dravix-agent 0.1.0

package/dist/mcp/tools/validate.d.ts

@@ -0,0 +1,73 @@
+/**
+ * `validate_edit` — authoritative gate (PostToolUse).
+ *
+ * Uses the MCP warm fast-path:
+ *   1. in-mem verdict LRU lookup (sub-millisecond on hit)
+ *   2. single-flight dedup for concurrent identical scans
+ *   3. fresh runGate() with precomputed engine availability
+ */
+import { z } from "zod";
+export declare const validateEditInputSchema: z.ZodObject<{
+    file_path: z.ZodString;
+    content: z.ZodString;
+    project_root: z.ZodOptional<z.ZodString>;
+    /** Override engines (rare — for tests). */
+    engines: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+}, "strip", z.ZodTypeAny, {
+    file_path: string;
+    content: string;
+    project_root?: string | undefined;
+    engines?: string[] | undefined;
+}, {
+    file_path: string;
+    content: string;
+    project_root?: string | undefined;
+    engines?: string[] | undefined;
+}>;
+export type ValidateEditInput = z.infer<typeof validateEditInputSchema>;
+export interface ValidateEditOutput {
+    verdict: "allow" | "warn" | "block";
+    summary: string;
+    duration_ms: number;
+    truncated: boolean;
+    /** Origin of the verdict — "lru" = in-mem cache hit (sub-ms),
+     * "fresh" = full gate run. Useful for clients to display "cached" badges. */
+    cache_source: "lru" | "single-flight" | "fresh";
+    findings: Array<{
+        id: string;
+        engine: string;
+        rule_id: string;
+        file: string;
+        line?: number;
+        col?: number;
+        cwe?: string;
+        severity: string;
+        confidence: number;
+        message: string;
+        remediation?: string;
+    }>;
+    /** Phase-1 sidecar: cross-file evidence (definitions of imports + callers).
+     * Present iff a SCIP index exists for the project. */
+    project_context?: {
+        available: boolean;
+        languages: string[];
+        imported_definitions: Array<{
+            symbol: string;
+            kind: string;
+            file: string;
+            line: number;
+            snippet?: string;
+        }>;
+        callers: Array<{
+            symbol: string;
+            callers: Array<{
+                file: string;
+                line: number;
+            }>;
+        }>;
+        duration_ms: number;
+    };
+    remediation_prompt?: string;
+}
+export declare function runValidateEdit(input: ValidateEditInput): Promise<ValidateEditOutput>;
+//# sourceMappingURL=validate.d.ts.map

package/dist/mcp/tools/validate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../../src/mcp/tools/validate.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,uBAAuB;;;;IAIlC,2CAA2C;;;;;;;;;;;;EAE3C,CAAC;AAEH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB;iFAC6E;IAC7E,YAAY,EAAE,KAAK,GAAG,eAAe,GAAG,OAAO,CAAC;IAChD,QAAQ,EAAE,KAAK,CAAC;QACd,EAAE,EAAE,MAAM,CAAC;QACX,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,MAAM,CAAC;QACnB,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC,CAAC;IACH;0DACsD;IACtD,eAAe,CAAC,EAAE;QAChB,SAAS,EAAE,OAAO,CAAC;QACnB,SAAS,EAAE,MAAM,EAAE,CAAC;QACpB,oBAAoB,EAAE,KAAK,CAAC;YAC1B,MAAM,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,OAAO,CAAC,EAAE,MAAM,CAAC;SAC5E,CAAC,CAAC;QACH,OAAO,EAAE,KAAK,CAAC;YACb,MAAM,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,KAAK,CAAC;gBAAE,IAAI,EAAE,MAAM,CAAC;gBAAC,IAAI,EAAE,MAAM,CAAA;aAAE,CAAC,CAAC;SAChE,CAAC,CAAC;QACH,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,wBAAsB,eAAe,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAoC3F"}

package/dist/mcp/tools/validate.js

@@ -0,0 +1,66 @@
+/**
+ * `validate_edit` — authoritative gate (PostToolUse).
