aztrx-cli 0.1.0

package/dist/core/heal/gates.js

@@ -0,0 +1,165 @@
+/**
+ * F10 gate #2 — AST safety gates. A model-generated patch is never applied
+ * blindly: the patched file is re-parsed and rejected if it smuggles in a new
+ * import, dynamic code execution, child-process access, or an empty catch that
+ * would swallow the very error we're trying to surface. JavaScript/TypeScript
+ * use the TypeScript compiler's AST; HTML/Vue/Svelte are audited by extracting
+ * inline <script> blocks and running the same checks on each.
+ */
+import ts from "typescript";
+const JS_EXT = new Set([".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs", ".mts", ".cts"]);
+const MARKUP_EXT = new Set([".html", ".htm", ".vue", ".svelte", ".astro"]);
+function scriptKindFor(ext) {
+    switch (ext) {
+        case ".tsx": return ts.ScriptKind.TSX;
+        case ".jsx": return ts.ScriptKind.JSX;
+        case ".ts":
+        case ".mts":
+        case ".cts": return ts.ScriptKind.TS;
+        default: return ts.ScriptKind.JS;
+    }
+}
+const FORBIDDEN_CALLS = new Set([
+    "exec",
+    "execSync",
+    "execFile",
+    "execFileSync",
+    "spawn",
+    "spawnSync",
+    "fork",
+]);
+function lineOf(source, node) {
+    return source.getLineAndCharacterOfPosition(node.getStart()).line + 1;
+}
+function collectImports(source) {
+    const out = new Set();
+    const visit = (node) => {
+        if (ts.isImportDeclaration(node) && ts.isStringLiteral(node.moduleSpecifier)) {
+            out.add(node.moduleSpecifier.text);
+        }
+        else if (ts.isImportEqualsDeclaration(node)) {
+            if (ts.isExternalModuleReference(node.moduleReference) &&
+                node.moduleReference.expression &&
+                ts.isStringLiteral(node.moduleReference.expression)) {
+                out.add(node.moduleReference.expression.text);
+            }
+        }
+        else if (ts.isCallExpression(node)) {
+            const expr = node.expression;
+            const isRequire = ts.isIdentifier(expr) && expr.text === "require";
+            const isDynamicImport = expr.kind === ts.SyntaxKind.ImportKeyword;
+            if ((isRequire || isDynamicImport) && node.arguments[0] && ts.isStringLiteral(node.arguments[0])) {
+                out.add(node.arguments[0].text);
+            }
+        }
+        ts.forEachChild(node, visit);
+    };
+    ts.forEachChild(source, visit);
+    return out;
+}
+function scanForbidden(source, violations) {
+    const visit = (node) => {
+        if (ts.isCallExpression(node)) {
+            const expr = node.expression;
+            const name = ts.isIdentifier(expr) ? expr.text : null;
+            const line = lineOf(source, node);
+            if (name === "eval") {
+                violations.push({ rule: "no-eval", detail: `eval() at line ${line}` });
+            }
+            else if (name === "require" && node.arguments[0] && ts.isStringLiteral(node.arguments[0])) {
+                const spec = node.arguments[0].text;
+                if (spec === "child_process" || spec.startsWith("node:")) {
+                    violations.push({ rule: "no-child-process", detail: `require(${JSON.stringify(spec)}) at line ${line}` });
+                }
+            }
+            else if (name === "setTimeout" || name === "setInterval") {
+                if (node.arguments[0] && ts.isStringLiteral(node.arguments[0])) {
+                    violations.push({ rule: "no-eval", detail: `${name}(string) at line ${line}` });
+                }
