fivosense 0.1.4 → 0.1.6

package/dist/cli/index.js

@@ -3,28 +3,69 @@
  * FivoSense CLI
  */
 import { auditFile, formatAuditResult } from '../index.js';
+import { generateRoast, formatRoast, generateBadge } from '../features/index.js';
 const args = process.argv.slice(2);
 if (args.length === 0) {
     console.log(`
 🛡️  FivoSense - Neuro-symbolic AI Security Scanner
 
 Usage:
-  npx fivosense <file>
-  npx fivosense audit <file>
+  fivosense <file>              Scan a file for vulnerabilities
+  fivosense --roast <file>      Get roasted for security issues 🔥
+  fivosense --badge <file>      Get your security grade badge
 
 Example:
-  npx fivosense src/server.js
+  fivosense src/server.js
+  fivosense --roast src/api.js
+  fivosense --badge src/app.js
   `);
     process.exit(0);
 }
-const command = args[0];
-const filepath = args[1] || args[0];
+// Parse command and file
+let mode = 'scan';
+let filepath = args[0];
+if (args[0] === '--roast' || args[0] === '-r') {
+    mode = 'roast';
+    filepath = args[1];
+}
+else if (args[0] === '--badge' || args[0] === '-b') {
+    mode = 'badge';
+    filepath = args[1];
+}
+else if (args[0] === 'audit') {
+    filepath = args[1];
+}
+if (!filepath) {
+    console.error('\n❌ Error: Please provide a file to scan\n');
+    process.exit(1);
+}
 async function main() {
     try {
         console.log(`\n🔍 Auditing ${filepath}...\n`);
         const result = await auditFile(filepath);
-        const output = formatAuditResult(result);
-        console.log(output);
+        if (mode === 'roast') {
+            // Roast mode
+            const roast = generateRoast(result);
+            const roastText = formatRoast(roast);
+            console.log('\n' + roastText + '\n');
+        }
+        else if (mode === 'badge') {
+            // Badge mode
+            const badge = generateBadge(result);
+            console.log('\n🛡️ Security Badge\n');
+            console.log(`Grade: ${badge.grade}`);
+            console.log(`Score: ${badge.score}/100`);
+            console.log(`\nFindings:`);
+            console.log(`  Critical: ${result.summary.critical}`);
+            console.log(`  High: ${result.summary.high}`);
+            console.log(`  Medium: ${result.summary.medium}`);
+            console.log();
+        }
+        else {
+            // Normal scan mode
+            const output = formatAuditResult(result);
+            console.log(output);
+        }
         // Exit with error code if critical/high findings
         if (result.summary.critical > 0 || result.summary.high > 0) {
             process.exit(1);

package/dist/cli/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":";AACA;;GAEG;AAEH,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAE3D,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAEnC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;IACtB,OAAO,CAAC,GAAG,CAAC;;;;;;;;;GASX,CAAC,CAAC;IACH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;AACxB,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;AAEpC,KAAK,UAAU,IAAI;IACjB,IAAI,CAAC;QACH,OAAO,CAAC,GAAG,CAAC,iBAAiB,QAAQ,OAAO,CAAC,CAAC;QAE9C,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAEzC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAEpB,iDAAiD;QACjD,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YAC3D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CAAC,cAAc,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;QAC/C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":";AACA;;GAEG;AAEH,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAEjF,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAEnC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;IACtB,OAAO,CAAC,GAAG,CAAC;;;;;;;;;;;;GAYX,CAAC,CAAC;IACH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,yBAAyB;AACzB,IAAI,IAAI,GAAG,MAAM,CAAC;AAClB,IAAI,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;AAEvB,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;IAC9C,IAAI,GAAG,OAAO,CAAC;IACf,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;AACrB,CAAC;KAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;IACrD,IAAI,GAAG,OAAO,CAAC;IACf,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;AACrB,CAAC;KAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC;IAC/B,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;AACrB,CAAC;AAED,IAAI,CAAC,QAAQ,EAAE,CAAC;IACd,OAAO,CAAC,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAC5D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,IAAI,CAAC;QACH,OAAO,CAAC,GAAG,CAAC,iBAAiB,QAAQ,OAAO,CAAC,CAAC;QAE9C,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAC;QAEzC,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACrB,aAAa;YACb,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;YACpC,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;YACrC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,SAAS,GAAG,IAAI,CAAC,CAAC;QACvC,CAAC;aAAM,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YAC5B,aAAa;YACb,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;YACpC,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;YACtC,OAAO,CAAC,GAAG,CAAC,UAAU,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;YACrC,OAAO,CAAC,GAAG,CAAC,UAAU,KAAK,CAAC,KAAK,MAAM,CAAC,CAAC;YACzC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YAC3B,OAAO,CAAC,GAAG,CAAC,eAAe,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;YACtD,OAAO,CAAC,GAAG,CAAC,WAAW,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;YAC9C,OAAO,CAAC,GAAG,CAAC,aAAa,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YAClD,OAAO,CAAC,GAAG,EAAE,CAAC;QAChB,CAAC;aAAM,CAAC;YACN,mBAAmB;YACnB,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;YACzC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACtB,CAAC;QAED,iDAAiD;QACjD,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YAC3D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CAAC,cAAc,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;QAC/C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC"}

