evergreen-deprecation 0.1.0 → 0.3.0

package/README.md

@@ -1,12 +1,42 @@
 # Evergreen
 
+<p align="center">
+  <picture>
+    <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/arminazimi/evergreen/main/brand/exports/banner-dark.png">
+    <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/arminazimi/evergreen/main/brand/exports/banner-light.png">
+    <img alt="Evergreen — Know what breaks next." src="https://raw.githubusercontent.com/arminazimi/evergreen/main/brand/exports/banner-light.png" width="100%">
+  </picture>
+</p>
+
 [![CI](https://github.com/arminazimi/evergreen/actions/workflows/ci.yml/badge.svg)](https://github.com/arminazimi/evergreen/actions/workflows/ci.yml)
+[![Coverage](https://img.shields.io/endpoint?url=https%3A%2F%2Fraw.githubusercontent.com%2Farminazimi%2Fevergreen%2Fbadges%2Fcoverage.json)](https://github.com/arminazimi/evergreen/actions/workflows/ci.yml)
 [![npm](https://img.shields.io/npm/v/evergreen-deprecation.svg)](https://www.npmjs.com/package/evergreen-deprecation)
+[![skills.sh](https://skills.sh/b/arminazimi/evergreen)](https://skills.sh/arminazimi/evergreen/evergreen-deprecation)
+[![Node.js](https://img.shields.io/badge/node-%3E%3D22-3c873a.svg)](docs/COMPATIBILITY.md)
+[![SARIF](https://img.shields.io/badge/SARIF-2.1.0-blue.svg)](docs/GITHUB_ACTION.md#code-scanning)
+[![MCP](https://img.shields.io/badge/MCP-server-8a2be2.svg)](docs/MCP.md)
 [![License](https://img.shields.io/badge/license-Apache--2.0-blue.svg)](LICENSE)
 
-Evergreen is a local-first deprecation intelligence engine for software repositories. It connects upcoming ecosystem changes to the exact files they affect and produces evidence-backed migration context for humans and AI coding agents.
+Evergreen finds **end-of-life and deprecated** runtimes, packages, and GitHub Actions in your repository, shows the exact file and line, and backs every finding with an authoritative source, a replacement, and migration steps. It runs on your machine as a CLI, a local MCP server, a GitHub Action (with SARIF for code scanning), and an Agent Skill, so people and coding agents can find lifecycle risk before it breaks a build, and check a dependency before adding it. Scans are deterministic and offline, and need no account.
+
+Read the [public documentation](https://arminazimi.github.io/evergreen/), run the [90-second demo](docs/DEMO.md), or inspect the [validation report](docs/VALIDATION.md). For AI tools, the docs are also published as [`llms.txt`](https://arminazimi.github.io/evergreen/llms.txt) and [`llms-full.txt`](https://arminazimi.github.io/evergreen/llms-full.txt).
+
+## What it covers
 
-Version 0.1 includes GitHub Actions, Node.js, npm, and Python lifecycle detectors. Read the [public documentation](https://arminazimi.github.io/evergreen/), run the [90-second demo](docs/DEMO.md), or inspect the [v0.1 validation report](docs/VALIDATION.md).
+| Ecosystem | What Evergreen reads | What it reports |
+| --- | --- | --- |
+| **Container base images** *(experimental)* | `Dockerfile`, `*.Dockerfile`, `Containerfile`, `compose.yaml`, `docker-compose.yml`: base images of official `node`, `python`, `postgres`, `mysql`, and `ruby` | Image release lines that are end of life. Variables, `latest`, and floating tags are listed as unclassified, never guessed. See [Container base images](docs/detectors/container.md) |
+| **.NET** *(experimental)* | `global.json`, `*.csproj`/`*.fsproj`/`*.vbproj`, `Directory.Build.props`, `Directory.Packages.props`, `packages.lock.json`: the pinned SDK, target frameworks, and direct NuGet packages | .NET release lines past end of support, and direct packages their publisher deprecated, with the C# files that use them. .NET Framework, `netstandard`, MSBuild properties, floating versions, and ranges are not judged. See [.NET](docs/detectors/dotnet.md) |
+| **Go** *(experimental)* | `go.mod` and `go.work`: `go` and `toolchain` directives, and direct `require` entries | Go release lines that no longer receive fixes, and direct modules with a lifecycle rule. Versions Evergreen cannot read are listed as unclassified. See [Go](docs/detectors/go.md) |
+| **GitHub Actions** | `.github/workflows/*.yml`: `uses:` references to actions, including full-SHA pins resolved through a trailing version comment or a bundled release map | Actions on retired runtimes (such as Node.js 20) and retired or deprecated majors, at the exact line |
+| **Java and Kotlin (JVM)** *(experimental)* | `pom.xml`, `build.gradle`, `build.gradle.kts`, `.java-version`, `.sdkmanrc`, `.tool-versions`: the JDK a project pins or targets, and direct Maven dependencies. See [Java and Kotlin](docs/detectors/java.md) | JDK feature releases that are out of support, and dependencies whose POM says they moved. Property references and expressions are listed as unclassified |
+| **Kubernetes APIs** *(experimental)* | `*.yaml`, `*.yml` manifests, Helm chart `templates/`, and `kustomization.yaml`: the literal `apiVersion` and `kind`, and kustomize patches. See [Kubernetes APIs](docs/detectors/kubernetes.md) | API versions the Kubernetes project says are no longer served. Helm values, cluster-guarded templates, and anything it cannot read literally are skipped |
+| **Node.js** | `engines.node`, `volta`, `.nvmrc`, `.node-version` | Runtime versions that are end of life or out of support |
+| **npm** | `package.json` dependencies, `package-lock.json`, `npm-shrinkwrap.json`, `yarn.lock`, `pnpm-lock.yaml`, and the imports and calls that use each package | Deprecated or unmaintained packages, with the replacement and where the package is used |
+| **Python** | `pyproject.toml`, `requirements*.txt`, `.python-version`, `runtime.txt`, `.tool-versions`, `poetry.lock`, `uv.lock`, `Pipfile.lock` | Python versions that are end of life, and deprecated or obsolete packages |
+| **Rust** *(experimental)* | `Cargo.toml`, `Cargo.lock`, `rust-toolchain(.toml)`: the pinned toolchain and direct crate dependencies | Toolchains older than the newest stable release, and direct dependencies on unmaintained crates with the files that use them. `edition`, `rust-version`, `stable`, and anything it cannot read literally are not judged. See [Rust](docs/detectors/rust.md) |
+
+Each finding carries its rule's sources, review date, and migration steps; see [Lifecycle rules](docs/RULES.md). Other ecosystems are not guessed at: Evergreen reports a package it has no rule for as `no-data`, never as safe, and new ecosystems start from a [generated detector skeleton](docs/DETECTORS.md#start-a-new-detector-in-this-repository). The [compatibility matrix](docs/COMPATIBILITY.md) lists supported environments and hosts.
 