+            }
+            else if (name && FORBIDDEN_CALLS.has(name)) {
+                violations.push({ rule: "no-child-process", detail: `${name}() at line ${line}` });
+            }
+        }
+        if (ts.isNewExpression(node)) {
+            const expr = node.expression;
+            if (ts.isIdentifier(expr) && expr.text === "Function") {
+                violations.push({ rule: "no-eval", detail: `new Function() at line ${lineOf(source, node)}` });
+            }
+        }
+        if (ts.isCatchClause(node) && node.block.statements.length === 0) {
+            violations.push({ rule: "no-empty-catch", detail: `empty catch at line ${lineOf(source, node)}` });
+        }
+        if (ts.isExpressionStatement(node)) {
+            const text = node.getText(source).trim();
+            if (/\bprocess\.(exit|kill)\s*\(/.test(text)) {
+                violations.push({ rule: "no-child-process", detail: `${text.slice(0, 60)}` });
+            }
+        }
+        ts.forEachChild(node, visit);
+    };
+    ts.forEachChild(source, visit);
+}
+function auditScript(original, patched, label, kind) {
+    const violations = [];
+    const fileName = `${label}.js`;
+    const origSrc = ts.createSourceFile(fileName, original, ts.ScriptTarget.Latest, true, kind);
+    const patchSrc = ts.createSourceFile(fileName, patched, ts.ScriptTarget.Latest, true, kind);
+    // Gate 0: the patched file must still parse — the compile fast-fail that runs
+    // before any Playwright verification (cheap, dependency-free).
+    const parseDiags = patchSrc.parseDiagnostics ?? [];
+    for (const d of parseDiags) {
+        violations.push({ rule: "syntax-error", detail: ts.flattenDiagnosticMessageText(d.messageText, " ") });
+    }
+    // Gate 1: no new imports / dependencies.
+    const before = collectImports(origSrc);
+    const after = collectImports(patchSrc);
+    for (const spec of after) {
+        if (!before.has(spec)) {
+            violations.push({ rule: "no-new-imports", detail: `new import ${JSON.stringify(spec)}` });
+        }
+    }
+    // Gates 2–4: no eval, no child_process, no empty catch.
+    scanForbidden(patchSrc, violations);
+    return { ok: violations.length === 0, violations };
+}
+function scriptBlocks(markup) {
+    const out = [];
+    const re = /<script\b[^>]*>([\s\S]*?)<\/script>/gi;
+    let m;
+    while ((m = re.exec(markup)) !== null)
+        out.push(m[1]);
+    return out;
+}
+/** Audit a patch by parsing the resulting file. `filePath` selects the parser. */
+export function auditPatch(original, patched, filePath) {
+    const ext = filePath.slice(filePath.lastIndexOf(".")).toLowerCase();
+    if (JS_EXT.has(ext)) {
+        return auditScript(original, patched, "file", scriptKindFor(ext));
+    }
+    if (MARKUP_EXT.has(ext)) {
+        const origBlocks = scriptBlocks(original);
+        const patchBlocks = scriptBlocks(patched);
+        const violations = [];
+        const n = Math.max(origBlocks.length, patchBlocks.length);
+        for (let i = 0; i < n; i++) {
+            const r = auditScript(origBlocks[i] ?? "", patchBlocks[i] ?? "", `script${i + 1}`, ts.ScriptKind.JS);
+            violations.push(...r.violations);
+        }
+        // If the patch introduced a <script> that wasn't there, patchBlocks grew;
+        // the per-block audit already covers the new content. Report combined.
+        return { ok: violations.length === 0, violations };
+    }
+    // Unknown extension: conservative lexical scan, clearly not an AST audit.
