edsger 0.77.0 → 0.78.0

package/dist/phases/find-shared/mcp.js

@@ -1,127 +0,0 @@
-/**
- * MCP helpers shared by find-bugs / find-features / find-smells.
- *
- * All three load a product's basics (name, description) for prompt context,
- * pull the open-issue list for dedup, and file findings via `issues/create`.
- * Centralising the calls means a schema change in MCP only needs touching one
- * place, and the per-phase orchestrators stay focused on their own logic.
- */
-import { getRepositoryBasics } from '../../api/github.js';
-import { callMcpEndpoint } from '../../api/mcp-client.js';
-import { getSupabase, hasSupabaseSession } from '../../supabase/client.js';
-import { logError, logWarning } from '../../utils/logger.js';
-export async function fetchProductBasics(productId) {
-    try {
-        const result = (await callMcpEndpoint('resources/read', {
-            uri: `product://${productId}`,
-        }));
-        const text = result.contents?.[0]?.text || '{}';
-        const parsed = JSON.parse(text);
-        return {
-            name: parsed.name || productId,
-            description: parsed.description,
-        };
-    }
-    catch {
-        return { name: productId };
-    }
-}
-/**
- * Build prompt "product basics" from a bare repository row (repo-scoped scans
- * have no product to read). Falls back to the repo id as the display name.
- */
-export async function fetchRepositoryBasics(repoId) {
-    const basics = await getRepositoryBasics(repoId).catch(() => null);
-    return {
-        name: basics?.fullName || repoId,
-        description: basics?.description ?? undefined,
-    };
-}
-/**
- * Fetch the product's open issues for dedup context. Filters out terminal
- * statuses (shipped/archived/closed/...) since those can't conflict with new
- * findings the agent might surface.
- */
-export async function fetchOpenIssues(productId) {
-    try {
-        const result = (await callMcpEndpoint('issues/list', {
-            product_id: productId,
-        }));
-        const all = result.issues || [];
-        return all.filter((i) => !isTerminalStatus(i.status));
-    }
-    catch (error) {
-        logWarning(`Could not load existing issues for dedup: ${error instanceof Error ? error.message : String(error)}`);
-        return [];
-    }
-}
-/**
- * Same as `fetchOpenIssues` but scoped to a single repository (repo-scoped
- * scans). Used for dedup context when filing findings against a bare repo.
- */
-export async function fetchOpenIssuesByRepo(repoId) {
-    try {
-        const result = (await callMcpEndpoint('issues/list', {
-            repository_id: repoId,
-        }));
-        const all = result.issues || [];
-        return all.filter((i) => !isTerminalStatus(i.status));
-    }
-    catch (error) {
-        logWarning(`Could not load existing issues for dedup: ${error instanceof Error ? error.message : String(error)}`);
-        return [];
-    }
-}
-export function isTerminalStatus(status) {
-    return (status === 'shipped' ||
-        status === 'archived' ||
-        status === 'cancelled' ||
-        status === 'closed' ||
-        status === 'completed');
-}
-/**
- * File a new issue via MCP. The issue is scoped to a product OR a single
- * repository — exactly one of `productId` / `repoId` should be set. Returns the
- * new issue id, or null if MCP returned an error / unexpected shape (already
- * logged).
- */
-export async function createIssue(input) {
-    const productId = input.productId ?? null;
-    const repositoryId = input.repoId ?? null;
-    try {
-        if (hasSupabaseSession()) {
-            try {
-                const { data, error } = await getSupabase()
-                    .from('issues')
-                    .insert({
-                    product_id: productId,
-                    repository_id: repositoryId,
-                    name: input.title,
-                    description: input.description,
-                    ...(input.source ? { source: input.source } : {}),
-                })
-                    .select('id')
-                    .single();
-                if (error) {
-                    throw new Error(error.message);
-                }
-                return data?.id || null;
-            }
-            catch {
-                // Fall through to MCP
-            }
-        }
-        const result = (await callMcpEndpoint('issues/create', {
-            ...(productId ? { product_id: productId } : {}),
-            ...(repositoryId ? { repository_id: repositoryId } : {}),
-            name: input.title,
-            description: input.description,
-            ...(input.source ? { source: input.source } : {}),
-        }));
-        return result.issue?.id || result.id || null;
-    }
-    catch (error) {
-        logError(`Failed to create issue for "${input.title}": ${error instanceof Error ? error.message : String(error)}`);
-        return null;
-    }
-}