 ## Product principles
 
@@ -24,6 +54,26 @@ Requirements: Node.js 22 or newer.
 npx evergreen-deprecation scan .
 ```
 
+Verify that the CLI, local MCP server, Agent Skill, plugin foundations, and CI
+workspace are ready without changing configuration or uploading repository data:
+
+```bash
+npx evergreen-deprecation doctor .
+npx evergreen-deprecation doctor . --json
+```
+
+See the [public compatibility matrix](docs/COMPATIBILITY.md) for supported,
+experimental, and unsupported combinations.
+
+Discover Evergreen's versioned capabilities and entry points programmatically:
+
+```bash
+npx evergreen-deprecation capabilities --json
+```
+
+The [auto-discovery contract](docs/CAPABILITIES.md) defines the shared identifiers
+used by the CLI, MCP server, Agent Skill, plugins, and CI integrations.
+
 Create a baseline for accepted existing findings, then report only new lifecycle regressions:
 
 ```bash
@@ -31,6 +81,24 @@ npx evergreen-deprecation baseline .
 npx evergreen-deprecation scan . --baseline .evergreen-baseline.json
 ```
 
+Check a single dependency before adding it, without scanning a repository:
+
+```bash
+npx evergreen-deprecation check pkg:npm/request@2.88.2
+npx evergreen-deprecation check pkg:github/actions/checkout@v4 --json
+```
+
+The command prints the lifecycle problem, replacement, and evidence, and exits `1` when a rule at or above `--fail-on` (default `high`) applies, `0` otherwise, and `2` for invalid input. A package Evergreen has no rule for reports `no-data`, which is not a claim that it is safe. Without a version, a package whose rules only cover some versions reports `version-dependent`; add a version to get a definite answer.
+
+Lifecycle rules can be refreshed between releases from signed bundles, and scans stay offline unless you ask:
+
+```bash
+npx evergreen-deprecation data status
+npx evergreen-deprecation data update
+```
+
+See [Lifecycle data](docs/DATA.md) for the signing and trust model, pinning, and what happens when a download cannot be verified.
+
 Inspect the evidence and migration direction for one result:
 
 ```bash
@@ -45,17 +113,39 @@ npx evergreen-deprecation context '<finding-id>' . --json
 
 Migration packets contain rule-specific constraints and steps, exact affected files and usages, authoritative sources, and suggested verification commands. Evergreen never executes those commands automatically. See the [migration packet guide](docs/MIGRATION_PACKETS.md).
 
+Tell the coding agents working in a repository to check dependencies before adding them. This adds (or refreshes) a clearly marked section in `AGENTS.md`, or `CLAUDE.md` if that is the file you have; running it again changes nothing, and nothing outside the markers is touched:
+
+```bash
+npx evergreen-deprecation init --agents --dry-run   # show the change
+npx evergreen-deprecation init --agents
+```
+
 Connect a coding agent through the local MCP server:
 
 ```bash
 npx --yes --package evergreen-deprecation evergreen-mcp
 ```
 
-The stdio server exposes `scan_repository`, `list_deprecations`, `explain_deprecation`, `create_migration_context`, and `verify_migration`. See the [local MCP guide](docs/MCP.md) for host configuration, the intended workflow, and privacy guarantees.
+The stdio server exposes `scan_repository`, `list_deprecations`, `explain_deprecation`, `create_migration_context`, `verify_migration`, and `check_dependency` (check one package before adding it). See the [local MCP guide](docs/MCP.md) for host configuration, the intended workflow, and privacy guarantees.
 
 ## Agent Skill
 
-The package includes a thin, vendor-neutral Agent Skill at [`skills/evergreen-deprecation`](skills/evergreen-deprecation/SKILL.md). Install that folder in any host implementing the open Agent Skills format. It teaches discovery, explanation, migration, and verification while leaving detection and migration logic inside Evergreen. See the [Agent Skill guide](docs/AGENT_SKILLS.md) for installation, evaluation, limits, and security assumptions.
+Install the vendor-neutral Agent Skill from the monorepo:
+
+```bash
+npx skills add arminazimi/evergreen
+```
+
+Pull future revisions with:
+
+```bash
+npx skills update evergreen-deprecation
+```
+
+The [`evergreen-deprecation` Skill](skills/evergreen-deprecation/README.md) teaches discovery, explanation, migration, and verification while leaving detection and migration logic inside Evergreen. It is discoverable on [skills.sh](https://skills.sh/arminazimi/evergreen/evergreen-deprecation) and has been install-validated for Codex, Claude Code, Cursor, GitHub Copilot, and Gemini CLI. See the [Agent Skill guide](docs/AGENT_SKILLS.md) for evaluation, compatibility, limits, and security assumptions.
+
+Codex and Claude plugin packages are generated from that same Skill and MCP workflow. Their [packaging architecture](docs/PLUGIN_PACKAGING.md) keeps host manifests thin and fails CI when either package drifts from the canonical sources.
+The [cross-host evaluation](docs/PLUGIN_EVALS.md) publishes shared-corpus results, context budgets, permission behavior, and security limitations; the same checks block release regressions in `npm run check`.
 
 Evergreen runs locally and does not upload repository contents.
 
@@ -102,7 +192,7 @@ permissions:
 
 steps:
   - uses: actions/checkout@v7
-  - uses: arminazimi/evergreen@v0.1.0
+  - uses: arminazimi/evergreen@v0.3.0
     with:
       baseline: .evergreen-baseline.json
       fail-on-severity: high
@@ -118,6 +208,16 @@ See the [detector authoring guide](docs/DETECTORS.md) and the [minimal detector
 
 ## Initial product shape
 
-The CLI is the product. Detectors extend it, GitHub Actions automate it, and the local MCP server exposes it to agents. A hosted backend is intentionally outside the first three-month roadmap.
+The CLI is the product. Detectors extend it, GitHub Actions automate it, and the local MCP server exposes it to agents. A hosted backend is intentionally outside the roadmap; lifecycle data updates through a signed, offline-verifiable data channel instead.
+
+See [the roadmap](docs/ROADMAP.md), [architecture](docs/ARCHITECTURE.md), [brand guide](brand/BRAND_GUIDE.md), and [contribution guide](CONTRIBUTING.md).
+
+## Community
+
+Questions, ideas, and things you built with Evergreen belong in [GitHub Discussions](https://github.com/arminazimi/evergreen/discussions): use **Q&A** to ask, **Ideas** to propose, and **Show and tell** to share. Use issues for bugs, lifecycle rule requests, and ecosystem requests.
+
+## License and brand
 
-See [the roadmap](docs/ROADMAP.md), [architecture](docs/ARCHITECTURE.md), and [contribution guide](CONTRIBUTING.md).
+Evergreen source code is licensed under the [Apache License 2.0](LICENSE). The
+Evergreen name, logo, and files in [`brand/`](brand/) are proprietary brand assets
+and are covered by separate [brand asset terms](brand/LICENSE.md).

package/data/README.md

@@ -0,0 +1,11 @@
+# Bundled trust material
+
+`sigstore-trusted-root.json` is the Sigstore public-good trusted root: the keys and validity periods of the Fulcio certificate authority, the Rekor transparency log, and the certificate transparency log. Evergreen uses it to verify a lifecycle data bundle's signature offline. It ships in the npm package.
+
+| | |
+| --- | --- |
+| Source | https://github.com/sigstore/root-signing/blob/main/targets/trusted_root.json |
+| Fetched | 2026-10-16 |
+| SHA-256 | `6494e21ea73fa7ee769f85f57d5a3e6a08725eae1e38c755fc3517c9e6bc0b66` |
+
+Trust in this file is trust in the Evergreen release that contains it, the same as trust in the registries bundled with that release. Sigstore rotates these keys occasionally; when a signing key in the file expires, signatures made after that time no longer verify and Evergreen falls back to its bundled data with a warning. Refresh the file when Sigstore publishes a new root, update the hash above, and release. A test checks the hash.