+    const violations = [];
+    if (/\beval\s*\(/.test(patched) || /\bnew\s+Function\b/.test(patched)) {
+        violations.push({ rule: "no-eval", detail: "lexical eval/Function in non-JS file" });
+    }
+    if (/child_process|\bexec(Sync|File|FileSync)?\s*\(|\bspawn(Sync)?\s*\(|\bfork\s*\(/.test(patched)) {
+        violations.push({ rule: "no-child-process", detail: "lexical child_process/exec in non-JS file" });
+    }
+    if (/catch\s*\([^)]*\)\s*\{\s*\}/.test(patched)) {
+        violations.push({ rule: "no-empty-catch", detail: "lexical empty catch in non-JS file" });
+    }
+    return { ok: violations.length === 0, violations };
+}

package/dist/core/heal/index.js

@@ -0,0 +1,242 @@
+/**
+ * F10 — closed-loop healing. Orchestrates the full loop, in order:
+ *
+ *   1. redact   — strip secrets from anything that will leave the machine
+ *   2. generate — ask an LLM for a Search & Replace diff (against the redacted
+ *                 file, unredacted before it touches the raw bytes)
+ *   3. gate     — re-parse the patched file; reject new imports / eval /
+ *                 child_process / empty catch
+ *   4. sandbox  — apply the patch in a detached git worktree, never the tree
+ *   5. verify   — replay the repro against the patched app; the bug must be gone
+ *   6. hand off — write a unified-diff `.patch` for a human to review and commit
+ *
+ * Aztrx never commits. A patch that fails any gate, does not apply exactly, or
+ * still reproduces the bug is rejected and reported, not silently kept.
+ */
+import { createServer } from "http";
+import * as fs from "fs";
+import * as path from "path";
+import { redact, unredact } from "./redact.js";
+import { auditPatch } from "./gates.js";
+import { generatePatch, modelTiers } from "./llm.js";
+import { applyHunks, createWorktree, diffWorktree, typecheckWorktree, writeWorktreeFile } from "./sandbox.js";
+import { verifyFix } from "./verify.js";
+const MIME = {
+    ".html": "text/html; charset=utf-8",
+    ".htm": "text/html; charset=utf-8",
+    ".js": "text/javascript",
+    ".mjs": "text/javascript",
+    ".json": "application/json",
+    ".css": "text/css",
+    ".svg": "image/svg+xml",
+    ".png": "image/png",
+    ".jpg": "image/jpeg",
+    ".ico": "image/x-icon",
+};
+/** Default verification server: serve the worktree's repo root statically and
+ * address the mapped file directly. Works for static fixtures; real apps inject
+ * their own dev-server `serve` fn. */
+function staticServe(worktreeDir, filePath) {
+    const entry = filePath.split(path.sep).join("/");
+    return new Promise((resolve, reject) => {
+        const server = createServer((req, res) => {
+            const pathname = decodeURIComponent(new URL(req.url ?? "/", "http://x").pathname);
+            let p = path.normalize(path.join(worktreeDir, pathname));
+            const root = path.resolve(worktreeDir);
+            if (p !== root && !p.startsWith(root + path.sep)) {
+                res.statusCode = 403;
+                res.end("forbidden");
+                return;
+            }
+            if (fs.existsSync(p) && fs.statSync(p).isDirectory())
+                p = path.join(p, "index.html");
+            try {
+                const body = fs.readFileSync(p);
+                res.setHeader("Content-Type", MIME[path.extname(p).toLowerCase()] ?? "text/plain");
+                res.end(body);
+            }
+            catch {
+                res.statusCode = 404;
+                res.end("not found");
+            }
+        });
+        server.on("error", reject);
+        server.listen(0, "127.0.0.1", () => {
+            const addr = server.address();
+            resolve({
+                url: `http://127.0.0.1:${addr.port}/${entry}`,
+                close: () => new Promise((r) => server.close(() => r())),
+            });
+        });
+    });
+}
+async function saveArtifact(repoRoot, finding, patch, gateOk, verification, worktreeDir, filePath) {
+    const dir = path.join(repoRoot, ".aztrx", "heal");
+    fs.mkdirSync(dir, { recursive: true });
+    const diff = await diffWorktree(worktreeDir, filePath);
+    const diffPath = path.join(dir, `${finding.id}.patch`);
+    fs.writeFileSync(diffPath, diff || `# (no unified diff produced)\n`, "utf-8");
+    fs.writeFileSync(path.join(dir, `${finding.id}.json`), JSON.stringify({ explanation: patch.explanation, hunks: patch.hunks, gateOk, verification }, null, 2), "utf-8");
+    return diffPath;
+}
+export async function heal(finding, opts) {
+    const base = {
+        status: "skipped",
+        findingId: finding.id,
+        filePath: finding.mappedLocation?.filePath ?? "",
+        hunks: [],
+        violations: [],
+    };
+    const loc = finding.mappedLocation;
+    if (!loc || !loc.isOwnCode) {
+        return { ...base, error: "no own-code source location to heal" };
+    }
+    if (!finding.repro || finding.repro.verdict === "unreliable") {
+        return { ...base, error: "no deterministic repro to verify against" };
+    }
+    const filePath = loc.filePath;
+    const absPath = path.resolve(opts.repoRoot, filePath);
+    let original;
+    try {
+        original = fs.readFileSync(absPath, "utf-8");
+    }
+    catch (e) {
+        return { ...base, error: `cannot read ${filePath}: ${e.message}` };
+    }
+    // 1. Redact — only the redacted copy is shown to the model.