+ *
+ * Uses the MCP warm fast-path:
+ *   1. in-mem verdict LRU lookup (sub-millisecond on hit)
+ *   2. single-flight dedup for concurrent identical scans
+ *   3. fresh runGate() with precomputed engine availability
+ */
+import { z } from "zod";
+import { runGateFast } from "../warm.js";
+export const validateEditInputSchema = z.object({
+    file_path: z.string().min(1),
+    content: z.string(),
+    project_root: z.string().optional(),
+    /** Override engines (rare — for tests). */
+    engines: z.array(z.string()).optional(),
+});
+export async function runValidateEdit(input) {
+    const { report, source } = await runGateFast({
+        filePath: input.file_path,
+        content: input.content,
+        ...(input.project_root !== undefined ? { projectRoot: input.project_root } : {}),
+    });
+    const findings = report.findings.map((f) => ({
+        id: f.id,
+        engine: f.engine,
+        rule_id: f.rule_id,
+        file: f.file,
+        ...(f.line !== undefined ? { line: f.line } : {}),
+        ...(f.col !== undefined ? { col: f.col } : {}),
+        ...(f.cwe !== undefined ? { cwe: f.cwe } : {}),
+        severity: f.severity,
+        confidence: f.confidence,
+        message: f.message,
+        ...(f.remediation !== undefined ? { remediation: f.remediation } : {}),
+    }));
+    const out = {
+        verdict: report.decision.action,
+        summary: report.decision.summary,
+        duration_ms: report.durationMs,
+        truncated: report.truncated,
+        cache_source: source,
+        findings,
+    };
+    if (report.projectContext) {
+        out.project_context = report.projectContext;
+    }
+    if (report.decision.action === "block") {
+        out.remediation_prompt = formatRemediation(report.filePath, findings.slice(0, 5));
+    }
+    return out;
+}
+function formatRemediation(filePath, top) {
+    const lines = [];
+    lines.push(`The proposed write to ${filePath} was blocked by Aegis. Fix:`);
+    for (const f of top) {
+        const loc = f.line ? `:${f.line}` : "";
+        const cwe = f.cwe ? ` [${f.cwe}]` : "";
+        lines.push(`- ${f.engine}/${f.rule_id}${cwe} at ${f.file}${loc} — ${f.message}`);
+        if (f.remediation)
+            lines.push(`  fix: ${f.remediation}`);
+    }
+    lines.push("Regenerate the file applying all the items above, then save again.");
+    return lines.join("\n");
+}
+//# sourceMappingURL=validate.js.map

package/dist/mcp/tools/validate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../../src/mcp/tools/validate.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEzC,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,2CAA2C;IAC3C,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAyCH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAAwB;IAC5D,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,WAAW,CAAC;QAC3C,QAAQ,EAAE,KAAK,CAAC,SAAS;QACzB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,GAAG,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjF,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3C,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,GAAG,CAAC,CAAC,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvE,CAAC,CAAC,CAAC;IAEJ,MAAM,GAAG,GAAuB;QAC9B,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;QAC/B,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO;QAChC,WAAW,EAAE,MAAM,CAAC,UAAU;QAC9B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,YAAY,EAAE,MAAM;QACpB,QAAQ;KACT,CAAC;IACF,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1B,GAAG,CAAC,eAAe,GAAG,MAAM,CAAC,cAAc,CAAC;IAC9C,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;QACvC,GAAG,CAAC,kBAAkB,GAAG,iBAAiB,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,iBAAiB,CACxB,QAAgB,EAChB,GAAmC;IAEnC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,yBAAyB,QAAQ,6BAA6B,CAAC,CAAC;IAC3E,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;QACpB,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,OAAO,GAAG,GAAG,OAAO,CAAC,CAAC,IAAI,GAAG,GAAG,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACjF,IAAI,CAAC,CAAC,WAAW;YAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAC3D,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,oEAAoE,CAAC,CAAC;IACjF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/mcp/warm.d.ts

@@ -0,0 +1,88 @@
+import type { Engine } from "../engines/types.js";
+import { type GateInput, type GateReport } from "../orchestrator.js";
+declare class VerdictLru {
+    private readonly cap;
+    private readonly ttlMs;
+    private readonly map;
+    private hits;
+    private misses;
+    private evictions;
+    constructor(cap: number, ttlMs: number);
+    get(key: string): GateReport | undefined;
+    put(key: string, report: GateReport): void;
+    size(): number;
+    stats(): {
+        hits: number;
+        misses: number;
+        evictions: number;
+        size: number;
+        cap: number;
+    };
+    clear(): void;
+}
+/** sha256 of the full input that determines verdict identity. Same key →
+ * same verdict iff our engines and policy haven't changed (we DON'T cache
+ * across policy edits — see notes at the call site). */
+export declare function verdictCacheKey(input: GateInput, engineSetTag: string): string;
+/** De-dup concurrent identical scans. Two agents calling ``validate_edit``
+ * with the same content at the same instant share ONE underlying gate
+ * run; the second callee awaits the same promise. Frees the system from
+ * O(N) LLM-critic calls under burst load. */
+export declare function singleFlight(key: string, fn: () => Promise<GateReport>): Promise<GateReport>;
+/** Probe every engine ONCE at boot. Subsequent runGate() calls can rely
+ * on this map instead of awaiting `e.available()` per engine per call. */
+export declare function computeAvailability(): Promise<Map<string, boolean>>;
+/** Get the precomputed availability snapshot. Returns null before
+ * ``warmAtBoot()`` completes. Callers SHOULD fall back to per-engine
+ * ``e.available()`` if null. */
+export declare function availabilitySnapshot(): Map<string, boolean> | null;
+/** Force a fresh probe (e.g. user just ran `pip install semgrep` mid-session). */
+export declare function refreshAvailability(): Promise<Map<string, boolean>>;
+interface WarmState {
+    warmedAt: number;
+    durationMs: number;
+    vulRagOk: boolean;
+    vulRagEntries: number;
+    engineCount: number;
+    engineAvailable: number;
+    claudeBin: string | null;
+}
+/** Eagerly load every subsystem that the hook path lazy-loads. Idempotent.