package/data/sigstore-trusted-root.json

@@ -0,0 +1,126 @@
+{
+  "mediaType": "application/vnd.dev.sigstore.trustedroot+json;version=0.1",
+  "tlogs": [
+    {
+      "baseUrl": "https://rekor.sigstore.dev",
+      "hashAlgorithm": "SHA2_256",
+      "publicKey": {
+        "rawBytes": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE2G2Y+2tabdTV5BcGiBIx0a9fAFwrkBbmLSGtks4L3qX6yYY0zufBnhC8Ur/iy55GhWP/9A/bY2LhC30M9+RYtw==",
+        "keyDetails": "PKIX_ECDSA_P256_SHA_256",
+        "validFor": {
+          "start": "2021-01-12T11:53:27Z"
+        }
+      },
+      "logId": {
+        "keyId": "wNI9atQGlz+VWfO6LRygH4QUfY/8W4RFwiT5i5WRgB0="
+      }
+    },
+    {
+      "baseUrl": "https://log2025-1.rekor.sigstore.dev",
+      "hashAlgorithm": "SHA2_256",
+      "publicKey": {
+        "rawBytes": "MCowBQYDK2VwAyEAt8rlp1knGwjfbcXAYPYAkn0XiLz1x8O4t0YkEhie244=",
+        "keyDetails": "PKIX_ED25519",
+        "validFor": {
+          "start": "2025-09-23T00:00:00Z"
+        }
+      },
+      "logId": {
+        "keyId": "zxGZFVvd0FEmjR8WrFwMdcAJ9vtaY/QXf44Y1wUeP6A="
+      }
+    }
+  ],
+  "certificateAuthorities": [
+    {
+      "subject": {
+        "organization": "sigstore.dev",
+        "commonName": "sigstore"
+      },
+      "uri": "https://fulcio.sigstore.dev",
+      "certChain": {
+        "certificates": [
+          {
+            "rawBytes": "MIIB+DCCAX6gAwIBAgITNVkDZoCiofPDsy7dfm6geLbuhzAKBggqhkjOPQQDAzAqMRUwEwYDVQQKEwxzaWdzdG9yZS5kZXYxETAPBgNVBAMTCHNpZ3N0b3JlMB4XDTIxMDMwNzAzMjAyOVoXDTMxMDIyMzAzMjAyOVowKjEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MREwDwYDVQQDEwhzaWdzdG9yZTB2MBAGByqGSM49AgEGBSuBBAAiA2IABLSyA7Ii5k+pNO8ZEWY0ylemWDowOkNa3kL+GZE5Z5GWehL9/A9bRNA3RbrsZ5i0JcastaRL7Sp5fp/jD5dxqc/UdTVnlvS16an+2Yfswe/QuLolRUCrcOE2+2iA5+tzd6NmMGQwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQEwHQYDVR0OBBYEFMjFHQBBmiQpMlEk6w2uSu1KBtPsMB8GA1UdIwQYMBaAFMjFHQBBmiQpMlEk6w2uSu1KBtPsMAoGCCqGSM49BAMDA2gAMGUCMH8liWJfMui6vXXBhjDgY4MwslmN/TJxVe/83WrFomwmNf056y1X48F9c4m3a3ozXAIxAKjRay5/aj/jsKKGIkmQatjI8uupHr/+CxFvaJWmpYqNkLDGRU+9orzh5hI2RrcuaQ=="
+          }
+        ]
+      },
+      "validFor": {
+        "start": "2021-03-07T03:20:29Z",
+        "end": "2022-12-31T23:59:59.999Z"
+      }
+    },
+    {
+      "subject": {
+        "organization": "sigstore.dev",
+        "commonName": "sigstore"
+      },
+      "uri": "https://fulcio.sigstore.dev",
+      "certChain": {
+        "certificates": [
+          {
+            "rawBytes": "MIICGjCCAaGgAwIBAgIUALnViVfnU0brJasmRkHrn/UnfaQwCgYIKoZIzj0EAwMwKjEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MREwDwYDVQQDEwhzaWdzdG9yZTAeFw0yMjA0MTMyMDA2MTVaFw0zMTEwMDUxMzU2NThaMDcxFTATBgNVBAoTDHNpZ3N0b3JlLmRldjEeMBwGA1UEAxMVc2lnc3RvcmUtaW50ZXJtZWRpYXRlMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE8RVS/ysH+NOvuDZyPIZtilgUF9NlarYpAd9HP1vBBH1U5CV77LSS7s0ZiH4nE7Hv7ptS6LvvR/STk798LVgMzLlJ4HeIfF3tHSaexLcYpSASr1kS0N/RgBJz/9jWCiXno3sweTAOBgNVHQ8BAf8EBAMCAQYwEwYDVR0lBAwwCgYIKwYBBQUHAwMwEgYDVR0TAQH/BAgwBgEB/wIBADAdBgNVHQ4EFgQU39Ppz1YkEZb5qNjpKFWixi4YZD8wHwYDVR0jBBgwFoAUWMAeX5FFpWapesyQoZMi0CrFxfowCgYIKoZIzj0EAwMDZwAwZAIwPCsQK4DYiZYDPIaDi5HFKnfxXx6ASSVmERfsynYBiX2X6SJRnZU84/9DZdnFvvxmAjBOt6QpBlc4J/0DxvkTCqpclvziL6BCCPnjdlIB3Pu3BxsPmygUY7Ii2zbdCdliiow="
+          },
+          {
+            "rawBytes": "MIIB9zCCAXygAwIBAgIUALZNAPFdxHPwjeDloDwyYChAO/4wCgYIKoZIzj0EAwMwKjEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MREwDwYDVQQDEwhzaWdzdG9yZTAeFw0yMTEwMDcxMzU2NTlaFw0zMTEwMDUxMzU2NThaMCoxFTATBgNVBAoTDHNpZ3N0b3JlLmRldjERMA8GA1UEAxMIc2lnc3RvcmUwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAT7XeFT4rb3PQGwS4IajtLk3/OlnpgangaBclYpsYBr5i+4ynB07ceb3LP0OIOZdxexX69c5iVuyJRQ+Hz05yi+UF3uBWAlHpiS5sh0+H2GHE7SXrk1EC5m1Tr19L9gg92jYzBhMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBRYwB5fkUWlZql6zJChkyLQKsXF+jAfBgNVHSMEGDAWgBRYwB5fkUWlZql6zJChkyLQKsXF+jAKBggqhkjOPQQDAwNpADBmAjEAj1nHeXZp+13NWBNa+EDsDP8G1WWg1tCMWP/WHPqpaVo0jhsweNFZgSs0eE7wYI4qAjEA2WB9ot98sIkoF3vZYdd3/VtWB5b9TNMea7Ix/stJ5TfcLLeABLE4BNJOsQ4vnBHJ"
+          }
+        ]
+      },
+      "validFor": {
+        "start": "2022-04-13T20:06:15Z"
+      }
+    }
+  ],
+  "ctlogs": [
+    {
+      "baseUrl": "https://ctfe.sigstore.dev/test",
+      "hashAlgorithm": "SHA2_256",
+      "publicKey": {
+        "rawBytes": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEbfwR+RJudXscgRBRpKX1XFDy3PyudDxz/SfnRi1fT8ekpfBd2O1uoz7jr3Z8nKzxA69EUQ+eFCFI3zeubPWU7w==",
+        "keyDetails": "PKIX_ECDSA_P256_SHA_256",
+        "validFor": {
+          "start": "2021-03-14T00:00:00Z",
+          "end": "2022-10-31T23:59:59.999Z"
+        }
+      },
+      "logId": {
+        "keyId": "CGCS8ChS/2hF0dFrJ4ScRWcYrBY9wzjSbea8IgY2b3I="
+      }
+    },
+    {
+      "baseUrl": "https://ctfe.sigstore.dev/2022",
+      "hashAlgorithm": "SHA2_256",
+      "publicKey": {
+        "rawBytes": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEiPSlFi0CmFTfEjCUqF9HuCEcYXNKAaYalIJmBZ8yyezPjTqhxrKBpMnaocVtLJBI1eM3uXnQzQGAJdJ4gs9Fyw==",
+        "keyDetails": "PKIX_ECDSA_P256_SHA_256",
+        "validFor": {
+          "start": "2022-10-20T00:00:00Z"
+        }
+      },
+      "logId": {
+        "keyId": "3T0wasbHETJjGR4cmWc3AqJKXrjePK3/h4pygC8p7o4="
+      }
+    }
+  ],
+  "timestampAuthorities": [
+    {
+      "subject": {
+        "organization": "sigstore.dev",
+        "commonName": "sigstore-tsa-selfsigned"
+      },
+      "uri": "https://timestamp.sigstore.dev/api/v1/timestamp",
+      "certChain": {
+        "certificates": [
+          {
+            "rawBytes": "MIICEDCCAZagAwIBAgIUOhNULwyQYe68wUMvy4qOiyojiwwwCgYIKoZIzj0EAwMwOTEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MSAwHgYDVQQDExdzaWdzdG9yZS10c2Etc2VsZnNpZ25lZDAeFw0yNTA0MDgwNjU5NDNaFw0zNTA0MDYwNjU5NDNaMC4xFTATBgNVBAoTDHNpZ3N0b3JlLmRldjEVMBMGA1UEAxMMc2lnc3RvcmUtdHNhMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE4ra2Z8hKNig2T9kFjCAToGG30jky+WQv3BzL+mKvh1SKNR/UwuwsfNCg4sryoYAd8E6isovVA3M4aoNdm9QDi50Z8nTEyvqgfDPtTIwXItfiW/AFf1V7uwkbkAoj0xxco2owaDAOBgNVHQ8BAf8EBAMCB4AwHQYDVR0OBBYEFIn9eUOHz9BlRsMCRscsc1t9tOsDMB8GA1UdIwQYMBaAFJjsAe9/u1H/1JUeb4qImFMHic6/MBYGA1UdJQEB/wQMMAoGCCsGAQUFBwMIMAoGCCqGSM49BAMDA2gAMGUCMDtpsV/6KaO0qyF/UMsX2aSUXKQFdoGTptQGc0ftq1csulHPGG6dsmyMNd3JB+G3EQIxAOajvBcjpJmKb4Nv+2Taoj8Uc5+b6ih6FXCCKraSqupe07zqswMcXJTe1cExvHvvlw=="
+          },
+          {
+            "rawBytes": "MIIB9zCCAXygAwIBAgIUV7f0GLDOoEzIh8LXSW80OJiUp14wCgYIKoZIzj0EAwMwOTEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MSAwHgYDVQQDExdzaWdzdG9yZS10c2Etc2VsZnNpZ25lZDAeFw0yNTA0MDgwNjU5NDNaFw0zNTA0MDYwNjU5NDNaMDkxFTATBgNVBAoTDHNpZ3N0b3JlLmRldjEgMB4GA1UEAxMXc2lnc3RvcmUtdHNhLXNlbGZzaWduZWQwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAQUQNtfRT/ou3YATa6wB/kKTe70cfJwyRIBovMnt8RcJph/COE82uyS6FmppLLL1VBPGcPfpQPYJNXzWwi8icwhKQ6W/Qe2h3oebBb2FHpwNJDqo+TMaC/tdfkv/ElJB72jRTBDMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBSY7AHvf7tR/9SVHm+KiJhTB4nOvzAKBggqhkjOPQQDAwNpADBmAjEAwGEGrfGZR1cen1R8/DTVMI943LssZmJRtDp/i7SfGHmGRP6gRbuj9vOK3b67Z0QQAjEAuT2H673LQEaHTcyQSZrkp4mX7WwkmF+sVbkYY5mXN+RMH13KUEHHOqASaemYWK/E"
+          }
+        ]
+      },
+      "validFor": {
+        "start": "2025-07-04T00:00:00Z"
+      }
+    }
+  ]
+}