+    const red = redact(original);
+    const ctx = { finding, filePath, fileContent: original, redactedContent: red.text };
+    // No transport configured (and no injected generator) → nothing to try. A
+    // higher model tier can't fix a missing key, so bail before paying anything.
+    if (!opts.patchFn && !process.env.ANTHROPIC_API_KEY) {
+        return {
+            ...base,
+            status: "no-llm",
+            error: "heal: ANTHROPIC_API_KEY is not set (and no patchFn was injected)",
+        };
+    }
+    // The Smart Cloud Router tier plan: fast/cheap first, Sonnet as the fallback.
+    // An injected patchFn collapses to a single tier (there is no model to route).
+    const tiers = opts.patchFn
+        ? [{ model: opts.model ?? "claude-sonnet-5", label: "sonnet" }]
+        : modelTiers(opts.model);
+    const wt = await createWorktree(opts.repoRoot, finding.id);
+    // The winning (or last) patch + verification, held back for the final save.
+    let savedPatch = null;
+    let savedVerification = null;
+    let savedGateOk = false;
+    let last = base;
+    try {
+        for (const tier of tiers) {
+            // 2. Generate (this tier).
+            let patch;
+            try {
+                patch = await generatePatch(ctx, { model: tier.model, patchFn: opts.patchFn });
+            }
+            catch (e) {
+                // A transport/config failure isn't a model-quality failure — a pricier
+                // tier won't fix a dead endpoint or a missing key, so stop here.
+                last = { ...base, status: "no-llm", error: e.message, model: tier.model };
+                break;
+            }
+            if (patch.hunks.length === 0) {
+                last = {
+                    ...base,
+                    status: "rejected",
+                    explanation: patch.explanation,
+                    error: "model produced no edits",
+                    model: tier.model,
+                };
+                continue; // a higher tier may still produce a real edit
+            }
+            // Unredact the diff back onto the raw bytes before anything is applied.
+            const hunks = patch.hunks.map((h) => ({
+                search: unredact(h.search, red.map),
+                replace: unredact(h.replace, red.map),
+            }));
+            // Apply in memory (exact-match), then gate the resulting file.
+            const applied = applyHunks(original, hunks);
+            if (!applied.ok) {
+                last = {
+                    ...base,
+                    status: "apply-failed",
+                    hunks,
+                    explanation: patch.explanation,
+                    error: applied.errors.join("; "),
+                    model: tier.model,
+                };
+                continue;
+            }
+            const gate = auditPatch(original, applied.patched, filePath);
+            if (!gate.ok) {
+                last = {
+                    ...base,
+                    status: "rejected",
+                    hunks,
+                    explanation: patch.explanation,
+                    violations: gate.violations,
+                    model: tier.model,
+                };
+                continue;
+            }
+            // 3. Sandbox — apply in a detached worktree.