package/dist/phases/find-shared/rule-config.d.ts

@@ -1,37 +0,0 @@
-/**
- * Per-scope rule-pack configuration, shared across the find-* phases.
- *
- * Lets a team tune which stack-aware rule packs the scanners apply via a preset
- * plus explicit per-pack toggles — the configurable-rules capability DCM-style
- * tools expose. Read here from the user's supabase session; edited from the
- * desktop app (services/db/quality-rule-configs.ts). Stored in
- * `quality_rule_configs`.
- */
-import type { ScanScope } from './baseline.js';
-import { type RulePack } from './rule-packs.js';
-export type RulePreset = 'minimal' | 'recommended' | 'strict';
-export interface RuleConfig {
-    preset: RulePreset;
-    disabledPacks: string[];
-}
-/**
- * Apply a rule config to the packs detection selected. Pure + exported for
- * testing.
- *
- * - no config → unchanged (default is 'recommended' = all detected packs).
- * - 'minimal' → no packs (generic categories only).
- * - otherwise → detected packs minus the explicitly disabled ones.
- */
-export declare function applyRuleConfig(packs: RulePack[], config: RuleConfig | null): RulePack[];
-/**
- * Fetch the rule config for a scope, or null if none is set / no session is
- * available. Never throws — a read failure must not abort a scan (it just
- * degrades to the default 'recommended' behaviour).
- */
-export declare function getRuleConfig(scope: ScanScope): Promise<RuleConfig | null>;
-/**
- * Detect the repo's stack, apply the scope's rule config, and return the rule
- * packs to inject — logging the detected stack and chosen packs. Shared by the
- * pack-consuming phases (find-smells, find-architecture).
- */
-export declare function resolveStackRulePacks(repoRoot: string, scope: ScanScope): Promise<RulePack[]>;

package/dist/phases/find-shared/rule-config.js

@@ -1,67 +0,0 @@
-/**
- * Per-scope rule-pack configuration, shared across the find-* phases.
- *
- * Lets a team tune which stack-aware rule packs the scanners apply via a preset
- * plus explicit per-pack toggles — the configurable-rules capability DCM-style
- * tools expose. Read here from the user's supabase session; edited from the
- * desktop app (services/db/quality-rule-configs.ts). Stored in
- * `quality_rule_configs`.
- */
-import { logInfo } from '../../utils/logger.js';
-import { detectProjectContext } from './detect-context.js';
-import { selectRulePacks } from './rule-packs.js';
-import { readScopedRow } from './scoped-read.js';
-/**
- * Apply a rule config to the packs detection selected. Pure + exported for
- * testing.
- *
- * - no config → unchanged (default is 'recommended' = all detected packs).
- * - 'minimal' → no packs (generic categories only).
- * - otherwise → detected packs minus the explicitly disabled ones.
- */
-export function applyRuleConfig(packs, config) {
-    if (!config) {
-        return packs;
-    }
-    if (config.preset === 'minimal') {
-        return [];
-    }
-    return packs.filter((p) => !config.disabledPacks.includes(p.id));
-}
-/**
- * Fetch the rule config for a scope, or null if none is set / no session is
- * available. Never throws — a read failure must not abort a scan (it just
- * degrades to the default 'recommended' behaviour).
- */
-export async function getRuleConfig(scope) {
-    const row = await readScopedRow('quality_rule_configs', 'preset, disabled_packs', scope);
-    if (!row) {
-        return null;
-    }
-    return {
-        preset: row.preset ?? 'recommended',
-        disabledPacks: row.disabled_packs ?? [],
-    };
-}
-/**
- * Detect the repo's stack, apply the scope's rule config, and return the rule
- * packs to inject — logging the detected stack and chosen packs. Shared by the
- * pack-consuming phases (find-smells, find-architecture).
- */
-export async function resolveStackRulePacks(repoRoot, scope) {
-    const projectContext = detectProjectContext(repoRoot);
-    const ruleConfig = await getRuleConfig(scope);
-    const rulePacks = applyRuleConfig(selectRulePacks(projectContext), ruleConfig);
-    const detectedStack = [
-        ...projectContext.languages,
-        ...projectContext.frameworks,
-    ];
-    const stackLabel = detectedStack.length
-        ? detectedStack.join(', ')
-        : 'unknown';
-    const packLabel = rulePacks.length
-        ? `; applying rule packs: ${rulePacks.map((p) => p.id).join(', ')}`
-        : '; no stack-specific rule packs matched';
-    logInfo(`Detected stack: ${stackLabel}${packLabel}`);
-    return rulePacks;
-}