package/dist/src/action.js

@@ -2,7 +2,7 @@
 import { appendFile } from "node:fs/promises";
 import process from "node:process";
 import { resolve } from "node:path";
-import { runGitHubAction } from "./github-action.js";
+import { renderFailure, renderSummary, runGitHubAction } from "./github-action.js";
 function commandValue(value) {
     return value.replaceAll("%", "%25").replaceAll("\r", "%0D").replaceAll("\n", "%0A");
 }
@@ -23,32 +23,52 @@ async function setOutput(name, value) {
     if (output)
         await appendFile(output, `${name}=${value}\n`, "utf8");
 }
-async function writeSummary(findings, failed, gate) {
+async function writeSummary(findings, failed, gate, data, expiredFailure = false, suppressions) {
     const summary = process.env.GITHUB_STEP_SUMMARY;
     if (!summary)
         return;
-    const status = failed ? `failed the **${gate}** severity gate` : "passed the severity gate";
-    await appendFile(summary, `## Evergreen\n\nFound **${findings}** new lifecycle finding${findings === 1 ? "" : "s"}; ${status}.\n`, "utf8");
+    // On by default; `attribution: "false"` turns the line off.
+    const attribution = process.env.INPUT_ATTRIBUTION !== "false";
+    const note = expiredFailure ? "\n> **Failed:** a baseline suppression has expired and `on-expired` is set to `fail`.\n" : "";
+    await appendFile(summary, `${renderSummary(findings, failed, gate, data, attribution, suppressions)}${note}`, "utf8");
 }
 async function main() {
     try {
         const workspace = process.env.GITHUB_WORKSPACE ?? process.cwd();
         const root = process.env.INPUT_PATH || workspace;
         const reportPath = resolve(process.env.RUNNER_TEMP ?? workspace, "evergreen-report.json");
+        const sarifPath = process.env["INPUT_UPLOAD-SARIF"] === "true"
+            ? resolve(process.env.RUNNER_TEMP ?? workspace, "evergreen-results.sarif")
+            : undefined;
         const outcome = await runGitHubAction({
             root,
             reportPath,
+            ...(sarifPath ? { sarifPath } : {}),
             ...(process.env.INPUT_BASELINE ? { baselinePath: process.env.INPUT_BASELINE } : {}),
+            ...(process.env["INPUT_BASELINE-WARN-DAYS"] ? { baselineWarnDays: Number(process.env["INPUT_BASELINE-WARN-DAYS"]) } : {}),
+            ...(process.env["INPUT_ON-EXPIRED"] ? { onExpired: process.env["INPUT_ON-EXPIRED"] } : {}),
             failOnSeverity: (process.env["INPUT_FAIL-ON-SEVERITY"] || "high"),
         });
         for (const annotation of outcome.annotations)
             console.log(annotationCommand(annotation));
+        // A suppression about to expire is a warning on the run, not a finding.
+        for (const diagnostic of outcome.result.diagnostics) {
+            if (diagnostic.startsWith("Baseline suppression expired"))
+                console.log(`::warning title=Evergreen baseline suppression expired::${commandValue(diagnostic)}`);
+            if (diagnostic.startsWith("Baseline suppression expires"))
+                console.log(`::warning title=Evergreen baseline suppression expires soon::${commandValue(diagnostic)}`);
+        }
         await setOutput("report-path", outcome.reportPath);
+        if (outcome.sarifPath)
+            await setOutput("sarif-path", outcome.sarifPath);
         await setOutput("finding-count", String(outcome.result.findings.length));
-        await writeSummary(outcome.result.findings.length, outcome.failed, outcome.gate);
+        await writeSummary(outcome.result.findings, outcome.gateFailed, outcome.gate, outcome.result.data, outcome.expiredFailure, outcome.result.suppressions);
+        if (outcome.result.data?.stale)
+            console.log(`::warning title=Evergreen lifecycle data is stale::The data is ${outcome.result.data.ageDays} days old, so findings may miss recent changes.`);
         console.log(`Evergreen found ${outcome.result.findings.length} new lifecycle finding${outcome.result.findings.length === 1 ? "" : "s"}.`);
-        if (outcome.failed) {
-            console.log(`::error title=Evergreen severity gate failed::A finding met the ${outcome.gate} threshold.`);
+        const failure = renderFailure(outcome);
+        if (failure) {
+            console.log(`::error title=Evergreen policy gate failed::${commandValue(failure)}`);
             process.exitCode = 1;
         }
     }

