dravix-agent 0.1.0

package/dist/engines/tsc.js

@@ -0,0 +1,142 @@
+/**
+ * TypeScript compiler (tsc) adapter — subprocess to `tsc --noEmit --pretty false`.
+ *
+ * Catches type errors in .ts/.tsx (and .js with checkJs). Mirrors what an
+ * editor would show on save, but reachable from the gate.
+ */
+import { writeFile, mkdir, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { makeFindingId } from "../findings.js";
+import { run, which } from "../util/subprocess.js";
+import { getLogger } from "../util/logger.js";
+const log = getLogger("aegis.engine.tsc");
+const SUPPORTED = ["typescript", "tsx", "javascript", "jsx"];
+// Lines from `tsc --pretty false` look like:
+//   path/to/file.ts(12,5): error TS2304: Cannot find name 'foo'.
+const LINE_RE = /^(?<file>.+?)\((?<line>\d+),(?<col>\d+)\):\s+(?<kind>error|warning)\s+TS(?<code>\d+):\s+(?<msg>.+)$/;
+async function findTsc() {
+    const override = process.env.AEGIS_TSC_BIN;
+    if (override)
+        return override;
+    return (await which("tsc")) ?? (await which("tsc.cmd"));
+}
+export class TscEngine {
+    name = "tsc";
+    languages = SUPPORTED;
+    _availability = null;
+    async available() {
+        if (this._availability !== null)
+            return this._availability;
+        this._availability = (await findTsc()) !== null;
+        return this._availability;
+    }
+    async run(input) {
+        const t0 = Date.now();
+        const bin = await findTsc();
+        if (!bin) {
+            return {
+                engine: this.name,
+                findings: [],
+                unavailable: true,
+                durationMs: Date.now() - t0,
+                reason: "tsc_not_installed",
+            };
+        }
+        const scratch = (await mkdir(join(tmpdir(), `aegis-tsc-${process.pid}-${Date.now()}`), { recursive: true }));
+        const ext = input.lang === "tsx" ? ".tsx" :
+            input.lang === "typescript" ? ".ts" :
+                input.lang === "jsx" ? ".jsx" :
+                    ".js";
+        const scratchPath = join(scratch, basename(input.filePath, ext));
+        try {
+            await writeFile(scratchPath, input.content, "utf8");
+            const checkJs = input.lang === "javascript" || input.lang === "jsx";
+            const args = [
+                "--noEmit",
+                "--pretty", "false",
+                "--strict",
+                "--target", "ES2022",
+                "--module", "ESNext",
+                "--moduleResolution", "Bundler",
+                "--allowJs",
+                ...(checkJs ? ["--checkJs"] : []),
+                "--skipLibCheck",
+                scratchPath,
+            ];
+            const r = await run(bin, {
+                args,
+                timeoutMs: Math.min(input.timeoutMs, 15_000),
+            });
+            if (r.timedOut) {
+                return {
+                    engine: this.name,
+                    findings: [],
+                    unavailable: true,
+                    durationMs: Date.now() - t0,
+                    reason: "timeout",
+                };
+            }
+            const out = (r.stdout + "\n" + r.stderr).split(/\r?\n/);
+            const findings = [];
+            for (const ln of out) {
+                const m = LINE_RE.exec(ln);
+                if (!m || !m.groups)
+                    continue;
+                const lineNum = parseInt(m.groups.line ?? "0", 10);
+                const colNum = parseInt(m.groups.col ?? "0", 10);
+                const code = m.groups.code ?? "0";
+                const msg = m.groups.msg ?? "";
+                const sev = m.groups.kind === "error" ? "high" : "medium";
+                const conf = m.groups.kind === "error" ? 0.85 : 0.7;
+                findings.push({
+                    id: makeFindingId({
+                        engine: this.name,
+                        file: input.filePath,
+                        line: lineNum,
+                        rule_id: `TS${code}`,
+                    }),
+                    engine: "tsc",
+                    file: input.filePath,
+                    line: lineNum,
+                    col: colNum,
+                    rule_id: `TS${code}`,
+                    severity: sev,
+                    message: msg.slice(0, 1900),
+                    confidence: conf,
+                    source: "type",
+                });
+            }
+            return {
+                engine: this.name,
+                findings,
+                unavailable: false,
+                durationMs: Date.now() - t0,
+            };
+        }
+        catch (err) {
+            log.warn("tsc run threw", { err: String(err) });
+            return {
+                engine: this.name,
+                findings: [],
+                unavailable: true,
+                durationMs: Date.now() - t0,
+                reason: "threw",
+            };
+        }
+        finally {
+            try {
+                await rm(scratch, { recursive: true, force: true });
+            }
+            catch {
+                // ignore
+            }
+        }
+    }
+}
+function basename(p, ext) {
+    const m = p.replace(/\\/g, "/").split("/");
+    const name = m[m.length - 1] || "file";
+    return name.includes(".") ? name : name + ext;
+}
+//# sourceMappingURL=tsc.js.map