package/dist/phases/find-shared/rule-packs.d.ts

@@ -1,65 +0,0 @@
-/**
- * Stack-specific rule packs for the find-* phases.
- *
- * The generic smell/bug/architecture categories in the base system prompts are
- * language-neutral and always apply. A *rule pack* adds targeted, stack-aware
- * guidance — e.g. Flutter widget anti-patterns, TypeScript type-safety escapes
- * — that should only fire when the relevant language/framework is actually
- * present in the repository.
- *
- * The design intentionally mirrors the quality-benchmark tool catalog:
- *   - tools gate on `applies_to: [<LanguageTag>]`, selected by
- *     `selectToolsForContext(languages)`.
- *   - rule packs gate on `applies_to: { languages?, frameworks?, files_present? }`,
- *     selected by `selectRulePacks(context)`.
- *
- * Adding support for a new language/framework is therefore a pure data change:
- * append one `RulePack` here (and, eventually, more of them) — no phase code
- * branches on a specific language anywhere.
- */
-import type { ProjectContext } from './detect-context.js';
-/**
- * Which find-* phase a guidance block is written for. A pack only contributes
- * to a phase it has guidance for, so the same pack can sharpen find-smells with
- * local anti-patterns and find-architecture with structural ones without
- * leaking smell guidance into the architecture audit (or vice versa).
- */
-export type FindPhaseKind = 'smells' | 'architecture' | 'bugs';
-export interface RulePack {
-    /** Stable id, shown in logs and used in tests. */
-    id: string;
-    /** Human-readable label. */
-    label: string;
-    /**
-     * Gate conditions. A pack is selected when EVERY specified gate matches
-     * (AND across gates), where a gate matches if ANY of its values is present
-     * in the detected context (OR within a gate). At least one gate must be set.
-     */
-    applies_to: {
-        languages?: string[];
-        frameworks?: string[];
-        files_present?: string[];
-    };
-    /**
-     * Per-phase markdown guidance injected into the find-* system prompt when the
-     * pack is selected. Each block should enumerate concrete, file:line-citable
-     * anti-patterns that map onto that phase's existing categories (no new
-     * categories introduced). A pack may cover only some phases.
-     */
-    guidance: Partial<Record<FindPhaseKind, string>>;
-}
-export declare const RULE_PACKS: readonly RulePack[];
-/**
- * Select the rule packs whose gates are satisfied by the detected context.
- * Same AND-across-gates / OR-within-gate semantics as the quality-benchmark
- * `selectToolsForContext`. Membership checks are case-insensitive.
- */
-export declare function selectRulePacks(ctx: ProjectContext): RulePack[];
-/**
- * Render the guidance the selected packs provide *for a given phase* into a
- * single markdown block for appending to that phase's system prompt. Packs
- * without guidance for `kind` are skipped, so e.g. the TypeScript pack (smells
- * only) contributes nothing to the architecture audit. Returns '' when nothing
- * applies, so callers can concatenate unconditionally.
- */
-export declare function renderRulePacks(packs: RulePack[], kind: FindPhaseKind): string;