package/dist/src/action.js.map

@@ -1 +1 @@
-{"version":3,"file":"action.js","sourceRoot":"","sources":["../../src/action.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,OAAO,MAAM,cAAc,CAAC;AACnC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAGrD,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACtF,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,iBAAiB,CAAC,UAA4B;IACrD,MAAM,UAAU,GAAG;QACjB,QAAQ,eAAe,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE;QACnD,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,UAAU,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS;QACzE,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,UAAU,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS;QAC5E,SAAS,eAAe,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE;KAC7C,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;IAC1D,OAAO,KAAK,UAAU,CAAC,KAAK,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,YAAY,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;AAC9F,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAY,EAAE,KAAa;IAClD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IACzC,IAAI,MAAM;QAAE,MAAM,UAAU,CAAC,MAAM,EAAE,GAAG,IAAI,IAAI,KAAK,IAAI,EAAE,MAAM,CAAC,CAAC;AACrE,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,QAAgB,EAAE,MAAe,EAAE,IAAkB;IAC/E,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;IAChD,IAAI,CAAC,OAAO;QAAE,OAAO;IACrB,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,gBAAgB,IAAI,kBAAkB,CAAC,CAAC,CAAC,0BAA0B,CAAC;IAC5F,MAAM,UAAU,CACd,OAAO,EACP,2BAA2B,QAAQ,2BAA2B,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,KAAK,EACvG,MAAM,CACP,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAChE,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,SAAS,CAAC;QACjD,MAAM,UAAU,GAAG,OAAO,CACxB,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,SAAS,EACpC,uBAAuB,CACxB,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC;YACpC,IAAI;YACJ,UAAU;YACV,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnF,cAAc,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,IAAI,MAAM,CAAiB;SAClF,CAAC,CAAC;QAEH,KAAK,MAAM,UAAU,IAAI,OAAO,CAAC,WAAW;YAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC,CAAC;QACzF,MAAM,SAAS,CAAC,aAAa,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QACnD,MAAM,SAAS,CAAC,eAAe,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACzE,MAAM,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QACjF,OAAO,CAAC,GAAG,CACT,mBAAmB,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,yBAAyB,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAC7H,CAAC;QACF,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,OAAO,CAAC,GAAG,CAAC,mEAAmE,OAAO,CAAC,IAAI,aAAa,CAAC,CAAC;YAC1G,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,OAAO,CAAC,GAAG,CAAC,mCAAmC,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACxE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AAED,KAAK,IAAI,EAAE,CAAC"}
+{"version":3,"file":"action.js","sourceRoot":"","sources":["../../src/action.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,OAAO,MAAM,cAAc,CAAC;AACnC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGpC,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAInF,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACtF,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,iBAAiB,CAAC,UAA4B;IACrD,MAAM,UAAU,GAAG;QACjB,QAAQ,eAAe,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE;QACnD,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,UAAU,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS;QACzE,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,UAAU,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS;QAC5E,SAAS,eAAe,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE;KAC7C,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;IAC1D,OAAO,KAAK,UAAU,CAAC,KAAK,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,YAAY,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;AAC9F,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAY,EAAE,KAAa;IAClD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IACzC,IAAI,MAAM;QAAE,MAAM,UAAU,CAAC,MAAM,EAAE,GAAG,IAAI,IAAI,KAAK,IAAI,EAAE,MAAM,CAAC,CAAC;AACrE,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,QAA4B,EAAE,MAAe,EAAE,IAAkB,EAAE,IAAe,EAAE,cAAc,GAAG,KAAK,EAAE,YAA+B;IACrK,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;IAChD,IAAI,CAAC,OAAO;QAAE,OAAO;IACrB,4DAA4D;IAC5D,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,KAAK,OAAO,CAAC;IAC9D,MAAM,IAAI,GAAG,cAAc,CAAC,CAAC,CAAC,yFAAyF,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7H,MAAM,UAAU,CAAC,OAAO,EAAE,GAAG,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,YAAY,CAAC,GAAG,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;AACxH,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAChE,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,SAAS,CAAC;QACjD,MAAM,UAAU,GAAG,OAAO,CACxB,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,SAAS,EACpC,uBAAuB,CACxB,CAAC;QACF,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,KAAK,MAAM;YAC5D,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,SAAS,EAAE,yBAAyB,CAAC;YAC1E,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC;YACpC,IAAI;YACJ,UAAU;YACV,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnF,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzH,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3G,cAAc,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,IAAI,MAAM,CAAiB;SAClF,CAAC,CAAC;QAEH,KAAK,MAAM,UAAU,IAAI,OAAO,CAAC,WAAW;YAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC,CAAC;QACzF,wEAAwE;QACxE,KAAK,MAAM,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YACpD,IAAI,UAAU,CAAC,UAAU,CAAC,8BAA8B,CAAC;gBAAE,OAAO,CAAC,GAAG,CAAC,2DAA2D,YAAY,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YAC9J,IAAI,UAAU,CAAC,UAAU,CAAC,8BAA8B,CAAC;gBAAE,OAAO,CAAC,GAAG,CAAC,gEAAgE,YAAY,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACrK,CAAC;QACD,MAAM,SAAS,CAAC,aAAa,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QACnD,IAAI,OAAO,CAAC,SAAS;YAAE,MAAM,SAAS,CAAC,YAAY,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QACxE,MAAM,SAAS,CAAC,eAAe,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACzE,MAAM,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACxJ,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK;YAAE,OAAO,CAAC,GAAG,CAAC,kEAAkE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,iDAAiD,CAAC,CAAC;QAC5L,OAAO,CAAC,GAAG,CACT,mBAAmB,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,yBAAyB,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAC7H,CAAC;QACF,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,GAAG,CAAC,+CAA+C,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACpF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,OAAO,CAAC,GAAG,CAAC,mCAAmC,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACxE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AAED,KAAK,IAAI,EAAE,CAAC"}