+            const writeErr = writeWorktreeFile(wt.dir, filePath, applied.patched);
+            if (writeErr) {
+                last = {
+                    ...base,
+                    status: "apply-failed",
+                    hunks,
+                    explanation: patch.explanation,
+                    error: writeErr,
+                    model: tier.model,
+                };
+                continue;
+            }
+            // 3b. Compile fast-fail — reject a patch that doesn't typecheck before
+            // paying for the Playwright verification loop.
+            const compile = await typecheckWorktree(wt.dir, opts.repoRoot);
+            if (!compile.ok) {
+                last = {
+                    ...base,
+                    status: "compile-failed",
+                    hunks,
+                    explanation: patch.explanation,
+                    error: compile.output.slice(0, 400) || "tsc --noEmit failed",
+                    model: tier.model,
+                };
+                continue;
+            }
+            // 4. Verify — the bug must stop reproducing.
+            const serve = opts.serve ?? ((dir, fp) => staticServe(dir, fp));
+            const v = await verifyFix({
+                url: opts.url,
+                actions: opts.actions,
+                fingerprint: opts.fingerprint,
+                runs: opts.verifyRuns ?? 3,
+                serve: () => serve(wt.dir, filePath),
+            });
+            savedPatch = patch;
+            savedVerification = v;
+            savedGateOk = gate.ok;
+            last = {
+                ...base,
+                status: v.fixed ? "healed" : "unfixed",
+                explanation: patch.explanation,
+                hunks,
+                violations: gate.violations,
+                verification: v,
+                model: tier.model,
+            };
+            if (v.fixed)
+                break;
+        }
+        // 5. Hand off a reviewable patch (the winning — or last — attempt only).
+        if (savedPatch && savedVerification) {
+            last.patchPath = await saveArtifact(opts.repoRoot, finding, savedPatch, savedGateOk, savedVerification, wt.dir, filePath);
+        }
+        return { ...last, tiers: tiers.map((t) => t.model) };
+    }
+    finally {
+        await wt.cleanup();
+    }
+}

package/dist/core/heal/llm.js

@@ -0,0 +1,108 @@
+/**
+ * F10 — LLM patch generator. Turns a redacted bug report into a minimal
+ * Search & Replace diff. The transport is Anthropic's Messages API (key from
+ * `ANTHROPIC_API_KEY`, model from `AZTRX_MODEL` or a sensible default); a
+ * `patchFn` can be injected instead, which is how the loop is unit-tested and
+ * how a future provider (local model, proxy) plugs in without touching this
+ * module's callers.
+ */
+import { redact } from "./redact.js";
+const DEFAULT_MODEL = process.env.AZTRX_MODEL || "claude-sonnet-5";
+/** Cheap/fast first tier for the Smart Cloud Router. The idea: most one-line
+ * fixes are trivial, so try the small model before paying for the big one. */
+const FAST_MODEL = process.env.AZTRX_FAST_MODEL || "claude-haiku-4-5-20251001";
+const API_URL = "https://api.anthropic.com/v1/messages";
+/**
+ * The Smart Cloud Router's tier plan: fast/cheap first, then the capable model
+ * as the fallback. Collapses to a single tier when the two resolve to the same
+ * model (e.g. `AZTRX_FAST_MODEL=claude-sonnet-5`). Consumers loop over this in
+ * order and stop at the first `healed` result.
+ */
+export function modelTiers(fallbackModel) {
+    const fast = process.env.AZTRX_FAST_MODEL || FAST_MODEL;
+    const sonnet = fallbackModel || DEFAULT_MODEL;
+    if (fast === sonnet)
+        return [{ model: sonnet, label: "sonnet" }];
+    return [
+        { model: fast, label: "fast" },
+        { model: sonnet, label: "sonnet" },
+    ];
+}
+const SYSTEM = `You are a meticulous bug-fixing engineer. You are given a single source file and a runtime error that occurs in it. Produce a MINIMAL fix as a Search & Replace diff.