package/dist/core/orchestrator.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Orchestrator - Coordinates analysis pipeline and flow control
+ */
+import type { AuditResult } from '../index.js';
+import type { AIProvider } from '../ai/client.js';
+export interface OrchestratorOptions {
+    enableAI?: boolean;
+    enableAdversarial?: boolean;
+    enablePoC?: boolean;
+    scopeToDiff?: boolean;
+    diffBase?: string;
+    aiProvider?: AIProvider;
+    verbose?: boolean;
+}
+/**
+ * Main orchestration pipeline
+ */
+export declare function orchestrateAudit(code: string, filepath: string, options?: OrchestratorOptions): Promise<AuditResult>;
+/**
+ * Quick audit (no AI, no scope)
+ */
+export declare function quickAudit(code: string, filepath: string): Promise<AuditResult>;
+/**
+ * Full audit (with AI and adversarial)
+ */
+export declare function fullAudit(code: string, filepath: string, aiProvider?: AIProvider): Promise<AuditResult>;
+/**
+ * Diff-scoped audit (only changed code)
+ */
+export declare function diffAudit(code: string, filepath: string, diffBase?: string): Promise<AuditResult>;
+//# sourceMappingURL=orchestrator.d.ts.map

package/dist/core/orchestrator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"orchestrator.d.ts","sourceRoot":"","sources":["../../src/core/orchestrator.ts"],"names":[],"mappings":"AAAA;;GAEG;AAUH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,mBAAwB,GAChC,OAAO,CAAC,WAAW,CAAC,CAiLtB;AAED;;GAEG;AACH,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAQrF;AAED;;GAEG;AACH,wBAAsB,SAAS,CAC7B,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,UAAU,CAAC,EAAE,UAAU,GACtB,OAAO,CAAC,WAAW,CAAC,CAStB;AAED;;GAEG;AACH,wBAAsB,SAAS,CAC7B,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,QAAQ,GAAE,MAAe,GACxB,OAAO,CAAC,WAAW,CAAC,CAStB"}