package/dist/engines/tsc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tsc.js","sourceRoot":"","sources":["../../src/engines/tsc.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC,OAAO,EAAW,aAAa,EAAY,MAAM,gBAAgB,CAAC;AAElE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAE9C,MAAM,GAAG,GAAG,SAAS,CAAC,kBAAkB,CAAC,CAAC;AAE1C,MAAM,SAAS,GAAwB,CAAC,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC;AAElF,6CAA6C;AAC7C,iEAAiE;AACjE,MAAM,OAAO,GACX,qGAAqG,CAAC;AAExG,KAAK,UAAU,OAAO;IACpB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IAC3C,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,OAAO,CAAC,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,OAAO,SAAS;IACX,IAAI,GAAG,KAAK,CAAC;IACb,SAAS,GAAG,SAAS,CAAC;IAEvB,aAAa,GAAmB,IAAI,CAAC;IAE7C,KAAK,CAAC,SAAS;QACb,IAAI,IAAI,CAAC,aAAa,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,aAAa,CAAC;QAC3D,IAAI,CAAC,aAAa,GAAG,CAAC,MAAM,OAAO,EAAE,CAAC,KAAK,IAAI,CAAC;QAChD,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAqB;QAC7B,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,MAAM,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO;gBACL,MAAM,EAAE,IAAI,CAAC,IAAI;gBACjB,QAAQ,EAAE,EAAE;gBACZ,WAAW,EAAE,IAAI;gBACjB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;gBAC3B,MAAM,EAAE,mBAAmB;aAC5B,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,CAAC,MAAM,KAAK,CAC1B,IAAI,CAAC,MAAM,EAAE,EAAE,aAAa,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,EACxD,EAAE,SAAS,EAAE,IAAI,EAAE,CACpB,CAAW,CAAC;QACb,MAAM,GAAG,GACP,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YAC/B,KAAK,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;gBACrC,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;oBAC/B,KAAK,CAAC;QACR,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;QACjE,IAAI,CAAC;YACH,MAAM,SAAS,CAAC,WAAW,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACpD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,KAAK,YAAY,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC;YACpE,MAAM,IAAI,GAAG;gBACX,UAAU;gBACV,UAAU,EAAE,OAAO;gBACnB,UAAU;gBACV,UAAU,EAAE,QAAQ;gBACpB,UAAU,EAAE,QAAQ;gBACpB,oBAAoB,EAAE,SAAS;gBAC/B,WAAW;gBACX,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjC,gBAAgB;gBAChB,WAAW;aACZ,CAAC;YACF,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,GAAG,EAAE;gBACvB,IAAI;gBACJ,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC;aAC7C,CAAC,CAAC;YACH,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;gBACf,OAAO;oBACL,MAAM,EAAE,IAAI,CAAC,IAAI;oBACjB,QAAQ,EAAE,EAAE;oBACZ,WAAW,EAAE,IAAI;oBACjB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;oBAC3B,MAAM,EAAE,SAAS;iBAClB,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACxD,MAAM,QAAQ,GAAc,EAAE,CAAC;YAC/B,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;gBACrB,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBAC3B,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM;oBAAE,SAAS;gBAC9B,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;gBACnD,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;gBACjD,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,IAAI,GAAG,CAAC;gBAClC,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;gBAC/B,MAAM,GAAG,GAAa,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;gBACpE,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;gBACpD,QAAQ,CAAC,IAAI,CAAC;oBACZ,EAAE,EAAE,aAAa,CAAC;wBAChB,MAAM,EAAE,IAAI,CAAC,IAAI;wBACjB,IAAI,EAAE,KAAK,CAAC,QAAQ;wBACpB,IAAI,EAAE,OAAO;wBACb,OAAO,EAAE,KAAK,IAAI,EAAE;qBACrB,CAAC;oBACF,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,KAAK,CAAC,QAAQ;oBACpB,IAAI,EAAE,OAAO;oBACb,GAAG,EAAE,MAAM;oBACX,OAAO,EAAE,KAAK,IAAI,EAAE;oBACpB,QAAQ,EAAE,GAAG;oBACb,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC;oBAC3B,UAAU,EAAE,IAAI;oBAChB,MAAM,EAAE,MAAM;iBACf,CAAC,CAAC;YACL,CAAC;YACD,OAAO;gBACL,MAAM,EAAE,IAAI,CAAC,IAAI;gBACjB,QAAQ;gBACR,WAAW,EAAE,KAAK;gBAClB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;aAC5B,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChD,OAAO;gBACL,MAAM,EAAE,IAAI,CAAC,IAAI;gBACjB,QAAQ,EAAE,EAAE;gBACZ,WAAW,EAAE,IAAI;gBACjB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;gBAC3B,MAAM,EAAE,OAAO;aAChB,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC;gBACH,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACtD,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAED,SAAS,QAAQ,CAAC,CAAS,EAAE,GAAW;IACtC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,MAAM,CAAC;IACvC,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,GAAG,CAAC;AAChD,CAAC"}