package/dist/src/agent-instructions.d.ts

@@ -0,0 +1,20 @@
+/** The section `evergreen init --agents` keeps in a repository's AGENTS.md or CLAUDE.md. */
+export declare const SECTION_BEGIN = "<!-- evergreen:begin -->";
+export declare const SECTION_END = "<!-- evergreen:end -->";
+/** The instructions themselves; `examples/agents/dependency-check.md` carries the same text for hosts configured by hand. */
+export declare const DEPENDENCY_CHECK_INSTRUCTIONS = "Before you add a new package, runtime, or GitHub Action to this project, or pick one to replace another, check it with Evergreen.\n\n- Call the `check_dependency` tool with a Package URL, for example `pkg:npm/request@2.88.2`, `pkg:pypi/nose`, or `pkg:github/actions/checkout@v4`. Without MCP, run `npx evergreen-deprecation check <purl>`.\n- If the status is `affected`, prefer the replacement it names and tell the user why, citing the evidence links it returns.\n- `version-dependent` means rules exist only for some versions: call again with the version you intend to use. `no-data` means Evergreen has no rule for that package; it is not a claim that the package is safe.\n- Do not use Evergreen for security vulnerability audits or for routine upgrades of dependencies the project already uses.\n";
+export declare const AGENT_SECTION = "<!-- evergreen:begin -->\n<!-- This section is maintained by `evergreen init --agents`. Edit around it, not inside it. -->\n## Evergreen dependency check\n\nBefore you add a new package, runtime, or GitHub Action to this project, or pick one to replace another, check it with Evergreen.\n\n- Call the `check_dependency` tool with a Package URL, for example `pkg:npm/request@2.88.2`, `pkg:pypi/nose`, or `pkg:github/actions/checkout@v4`. Without MCP, run `npx evergreen-deprecation check <purl>`.\n- If the status is `affected`, prefer the replacement it names and tell the user why, citing the evidence links it returns.\n- `version-dependent` means rules exist only for some versions: call again with the version you intend to use. `no-data` means Evergreen has no rule for that package; it is not a claim that the package is safe.\n- Do not use Evergreen for security vulnerability audits or for routine upgrades of dependencies the project already uses.\n<!-- evergreen:end -->";
+export declare class AgentFileError extends Error {
+    constructor(message: string);
+}
+export interface SectionUpdate {
+    text: string;
+    change: "created" | "added" | "updated" | "unchanged";
+}
+/**
+ * Returns `existing` with the Evergreen section added or refreshed. Everything outside the markers is preserved
+ * byte for byte, including the file's line endings; a file with damaged markers is refused rather than guessed at.
+ */
+export declare function withAgentSection(existing: string | undefined): SectionUpdate;
+/** A small unified diff of the one region that changes, with two lines of context. */
+export declare function renderDiff(file: string, before: string, after: string): string;

package/dist/src/agent-instructions.js

@@ -0,0 +1,76 @@
+/** The section `evergreen init --agents` keeps in a repository's AGENTS.md or CLAUDE.md. */
+export const SECTION_BEGIN = "<!-- evergreen:begin -->";
+export const SECTION_END = "<!-- evergreen:end -->";
+/** The instructions themselves; `examples/agents/dependency-check.md` carries the same text for hosts configured by hand. */
+export const DEPENDENCY_CHECK_INSTRUCTIONS = `Before you add a new package, runtime, or GitHub Action to this project, or pick one to replace another, check it with Evergreen.
+
+- Call the \`check_dependency\` tool with a Package URL, for example \`pkg:npm/request@2.88.2\`, \`pkg:pypi/nose\`, or \`pkg:github/actions/checkout@v4\`. Without MCP, run \`npx evergreen-deprecation check <purl>\`.
+- If the status is \`affected\`, prefer the replacement it names and tell the user why, citing the evidence links it returns.
+- \`version-dependent\` means rules exist only for some versions: call again with the version you intend to use. \`no-data\` means Evergreen has no rule for that package; it is not a claim that the package is safe.
+- Do not use Evergreen for security vulnerability audits or for routine upgrades of dependencies the project already uses.
+`;
+export const AGENT_SECTION = `${SECTION_BEGIN}
+<!-- This section is maintained by \`evergreen init --agents\`. Edit around it, not inside it. -->
+## Evergreen dependency check
+
+${DEPENDENCY_CHECK_INSTRUCTIONS}${SECTION_END}`;
+export class AgentFileError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "AgentFileError";
+    }
+}
+/**
+ * Returns `existing` with the Evergreen section added or refreshed. Everything outside the markers is preserved
+ * byte for byte, including the file's line endings; a file with damaged markers is refused rather than guessed at.
+ */
+export function withAgentSection(existing) {
+    if (existing === undefined || existing.length === 0)
+        return { text: `${AGENT_SECTION}\n`, change: "created" };
+    const newline = existing.includes("\r\n") ? "\r\n" : "\n";
+    const section = AGENT_SECTION.replaceAll("\n", newline);
+    const begins = existing.split(SECTION_BEGIN).length - 1;
+    const ends = existing.split(SECTION_END).length - 1;
+    if (begins === 0 && ends === 0) {
+        const separator = existing.endsWith(newline) ? newline : `${newline}${newline}`;
+        return { text: `${existing}${separator}${section}${newline}`, change: "added" };
+    }
+    if (begins !== 1 || ends !== 1) {
+        throw new AgentFileError(`The file has ${begins} "${SECTION_BEGIN}" and ${ends} "${SECTION_END}" markers; there must be exactly one of each. Fix them by hand and run the command again. Nothing was changed.`);
+    }
+    const start = existing.indexOf(SECTION_BEGIN);
+    const end = existing.indexOf(SECTION_END);
+    if (end < start)
+        throw new AgentFileError(`The "${SECTION_END}" marker comes before "${SECTION_BEGIN}". Fix them by hand and run the command again. Nothing was changed.`);
+    const text = `${existing.slice(0, start)}${section}${existing.slice(end + SECTION_END.length)}`;
+    return { text, change: text === existing ? "unchanged" : "updated" };
+}
+/** A small unified diff of the one region that changes, with two lines of context. */
+export function renderDiff(file, before, after) {
+    const old = before.split("\n");
+    const next = after.split("\n");
+    let prefix = 0;
+    while (prefix < old.length && prefix < next.length && old[prefix] === next[prefix])
+        prefix++;
+    let suffix = 0;
+    while (suffix < old.length - prefix && suffix < next.length - prefix && old[old.length - 1 - suffix] === next[next.length - 1 - suffix])
+        suffix++;
+    const contextStart = Math.max(0, prefix - 2);
+    const contextEnd = Math.min(suffix, 2);
+    const removed = old.slice(prefix, old.length - suffix);
+    const added = next.slice(prefix, next.length - suffix);
+    const head = old.slice(contextStart, prefix);
+    const tail = old.slice(old.length - suffix, old.length - suffix + contextEnd);
+    const oldCount = head.length + removed.length + tail.length;
+    const newCount = head.length + added.length + tail.length;
+    return [
+        `--- a/${file}`,
+        `+++ b/${file}`,
+        `@@ -${contextStart + 1},${oldCount} +${contextStart + 1},${newCount} @@`,
+        ...head.map((line) => ` ${line}`),
+        ...removed.map((line) => `-${line}`),
+        ...added.map((line) => `+${line}`),
+        ...tail.map((line) => ` ${line}`),
+    ].join("\n");
+}
+//# sourceMappingURL=agent-instructions.js.map