package/dist/core/orchestrator.js

@@ -0,0 +1,205 @@
+/**
+ * Orchestrator - Coordinates analysis pipeline and flow control
+ */
+import { buildDataFlowGraph } from '../engine/graph.js';
+import { generateTaintTraces } from '../engine/taint.js';
+import { detectSecrets } from '../rules/secrets.js';
+import { detectDestructive } from '../rules/destructive.js';
+import { judgePathWithAI } from '../ai/judge.js';
+import { verifyWithAdversary } from '../engine/adversary.js';
+import { generatePoC } from '../engine/poc.js';
+import { getDiffScope, filterFindingsByScope } from './scope.js';
+/**
+ * Main orchestration pipeline
+ */
+export async function orchestrateAudit(code, filepath, options = {}) {
+    const { enableAI = false, enableAdversarial = false, enablePoC = false, scopeToDiff = false, diffBase = 'main', aiProvider, verbose = false, } = options;
+    if (verbose) {
+        console.log(`🔍 Starting audit: ${filepath}`);
+        console.log(`   AI Judge: ${enableAI ? '✅' : '❌'}`);
+        console.log(`   Adversarial: ${enableAdversarial ? '✅' : '❌'}`);
+        console.log(`   PoC Generation: ${enablePoC ? '✅' : '❌'}`);
+        console.log(`   Scope to diff: ${scopeToDiff ? '✅' : '❌'}`);
+    }
+    // Step 1: Get scope if needed
+    let scope;
+    if (scopeToDiff) {
+        if (verbose)
+            console.log(`📋 Getting diff scope (base: ${diffBase})...`);
+        scope = await getDiffScope(diffBase);
+        if (verbose)
+            console.log(`   ${scope.files.length} files in scope`);
+    }
+    // Step 2: Build data-flow graph
+    if (verbose)
+        console.log(`🔨 Building data-flow graph...`);
+    const graph = buildDataFlowGraph(code, filepath);
+    // Step 3: Taint analysis
+    if (verbose)
+        console.log(`🔍 Running taint analysis...`);
+    const traces = generateTaintTraces(graph, filepath);
+    // Convert traces to vulnerabilities format
+    const allVulnerabilities = traces.map(trace => ({
+        finding: trace.finding,
+        severity: trace.severity,
+        category: trace.category,
+        cwe: trace.cwe,
+        path: trace.path.split(' → '),
+        evidence: trace.evidence,
+        location: trace.location,
+        sanitized: trace.sanitized,
+        confidence: 0.8,
+    }));
+    // Step 4: Filter by scope if enabled
+    let vulnerabilities = allVulnerabilities;
+    if (scope && scopeToDiff) {
+        if (verbose)
+            console.log(`🎯 Filtering by scope...`);
+        vulnerabilities = filterFindingsByScope(vulnerabilities, filepath, scope);
+        if (verbose)
+            console.log(`   ${vulnerabilities.length} vulnerabilities in scope`);
+    }
+    // Step 5: AI judgment (if enabled)
+    if (enableAI && vulnerabilities.length > 0) {
+        if (verbose)
+            console.log(`🤖 Running AI judgment...`);
+        for (let i = 0; i < vulnerabilities.length; i++) {
+            const vuln = vulnerabilities[i];
+            try {
+                const judgment = await judgePathWithAI({
+                    source: vuln.path[0] || 'unknown',
+                    sourceType: 'user input',
+                    sourceLoc: `line ${vuln.location.line}`,
+                    sink: vuln.path[vuln.path.length - 1] || 'unknown',
+                    sinkType: vuln.category,
+                    category: vuln.category,
+                    cwe: vuln.cwe,
+                    dataFlow: vuln.path.join(' → '),
+                    codeSnippet: code.split('\n').slice(Math.max(0, vuln.location.line - 3), vuln.location.line + 2).join('\n'),
+                    language: filepath.endsWith('.ts') || filepath.endsWith('.tsx') ? 'typescript' : 'javascript',
+                }, aiProvider);
+                // Update vulnerability with AI judgment
+                vuln.confidence = judgment.confidence;
+                if (verbose) {
+                    console.log(`   [${i + 1}/${vulnerabilities.length}] ${vuln.finding}: ${judgment.exploitable ? '❌ Exploitable' : '✅ Safe'} (confidence: ${judgment.confidence})`);
+                }
+            }
+            catch (error) {
+                if (verbose) {
+                    console.warn(`   [${i + 1}/${vulnerabilities.length}] AI judgment failed:`, error);