+
+Return ONLY a JSON object, no markdown fences, no prose. Shape:
+{ "explanation": "one sentence", "edits": [ { "search": "<exact substring from the file>", "replace": "<the fixed version>" } ] }
+
+Hard rules:
+- "search" must be an EXACT, unique substring of the file you were shown (include enough surrounding lines to be unique).
+- "replace" is the corrected version of exactly that substring.
+- Change as little as possible. Do not reformat unrelated code.
+- Do NOT add any new import/require/import(). Do NOT use eval or new Function. Do NOT write an empty catch block (catch {}). Do NOT touch child_process, exec, spawn, fork, process.exit.
+- If you see __AZTRX_REDACTED_N__ placeholders, treat them as opaque tokens and carry them through unchanged — do not invent values for them.
+- If you cannot fix the bug, return { "explanation": "cannot fix", "edits": [] }.`;
+function buildPrompt(ctx) {
+    const loc = ctx.finding.mappedLocation;
+    const msg = redact(ctx.finding.rawMessage).text;
+    const stack = redact(ctx.finding.rawStack).text;
+    const parts = [];
+    parts.push(`File: ${ctx.filePath}`);
+    if (loc)
+        parts.push(`Bug location: line ${loc.line}, column ${loc.column}`);
+    parts.push(`Error: ${msg.split("\n")[0].slice(0, 200)}`);
+    if (stack)
+        parts.push(`Stack (truncated):\n${stack.split("\n").slice(0, 12).join("\n")}`);
+    parts.push(`--- file: ${ctx.filePath} ---`);
+    parts.push(ctx.redactedContent);
+    parts.push("--- end file ---");
+    parts.push("Return the JSON Search & Replace diff that fixes this error.");
+    return parts.join("\n");
+}
+/** Parse a model reply into a Patch. Tolerates markdown fences and leading text. */
+export function parsePatch(raw) {
+    let text = raw.trim();
+    const fence = text.match(/```(?:json)?\s*([\s\S]*?)```/i);
+    if (fence)
+        text = fence[1].trim();
+    const start = text.indexOf("{");
+    const end = text.lastIndexOf("}");
+    if (start >= 0 && end > start)
+        text = text.slice(start, end + 1);
+    const data = JSON.parse(text);
+    const hunks = (data.edits ?? [])
+        .filter((e) => typeof e?.search === "string" && e.search.length > 0 && typeof e?.replace === "string")
+        .map((e) => ({ search: e.search, replace: e.replace }));
+    return { explanation: typeof data.explanation === "string" ? data.explanation : "", hunks };
+}
+export async function generatePatch(ctx, opts = {}) {
+    if (opts.patchFn)
+        return opts.patchFn(ctx);
+    const key = process.env.ANTHROPIC_API_KEY;
+    if (!key) {
+        throw new Error("heal: ANTHROPIC_API_KEY is not set (and no patchFn was injected)");
+    }
+    const res = await fetch(API_URL, {
+        method: "POST",
+        headers: {
+            "content-type": "application/json",
+            "x-api-key": key,
+            "anthropic-version": "2023-06-01",
+        },
+        body: JSON.stringify({
+            model: opts.model ?? DEFAULT_MODEL,
+            max_tokens: 2048,
+            temperature: 0,
+            system: SYSTEM,
+            messages: [{ role: "user", content: buildPrompt(ctx) }],
+        }),
+    });
+    if (!res.ok) {
+        const body = await res.text().catch(() => "");
+        throw new Error(`heal: LLM request failed (${res.status}): ${body.slice(0, 300)}`);
+    }
+    const data = (await res.json());
+    const text = (data.content ?? [])
+        .filter((c) => c.type === "text")
+        .map((c) => c.text ?? "")
+        .join("\n");
+    return parsePatch(text);
+}

package/dist/core/heal/redact.js

@@ -0,0 +1,63 @@
+/**
+ * Secret redaction layer — F10 gate #1. Before any byte leaves the machine
+ * (sent to an LLM, written to a log, streamed to a dashboard) it passes through
+ * here. Redaction is *reversible*: the caller keeps the placeholder→secret map
+ * so a generated Search & Replace diff (which references placeholders) can be
+ * unredacted back onto the raw source before it is applied.