package/dist/src/agent-instructions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-instructions.js","sourceRoot":"","sources":["../../src/agent-instructions.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAE5F,MAAM,CAAC,MAAM,aAAa,GAAG,0BAA0B,CAAC;AACxD,MAAM,CAAC,MAAM,WAAW,GAAG,wBAAwB,CAAC;AAEpD,6HAA6H;AAC7H,MAAM,CAAC,MAAM,6BAA6B,GAAG;;;;;;CAM5C,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,GAAG,aAAa;;;;EAI3C,6BAA6B,GAAG,WAAW,EAAE,CAAC;AAEhD,MAAM,OAAO,cAAe,SAAQ,KAAK;IACvC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AAOD;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAA4B;IAC3D,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,GAAG,aAAa,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAE9G,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1D,MAAM,OAAO,GAAG,aAAa,CAAC,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IACpD,IAAI,MAAM,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,GAAG,OAAO,EAAE,CAAC;QAChF,OAAO,EAAE,IAAI,EAAE,GAAG,QAAQ,GAAG,SAAS,GAAG,OAAO,GAAG,OAAO,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAClF,CAAC;IACD,IAAI,MAAM,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,cAAc,CAAC,gBAAgB,MAAM,KAAK,aAAa,SAAS,IAAI,KAAK,WAAW,gHAAgH,CAAC,CAAC;IAClN,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC1C,IAAI,GAAG,GAAG,KAAK;QAAE,MAAM,IAAI,cAAc,CAAC,QAAQ,WAAW,0BAA0B,aAAa,qEAAqE,CAAC,CAAC;IAC3K,MAAM,IAAI,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,GAAG,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;IAChG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;AACvE,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,MAAc,EAAE,KAAa;IACpE,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,OAAO,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC;QAAE,MAAM,EAAE,CAAC;IAC7F,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,OAAO,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,MAAM,IAAI,MAAM,GAAG,IAAI,CAAC,MAAM,GAAG,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC;QAAE,MAAM,EAAE,CAAC;IAClJ,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,CAAC;IAC7C,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC;IACvD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,MAAM,EAAE,GAAG,CAAC,MAAM,GAAG,MAAM,GAAG,UAAU,CAAC,CAAC;IAC9E,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC5D,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC1D,OAAO;QACL,SAAS,IAAI,EAAE;QACf,SAAS,IAAI,EAAE;QACf,OAAO,YAAY,GAAG,CAAC,IAAI,QAAQ,KAAK,YAAY,GAAG,CAAC,IAAI,QAAQ,KAAK;QACzE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;QACjC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;QACpC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;QAClC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;KAClC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}

package/dist/src/agent-tools.d.ts

@@ -1,4 +1,4 @@
-import type { Finding, ScanResult, Severity, SourceLocation, VerificationCommand } from "./domain.js";
+import type { DataInfo, Finding, ScanResult, Severity, SourceLocation, VerificationCommand } from "./domain.js";
 import type { MigrationPacket } from "./migration-packet.js";
 export interface DeprecationSummary {
     id: string;
@@ -15,6 +15,7 @@ export interface DeprecationList {
     scannedAt: string;
     count: number;
     deprecations: DeprecationSummary[];
+    data?: DataInfo;
 }
 export interface MigrationVerification {
     schemaVersion: "evergreen.verification.v1";
@@ -27,6 +28,14 @@ export interface MigrationVerification {
     remainingFindings: Finding[];
     suggestedCommands: VerificationCommand[];
 }
+/** A finding observed in this session, with the repository it came from. */
+export interface ObservedFinding {
+    /** Short stable key of the repository root, used in the finding's resource URI. */
+    repositoryKey: string;
+    repositoryRoot: string;
+    finding: Finding;
+}
+export declare const repositoryKey: (root: string) => string;
 export declare class FindingNotObservedError extends Error {
     constructor(findingId: string);
 }
@@ -36,10 +45,13 @@ export declare class FindingNotObservedError extends Error {
  */
 export declare class EvergreenAgentTools {
     private readonly observed;
-    scan(repositoryPath?: string): Promise<ScanResult>;
+    scan(repositoryPath?: string, baselinePath?: string): Promise<ScanResult>;
     list(repositoryPath?: string): Promise<DeprecationList>;
     explain(findingId: string, repositoryPath?: string): Promise<Finding>;
     context(findingId: string, repositoryPath?: string): Promise<MigrationPacket>;
     verify(findingId: string, repositoryPath?: string): Promise<MigrationVerification>;
+    /** Every finding observed by this session so far, ordered by repository, then finding id. */
+    observedFindings(): ObservedFinding[];
+    observedFinding(key: string, findingId: string): ObservedFinding | undefined;
     private remember;
 }

package/dist/src/agent-tools.js

@@ -1,8 +1,10 @@
+import { createHash } from "node:crypto";
 import { resolve } from "node:path";
-import { findingFingerprint } from "./baseline.js";
+import { applyBaseline, findingFingerprint, readBaseline } from "./baseline.js";
 import { builtInDetectors } from "./detectors/index.js";
 import { scanRepository } from "./engine.js";
 import { createMigrationPacket } from "./migration-packet.js";
+export const repositoryKey = (root) => createHash("sha256").update(root).digest("hex").slice(0, 8);
 export class FindingNotObservedError extends Error {
     constructor(findingId) {
         super(`Finding was not observed in this MCP session: ${findingId}. Call scan_repository, explain_deprecation, or create_migration_context before editing the repository.`);
@@ -15,8 +17,12 @@ export class FindingNotObservedError extends Error {
  */
 export class EvergreenAgentTools {
     observed = new Map();
-    async scan(repositoryPath = ".") {
-        const result = await scanRepository(repositoryPath, builtInDetectors);
+    async scan(repositoryPath = ".", baselinePath) {
+        let result = await scanRepository(repositoryPath, builtInDetectors);
+        if (baselinePath) {
+            // A baseline path is relative to the repository, as in the Action. The reference day is today in UTC.
+            result = applyBaseline(result, await readBaseline(resolve(repositoryPath, baselinePath)), { today: new Date().toISOString().slice(0, 10) });
+        }
         this.remember(result);
         return result;
     }
@@ -27,6 +33,7 @@ export class EvergreenAgentTools {
             repositoryRoot: result.root,
             scannedAt: result.scannedAt,
             count: result.findings.length,
+            ...(result.data ? { data: result.data } : {}),
             deprecations: result.findings.map((finding) => ({
                 id: finding.id,
                 ruleId: finding.ruleId,
@@ -80,6 +87,15 @@ export class EvergreenAgentTools {
             suggestedCommands,
         };
     }
+    /** Every finding observed by this session so far, ordered by repository, then finding id. */
+    observedFindings() {
+        return [...this.observed.entries()]
+            .flatMap(([root, findings]) => [...findings.values()].map((finding) => ({ repositoryKey: repositoryKey(root), repositoryRoot: root, finding })))
+            .sort((left, right) => left.repositoryRoot.localeCompare(right.repositoryRoot) || left.finding.id.localeCompare(right.finding.id));
+    }
+    observedFinding(key, findingId) {
+        return this.observedFindings().find((entry) => entry.repositoryKey === key && entry.finding.id === findingId);
+    }
     remember(result) {
         const findings = this.observed.get(result.root) ?? new Map();
         for (const finding of result.findings) {