package/dist/engines/types.d.ts

@@ -0,0 +1,47 @@
+/** Engine interface — every analyzer implements this. */
+import type { ProjectContextBlock } from "../index/context.js";
+import { Finding } from "../findings.js";
+import { Lang } from "../lang.js";
+export interface EngineRunInput {
+    /** Absolute path of the file under judgement. */
+    filePath: string;
+    /** Full file contents (UTF-8). */
+    content: string;
+    /** Detected language. */
+    lang: Lang;
+    /** Optional project root for engines that need cross-file context. */
+    projectRoot?: string;
+    /** Max wall-clock the engine has to return. Hard cap. */
+    timeoutMs: number;
+    /** Findings emitted by stage-1 engines (semgrep, pyright, etc.). Populated
+     * by the orchestrator BEFORE invoking stage-2 engines (currently:
+     * llm-critic) so the critic can reason over the static evidence instead
+     * of re-deriving it. Empty / undefined for stage-1 engines. */
+    priorFindings?: ReadonlyArray<Finding>;
+    /** Cross-file context block (SCIP-derived). Populated when the project
+     * has been indexed. Stage-2 engines use it as evidence in their prompt. */
+    projectContext?: ProjectContextBlock;
+}
+export interface EngineRunResult {
+    engine: string;
+    findings: Finding[];
+    /** True if the engine couldn't run (binary missing, parse failed). */
+    unavailable: boolean;
+    /** Wall-clock duration in ms. */
+    durationMs: number;
+    /** Optional short reason if unavailable. */
+    reason?: string;
+}
+export interface Engine {
+    /** Stable name; must match the `Engine` enum in `findings.ts`. */
+    readonly name: string;
+    /** Languages this engine supports. Empty = all. */
+    readonly languages: ReadonlyArray<Lang> | "all";
+    /** Quick check (no work) — is this engine available on the host? */
+    available(): Promise<boolean>;
+    /** Run the engine on one file. Must never throw. */
+    run(input: EngineRunInput): Promise<EngineRunResult>;
+}
+/** Wraps an engine `run` with try/catch + timing — never lets an engine kill the gate. */
+export declare function safeRun(engine: Engine, input: EngineRunInput): Promise<EngineRunResult>;
+//# sourceMappingURL=types.d.ts.map

package/dist/engines/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/engines/types.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAElC,MAAM,WAAW,cAAc;IAC7B,iDAAiD;IACjD,QAAQ,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,yBAAyB;IACzB,IAAI,EAAE,IAAI,CAAC;IACX,sEAAsE;IACtE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yDAAyD;IACzD,SAAS,EAAE,MAAM,CAAC;IAClB;;;mEAG+D;IAC/D,aAAa,CAAC,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC;IACvC;+EAC2E;IAC3E,cAAc,CAAC,EAAE,mBAAmB,CAAC;CACtC;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,sEAAsE;IACtE,WAAW,EAAE,OAAO,CAAC;IACrB,iCAAiC;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,4CAA4C;IAC5C,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,MAAM;IACrB,kEAAkE;IAClE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,mDAAmD;IACnD,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IAChD,oEAAoE;IACpE,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9B,oDAAoD;IACpD,GAAG,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;CACtD;AAED,0FAA0F;AAC1F,wBAAsB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC,CAuB7F"}