+ * Returns the cached state if already warmed. Concurrent callers share
+ * the same in-flight warm promise. */
+export declare function warmAtBoot(): Promise<WarmState>;
+/** Snapshot of warm state for ``aegis.health`` probe / debug. */
+export declare function warmStateSnapshot(): WarmState | null;
+/** Run the gate with full warm-path optimisation:
+ *
+ *  1. In-memory LRU lookup (returns in <0.2 ms when hit).
+ *  2. Single-flight dedup: if another call is in flight for the same key,
+ *     wait for it instead of starting a parallel one.
+ *  3. Forward to ``runGate``, passing the warm availability snapshot so
+ *     the orchestrator skips per-call ``e.available()`` awaits.
+ *  4. Store the resulting report in the LRU.
+ *
+ * Non-cacheable scans (``noCache: true``) bypass steps 1-2-4 — used by
+ * the precheck path which always wants fresh.
+ */
+export declare function runGateFast(input: GateInput): Promise<{
+    report: GateReport;
+    source: "lru" | "single-flight" | "fresh";
+}>;
+export declare function warmMetrics(): {
+    verdict_lru: ReturnType<VerdictLru["stats"]>;
+    inflight: number;
+    engine_set_tag: string;
+    warm: WarmState | null;
+};
+/** Reset all warm state. Tests only — production code must NOT call this. */
+export declare function _resetWarmStateForTests(): void;
+/** Expose internal hooks for unit tests. */
+export declare const _testing: {
+    verdictLru: VerdictLru;
+    inflight: Map<string, Promise<GateReport>>;
+    ENGINE_SET_TAG: string;
+    engineSet: () => ReadonlyArray<Engine>;
+};
+export {};
+//# sourceMappingURL=warm.d.ts.map

package/dist/mcp/warm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"warm.d.ts","sourceRoot":"","sources":["../../src/mcp/warm.ts"],"names":[],"mappings":"AAkCA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAGlD,OAAO,EAAW,KAAK,SAAS,EAAE,KAAK,UAAU,EAAE,MAAM,oBAAoB,CAAC;AA6B9E,cAAM,UAAU;IACd,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAmC;IACvD,OAAO,CAAC,IAAI,CAAK;IACjB,OAAO,CAAC,MAAM,CAAK;IACnB,OAAO,CAAC,SAAS,CAAK;gBAEV,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM;IAKtC,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS;IAkBxC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,IAAI;IAW1C,IAAI,IAAI,MAAM;IAId,KAAK,IAAI;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE;IAUvF,KAAK,IAAI,IAAI;CAMd;AAID;;wDAEwD;AACxD,wBAAgB,eAAe,CAAC,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAW9E;AAMD;;;6CAG6C;AAC7C,wBAAsB,YAAY,CAChC,GAAG,EAAE,MAAM,EACX,EAAE,EAAE,MAAM,OAAO,CAAC,UAAU,CAAC,GAC5B,OAAO,CAAC,UAAU,CAAC,CAYrB;AAMD;0EAC0E;AAC1E,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAiBzE;AAED;;gCAEgC;AAChC,wBAAgB,oBAAoB,IAAI,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAElE;AAED,kFAAkF;AAClF,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAEzE;AAID,UAAU,SAAS;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,OAAO,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AA8BD;;sCAEsC;AACtC,wBAAsB,UAAU,IAAI,OAAO,CAAC,SAAS,CAAC,CA2DrD;AAED,iEAAiE;AACjE,wBAAgB,iBAAiB,IAAI,SAAS,GAAG,IAAI,CAEpD;AAYD;;;;;;;;;;;GAWG;AACH,wBAAsB,WAAW,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC;IAC3D,MAAM,EAAE,UAAU,CAAC;IACnB,MAAM,EAAE,KAAK,GAAG,eAAe,GAAG,OAAO,CAAC;CAC3C,CAAC,CA+BD;AAID,wBAAgB,WAAW,IAAI;IAC7B,WAAW,EAAE,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7C,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,SAAS,GAAG,IAAI,CAAC;CACxB,CAOA;AAID,6EAA6E;AAC7E,wBAAgB,uBAAuB,IAAI,IAAI,CAM9C;AAED,4CAA4C;AAC5C,eAAO,MAAM,QAAQ;;;;qBAIJ,aAAa,CAAC,MAAM,CAAC;CACrC,CAAC"}

package/dist/mcp/warm.js

@@ -0,0 +1,331 @@
+/**
+ * Process-wide warm state for the MCP server.
+ *
+ * The aegis hook CLI pays full cold-start cost on every invocation
+ * (Vul-RAG KB embed, engine availability probes, LMDB open, claude
+ * binary discovery). For an interactive realtime gate this is
+ * unacceptable — a single fresh process is ~2-3 s before any actual
+ * scan work begins.
+ *
+ * The MCP server is long-running by design (stdio transport stays
+ * open for the entire IDE session). This module owns the state that
+ * needs to be hot from the very first tool call:
+ *
+ *   - Vul-RAG: KB + embeddings loaded eagerly at boot.
+ *   - SCIP indexer singleton: created (its real work is lazy
+ *     per-project, but the singleton exists).