+ */
+const PLACEHOLDER = (n) => `__AZTRX_REDACTED_${n}__`;
+// Whole-match secrets: the entire match is replaced by a placeholder.
+const WHOLE_MATCH = [
+    { re: /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z0-9 ]*PRIVATE KEY-----/g, label: "private_key" },
+    { re: /sk-(?:ant-)?[A-Za-z0-9_-]{20,}/g, label: "api_key" },
+    { re: /\bAKIA[0-9A-Z]{16}\b/g, label: "aws_key" },
+    { re: /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{20,}\b/g, label: "github_token" },
+    { re: /\bgithub_pat_[A-Za-z0-9_]{20,}\b/g, label: "github_token" },
+    { re: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g, label: "slack_token" },
+    { re: /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g, label: "jwt" },
+    { re: /\bBearer [A-Za-z0-9._-]{20,}/g, label: "bearer_token" },
+];
+// Prefix-preserving: group 1 stays in place (so the code structure — the key
+// name, the scheme+user of a URL — remains visible to the model), group 2 is
+// the secret value that is replaced.
+const VALUE_MATCH = [
+    {
+        re: /(["']?(?:password|passwd|pwd|secret|token|api[_-]?key|access[_-]?token|client[_-]?secret|private[_-]?key|auth[_-]?token)["']?\s*[:=]\s*)(["']?[^"'\s;,&}{=]{8,}["']?)/gi,
+        label: "secret_value",
+    },
+    {
+        re: /((?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis|amqp|amqps):\/\/[^:/\s]+:)[^@\s]+(@)/gi,
+        label: "url_password",
+    },
+];
+export function redact(input) {
+    const map = new Map();
+    let counter = 0;
+    let text = input;
+    for (const { re, label } of WHOLE_MATCH) {
+        re.lastIndex = 0;
+        text = text.replace(re, (match) => {
+            const ph = PLACEHOLDER(counter++);
+            map.set(ph, match);
+            void label;
+            return ph;
+        });
+    }
+    for (const { re, label } of VALUE_MATCH) {
+        re.lastIndex = 0;
+        text = text.replace(re, (_match, prefix, secret) => {
+            const ph = PLACEHOLDER(counter++);
+            map.set(ph, secret);
+            void label;
+            return prefix + ph;
+        });
+    }
+    return { text, map };
+}
+/** Reverse a redaction: swap every placeholder back to its original secret. */
+export function unredact(input, map) {
+    let out = input;
+    for (const [ph, secret] of map)
+        out = out.split(ph).join(secret);
+    return out;
+}

package/dist/core/heal/sandbox.js

@@ -0,0 +1,99 @@
+/**
+ * F10 gate #3 — isolated Git worktree sandbox. A patch is never applied to the
+ * user's working tree: it lands in a detached `git worktree`, is verified there,
+ * and the only artifact that escapes is a `.patch` file for a human to review
+ * and apply. Aztrx never commits — humans do.