package/dist/engines/types.js

@@ -0,0 +1,27 @@
+/** Wraps an engine `run` with try/catch + timing — never lets an engine kill the gate. */
+export async function safeRun(engine, input) {
+    const t0 = Date.now();
+    try {
+        if (engine.languages !== "all" && !engine.languages.includes(input.lang)) {
+            return {
+                engine: engine.name,
+                findings: [],
+                unavailable: false,
+                durationMs: 0,
+                reason: "lang_not_supported",
+            };
+        }
+        const r = await engine.run(input);
+        return r;
+    }
+    catch (err) {
+        return {
+            engine: engine.name,
+            findings: [],
+            unavailable: true,
+            durationMs: Date.now() - t0,
+            reason: err instanceof Error ? err.message.slice(0, 200) : "unknown_error",
+        };
+    }
+}
+//# sourceMappingURL=types.js.map

package/dist/engines/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/engines/types.ts"],"names":[],"mappings":"AAgDA,0FAA0F;AAC1F,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,MAAc,EAAE,KAAqB;IACjE,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACtB,IAAI,CAAC;QACH,IAAI,MAAM,CAAC,SAAS,KAAK,KAAK,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACzE,OAAO;gBACL,MAAM,EAAE,MAAM,CAAC,IAAI;gBACnB,QAAQ,EAAE,EAAE;gBACZ,WAAW,EAAE,KAAK;gBAClB,UAAU,EAAE,CAAC;gBACb,MAAM,EAAE,oBAAoB;aAC7B,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAClC,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,MAAM,EAAE,MAAM,CAAC,IAAI;YACnB,QAAQ,EAAE,EAAE;YACZ,WAAW,EAAE,IAAI;YACjB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;YAC3B,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe;SAC3E,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/findings.d.ts

@@ -0,0 +1,121 @@
+import { z } from "zod";
+export declare const SeverityEnum: z.ZodEnum<["info", "low", "medium", "high", "critical"]>;
+export type Severity = z.infer<typeof SeverityEnum>;
+export declare const SEVERITY_ORDER: readonly Severity[];
+export declare function severityRank(s: Severity): number;
+export declare const EngineEnum: z.ZodEnum<["treesitter", "semgrep", "pyright", "tsc", "eslint", "secret-scan", "python-sinks", "js-sinks", "ai-sinks", "scip", "joern", "embeddings", "pysa", "racerd", "vulrag", "router-150m", "llm-critic"]>;
+export type Engine = z.infer<typeof EngineEnum>;
+export declare const SourceKindEnum: z.ZodEnum<["pattern", "type", "lint", "dataflow", "router", "critic", "ensemble"]>;
+export type SourceKind = z.infer<typeof SourceKindEnum>;
+export declare const FindingSchema: z.ZodObject<{
+    id: z.ZodString;
+    engine: z.ZodEnum<["treesitter", "semgrep", "pyright", "tsc", "eslint", "secret-scan", "python-sinks", "js-sinks", "ai-sinks", "scip", "joern", "embeddings", "pysa", "racerd", "vulrag", "router-150m", "llm-critic"]>;
+    file: z.ZodString;
+    line: z.ZodOptional<z.ZodNumber>;
+    col: z.ZodOptional<z.ZodNumber>;
+    rule_id: z.ZodString;
+    cwe: z.ZodOptional<z.ZodString>;
+    severity: z.ZodEnum<["info", "low", "medium", "high", "critical"]>;
+    message: z.ZodString;
+    evidence: z.ZodOptional<z.ZodObject<{
+        snippet: z.ZodOptional<z.ZodString>;
+        dataflow: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            file: z.ZodString;
+            line: z.ZodNumber;
+            label: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            file: string;
+            line: number;
+            label: string;