+ *   - Claude binary discovery: ``which("claude")`` cached.
+ *   - Per-engine availability map: computed once at boot, refreshed
+ *     manually via ``refreshAvailability()`` if engines are
+ *     installed during the session.
+ *   - Verdict LRU keyed on (engine-set hash, sha256(content)): a
+ *     sub-millisecond cache layer above LMDB. Hits return without
+ *     touching disk.
+ *   - Single-flight dedup: two concurrent identical scans share one
+ *     in-flight ``runGate`` promise. Prevents N×LLM-critic blow-up
+ *     when an agent fans out edits.
+ *
+ * The warm contract is opt-in — callers must `await warmAtBoot()`
+ * before the server's first tool call. ``server.ts`` does this
+ * before ``transport.connect()``.
+ */
+import { createHash } from "node:crypto";
+import { ALL_ENGINES, ENGINES, STAGE2_ENGINES } from "../engines/registry.js";
+import { getIndexer } from "../index/scip.js";
+import { getVulRag } from "../index/vulrag.js";
+import { runGate } from "../orchestrator.js";
+import { getLogger } from "../util/logger.js";
+import { which } from "../util/subprocess.js";
+const log = getLogger("aegis.mcp.warm");
+// ── Tunables ──────────────────────────────────────────────────────────────
+/** Max verdicts retained in-process. 2k × ~5KB/verdict ≈ 10 MB worst case. */
+const VERDICT_LRU_CAP = Number(process.env.AEGIS_MCP_VERDICT_LRU ?? 2000);
+/** Soft time after which an in-mem verdict is re-validated against LMDB.
+ * Same content + same engine set → invariant verdict, so we can hold for
+ * a full coding session (8 h). */
+const VERDICT_LRU_TTL_MS = Number(process.env.AEGIS_MCP_VERDICT_TTL_MS ?? 8 * 60 * 60 * 1000);
+/** Per-call timeout for the boot warm-up of each subsystem. Vul-RAG
+ * embed of 60 entries on cold CPU is ~600 ms; SCIP indexer construction is
+ * trivial; ``which`` is <5 ms. 30 s is a generous upper bound that still
+ * fails fast if something is wedged. */
+const WARM_PER_SUBSYSTEM_TIMEOUT_MS = 30_000;
+class VerdictLru {
+    cap;
+    ttlMs;
+    map = new Map();
+    hits = 0;
+    misses = 0;
+    evictions = 0;
+    constructor(cap, ttlMs) {
+        this.cap = cap;
+        this.ttlMs = ttlMs;
+    }
+    get(key) {
+        const e = this.map.get(key);
+        if (!e) {
+            this.misses++;
+            return undefined;
+        }
+        if (Date.now() - e.storedAt > this.ttlMs) {
+            this.map.delete(key);
+            this.misses++;
+            return undefined;
+        }
+        // Move-to-end = recency bump.
+        this.map.delete(key);
+        this.map.set(key, e);
+        this.hits++;
+        return e.report;
+    }
+    put(key, report) {
+        if (this.map.has(key))
+            this.map.delete(key);
+        this.map.set(key, { report, storedAt: Date.now() });
+        while (this.map.size > this.cap) {
+            const oldest = this.map.keys().next().value;
+            if (oldest === undefined)
+                break;
+            this.map.delete(oldest);
+            this.evictions++;
+        }
+    }
+    size() {
+        return this.map.size;
+    }
+    stats() {
+        return {
+            hits: this.hits,
+            misses: this.misses,
+            evictions: this.evictions,
+            size: this.map.size,
+            cap: this.cap,
+        };
+    }
+    clear() {
+        this.map.clear();
+        this.hits = 0;
+        this.misses = 0;
+        this.evictions = 0;
+    }
+}
+const verdictLru = new VerdictLru(VERDICT_LRU_CAP, VERDICT_LRU_TTL_MS);
+/** sha256 of the full input that determines verdict identity. Same key →
+ * same verdict iff our engines and policy haven't changed (we DON'T cache
+ * across policy edits — see notes at the call site). */
+export function verdictCacheKey(input, engineSetTag) {
+    const h = createHash("sha256");
+    h.update(engineSetTag);
+    h.update("\0");
+    h.update(input.filePath);
+    h.update("\0");
+    // projectRoot affects findings via policy + suppressions + SCIP context.
+    h.update(input.projectRoot ?? "");
+    h.update("\0");
+    h.update(input.content);
+    return h.digest("hex").slice(0, 32);
+}
+// ── Single-flight ─────────────────────────────────────────────────────────
+const inflight = new Map();
+/** De-dup concurrent identical scans. Two agents calling ``validate_edit``
+ * with the same content at the same instant share ONE underlying gate
+ * run; the second callee awaits the same promise. Frees the system from
+ * O(N) LLM-critic calls under burst load. */
+export async function singleFlight(key, fn) {
+    const existing = inflight.get(key);
+    if (existing) {
+        return existing;
+    }
+    const p = fn().finally(() => {
+        // Detach AFTER resolution so a follow-up call that arrives 1ms later
+        // doesn't latch onto a not-yet-cleared entry expecting fresh data.