package/dist/src/agent-tools.js.map

@@ -1 +1 @@
-{"version":3,"file":"agent-tools.js","sourceRoot":"","sources":["../../src/agent-tools.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAExD,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAiC9D,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAChD,YAAY,SAAiB;QAC3B,KAAK,CACH,iDAAiD,SAAS,yGAAyG,CACpK,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,mBAAmB;IACb,QAAQ,GAAG,IAAI,GAAG,EAAgC,CAAC;IAEpE,KAAK,CAAC,IAAI,CAAC,cAAc,GAAG,GAAG;QAC7B,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;QACtE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACtB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,cAAc,GAAG,GAAG;QAC7B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC/C,OAAO;YACL,aAAa,EAAE,2BAA2B;YAC1C,cAAc,EAAE,MAAM,CAAC,IAAI;YAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;YAC7B,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;gBAC9C,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,UAAU,EAAE,OAAO,CAAC,MAAM,EAAE,UAAU,IAAI,OAAO,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC;gBACrE,aAAa,EACX,OAAO,CAAC,MAAM,EAAE,aAAa;oBAC7B,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;aAC3E,CAAC,CAAC;SACJ,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,SAAiB,EAAE,cAAc,GAAG,GAAG;QACnD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC;QAChF,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,SAAS,EAAE,CAAC,CAAC;QACjE,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,SAAiB,EAAE,cAAc,GAAG,GAAG;QACnD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC/C,OAAO,qBAAqB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,SAAiB,EAAE,cAAc,GAAG,GAAG;QAClD,MAAM,IAAI,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;QACzD,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,uBAAuB,CAAC,SAAS,CAAC,CAAC;QAE5D,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;QAC5D,MAAM,iBAAiB,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAC9C,CAAC,OAAO,EAAE,EAAE,CACV,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,QAAQ,CAAC,IAAI,CACzF,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACtB,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,KAAK,CAAC,CAAC;QAChD,MAAM,iBAAiB,GAAG;YACxB,GAAG,CAAC,QAAQ,CAAC,SAAS,EAAE,YAAY,IAAI,EAAE,CAAC;YAC3C;gBACE,OAAO,EAAE,yBAAyB;gBAClC,OAAO,EAAE,kDAAkD;aAC5D;SACF,CAAC,MAAM,CACN,CAAC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,CAC3B,QAAQ,CAAC,SAAS,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,KAAK,KAAK,CACrF,CAAC;QAEF,OAAO;YACL,aAAa,EAAE,2BAA2B;YAC1C,cAAc,EAAE,MAAM,CAAC,IAAI;YAC3B,SAAS;YACT,UAAU,EAAE,MAAM,CAAC,SAAS;YAC5B,QAAQ;YACR,gBAAgB,EAAE,KAAK;YACvB,OAAO,EAAE,QAAQ;gBACf,CAAC,CAAC,wEAAwE;gBAC1E,CAAC,CAAC,oCAAoC,iBAAiB,CAAC,MAAM,wBAAwB,iBAAiB,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG;YACpI,iBAAiB;YACjB,iBAAiB;SAClB,CAAC;IACJ,CAAC;IAEO,QAAQ,CAAC,MAAkB;QACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,EAAmB,CAAC;QAC9E,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACtC,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC1C,IAAI,CAAC,QAAQ,IAAI,kBAAkB,CAAC,QAAQ,CAAC,KAAK,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC9E,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC3C,CAAC;CACF"}
+{"version":3,"file":"agent-tools.js","sourceRoot":"","sources":["../../src/agent-tools.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAChF,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAExD,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AA0C9D,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,IAAY,EAAU,EAAE,CACpD,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAE9D,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAChD,YAAY,SAAiB;QAC3B,KAAK,CACH,iDAAiD,SAAS,yGAAyG,CACpK,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,mBAAmB;IACb,QAAQ,GAAG,IAAI,GAAG,EAAgC,CAAC;IAEpE,KAAK,CAAC,IAAI,CAAC,cAAc,GAAG,GAAG,EAAE,YAAqB;QACpD,IAAI,MAAM,GAAG,MAAM,cAAc,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;QACpE,IAAI,YAAY,EAAE,CAAC;YACjB,sGAAsG;YACtG,MAAM,GAAG,aAAa,CAAC,MAAM,EAAE,MAAM,YAAY,CAAC,OAAO,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9I,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACtB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,cAAc,GAAG,GAAG;QAC7B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC/C,OAAO;YACL,aAAa,EAAE,2BAA2B;YAC1C,cAAc,EAAE,MAAM,CAAC,IAAI;YAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;YAC7B,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7C,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;gBAC9C,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,UAAU,EAAE,OAAO,CAAC,MAAM,EAAE,UAAU,IAAI,OAAO,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC;gBACrE,aAAa,EACX,OAAO,CAAC,MAAM,EAAE,aAAa;oBAC7B,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;aAC3E,CAAC,CAAC;SACJ,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,SAAiB,EAAE,cAAc,GAAG,GAAG;QACnD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC;QAChF,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,SAAS,EAAE,CAAC,CAAC;QACjE,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,SAAiB,EAAE,cAAc,GAAG,GAAG;QACnD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC/C,OAAO,qBAAqB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,SAAiB,EAAE,cAAc,GAAG,GAAG;QAClD,MAAM,IAAI,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;QACzD,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,uBAAuB,CAAC,SAAS,CAAC,CAAC;QAE5D,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;QAC5D,MAAM,iBAAiB,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAC9C,CAAC,OAAO,EAAE,EAAE,CACV,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,QAAQ,CAAC,IAAI,CACzF,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACtB,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,KAAK,CAAC,CAAC;QAChD,MAAM,iBAAiB,GAAG;YACxB,GAAG,CAAC,QAAQ,CAAC,SAAS,EAAE,YAAY,IAAI,EAAE,CAAC;YAC3C;gBACE,OAAO,EAAE,yBAAyB;gBAClC,OAAO,EAAE,kDAAkD;aAC5D;SACF,CAAC,MAAM,CACN,CAAC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,CAC3B,QAAQ,CAAC,SAAS,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,KAAK,KAAK,CACrF,CAAC;QAEF,OAAO;YACL,aAAa,EAAE,2BAA2B;YAC1C,cAAc,EAAE,MAAM,CAAC,IAAI;YAC3B,SAAS;YACT,UAAU,EAAE,MAAM,CAAC,SAAS;YAC5B,QAAQ;YACR,gBAAgB,EAAE,KAAK;YACvB,OAAO,EAAE,QAAQ;gBACf,CAAC,CAAC,wEAAwE;gBAC1E,CAAC,CAAC,oCAAoC,iBAAiB,CAAC,MAAM,wBAAwB,iBAAiB,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG;YACpI,iBAAiB;YACjB,iBAAiB;SAClB,CAAC;IACJ,CAAC;IAED,6FAA6F;IAC7F,gBAAgB;QACd,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;aAChC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE,CAC5B,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,aAAa,EAAE,aAAa,CAAC,IAAI,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CACjH;aACA,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;IACvI,CAAC;IAED,eAAe,CAAC,GAAW,EAAE,SAAiB;QAC5C,OAAO,IAAI,CAAC,gBAAgB,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,aAAa,KAAK,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC;IAChH,CAAC;IAEO,QAAQ,CAAC,MAAkB;QACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,EAAmB,CAAC;QAC9E,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACtC,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC1C,IAAI,CAAC,QAAQ,IAAI,kBAAkB,CAAC,QAAQ,CAAC,KAAK,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC9E,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC3C,CAAC;CACF"}