+        }, {
+            file: string;
+            line: number;
+            label: string;
+        }>, "many">>;
+        callers: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        related_cves: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        dataflow?: {
+            file: string;
+            line: number;
+            label: string;
+        }[] | undefined;
+        snippet?: string | undefined;
+        callers?: string[] | undefined;
+        related_cves?: string[] | undefined;
+    }, {
+        dataflow?: {
+            file: string;
+            line: number;
+            label: string;
+        }[] | undefined;
+        snippet?: string | undefined;
+        callers?: string[] | undefined;
+        related_cves?: string[] | undefined;
+    }>>;
+    confidence: z.ZodNumber;
+    source: z.ZodEnum<["pattern", "type", "lint", "dataflow", "router", "critic", "ensemble"]>;
+    remediation: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    message: string;
+    file: string;
+    id: string;
+    engine: "treesitter" | "semgrep" | "pyright" | "tsc" | "eslint" | "secret-scan" | "python-sinks" | "js-sinks" | "ai-sinks" | "scip" | "joern" | "embeddings" | "pysa" | "racerd" | "vulrag" | "router-150m" | "llm-critic";
+    rule_id: string;
+    severity: "info" | "low" | "medium" | "high" | "critical";
+    confidence: number;
+    source: "type" | "pattern" | "lint" | "dataflow" | "router" | "critic" | "ensemble";
+    line?: number | undefined;
+    col?: number | undefined;
+    cwe?: string | undefined;
+    evidence?: {
+        dataflow?: {
+            file: string;
+            line: number;
+            label: string;
+        }[] | undefined;
+        snippet?: string | undefined;
+        callers?: string[] | undefined;
+        related_cves?: string[] | undefined;
+    } | undefined;
+    remediation?: string | undefined;
+}, {
+    message: string;
+    file: string;
+    id: string;
+    engine: "treesitter" | "semgrep" | "pyright" | "tsc" | "eslint" | "secret-scan" | "python-sinks" | "js-sinks" | "ai-sinks" | "scip" | "joern" | "embeddings" | "pysa" | "racerd" | "vulrag" | "router-150m" | "llm-critic";
+    rule_id: string;
+    severity: "info" | "low" | "medium" | "high" | "critical";
+    confidence: number;
+    source: "type" | "pattern" | "lint" | "dataflow" | "router" | "critic" | "ensemble";
+    line?: number | undefined;
+    col?: number | undefined;
+    cwe?: string | undefined;
+    evidence?: {
+        dataflow?: {
+            file: string;
+            line: number;
+            label: string;
+        }[] | undefined;
+        snippet?: string | undefined;
+        callers?: string[] | undefined;
+        related_cves?: string[] | undefined;
+    } | undefined;
+    remediation?: string | undefined;
+}>;
+export type Finding = z.infer<typeof FindingSchema>;
+/** Stable 16-hex id from engine+file+line+rule — same input = same id (idempotent). */
+export declare function makeFindingId(parts: {
+    engine: string;
+    file: string;
+    line?: number;
+    rule_id: string;
+}): string;
+/**
+ * Helper: validate a finding (throws on invalid). Engines call this in dev to
+ * fail loud; in production we use safeParse + log the violator and drop it.
+ */
+export declare function validateFinding(f: unknown): Finding;
+/** Safe variant: returns null on invalid (engine bug shouldn't kill the gate). */
+export declare function safeValidate(f: unknown): Finding | null;
+//# sourceMappingURL=findings.d.ts.map