+        inflight.delete(key);
+    });
+    inflight.set(key, p);
+    return p;
+}
+// ── Engine availability map ───────────────────────────────────────────────
+let _availabilityMap = null;
+/** Probe every engine ONCE at boot. Subsequent runGate() calls can rely
+ * on this map instead of awaiting `e.available()` per engine per call. */
+export async function computeAvailability() {
+    const m = new Map();
+    const checks = ALL_ENGINES.map(async (e) => {
+        try {
+            m.set(e.name, await e.available());
+        }
+        catch {
+            m.set(e.name, false);
+        }
+    });
+    await Promise.all(checks);
+    _availabilityMap = m;
+    log.info("availability probed", {
+        total: m.size,
+        available: [...m.entries()].filter(([, ok]) => ok).map(([n]) => n),
+        unavailable: [...m.entries()].filter(([, ok]) => !ok).map(([n]) => n),
+    });
+    return m;
+}
+/** Get the precomputed availability snapshot. Returns null before
+ * ``warmAtBoot()`` completes. Callers SHOULD fall back to per-engine
+ * ``e.available()`` if null. */
+export function availabilitySnapshot() {
+    return _availabilityMap;
+}
+/** Force a fresh probe (e.g. user just ran `pip install semgrep` mid-session). */
+export async function refreshAvailability() {
+    return computeAvailability();
+}
+let _warmState = null;
+let _warmPromise = null;
+/** Unique sentinel for timeout — using a Symbol avoids confusing the
+ * "step succeeded but returned null/undefined" case with "step timed out". */
+const TIMEOUT_SENTINEL = Symbol("warm.timeout");
+async function withDeadline(label, ms, fn) {
+    const deadline = new Promise((r) => setTimeout(() => r(TIMEOUT_SENTINEL), ms));
+    try {
+        const res = await Promise.race([fn(), deadline]);
+        if (res === TIMEOUT_SENTINEL) {
+            log.warn(`warm step timed out`, { step: label, timeoutMs: ms });
+        }
+        return res;
+    }
+    catch (err) {
+        log.warn(`warm step failed`, { step: label, err: String(err) });
+        return TIMEOUT_SENTINEL;
+    }
+}
+/** Eagerly load every subsystem that the hook path lazy-loads. Idempotent.
+ * Returns the cached state if already warmed. Concurrent callers share
+ * the same in-flight warm promise. */
+export async function warmAtBoot() {
+    if (_warmState)
+        return _warmState;
+    if (_warmPromise)
+        return _warmPromise;
+    const t0 = Date.now();
+    _warmPromise = (async () => {
+        log.info("warm-at-boot starting", {
+            stage1Engines: ENGINES.map((e) => e.name),
+            stage2Engines: STAGE2_ENGINES.map((e) => e.name),
+        });
+        // 1. Engine availability — parallel, fail-safe per engine inside.
+        const avail = await withDeadline("availability", WARM_PER_SUBSYSTEM_TIMEOUT_MS, () => computeAvailability());
+        const availMap = avail === TIMEOUT_SENTINEL ? new Map() : avail;
+        const availCount = [...availMap.values()].filter(Boolean).length;
+        // 2. Vul-RAG KB embed (this is the dominant cost — ~0.6-1.5 s cold).
+        let vulRagOk = false;
+        let vulRagEntries = 0;
+        await withDeadline("vulrag", WARM_PER_SUBSYSTEM_TIMEOUT_MS, async () => {
+            const rag = getVulRag();
+            vulRagOk = await rag.ensureLoaded();
+            vulRagEntries = rag.size;
+            return null;
+        });
+        // 3. SCIP indexer singleton — construction is cheap; per-project work
+        //    is still lazy. We just want the singleton extant so the first
+        //    runGate() doesn't pay a Map+Cache construction cost.
+        await withDeadline("scip-indexer", 2_000, async () => {
+            getIndexer();
+            return null;
+        });
+        // 4. Claude binary discovery — `which()` itself is cached, but the
+        //    first lookup spawns a subprocess on Windows.
+        let claudeBin = null;
+        await withDeadline("claude-bin", 5_000, async () => {
+            claudeBin = await which("claude");
+            return null;
+        });
+        const state = {
+            warmedAt: Date.now(),
+            durationMs: Date.now() - t0,
+            vulRagOk,
+            vulRagEntries,
+            engineCount: ALL_ENGINES.length,
+            engineAvailable: availCount,
+            claudeBin,
+        };
+        _warmState = state;
+        log.info("warm-at-boot complete", { ...state });
+        return state;
+    })();
+    return _warmPromise;
+}
+/** Snapshot of warm state for ``aegis.health`` probe / debug. */
+export function warmStateSnapshot() {
+    return _warmState;
+}
+// ── Gate fast-path ────────────────────────────────────────────────────────
+/** Build a stable tag identifying the current engine set so the verdict
+ * cache invalidates correctly if an engine is added/removed between
+ * server restarts. Computed once per process. */
+const ENGINE_SET_TAG = (() => {
+    const names = ALL_ENGINES.map((e) => e.name).sort();
+    return createHash("sha256").update(names.join("|")).digest("hex").slice(0, 12);
+})();
+/** Run the gate with full warm-path optimisation:
+ *
+ *  1. In-memory LRU lookup (returns in <0.2 ms when hit).