+                }
+            }
+        }
+    }
+    // Step 6: Adversarial verification (if enabled)
+    if (enableAdversarial && vulnerabilities.length > 0) {
+        if (verbose)
+            console.log(`⚔️  Running adversarial verification...`);
+        for (let i = 0; i < vulnerabilities.length; i++) {
+            const vuln = vulnerabilities[i];
+            try {
+                const trace = traces.find((t) => t.category === vuln.category && t.location.line === vuln.location.line);
+                if (trace) {
+                    const adversary = await verifyWithAdversary(trace, code, aiProvider);
+                    // Update confidence based on adversarial result
+                    vuln.confidence = Math.min(vuln.confidence, adversary.confidence);
+                    if (verbose) {
+                        console.log(`   [${i + 1}/${vulnerabilities.length}] ${adversary.exploitable ? '⚔️  Exploit found' : '🛡️  Defense holds'}`);
+                    }
+                }
+            }
+            catch (error) {
+                if (verbose) {
+                    console.warn(`   [${i + 1}/${vulnerabilities.length}] Adversarial verification failed:`, error);
+                }
+            }
+        }
+    }
+    // Step 7: PoC generation (if enabled)
+    if (enablePoC && vulnerabilities.length > 0) {
+        if (verbose)
+            console.log(`💣 Generating PoCs...`);
+        for (const vuln of vulnerabilities) {
+            try {
+                const trace = traces.find((t) => t.category === vuln.category && t.location.line === vuln.location.line);
+                if (trace) {
+                    const poc = generatePoC(trace);
+                    // Attach PoC to vulnerability (could extend Vulnerability type)
+                    vuln.poc = poc;
+                }
+            }
+            catch (error) {
+                if (verbose) {
+                    console.warn(`   Failed to generate PoC:`, error);
+                }
+            }
+        }
+    }
+    // Step 8: Secret detection
+    if (verbose)
+        console.log(`🔑 Detecting secrets...`);
+    const secrets = detectSecrets(code);
+    // Step 9: Destructive command detection
+    if (verbose)
+        console.log(`💥 Detecting destructive commands...`);
+    const destructive = detectDestructive(code);
+    // Step 10: Build summary
+    const summary = {
+        total: vulnerabilities.length + secrets.length + destructive.length,
+        critical: vulnerabilities.filter((v) => v.severity === 'critical').length,
+        high: vulnerabilities.filter((v) => v.severity === 'high').length + secrets.length,
+        medium: vulnerabilities.filter((v) => v.severity === 'medium').length + destructive.length,
+    };
+    if (verbose) {
+        console.log(`\n📊 Audit complete:`);
+        console.log(`   Total: ${summary.total}`);
+        console.log(`   Critical: ${summary.critical}`);
+        console.log(`   High: ${summary.high}`);
+        console.log(`   Medium: ${summary.medium}\n`);
+    }
+    return {
+        vulnerabilities,
+        secrets,
+        destructive,
+        summary,
+    };
+}
+/**
+ * Quick audit (no AI, no scope)
+ */
+export async function quickAudit(code, filepath) {
+    return orchestrateAudit(code, filepath, {
+        enableAI: false,
+        enableAdversarial: false,
+        enablePoC: false,
+        scopeToDiff: false,
+        verbose: false,
+    });
+}
+/**
+ * Full audit (with AI and adversarial)
+ */
+export async function fullAudit(code, filepath, aiProvider) {
+    return orchestrateAudit(code, filepath, {
+        enableAI: true,
+        enableAdversarial: true,
+        enablePoC: true,
+        scopeToDiff: false,
+        aiProvider,
+        verbose: true,
+    });
+}
+/**
+ * Diff-scoped audit (only changed code)
+ */
+export async function diffAudit(code, filepath, diffBase = 'main') {
+    return orchestrateAudit(code, filepath, {
+        enableAI: false,
+        enableAdversarial: false,
+        enablePoC: false,
+        scopeToDiff: true,
+        diffBase,
+        verbose: true,
+    });
+}
+//# sourceMappingURL=orchestrator.js.map