package/dist/findings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"findings.d.ts","sourceRoot":"","sources":["../src/findings.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,YAAY,0DAAwD,CAAC;AAClF,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAEpD,eAAO,MAAM,cAAc,EAAE,SAAS,QAAQ,EAMpC,CAAC;AAEX,wBAAgB,YAAY,CAAC,CAAC,EAAE,QAAQ,GAAG,MAAM,CAEhD;AAED,eAAO,MAAM,UAAU,iNAoBrB,CAAC;AACH,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEhD,eAAO,MAAM,cAAc,oFAQzB,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAexD,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAcxB,CAAC;AACH,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAEpD,uFAAuF;AACvF,wBAAgB,aAAa,CAAC,KAAK,EAAE;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB,GAAG,MAAM,CAUT;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,OAAO,GAAG,OAAO,CAEnD;AAED,kFAAkF;AAClF,wBAAgB,YAAY,CAAC,CAAC,EAAE,OAAO,GAAG,OAAO,GAAG,IAAI,CAGvD"}

package/dist/findings.js

@@ -0,0 +1,98 @@
+/**
+ * Unified Finding schema — the single contract every engine produces.
+ * Engines do not leak their native shapes; the orchestrator only sees `Finding`.
+ */
+import { createHash } from "node:crypto";
+import { z } from "zod";
+export const SeverityEnum = z.enum(["info", "low", "medium", "high", "critical"]);
+export const SEVERITY_ORDER = [
+    "info",
+    "low",
+    "medium",
+    "high",
+    "critical",
+];
+export function severityRank(s) {
+    return SEVERITY_ORDER.indexOf(s);
+}
+export const EngineEnum = z.enum([
+    // Phase 0
+    "treesitter",
+    "semgrep",
+    "pyright",
+    "tsc",
+    "eslint",
+    "secret-scan",
+    "python-sinks",
+    "js-sinks",
+    "ai-sinks",
+    // Phase 1+ (declared so the schema is stable from day 1)
+    "scip",
+    "joern",
+    "embeddings",
+    "pysa",
+    "racerd",
+    "vulrag",
+    "router-150m",
+    "llm-critic",
+]);
+export const SourceKindEnum = z.enum([
+    "pattern", // regex / syntactic match
+    "type", // type checker
+    "lint", // linter rule
+    "dataflow", // taint / data-flow path
+    "router", // 150M classifier output
+    "critic", // LLM critic verdict
+    "ensemble", // multi-source agreement
+]);
+const DataFlowNode = z.object({
+    file: z.string(),
+    line: z.number().int().positive(),
+    label: z.string().max(200),
+});
+const Evidence = z.object({
+    snippet: z.string().max(4000).optional(),
+    dataflow: z.array(DataFlowNode).max(20).optional(),
+    callers: z.array(z.string().max(200)).max(10).optional(),
+    related_cves: z.array(z.string().max(40)).max(5).optional(),
+});
+export const FindingSchema = z.object({
+    id: z.string().regex(/^[0-9a-f]{16}$/),
+    engine: EngineEnum,
+    file: z.string().min(1),
+    line: z.number().int().positive().optional(),
+    col: z.number().int().positive().optional(),
+    rule_id: z.string().min(1).max(200),
+    cwe: z.string().regex(/^CWE-\d+$/).optional(),
+    severity: SeverityEnum,
+    message: z.string().min(1).max(2000),
+    evidence: Evidence.optional(),
+    confidence: z.number().min(0).max(1),
+    source: SourceKindEnum,
+    remediation: z.string().max(4000).optional(),
+});
+/** Stable 16-hex id from engine+file+line+rule — same input = same id (idempotent). */
+export function makeFindingId(parts) {
+    const h = createHash("sha256");
+    h.update(parts.engine);
+    h.update("\0");
+    h.update(parts.file);
+    h.update("\0");
+    h.update(String(parts.line ?? ""));
+    h.update("\0");
+    h.update(parts.rule_id);
+    return h.digest("hex").slice(0, 16);
+}
+/**
+ * Helper: validate a finding (throws on invalid). Engines call this in dev to
+ * fail loud; in production we use safeParse + log the violator and drop it.
+ */
+export function validateFinding(f) {
+    return FindingSchema.parse(f);
+}
+/** Safe variant: returns null on invalid (engine bug shouldn't kill the gate). */
+export function safeValidate(f) {
+    const parsed = FindingSchema.safeParse(f);
+    return parsed.success ? parsed.data : null;
+}
+//# sourceMappingURL=findings.js.map

package/dist/findings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"findings.js","sourceRoot":"","sources":["../src/findings.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;AAGlF,MAAM,CAAC,MAAM,cAAc,GAAwB;IACjD,MAAM;IACN,KAAK;IACL,QAAQ;IACR,MAAM;IACN,UAAU;CACF,CAAC;AAEX,MAAM,UAAU,YAAY,CAAC,CAAW;IACtC,OAAO,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,IAAI,CAAC;IAC/B,UAAU;IACV,YAAY;IACZ,SAAS;IACT,SAAS;IACT,KAAK;IACL,QAAQ;IACR,aAAa;IACb,cAAc;IACd,UAAU;IACV,UAAU;IACV,yDAAyD;IACzD,MAAM;IACN,OAAO;IACP,YAAY;IACZ,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,aAAa;IACb,YAAY;CACb,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC;IACnC,SAAS,EAAE,0BAA0B;IACrC,MAAM,EAAE,eAAe;IACvB,MAAM,EAAE,cAAc;IACtB,UAAU,EAAE,yBAAyB;IACrC,QAAQ,EAAE,yBAAyB;IACnC,QAAQ,EAAE,qBAAqB;IAC/B,UAAU,EAAE,yBAAyB;CACtC,CAAC,CAAC;AAGH,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACjC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC;CAC3B,CAAC,CAAC;AAEH,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC;IACxB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IACxC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAClD,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IACxD,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC5D,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC;IACtC,MAAM,EAAE,UAAU;IAClB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC5C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC3C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACnC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE;IAC7C,QAAQ,EAAE,YAAY;IACtB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;IACpC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE;IAC7B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACpC,MAAM,EAAE,cAAc;IACtB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;CAC7C,CAAC,CAAC;AAGH,uFAAuF;AACvF,MAAM,UAAU,aAAa,CAAC,KAK7B;IACC,MAAM,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC/B,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACf,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACf,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;IACnC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACf,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACxB,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACtC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,CAAU;IACxC,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAChC,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,YAAY,CAAC,CAAU;IACrC,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAC1C,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7C,CAAC"}