+ */
+import { execFile } from "child_process";
+import { promisify } from "util";
+import * as fs from "fs";
+import * as os from "os";
+import * as path from "path";
+const execFileP = promisify(execFile);
+const preview = (s) => JSON.stringify(s.length > 60 ? s.slice(0, 57) + "…" : s);
+/** Create a detached worktree at HEAD in a temp dir (outside the repo). */
+export async function createWorktree(repoRoot, label) {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), `aztrx-heal-${label}-`));
+    await execFileP("git", ["-C", repoRoot, "worktree", "add", "--detach", dir, "HEAD"]);
+    return {
+        dir,
+        cleanup: async () => {
+            await execFileP("git", ["-C", repoRoot, "worktree", "remove", "--force", dir]).catch(() => { });
+            fs.rmSync(dir, { recursive: true, force: true });
+        },
+    };
+}
+/** Apply Search & Replace hunks to an in-memory file. Each `search` must match
+ * exactly once; ambiguous or missing matches fail the whole apply (no partial
+ * writes). Pure — the caller decides where the result lands. */
+export function applyHunks(content, hunks) {
+    const errors = [];
+    for (const h of hunks) {
+        const first = content.indexOf(h.search);
+        if (first === -1) {
+            errors.push(`search not found: ${preview(h.search)}`);
+            continue;
+        }
+        if (content.indexOf(h.search, first + h.search.length) !== -1) {
+            errors.push(`search ambiguous (matches multiple times): ${preview(h.search)}`);
+        }
+    }
+    if (errors.length)
+        return { ok: false, patched: content, applied: 0, errors };
+    let patched = content;
+    for (const h of hunks) {
+        patched = patched.replace(h.search, h.replace);
+    }
+    return { ok: true, patched, applied: hunks.length, errors: [] };
+}
+/** Write the patched file into the worktree, refusing to escape it. */
+export function writeWorktreeFile(worktreeDir, repoRelativePath, content) {
+    const root = path.resolve(worktreeDir);
+    const target = path.resolve(root, repoRelativePath);
+    if (target !== root && !target.startsWith(root + path.sep)) {
+        return `refusing to write outside worktree: ${repoRelativePath}`;
+    }
+    fs.mkdirSync(path.dirname(target), { recursive: true });
+    fs.writeFileSync(target, content, "utf-8");
+    return null;
+}
+/** Produce a unified diff of the patched file against HEAD in the worktree. */
+export async function diffWorktree(worktreeDir, repoRelativePath) {
+    try {
+        const { stdout } = await execFileP("git", ["-C", worktreeDir, "diff", "--", repoRelativePath]);
+        return stdout;
+    }
+    catch {
+        return "";
+    }
+}
+/** Run `tsc --noEmit` against the patched worktree — the full type check that
+ * follows the AST syntax gate. Best-effort: passes (skips) when the repo has no
+ * TypeScript or the worktree has no tsconfig, so non-TS projects aren't blocked.
+ * The worktree has no node_modules; a symlink to the root's is created first and
+ * removed with the worktree on cleanup. */
+export async function typecheckWorktree(worktreeDir, repoRoot) {
+    const tscBin = path.join(repoRoot, "node_modules", "typescript", "bin", "tsc");
+    const hasTsconfig = fs.existsSync(path.join(worktreeDir, "tsconfig.json"));
+    if (!fs.existsSync(tscBin) || !hasTsconfig) {
+        return { ok: true, ran: false, output: "" };
+    }
+    const rootNodeModules = path.join(repoRoot, "node_modules");
+    const wtNodeModules = path.join(worktreeDir, "node_modules");
+    if (!fs.existsSync(wtNodeModules)) {
+        try {
+            fs.symlinkSync(rootNodeModules, wtNodeModules, process.platform === "win32" ? "junction" : "dir");
+        }
+        catch {
+            /* symlink failed — tsc reports its own resolution errors below */
+        }
+    }
+    try {
+        const { stdout } = await execFileP(process.execPath, [tscBin, "--noEmit", "-p", worktreeDir], { cwd: worktreeDir, maxBuffer: 10 * 1024 * 1024 });
+        return { ok: true, ran: true, output: stdout.trim() };
+    }
+    catch (e) {
+        const err = e;
+        return { ok: false, ran: true, output: ((err.stdout ?? "") + (err.stderr ?? "")).trim() };
+    }
+}

package/dist/core/heal/types.js

@@ -0,0 +1 @@
+export {};