+      typecheck: input.typecheck ?? options.typecheck ?? constraints.typecheck,
+      breakingChangeRefactor: input.breakingChangeRefactor ?? options.breakingChangeRefactor ?? constraints.enableBreakingChangeRefactor,
       dryRun: preview ? true : input.dryRun
     })
   };
@@ -6718,6 +7447,8 @@ function createRuntimeToolsForRun(options) {
       installPreferOffline: constraints.installPreferOffline,
       enforceFrozenLockfile: constraints.enforceFrozenLockfile,
       workspace: constraints.workspace,
+      proofOfFix: input.proofOfFix ?? options.proofOfFix,
+      requireProofOfFix: input.requireProofOfFix ?? options.requireProofOfFix ?? constraints.requireProofOfFix,
       dryRun: preview ? true : input.dryRun
     })
   };
@@ -7148,13 +7879,17 @@ function resolveConstraints(options, cwd) {
     installMode: options.constraints?.installMode ?? policy.constraints?.installMode ?? "deterministic",
     installPreferOffline: options.constraints?.installPreferOffline ?? policy.constraints?.installPreferOffline,
     enforceFrozenLockfile: options.constraints?.enforceFrozenLockfile ?? policy.constraints?.enforceFrozenLockfile,
-    workspace: options.constraints?.workspace ?? policy.constraints?.workspace
+    workspace: options.constraints?.workspace ?? policy.constraints?.workspace,
+    typecheck: options.typecheck ?? options.constraints?.typecheck ?? policy.constraints?.typecheck,
+    requireProofOfFix: options.requireProofOfFix ?? options.constraints?.requireProofOfFix ?? policy.constraints?.requireProofOfFix,
+    enableBreakingChangeRefactor: options.breakingChangeRefactor ?? options.constraints?.enableBreakingChangeRefactor ?? policy.constraints?.enableBreakingChangeRefactor,
+    supplyChainPolicy: options.supplyChainPolicy ?? options.constraints?.supplyChainPolicy ?? policy.constraints?.supplyChainPolicy
   };
 }
 
 // src/platform/evidence.ts
-import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync5 } from "fs";
-import { join as join20 } from "path";
+import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync6 } from "fs";
+import { join as join21 } from "path";
 function createEvidenceLog(cwd, cveIds, context = {}) {
   return {
     runId: `${Date.now()}-${Math.random().toString(36).slice(2, 8)}`,
@@ -7186,10 +7921,10 @@ function finalizeEvidence(log) {
   return log;
 }
 function writeEvidenceLog(cwd, log) {
-  const dir = join20(cwd, ".autoremediator", "evidence");
+  const dir = join21(cwd, ".autoremediator", "evidence");
   mkdirSync3(dir, { recursive: true });
-  const filePath = join20(dir, `${log.runId}.json`);
-  writeFileSync5(filePath, JSON.stringify(log, null, 2) + "\n", "utf8");
+  const filePath = join21(dir, `${log.runId}.json`);
+  writeFileSync6(filePath, JSON.stringify(log, null, 2) + "\n", "utf8");
   return filePath;
 }
 
@@ -7431,12 +8166,12 @@ async function planRemediation(cveId, options = {}) {
 }
 
 // src/scanner/parse-input.ts
-import { extname, resolve as resolve4 } from "path";
-import { readFileSync as readFileSync17 } from "fs";
+import { extname, resolve as resolve5 } from "path";
+import { readFileSync as readFileSync19 } from "fs";
 import { execa as execa11 } from "execa";
 
 // src/scanner/adapters/npm-audit.ts
-import { readFileSync as readFileSync14 } from "fs";
+import { readFileSync as readFileSync16 } from "fs";
 var CVE_REGEX = /CVE-\d{4}-\d{1,7}/gi;
 var GHSA_REGEX = /GHSA-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}/gi;
 function normalizeSeverity(raw) {
@@ -7472,12 +8207,12 @@ function parseNpmAuditJsonFromString(content) {
   return findings;
 }
 function parseNpmAuditJsonFile(filePath) {
-  const content = readFileSync14(filePath, "utf8");
+  const content = readFileSync16(filePath, "utf8");
   return parseNpmAuditJsonFromString(content);
 }
 
 // src/scanner/adapters/yarn-audit.ts
-import { readFileSync as readFileSync15 } from "fs";
+import { readFileSync as readFileSync17 } from "fs";
 var CVE_REGEX2 = /CVE-\d{4}-\d{1,7}/gi;
 var GHSA_REGEX2 = /GHSA-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}/gi;
 function normalizeSeverity2(raw) {
@@ -7522,12 +8257,12 @@ function parseYarnAuditJsonFromString(content) {
   return findings;
 }
 function parseYarnAuditJsonFile(filePath) {
-  const content = readFileSync15(filePath, "utf8");
+  const content = readFileSync17(filePath, "utf8");
   return parseYarnAuditJsonFromString(content);
 }
 
 // src/scanner/adapters/sarif.ts
-import { readFileSync as readFileSync16 } from "fs";
+import { readFileSync as readFileSync18 } from "fs";
 var CVE_REGEX3 = /CVE-\d{4}-\d{1,7}/gi;
 function extractPackageName(result) {
   const pkg = result.properties?.["packageName"];
@@ -7565,7 +8300,7 @@ function parseSarifFromString(content) {
   return findings;
 }
 function parseSarifFile(filePath) {
-  const content = readFileSync16(filePath, "utf8");
+  const content = readFileSync18(filePath, "utf8");
   return parseSarifFromString(content);
 }
 