package/dist/hooks/claude-code.d.ts

@@ -0,0 +1,3 @@
+/** Main entry — call from `bin/aegis hook`. */
+export declare function runHook(): Promise<void>;
+//# sourceMappingURL=claude-code.d.ts.map

package/dist/hooks/claude-code.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-code.d.ts","sourceRoot":"","sources":["../../src/hooks/claude-code.ts"],"names":[],"mappings":"AA4KA,+CAA+C;AAC/C,wBAAsB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAqD7C"}

package/dist/hooks/claude-code.js

@@ -0,0 +1,187 @@
+/**
+ * Claude Code hook protocol — stdin/stdout JSON, exit-code controlled.
+ *
+ * Hook invocation (per Claude Code docs):
+ *   stdin  = JSON {"tool_input": {"file_path": "...", "content": "..."}, ...}
+ *   stdout = optional advisory text (warnings)
+ *   exit 0 = allow, exit 2 = block (Claude shows the stderr message to the user
+ *            and asks the agent to regenerate)
+ *
+ * This handler:
+ *   1. Reads JSON from stdin (no time pressure — Claude waits).
+ *   2. Extracts file_path + content from tool_input. Supports both `content`
+ *      (Write) and `new_string` (Edit) — for Edit, reconstructs the full
+ *      post-edit file by reading from disk and applying the string swap so
+ *      syntax/parse engines see a complete file, not a fragment.
+ *   3. Calls `runGate`.
+ *   4. Writes the remediation prompt to stderr.
+ *   5. Exits 0 / 2.
+ */
+import { existsSync, readFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { runGate } from "../orchestrator.js";
+import { getLogger } from "../util/logger.js";
+const log = getLogger("aegis.hook");
+function readStdinSync() {
+    try {
+        return readFileSync(0, "utf8");
+    }
+    catch (err) {
+        log.warn("stdin read failed", { err: String(err) });
+        return "";
+    }
+}
+function parsePayload(raw) {
+    if (!raw.trim())
+        return {};
+    try {
+        return JSON.parse(raw);
+    }
+    catch (err) {
+        log.warn("hook payload not JSON", { err: String(err), preview: raw.slice(0, 200) });
+        return {};
+    }
+}
+/** Extract the file_path + the FULL post-edit content from a hook payload.
+ *
+ * For ``Write``: ``tool_input.content`` is the full new file — use as-is.
+ * For ``Edit``: ``tool_input.new_string`` is a fragment to swap into an
+ *   existing file. Read the on-disk file, replace the first occurrence of
+ *   ``old_string`` with ``new_string`` — that reconstructs what the file
+ *   WILL look like after the edit. Sending the fragment alone would make
+ *   syntax/parse engines fire spurious "unbalanced brace" errors.
+ */
+function extractFileAndContent(p, cwd) {
+    const ti = p.tool_input ?? p.toolInput ?? {};
+    const filePath = ti.file_path ?? ti.filePath ?? ti.path ?? null;
+    if (!filePath)
+        return { filePath: null, content: null, fullFile: false };
+    // Write tool: content is full file.
+    if (ti.content !== undefined && ti.content !== null) {
+        return { filePath, content: ti.content, fullFile: true };
+    }
+    // Edit tool: reconstruct full file by applying the swap.
+    const newStr = ti.new_string ?? ti.newString ?? null;
+    const oldStr = ti.old_string ?? ti.oldString ?? null;
+    if (newStr !== null && oldStr !== null) {
+        const absPath = resolve(cwd, filePath);
+        if (existsSync(absPath)) {
+            try {
+                const original = readFileSync(absPath, "utf8");
+                // Apply the FIRST occurrence (matching the Edit tool's contract).
+                const idx = original.indexOf(oldStr);
+                if (idx >= 0) {
+                    const reconstructed = original.slice(0, idx) + newStr + original.slice(idx + oldStr.length);
+                    return { filePath, content: reconstructed, fullFile: true };
+                }
+                log.debug("hook: old_string not found in file — falling back to fragment", {
+                    file: absPath,
+                    previewLen: oldStr.length,
+                });
+            }
+            catch (err) {
+                log.debug("hook: file read failed — falling back to fragment", {
+                    file: absPath,
+                    err: String(err),
+                });
+            }
+        }
+        // Fragment-only fallback. The gate may emit spurious syntax findings,