package/dist/phases/find-shared/rule-packs.js

@@ -1,124 +0,0 @@
-/**
- * Stack-specific rule packs for the find-* phases.
- *
- * The generic smell/bug/architecture categories in the base system prompts are
- * language-neutral and always apply. A *rule pack* adds targeted, stack-aware
- * guidance — e.g. Flutter widget anti-patterns, TypeScript type-safety escapes
- * — that should only fire when the relevant language/framework is actually
- * present in the repository.
- *
- * The design intentionally mirrors the quality-benchmark tool catalog:
- *   - tools gate on `applies_to: [<LanguageTag>]`, selected by
- *     `selectToolsForContext(languages)`.
- *   - rule packs gate on `applies_to: { languages?, frameworks?, files_present? }`,
- *     selected by `selectRulePacks(context)`.
- *
- * Adding support for a new language/framework is therefore a pure data change:
- * append one `RulePack` here (and, eventually, more of them) — no phase code
- * branches on a specific language anywhere.
- */
-// ---------------------------------------------------------------------------
-// Packs
-// ---------------------------------------------------------------------------
-const flutter = {
-    id: 'flutter',
-    label: 'Flutter / Dart',
-    applies_to: { frameworks: ['flutter'] },
-    guidance: {
-        smells: `Flutter/Dart widget and performance smells (in addition to the generic categories):
-- **Giant \`build()\` methods**: a build method spanning dozens of lines or many nested widgets — extract subtrees into named \`Widget\` classes or helper methods. (category: complexity)
-- **Missing \`const\`**: widgets with compile-time-constant configuration that are not \`const\`, forcing needless rebuilds. (category: performance)
-- **Deep widget nesting**: trees nested well beyond ~5 levels that should be decomposed into smaller widgets. (category: complexity)
-- **Unbounded list rendering**: \`Column\`/\`ListView(children: [...])\` over a growing or large collection instead of \`ListView.builder\`/\`SliverList\`. (category: performance)
-- **Work inside \`build()\`**: constructing controllers, futures, or expensive objects in \`build()\` instead of \`initState\`/memoization — they get recreated every rebuild. (category: performance)
-- **Over-broad \`setState\`**: calling \`setState\` on a large widget where a smaller \`StatefulWidget\`, \`ValueListenableBuilder\`, or \`Selector\` would localise the rebuild. (category: performance)
-- **Unkeyed dynamic lists**: reorderable/dynamic children without \`Key\`s, risking state mismatches. (category: readability)`,
-        architecture: `Flutter/Dart structural concerns (in addition to the generic categories):
-- **Business logic in widgets**: data fetching, persistence, or domain rules embedded directly in \`Widget\`/\`State\` classes instead of a dedicated layer (controller/bloc/cubit/service). (concern: layering)
-- **God widgets**: a single screen widget that builds UI, holds state, talks to the network, and formats data — split by responsibility. (concern: cohesion)
-- **Cross-feature \`BuildContext\` reach-through**: features reaching into each other's widget state instead of going through a shared layer. (concern: coupling)`,
-    },
-};
-const typescript = {
-    id: 'typescript',
-    label: 'TypeScript',
-    applies_to: { languages: ['ts'] },
-    guidance: {
-        smells: `TypeScript type-safety smells (in addition to the generic categories):
-- **Type escapes**: \`any\`/\`unknown\` casts that erase checking; prefer precise types or generics. (category: type_safety)
-- **Suppressed errors**: \`@ts-ignore\`/\`@ts-expect-error\` hiding real type errors rather than fixing them. (category: type_safety)
-- **Unsafe assertions**: \`as\` casts and non-null assertions (\`!\`) at trust boundaries instead of real narrowing/null checks. (category: type_safety)
-- **Loose contracts**: \`object\`, open index signatures, or wide unions where a tighter interface/literal type is intended. (category: type_safety)
-- **Derivable duplication**: enums/unions hand-maintained in parallel instead of derived (\`as const\` + \`keyof\`/\`typeof\`). (category: refactor)`,
-    },
-};
-const csharp = {
-    id: 'csharp',
-    label: 'C# / .NET',
-    applies_to: { languages: ['cs'] },
-    guidance: {
-        smells: `C#/.NET smells (in addition to the generic categories):
-- **Async anti-patterns**: \`.Result\`/\`.Wait()\`/\`.GetAwaiter().GetResult()\` on tasks (sync-over-async deadlock risk); \`async void\` outside event handlers. (category: performance)
-- **Multiple enumeration**: enumerating the same \`IEnumerable\` more than once (re-runs the query/LINQ); materialize with \`ToList()\`/\`ToArray()\` once. (category: performance)
-- **Disposal**: \`IDisposable\` created without \`using\`/\`await using\` or an explicit \`Dispose\`. (category: type_safety)
-- **Swallowed exceptions**: empty \`catch {}\` or \`catch (Exception)\` that hides failures. (category: refactor)
-- **Nullable ignored**: suppressing nullable warnings with \`!\` (null-forgiving) at trust boundaries instead of real checks. (category: type_safety)
-- **String building in loops**: \`+=\` string concatenation inside loops instead of \`StringBuilder\`. (category: performance)
-- **Public mutable fields**: public fields where a property is intended. (category: readability)`,
-        architecture: `C#/.NET structural concerns (in addition to the generic categories):
-- **Fat controllers**: business/data logic in ASP.NET controllers instead of a service/handler layer. (concern: layering)
-- **Leaky persistence**: \`DbContext\`/EF queries used directly across layers instead of behind a repository/service boundary. (concern: layering)
-- **Mutable static/singleton state**: static fields or singletons holding mutable shared state, complicating testing and concurrency. (concern: coupling)
-- **Project reference cycles**: circular references between projects/assemblies. (concern: cyclic dependencies)`,
-    },
-};
-// ---------------------------------------------------------------------------
-// Registry + selection
-// ---------------------------------------------------------------------------
-export const RULE_PACKS = [
-    flutter,
-    typescript,
-    csharp,
-];
-/**
- * Select the rule packs whose gates are satisfied by the detected context.
- * Same AND-across-gates / OR-within-gate semantics as the quality-benchmark
- * `selectToolsForContext`. Membership checks are case-insensitive.
- */
-export function selectRulePacks(ctx) {
-    const langSet = new Set(ctx.languages.map((l) => l.toLowerCase()));
-    const fwSet = new Set(ctx.frameworks.map((f) => f.toLowerCase()));
-    const fileSet = new Set(ctx.files_present);
-    return RULE_PACKS.filter((pack) => {
-        const { languages, frameworks, files_present } = pack.applies_to;
-        const gates = [];
-        if (languages?.length) {
-            gates.push(languages.some((l) => langSet.has(l.toLowerCase())));
-        }
-        if (frameworks?.length) {
-            gates.push(frameworks.some((f) => fwSet.has(f.toLowerCase())));
-        }
-        if (files_present?.length) {
-            gates.push(files_present.some((f) => fileSet.has(f)));
-        }
-        // A pack with no gates is a misconfiguration — never auto-select it.
-        return gates.length > 0 && gates.every(Boolean);
-    });
-}
-/**
- * Render the guidance the selected packs provide *for a given phase* into a
- * single markdown block for appending to that phase's system prompt. Packs
- * without guidance for `kind` are skipped, so e.g. the TypeScript pack (smells
- * only) contributes nothing to the architecture audit. Returns '' when nothing
- * applies, so callers can concatenate unconditionally.
- */
-export function renderRulePacks(packs, kind) {
-    const sections = packs
-        .map((p) => ({ label: p.label, text: p.guidance[kind] }))
-        .filter((s) => Boolean(s.text))
-        .map((s) => `### ${s.label}\n${s.text}`);
-    if (sections.length === 0) {
-        return '';
-    }
-    return `\n\n**Stack-specific checks** — the repository's detected stack triggers the following targeted checks. Apply them *in addition to* the generic categories above, using the same severity rubric and output format:\n\n${sections.join('\n\n')}`;
-}