+ *  2. Single-flight dedup: if another call is in flight for the same key,
+ *     wait for it instead of starting a parallel one.
+ *  3. Forward to ``runGate``, passing the warm availability snapshot so
+ *     the orchestrator skips per-call ``e.available()`` awaits.
+ *  4. Store the resulting report in the LRU.
+ *
+ * Non-cacheable scans (``noCache: true``) bypass steps 1-2-4 — used by
+ * the precheck path which always wants fresh.
+ */
+export async function runGateFast(input) {
+    // Inject the warm availability snapshot into every gate call so the
+    // orchestrator doesn't await per-engine availability. If warmAtBoot
+    // hasn't completed yet (e.g. someone called runGateFast before await),
+    // the override is null and the orchestrator falls back to per-call probes.
+    const inputWithOverride = {
+        ...input,
+        ...(_availabilityMap ? { availabilityOverride: _availabilityMap } : {}),
+    };
+    if (input.noCache) {
+        const report = await runGate(inputWithOverride);
+        return { report, source: "fresh" };
+    }
+    const key = verdictCacheKey(input, ENGINE_SET_TAG);
+    const hit = verdictLru.get(key);
+    if (hit) {
+        return { report: hit, source: "lru" };
+    }
+    // Note on label correctness: we can't distinguish "original runner"
+    // from "joined an in-flight peer" from inside singleFlight() without
+    // a check-and-set racey lookup. We label "fresh" uniformly because
+    // the LRU put below STILL happens (idempotent — the joined caller
+    // re-puts the same report). Telemetry on actual single-flight hits
+    // is exposed via warmMetrics().inflight watermark.
+    const report = await singleFlight(key, async () => runGate(inputWithOverride));
+    verdictLru.put(key, report);
+    return { report, source: "fresh" };
+}
+// ── Metrics (for explain_health / debug) ──────────────────────────────────
+export function warmMetrics() {
+    return {
+        verdict_lru: verdictLru.stats(),
+        inflight: inflight.size,
+        engine_set_tag: ENGINE_SET_TAG,
+        warm: _warmState,
+    };
+}
+// ── Test-only helpers ─────────────────────────────────────────────────────
+/** Reset all warm state. Tests only — production code must NOT call this. */
+export function _resetWarmStateForTests() {
+    _warmState = null;
+    _warmPromise = null;
+    _availabilityMap = null;
+    verdictLru.clear();
+    inflight.clear();
+}
+/** Expose internal hooks for unit tests. */
+export const _testing = {
+    verdictLru,
+    inflight,
+    ENGINE_SET_TAG,
+    engineSet: () => ALL_ENGINES,
+};
+//# sourceMappingURL=warm.js.map

package/dist/mcp/warm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"warm.js","sourceRoot":"","sources":["../../src/mcp/warm.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAE9E,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,OAAO,EAAmC,MAAM,oBAAoB,CAAC;AAC9E,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAE9C,MAAM,GAAG,GAAG,SAAS,CAAC,gBAAgB,CAAC,CAAC;AAExC,6EAA6E;AAE7E,8EAA8E;AAC9E,MAAM,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,IAAI,CAAC,CAAC;AAE1E;;kCAEkC;AAClC,MAAM,kBAAkB,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;AAE9F;;;wCAGwC;AACxC,MAAM,6BAA6B,GAAG,MAAM,CAAC;AAS7C,MAAM,UAAU;IACG,GAAG,CAAS;IACZ,KAAK,CAAS;IACd,GAAG,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC/C,IAAI,GAAG,CAAC,CAAC;IACT,MAAM,GAAG,CAAC,CAAC;IACX,SAAS,GAAG,CAAC,CAAC;IAEtB,YAAY,GAAW,EAAE,KAAa;QACpC,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAED,GAAG,CAAC,GAAW;QACb,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,IAAI,CAAC,MAAM,EAAE,CAAC;YACd,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;YACzC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACrB,IAAI,CAAC,MAAM,EAAE,CAAC;YACd,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,8BAA8B;QAC9B,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACrB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,OAAO,CAAC,CAAC,MAAM,CAAC;IAClB,CAAC;IAED,GAAG,CAAC,GAAW,EAAE,MAAkB;QACjC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC5C,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACpD,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAChC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YAC5C,IAAI,MAAM,KAAK,SAAS;gBAAE,MAAM;YAChC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACxB,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,CAAC;IACH,CAAC;IAED,IAAI;QACF,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;IACvB,CAAC;IAED,KAAK;QACH,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI;YACnB,GAAG,EAAE,IAAI,CAAC,GAAG;SACd,CAAC;IACJ,CAAC;IAED,KAAK;QACH,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;QACjB