+        // but we don't want to silently allow uninspected content either.
+        return { filePath, content: newStr, fullFile: false };
+    }
+    return { filePath: null, content: null, fullFile: false };
+}
+function formatRemediation(report) {
+    const lines = [];
+    lines.push(`[aegis] BLOCKED ${report.filePath}`);
+    lines.push(`        ${report.decision.summary}`);
+    const top = report.findings.slice(0, 5);
+    for (const f of top) {
+        const loc = f.line ? `:${f.line}${f.col ? `:${f.col}` : ""}` : "";
+        const cwe = f.cwe ? ` [${f.cwe}]` : "";
+        lines.push(`  - ${f.engine}/${f.rule_id}${cwe} (${f.severity}, conf=${f.confidence.toFixed(2)}) at ${f.file}${loc}`);
+        lines.push(`      ${f.message.slice(0, 200)}`);
+        if (f.remediation) {
+            lines.push(`      fix: ${f.remediation.slice(0, 300)}`);
+        }
+    }
+    if (report.findings.length > top.length) {
+        lines.push(`  ... and ${report.findings.length - top.length} more.`);
+    }
+    lines.push("");
+    lines.push("Regenerate the file fixing the items above, then save again.");
+    return lines.join("\n");
+}
+/**
+ * Drain the telemetry buffer with a short hard cap. The hook runs in the
+ * critical path of the agent regenerate loop, so we cap upload latency at
+ * 3 s — if the server is slow/unreachable the data stays in-buffer and is
+ * picked up on the next process that successfully flushes (the in-memory
+ * buffer is per-process, so in practice this means the batch is dropped;
+ * acceptable for a single-finding write).
+ */
+async function drainTelemetry() {
+    try {
+        const { flush } = await import("../telemetry/collector.js");
+        await Promise.race([
+            flush(),
+            new Promise((resolve) => setTimeout(resolve, 3000).unref()),
+        ]);
+    }
+    catch (err) {
+        log.debug("hook telemetry flush failed", { err: String(err) });
+    }
+}
+/** Main entry — call from `bin/aegis hook`. */
+export async function runHook() {
+    const raw = readStdinSync();
+    const payload = parsePayload(raw);
+    const cwd = payload.cwd ?? process.cwd();
+    const { filePath, content, fullFile } = extractFileAndContent(payload, cwd);
+    if (!filePath || content === null) {
+        log.debug("hook: no file_path/content in payload — allowing");
+        process.exit(0);
+    }
+    const projectRoot = payload.project_root ?? payload.projectRoot ?? cwd;
+    const absFile = resolve(cwd, filePath);
+    let report;
+    try {
+        report = await runGate({
+            filePath: absFile,
+            content,
+            projectRoot,
+            // Containment is OFF for the hook: the agent already chose the
+            // file path (cwd is just an opinion, not a security boundary).
+            // The hardcoded denylist for ~/.ssh / /etc / etc. STILL applies
+            // via safeResolve regardless — that's the actual security gate.
+            // Without this, every write to a memory file / dotfile / abs path
+            // outside cwd would be blocked with reason="outside_root".
+            enforceContainment: false,
+            totalTimeoutMs: Number.parseInt(process.env.AEGIS_TOTAL_TIMEOUT_MS ?? "5000", 10),
+        });
+    }
+    catch (err) {
+        // Never block on internal errors — fail OPEN with a warning.
+        log.error("hook gate threw", { err: String(err) });
+        process.stderr.write(`[aegis] internal error: ${String(err).slice(0, 200)} — allowing\n`);
+        process.exit(0);
+    }
+    if (report.decision.action === "block") {
+        process.stderr.write(formatRemediation(report) + "\n");
+        if (!fullFile) {
+            process.stderr.write(`[aegis] note: validated only the Edit fragment (could not reconstruct full file). ` +
+                `Some findings may be spurious — please review before bypassing.\n`);
+        }
+        await drainTelemetry();
+        process.exit(2);
+    }
+    if (report.decision.action === "warn") {
+        process.stderr.write(`[aegis] WARN ${report.filePath}: ${report.decision.summary}\n`);
+        await drainTelemetry();
+        process.exit(0);
+    }
+    await drainTelemetry();
+    process.exit(0);
+}
+//# sourceMappingURL=claude-code.js.map