package/dist/phases/find-shared/scan-state.d.ts

@@ -1,33 +0,0 @@
-/**
- * Per-product scan state, generic across the find-* phases. Each phase has
- * its own state schema (find-bugs tracks a commit sha, find-features tracks
- * the most-recent-seen feedback id, etc.) so the type is parametric, but the
- * file layout, atomic-write, and lock semantics are identical and live here.
- *
- * Storage layout: `~/.edsger/<dirName>/<productId>.json` plus a sibling
- * `.lock` file. The lockfile uses O_EXCL so concurrent acquirers race on the
- * filesystem, not on application code — atomic on local POSIX filesystems
- * (good enough; the workspace clone is also machine-local).
- *
- * Known limitation: state is machine-local. A scan started on machine A and
- * next on machine B will look like a first run.
- */
-export interface LockHandle {
-    release: () => void;
-}
-export interface ScanStateModule<T extends object> {
-    load: (productId: string) => T;
-    save: (productId: string, state: T) => void;
-    /** Merge `patch` into the stored state. Fields not mentioned are preserved. */
-    update: (productId: string, patch: Partial<T>) => T;
-    /**
-     * Acquire an exclusive lock for this product's state. Returns null if held.
-     * Stale locks older than `staleAfterMs` (default 1h) are reclaimed.
-     */
-    acquireLock: (productId: string, staleAfterMs?: number) => LockHandle | null;
-}
-export interface CreateScanStateModuleOptions {
-    /** Subdirectory under ~/.edsger/. Example: 'find-bugs-state'. */
-    dirName: string;
-}
-export declare function createScanStateModule<T extends object>(opts: CreateScanStateModuleOptions): ScanStateModule<T>;