@@ -7574,7 +8309,7 @@ function parseScanInput(filePath, format) {
   if (filePath.includes("\0")) {
     throw new Error("Invalid scan input path: path contains null bytes");
   }
-  const resolvedPath = resolve4(filePath);
+  const resolvedPath = resolve5(filePath);
   const resolved = format === "auto" ? inferFormat(resolvedPath) : format;
   if (resolved === "npm-audit") {
     return parseNpmAuditJsonFile(resolvedPath);
@@ -7650,7 +8385,7 @@ function inferFormat(filePath) {
   const ext = extname(filePath).toLowerCase();
   if (ext === ".sarif") return "sarif";
   try {
-    const content = readFileSync17(filePath, "utf8");
+    const content = readFileSync19(filePath, "utf8");
     const firstLine = content.split("\n").find((line) => line.trim().startsWith("{"));
     if (firstLine) {
       const parsed = JSON.parse(firstLine);
@@ -8061,14 +8796,14 @@ async function remediatePortfolio(targets, options = {}) {
 }
 
 // src/api/update-outdated/index.ts
-import { join as join21 } from "path";
-import { readFileSync as readFileSync18, writeFileSync as writeFileSync6 } from "fs";
+import { join as join22 } from "path";
+import { readFileSync as readFileSync20, writeFileSync as writeFileSync7 } from "fs";
 import { execa as execa12 } from "execa";
 async function applyBump(params) {
-  const pkgPath = join21(params.cwd, "package.json");
+  const pkgPath = join22(params.cwd, "package.json");
   let pkgJson;
   try {
-    pkgJson = JSON.parse(readFileSync18(pkgPath, "utf8"));
+    pkgJson = JSON.parse(readFileSync20(pkgPath, "utf8"));
   } catch {
     return {
       applied: false,
@@ -8090,13 +8825,13 @@ async function applyBump(params) {
   const newRange = `${prefix}${params.toVersion}`;
   return withRepoLock(params.cwd, async () => {
     pkgJson[depField][params.packageName] = newRange;
-    writeFileSync6(pkgPath, JSON.stringify(pkgJson, null, 2) + "\n", "utf8");
+    writeFileSync7(pkgPath, JSON.stringify(pkgJson, null, 2) + "\n", "utf8");
     try {
       const [installCmd, ...installArgs] = params.installCommand;
       await execa12(installCmd, installArgs, { cwd: params.cwd, stdio: "pipe" });
     } catch (err) {
       pkgJson[depField][params.packageName] = currentRange;
-      writeFileSync6(pkgPath, JSON.stringify(pkgJson, null, 2) + "\n", "utf8");
+      writeFileSync7(pkgPath, JSON.stringify(pkgJson, null, 2) + "\n", "utf8");
       const message = err instanceof Error ? err.message : String(err);
       return {
         applied: false,
@@ -8109,7 +8844,7 @@ async function applyBump(params) {
         await execa12(testCmd, testArgs, { cwd: params.cwd, stdio: "pipe" });
       } catch (err) {
         pkgJson[depField][params.packageName] = currentRange;
-        writeFileSync6(pkgPath, JSON.stringify(pkgJson, null, 2) + "\n", "utf8");
+        writeFileSync7(pkgPath, JSON.stringify(pkgJson, null, 2) + "\n", "utf8");
         try {
           const [rollbackCmd, ...rollbackArgs] = params.installCommand;
           await execa12(rollbackCmd, rollbackArgs, { cwd: params.cwd, stdio: "pipe" });
@@ -8314,8 +9049,8 @@ async function checkReachability(options) {
 }
 
 // src/scanner/delta-scan.ts
-import { existsSync as existsSync14, readFileSync as readFileSync19 } from "fs";
-import { join as join22 } from "path";
+import { existsSync as existsSync16, readFileSync as readFileSync21 } from "fs";
+import { join as join23 } from "path";
 import { execa as execa13 } from "execa";
 import semver9 from "semver";
 
@@ -8508,7 +9243,7 @@ async function getChangedManifestPaths(cwd, baseRef) {
       }
     }
   } catch {
-    if (existsSync14(join22(cwd, "package.json"))) {
+    if (existsSync16(join23(cwd, "package.json"))) {
       manifests.add("package.json");
     }
   }
@@ -8527,10 +9262,10 @@ async function getOldManifestContent(cwd, baseRef, relPath) {
   }
 }
 function getNewManifestContent(cwd, relPath) {
-  const fullPath = join22(cwd, relPath);
-  if (!existsSync14(fullPath)) return null;
+  const fullPath = join23(cwd, relPath);
+  if (!existsSync16(fullPath)) return null;
   try {
-    return JSON.parse(readFileSync19(fullPath, "utf8"));
+    return JSON.parse(readFileSync21(fullPath, "utf8"));
   } catch {
     return null;
   }
@@ -8644,8 +9379,8 @@ async function scanDelta(options = {}) {
   }
   for (const lockfileRel of changedLockfiles) {
     const oldContent = await getFileContentAtRef(cwd, baseRef, lockfileRel);
-    const fullPath = join22(cwd, lockfileRel);
-    const newContent = existsSync14(fullPath) ? readFileSync19(fullPath, "utf8") : null;
+    const fullPath = join23(cwd, lockfileRel);
+    const newContent = existsSync16(fullPath) ? readFileSync21(fullPath, "utf8") : null;
     const lockDiffs = computeLockfileDiff(lockfileRel, oldContent, newContent);
     for (const change of lockDiffs) {
       if (!directPkgs.has(change.packageName)) {