package/dist/core/orchestrator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"orchestrator.js","sourceRoot":"","sources":["../../src/core/orchestrator.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAmB,MAAM,oBAAoB,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,qBAAqB,EAAkB,MAAM,YAAY,CAAC;AAcjF;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,IAAY,EACZ,QAAgB,EAChB,UAA+B,EAAE;IAEjC,MAAM,EACJ,QAAQ,GAAG,KAAK,EAChB,iBAAiB,GAAG,KAAK,EACzB,SAAS,GAAG,KAAK,EACjB,WAAW,GAAG,KAAK,EACnB,QAAQ,GAAG,MAAM,EACjB,UAAU,EACV,OAAO,GAAG,KAAK,GAChB,GAAG,OAAO,CAAC;IAEZ,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,CAAC,GAAG,CAAC,sBAAsB,QAAQ,EAAE,CAAC,CAAC;QAC9C,OAAO,CAAC,GAAG,CAAC,gBAAgB,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;QACpD,OAAO,CAAC,GAAG,CAAC,mBAAmB,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;QAChE,OAAO,CAAC,GAAG,CAAC,sBAAsB,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;QAC3D,OAAO,CAAC,GAAG,CAAC,qBAAqB,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,8BAA8B;IAC9B,IAAI,KAA4B,CAAC;IACjC,IAAI,WAAW,EAAE,CAAC;QAChB,IAAI,OAAO;YAAE,OAAO,CAAC,GAAG,CAAC,gCAAgC,QAAQ,MAAM,CAAC,CAAC;QACzE,KAAK,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC;QACrC,IAAI,OAAO;YAAE,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,KAAK,CAAC,MAAM,iBAAiB,CAAC,CAAC;IACtE,CAAC;IAED,gCAAgC;IAChC,IAAI,OAAO;QAAE,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;IAC3D,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAEjD,yBAAyB;IACzB,IAAI,OAAO;QAAE,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAEpD,2CAA2C;IAC3C,MAAM,kBAAkB,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC9C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;QAC7B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,UAAU,EAAE,GAAG;KAChB,CAAC,CAAC,CAAC;IAEJ,qCAAqC;IACrC,IAAI,eAAe,GAAG,kBAAkB,CAAC;IACzC,IAAI,KAAK,IAAI,WAAW,EAAE,CAAC;QACzB,IAAI,OAAO;YAAE,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;QACrD,eAAe,GAAG,qBAAqB,CAAC,eAAe,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC1E,IAAI,OAAO;YAAE,OAAO,CAAC,GAAG,CAAC,MAAM,eAAe,CAAC,MAAM,2BAA2B,CAAC,CAAC;IACpF,CAAC;IAED,mCAAmC;IACnC,IAAI,QAAQ,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3C,IAAI,OAAO;YAAE,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;QAEtD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,eAAe,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAChD,MAAM,IAAI,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;YAEhC,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC;oBACrC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,SAAS;oBACjC,UAAU,EAAE,YAAY;oBACxB,SAAS,EAAE,QAAQ,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE;oBACvC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,SAAS;oBAClD,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;oBAC/B,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CACjC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,EACnC,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,CACvB,CAAC,IAAI,CAAC,IAAI,CAAC;oBACZ,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,YAAY;iBAC9F,EAAE,UAAU,CAAC,CAAC;gBAEf,wCAAwC;gBACxC,IAAI,CAAC,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC;gBAEtC,IAAI,OAAO,EAAE,CAAC;oBACZ,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,eAAe,CAAC,MAAM,KAAK,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,QAAQ,iBAAiB,QAAQ,CAAC,UAAU,GAAG,CAAC,CAAC;gBACpK,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,OAAO,EAAE,CAAC;oBACZ,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,eAAe,CAAC,MAAM,uBAAuB,EAAE,KAAK,CAAC,CAAC;gBACrF,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,gDAAgD;IAChD,IAAI,iBAAiB,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpD,IAAI,OAAO;YAAE,OAAO,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC;QAEpE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,eAAe,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAChD,MAAM,IAAI,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;YAEhC,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAa,EAAE,EAAE,CAC1C,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,KAAK,IAAI,CAAC,QAAQ,CAAC,IAAI,CACvE,CAAC;gBAEF,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,KAAK,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;oBAErE,gDAAgD;oBAChD,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC;oBAElE,IAAI,OAAO,EAAE,CAAC;wBACZ,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,eAAe,CAAC,MAAM,KAAK,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,oBAAoB,EAAE,CAAC,CAAC;oBAC/H,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,OAAO,EAAE,CAAC;oBACZ,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,eAAe,CAAC,MAAM,oCAAoC,EAAE,KAAK,CAAC,CAAC;gBAClG,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,sCAAsC;IACtC,IAAI,SAAS,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,IAAI,OAAO;YAAE,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;QAElD,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;YACnC,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAa,EAAE,EAAE,CAC1C,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,KAAK,IAAI,CAAC,QAAQ,CAAC,IAAI,CACvE,CAAC;gBAEF,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,GAAG,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;oBAC/B,gEAAgE;oBAC/D,IAAY,CAAC,GAAG,GAAG,GAAG,CAAC;gBAC1B,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,OAAO,EAAE,CAAC;oBACZ,OAAO,CAAC,IAAI,CAAC,4BAA4B,EAAE,KAAK,CAAC,CAAC;gBACpD,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,2BAA2B;IAC3B,IAAI,OAAO;QAAE,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAEpC,wCAAwC;IACxC,IAAI,OAAO;QAAE,OAAO,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;IACjE,MAAM,WAAW,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAE5C,yBAAyB;IACzB,MAAM,OAAO,GAAG;QACd,KAAK,EAAE,eAAe,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,WAAW,CAAC,MAAM;QACnE,QAAQ,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,MAAM;QAC9E,IAAI,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM;QACvF,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,MAAM,GAAG,WAAW,CAAC,MAAM;KAChG,CAAC;IAEF,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;QACpC,OAAO,CAAC,GAAG,CAAC,aAAa,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,gBAAgB,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QAChD,OAAO,CAAC,GAAG,CAAC,YAAY,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,cAAc,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC;IAChD,CAAC;IAED,OAAO;QACL,eAAe;QACf,OAAO;QACP,WAAW;QACX,OAAO;KACR,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAY,EAAE,QAAgB;IAC7D,OAAO,gBAAgB,CAAC,IAAI,EAAE,QAAQ,EAAE;QACtC,QAAQ,EAAE,KAAK;QACf,iBAAiB,EAAE,KAAK;QACxB,SAAS,EAAE,KAAK;QAChB,WAAW,EAAE,KAAK;QAClB,OAAO,EAAE,KAAK;KACf,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAY,EACZ,QAAgB,EAChB,UAAuB;IAEvB,OAAO,gBAAgB,CAAC,IAAI,EAAE,QAAQ,EAAE;QACtC,QAAQ,EAAE,IAAI;QACd,iBAAiB,EAAE,IAAI;QACvB,SAAS,EAAE,IAAI;QACf,WAAW,EAAE,KAAK;QAClB,UAAU;QACV,OAAO,EAAE,IAAI;KACd,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAY,EACZ,QAAgB,EAChB,WAAmB,MAAM;IAEzB,OAAO,gBAAgB,CAAC,IAAI,EAAE,QAAQ,EAAE;QACtC,QAAQ,EAAE,KAAK;QACf,iBAAiB,EAAE,KAAK;QACxB,SAAS,EAAE,KAAK;QAChB,WAAW,EAAE,IAAI;QACjB,QAAQ;QACR,OAAO,EAAE,IAAI;KACd,CAAC,CAAC;AACL,CAAC"}