package/dist/phases/find-shared/scan-state.js

@@ -1,112 +0,0 @@
-/**
- * Per-product scan state, generic across the find-* phases. Each phase has
- * its own state schema (find-bugs tracks a commit sha, find-features tracks
- * the most-recent-seen feedback id, etc.) so the type is parametric, but the
- * file layout, atomic-write, and lock semantics are identical and live here.
- *
- * Storage layout: `~/.edsger/<dirName>/<productId>.json` plus a sibling
- * `.lock` file. The lockfile uses O_EXCL so concurrent acquirers race on the
- * filesystem, not on application code — atomic on local POSIX filesystems
- * (good enough; the workspace clone is also machine-local).
- *
- * Known limitation: state is machine-local. A scan started on machine A and
- * next on machine B will look like a first run.
- */
-import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, unlinkSync, writeFileSync, } from 'fs';
-import { homedir } from 'os';
-import { join } from 'path';
-const DEFAULT_STALE_AFTER_MS = 60 * 60 * 1000;
-export function createScanStateModule(opts) {
-    const { dirName } = opts;
-    // Resolve at call time, not module-load time, so test setups that swap
-    // process.env.HOME between cases see the change.
-    function stateDir() {
-        return join(homedir(), '.edsger', dirName);
-    }
-    function safeProductId(productId) {
-        return productId.replace(/[^a-zA-Z0-9_-]/g, '_');
-    }
-    function statePath(productId) {
-        return join(stateDir(), `${safeProductId(productId)}.json`);
-    }
-    function lockPath(productId) {
-        return join(stateDir(), `${safeProductId(productId)}.lock`);
-    }
-    function ensureStateDir() {
-        const dir = stateDir();
-        if (!existsSync(dir)) {
-            mkdirSync(dir, { recursive: true });
-        }
-    }
-    function load(productId) {
-        const p = statePath(productId);
-        if (!existsSync(p)) {
-            return {};
-        }
-        try {
-            const raw = readFileSync(p, 'utf-8');
-            const parsed = JSON.parse(raw);
-            return parsed && typeof parsed === 'object' ? parsed : {};
-        }
-        catch {
-            return {};
-        }
-    }
-    /** Atomic write: stage to a tempfile, then rename. */
-    function save(productId, state) {
-        ensureStateDir();
-        const finalPath = statePath(productId);
-        const tmpPath = `${finalPath}.${process.pid}.tmp`;
-        writeFileSync(tmpPath, JSON.stringify(state, null, 2), 'utf-8');
-        renameSync(tmpPath, finalPath);
-    }
-    function update(productId, patch) {
-        const merged = { ...load(productId), ...patch };
-        save(productId, merged);
-        return merged;
-    }
-    function acquireLock(productId, staleAfterMs = DEFAULT_STALE_AFTER_MS) {
-        ensureStateDir();
-        const lock = lockPath(productId);
-        if (existsSync(lock)) {
-            try {
-                const raw = readFileSync(lock, 'utf-8');
-                const parsed = JSON.parse(raw);
-                const age = Date.now() - new Date(parsed.acquiredAt ?? 0).getTime();
-                if (age < staleAfterMs) {
-                    return null;
-                }
-                // Stale or corrupt — reclaim. Only reachable if a previous run died
-                // without releasing (SIGKILL, OOM).
-                rmSync(lock, { force: true });
-            }
-            catch {
-                rmSync(lock, { force: true });
-            }
-        }
-        try {
-            // `flag: 'wx'` = open with O_CREAT | O_EXCL — atomic against a racing
-            // peer, and writeFileSync(path, ...) closes the fd internally so no
-            // manual closeSync is needed (vs. the openSync + writeFileSync(fd)
-            // form, which leaks the fd).
-            writeFileSync(lock, JSON.stringify({
-                acquiredAt: new Date().toISOString(),
-                pid: process.pid,
-            }), { flag: 'wx' });
-            return {
-                release: () => {
-                    try {
-                        unlinkSync(lock);
-                    }
-                    catch {
-                        // Already gone — fine.
-                    }
-                },
-            };
-        }
-        catch {
-            return null;
-        }
-    }
-    return { load, save, update, acquireLock };
-}