,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC;QACd,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;QAChB,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC;IACrB,CAAC;CACF;AAED,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,eAAe,EAAE,kBAAkB,CAAC,CAAC;AAEvE;;wDAEwD;AACxD,MAAM,UAAU,eAAe,CAAC,KAAgB,EAAE,YAAoB;IACpE,MAAM,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC/B,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACvB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACf,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACzB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACf,yEAAyE;IACzE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACf,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACxB,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACtC,CAAC;AAED,6EAA6E;AAE7E,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA+B,CAAC;AAExD;;;6CAG6C;AAC7C,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,GAAW,EACX,EAA6B;IAE7B,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;QAC1B,qEAAqE;QACrE,mEAAmE;QACnE,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;IACH,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACrB,OAAO,CAAC,CAAC;AACX,CAAC;AAED,6EAA6E;AAE7E,IAAI,gBAAgB,GAAgC,IAAI,CAAC;AAEzD;0EAC0E;AAC1E,MAAM,CAAC,KAAK,UAAU,mBAAmB;IACvC,MAAM,CAAC,GAAG,IAAI,GAAG,EAAmB,CAAC;IACrC,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;QACzC,IAAI,CAAC;YACH,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACvB,CAAC;IACH,CAAC,CAAC,CAAC;IACH,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1B,gBAAgB,GAAG,CAAC,CAAC;IACrB,GAAG,CAAC,IAAI,CAAC,qBAAqB,EAAE;QAC9B,KAAK,EAAE,CAAC,CAAC,IAAI;QACb,SAAS,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QAClE,WAAW,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;KACtE,CAAC,CAAC;IACH,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;gCAEgC;AAChC,MAAM,UAAU,oBAAoB;IAClC,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,mBAAmB;IACvC,OAAO,mBAAmB,EAAE,CAAC;AAC/B,CAAC;AAcD,IAAI,UAAU,GAAqB,IAAI,CAAC;AACxC,IAAI,YAAY,GAA8B,IAAI,CAAC;AAEnD;8EAC8E;AAC9E,MAAM,gBAAgB,GAAkB,MAAM,CAAC,cAAc,CAAC,CAAC;AAG/D,KAAK,UAAU,YAAY,CACzB,KAAa,EACb,EAAU,EACV,EAAoB;IAEpB,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAkB,CAAC,CAAC,EAAE,EAAE,CAClD,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC,EAAE,EAAE,CAAC,CAC1C,CAAC;IACF,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC;QACjD,IAAI,GAAG,KAAK,gBAAgB,EAAE,CAAC;YAC7B,GAAG,CAAC,IAAI,CAAC,qBAAqB,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChE,OAAO,gBAAgB,CAAC;IAC1B,CAAC;AACH,CAAC;AAED;;sCAEsC;AACtC,MAAM,CAAC,KAAK,UAAU,UAAU;IAC9B,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC;IAClC,IAAI,YAAY;QAAE,OAAO,YAAY,CAAC;IACtC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACtB,YAAY,GAAG,CAAC,KAAK,IAAI,EAAE;QACzB,GAAG,CAAC,IAAI,CAAC,uBAAuB,EAAE;YAChC,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YACzC,aAAa,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;SACjD,CAAC,CAAC;QAEH,kEAAkE;QAClE,MAAM,KAAK,GAAG,MAAM,YAAY,CAC9B,cAAc,EACd,6BAA6B,EAC7B,GAAG,EAAE,CAAC,mBAAmB,EAAE,CAC5B,CAAC;QACF,MAAM,QAAQ,GAAG,KAAK,KAAK,gBAAgB,CAAC,CAAC,CAAC,IAAI,GAAG,EAAmB,CAAC,CAAC,CAAC,KAAK,CAAC;QACjF,MAAM,UAAU,GAAG,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;QAEjE,qEAAqE;QACrE,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,aAAa,GAAG,CAAC,CAAC;QACtB,MAAM,YAAY,CAAC,QAAQ,EAAE,6BAA6B,EAAE,KAAK,IAAI,EAAE;YACrE,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;YACxB,QAAQ,GAAG,MAAM,GAAG,CAAC,YAAY,EAAE,CAAC;YACpC,aAAa,GAAG,GAAG,CAAC,IAAI,CAAC;YACzB,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;QAEH,sEAAsE;QACtE,mEAAmE;QACnE,0DAA0D;QAC1D,MAAM,YAAY,CAAC,cAAc,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;YACnD,UAAU,EAAE,CAAC;YACb,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;QAEH,mEAAmE;QACnE,kDAAkD;QAClD,IAAI,SAAS,GAAkB,IAAI,CAAC;QACpC,MAAM,YAAY,CAAC,YAAY,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;YACjD,SAAS,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;YAClC,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;QAEH,MAAM,KAAK,GAAc;YACvB,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE;YACpB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;YAC3B,QAAQ;YACR,aAAa;YACb,WAAW,EAAE,WAAW,CAAC,MAAM;YAC/B,eAAe,EAAE,UAAU;YAC3B,SAAS;SACV,CAAC;QACF,UAAU,GAAG,KAAK,CAAC;QACnB,GAAG,CAAC,IAAI,CAAC,uBAAuB,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,EAAE,CAAC;IACL,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,iBAAiB;IAC/B,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,6EAA6E;AAE7E;;iDAEiD;AACjD,MAAM,cAAc,GAAW,CAAC,GAAG,EAAE;IACnC,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;IACpD