package/dist/core/scope.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Scope Management - Track and filter relevant code changes
+ */
+export interface CodeScope {
+    files: string[];
+    lines: Map<string, Set<number>>;
+    changedFunctions: Map<string, string[]>;
+}
+/**
+ * Get diff scope for current changes
+ */
+export declare function getDiffScope(base?: string): Promise<CodeScope>;
+/**
+ * Filter findings to only those in changed scope
+ */
+export declare function filterFindingsByScope<T extends {
+    location?: {
+        line: number;
+    };
+}>(findings: T[], file: string, scope: CodeScope): T[];
+/**
+ * Get scope for staged changes
+ */
+export declare function getStagedScope(): Promise<CodeScope>;
+/**
+ * Check if a line is in scope
+ */
+export declare function isLineInScope(file: string, line: number, scope: CodeScope): boolean;
+//# sourceMappingURL=scope.d.ts.map

package/dist/core/scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.d.ts","sourceRoot":"","sources":["../../src/core/scope.ts"],"names":[],"mappings":"AAAA;;GAEG;AAOH,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IAChC,gBAAgB,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;CACzC;AAED;;GAEG;AACH,wBAAsB,YAAY,CAAC,IAAI,GAAE,MAAe,GAAG,OAAO,CAAC,SAAS,CAAC,CAiC5E;AA+BD;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,SAAS;IAAE,QAAQ,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,EAC7E,QAAQ,EAAE,CAAC,EAAE,EACb,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,SAAS,GACf,CAAC,EAAE,CAsBL;AAED;;GAEG;AACH,wBAAsB,cAAc,IAAI,OAAO,CAAC,SAAS,CAAC,CAiCzD;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAanF"}