package/dist/phases/find-shared/scoped-read.d.ts

@@ -1,12 +0,0 @@
-/**
- * Shared helper for reading a single scope-keyed row (product XOR repo) via the
- * user's supabase session. Used by the find-* scan-config readers
- * (getScanBaseline, getRuleConfig) so they don't each re-implement the
- * session-guard + scoped query + never-throw error handling.
- */
-import type { ScanScope } from './baseline.js';
-/**
- * Fetch one scope-keyed row, or null when there's no session / no row / a read
- * error. Never throws — a read failure must not abort a scan.
- */
-export declare function readScopedRow<T>(table: string, columns: string, scope: ScanScope): Promise<T | null>;

package/dist/phases/find-shared/scoped-read.js

@@ -1,33 +0,0 @@
-/**
- * Shared helper for reading a single scope-keyed row (product XOR repo) via the
- * user's supabase session. Used by the find-* scan-config readers
- * (getScanBaseline, getRuleConfig) so they don't each re-implement the
- * session-guard + scoped query + never-throw error handling.
- */
-import { getSupabase, hasSupabaseSession } from '../../supabase/client.js';
-import { logWarning } from '../../utils/logger.js';
-/**
- * Fetch one scope-keyed row, or null when there's no session / no row / a read
- * error. Never throws — a read failure must not abort a scan.
- */
-export async function readScopedRow(table, columns, scope) {
-    if (!hasSupabaseSession()) {
-        return null;
-    }
-    try {
-        const query = getSupabase().from(table).select(columns);
-        const scoped = scope.productId
-            ? query.eq('product_id', scope.productId)
-            : query.eq('repository_id', scope.repoId);
-        const { data, error } = await scoped.maybeSingle();
-        if (error) {
-            logWarning(`Could not read ${table}: ${error.message}`);
-            return null;
-        }
-        return data ?? null;
-    }
-    catch (err) {
-        logWarning(`Could not read ${table}: ${err instanceof Error ? err.message : String(err)}`);
-        return null;
-    }
-}

package/dist/phases/find-smells/index.d.ts

@@ -1,50 +0,0 @@
-/**
- * Find-smells phase: clone the product's repo, ask Claude to audit code for
- * code smells (refactor candidates, perf cliffs, dead code, etc.), and file
- * each new finding as an issue. Subsequent runs are incremental, scoped to
- * commits since the previous successful scan.
- *
- * Companion to find-bugs (real defects) and find-features (missing user
- * capability). The three phases share the same workspace + state pattern.
- */
-import { type SmellCategory } from './types.js';
-export interface FindSmellsOptions {
-    /** Product scope. Provide this OR repoId (repo-scoped scan). */
-    productId?: string;
-    /** Repository scope: scan a bare `repositories` row with no product. */
-    repoId?: string;
-    githubToken: string;
-    owner: string;
-    repo: string;
-    /** Force a full scan even if previous-scan state exists. */
-    full?: boolean;
-    /** Branch to scan; defaults to the repo's default branch. */
-    branch?: string;
-    /** Upper bound on files the auditor may Read. Keeps token cost predictable. */
-    maxFiles?: number;
-    /**
-     * Optional category filter. Agent is asked to honour it via the prompt
-     * AND its output is re-filtered after parsing — both are required because
-     * the agent can't be trusted to obey perfectly.
-     */
-    categories?: SmellCategory[];
-    verbose?: boolean;
-}
-export interface FindSmellsResult {
-    status: 'success' | 'error';
-    message: string;
-    scannedCommitSha?: string;
-    smellsFound?: number;
-    issuesCreated?: number;
-    /** Findings the agent passed off to find-bugs (not filed by this run). */
-    deferredToBugs?: number;
-    /** Findings the agent passed off to find-features (not filed by this run). */
-    deferredToFeatures?: number;
-    summary?: string;
-}
-/** Single source of truth — referenced by the CLI help string too. */
-export declare const DEFAULT_MAX_FILES = 200;
-/**
- * Scan a product's repository for code smells and file each new finding as an issue.
- */
-export declare function scanForSmells(options: FindSmellsOptions): Promise<FindSmellsResult>;