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACjF,CAAC,CAAC,EAAE,CAAC;AAEL;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAAgB;IAIhD,oEAAoE;IACpE,oEAAoE;IACpE,uEAAuE;IACvE,2EAA2E;IAC3E,MAAM,iBAAiB,GAAc;QACnC,GAAG,KAAK;QACR,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxE,CAAC;IAEF,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC,CAAC;QAChD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IACrC,CAAC;IAED,MAAM,GAAG,GAAG,eAAe,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IAEnD,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,GAAG,EAAE,CAAC;QACR,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IACxC,CAAC;IAED,oEAAoE;IACpE,qEAAqE;IACrE,mEAAmE;IACnE,kEAAkE;IAClE,mEAAmE;IACnE,mDAAmD;IACnD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAC/E,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC5B,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AACrC,CAAC;AAED,6EAA6E;AAE7E,MAAM,UAAU,WAAW;IAMzB,OAAO;QACL,WAAW,EAAE,UAAU,CAAC,KAAK,EAAE;QAC/B,QAAQ,EAAE,QAAQ,CAAC,IAAI;QACvB,cAAc,EAAE,cAAc;QAC9B,IAAI,EAAE,UAAU;KACjB,CAAC;AACJ,CAAC;AAED,6EAA6E;AAE7E,6EAA6E;AAC7E,MAAM,UAAU,uBAAuB;IACrC,UAAU,GAAG,IAAI,CAAC;IAClB,YAAY,GAAG,IAAI,CAAC;IACpB,gBAAgB,GAAG,IAAI,CAAC;IACxB,UAAU,CAAC,KAAK,EAAE,CAAC;IACnB,QAAQ,CAAC,KAAK,EAAE,CAAC;AACnB,CAAC;AAED,4CAA4C;AAC5C,MAAM,CAAC,MAAM,QAAQ,GAAG;IACtB,UAAU;IACV,QAAQ;IACR,cAAc;IACd,SAAS,EAAE,GAA0B,EAAE,CAAC,WAAW;CACpD,CAAC"}

package/dist/orchestrator.d.ts

@@ -0,0 +1,46 @@
+import { Engine, EngineRunResult } from "./engines/types.js";
+import { Finding } from "./findings.js";
+import { type ProjectContextBlock } from "./index/context.js";
+import { Lang } from "./lang.js";
+import { ActionDecision } from "./risk.js";
+export interface GateInput {
+    filePath: string;
+    content: string;
+    projectRoot?: string;
+    /** Overall budget; default 5_000 ms. */
+    totalTimeoutMs?: number;
+    /** Override which engines run; default = all available. */
+    engines?: ReadonlyArray<Engine>;
+    /** Disable caching (tests). */
+    noCache?: boolean;
+    /** If false, the path safety check WILL NOT reject files that are
+     * outside ``projectRoot``. Used by the ad-hoc ``aegis scan`` CLI where
+     * the user explicitly chose the file. Hook path leaves it default (true). */
+    enforceContainment?: boolean;
+    /** Precomputed engine availability map. When supplied, the orchestrator
+     * SKIPS the per-call ``await e.available()`` round-trip — used by the
+     * MCP server warm path where availability is probed once at boot. Engines
+     * NOT present in the map fall back to per-call probing. Engines present
+     * with ``false`` are skipped without re-probing. */
+    availabilityOverride?: ReadonlyMap<string, boolean>;
+}
+export interface GateReport {
+    filePath: string;
+    lang: Lang;
+    decision: ActionDecision;
+    findings: Finding[];
+    engineResults: ReadonlyArray<EngineRunResult>;
+    durationMs: number;
+    truncated: boolean;
+    pathCheck: {
+        ok: true;
+        resolved: string;
+    } | {
+        ok: false;
+        reason: string;
+    };
+    /** Cross-file evidence assembled from the SCIP index, if available. */
+    projectContext?: ProjectContextBlock;
+}
+export declare function runGate(input: GateInput): Promise<GateReport>;
+//# sourceMappingURL=orchestrator.d.ts.map

package/dist/orchestrator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"orchestrator.d.ts","sourceRoot":"","sources":["../src/orchestrator.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,MAAM,EAAkB,eAAe,EAAW,MAAM,oBAAoB,CAAC;AAEtF,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAuB,KAAK,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAKnF,OAAO,EAAc,IAAI,EAAE,MAAM,WAAW,CAAC;AAG7C,OAAO,EAAE,cAAc,EAAU,MAAM,WAAW,CAAC;AAMnD,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wCAAwC;IACxC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,2DAA2D;IAC3D,OAAO,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAChC,+BAA+B;IAC/B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;iFAE6E;IAC7E,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;wDAIoD;IACpD,oBAAoB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrD;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,IAAI,CAAC;IACX,QAAQ,EAAE,cAAc,CAAC;IACzB,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,aAAa,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IAC9C,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,EACL;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAC9B;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAClC,uEAAuE;IACvE,cAAc,CAAC,EAAE,mBAAmB,CAAC;CACtC;AAqKD,wBAAsB,OAAO,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CA8WnE"}