package/dist/core/scope.js

@@ -0,0 +1,143 @@
+/**
+ * Scope Management - Track and filter relevant code changes
+ */
+import { exec } from 'child_process';
+import { promisify } from 'util';
+const execAsync = promisify(exec);
+/**
+ * Get diff scope for current changes
+ */
+export async function getDiffScope(base = 'main') {
+    const scope = {
+        files: [],
+        lines: new Map(),
+        changedFunctions: new Map(),
+    };
+    try {
+        // Get changed files
+        const { stdout: filesOutput } = await execAsync(`git diff --name-only ${base}...HEAD`);
+        const files = filesOutput
+            .split('\n')
+            .filter(f => f.endsWith('.js') || f.endsWith('.ts') || f.endsWith('.jsx') || f.endsWith('.tsx'))
+            .filter(f => f.trim().length > 0);
+        scope.files = files;
+        // Get changed lines for each file
+        for (const file of files) {
+            try {
+                const { stdout: diffOutput } = await execAsync(`git diff ${base}...HEAD -- ${file}`);
+                const changedLines = parseDiffLines(diffOutput);
+                scope.lines.set(file, changedLines);
+            }
+            catch (error) {
+                console.warn(`Failed to get diff for ${file}:`, error);
+            }
+        }
+        return scope;
+    }
+    catch (error) {
+        console.warn('Failed to get diff scope:', error);
+        return scope;
+    }
+}
+/**
+ * Parse diff output to extract changed line numbers
+ */
+function parseDiffLines(diff) {
+    const lines = new Set();
+    const diffLines = diff.split('\n');
+    let currentLine = 0;
+    for (const line of diffLines) {
+        // Parse hunk header: @@ -1,5 +1,7 @@
+        const hunkMatch = line.match(/^@@\s+-\d+,?\d*\s+\+(\d+),?(\d*)\s+@@/);
+        if (hunkMatch) {
+            currentLine = parseInt(hunkMatch[1], 10);
+            continue;
+        }
+        // Track added/modified lines
+        if (line.startsWith('+') && !line.startsWith('+++')) {
+            lines.add(currentLine);
+            currentLine++;
+        }
+        else if (!line.startsWith('-')) {
+            currentLine++;
+        }
+    }
+    return lines;
+}
+/**
+ * Filter findings to only those in changed scope
+ */
+export function filterFindingsByScope(findings, file, scope) {
+    const changedLines = scope.lines.get(file);
+    if (!changedLines || changedLines.size === 0) {
+        // No scope info, include all findings
+        return findings;
+    }
+    return findings.filter(finding => {
+        const line = finding.location?.line;
+        if (!line)
+            return false;
+        // Include if exact line changed
+        if (changedLines.has(line))
+            return true;
+        // Include if within 5 lines of a change (context)
+        for (const changedLine of changedLines) {
+            if (Math.abs(line - changedLine) <= 5)
+                return true;
+        }
+        return false;
+    });
+}
+/**
+ * Get scope for staged changes
+ */
+export async function getStagedScope() {
+    const scope = {
+        files: [],
+        lines: new Map(),
+        changedFunctions: new Map(),
+    };
+    try {
+        // Get staged files
+        const { stdout: filesOutput } = await execAsync('git diff --cached --name-only --diff-filter=ACM');
+        const files = filesOutput
+            .split('\n')
+            .filter(f => f.endsWith('.js') || f.endsWith('.ts') || f.endsWith('.jsx') || f.endsWith('.tsx'))
+            .filter(f => f.trim().length > 0);
+        scope.files = files;
+        // Get changed lines for each file
+        for (const file of files) {
+            try {
+                const { stdout: diffOutput } = await execAsync(`git diff --cached -- ${file}`);
+                const changedLines = parseDiffLines(diffOutput);
+                scope.lines.set(file, changedLines);
+            }
+            catch (error) {
+                console.warn(`Failed to get staged diff for ${file}:`, error);
+            }
+        }
+        return scope;
+    }
+    catch (error) {
+        console.warn('Failed to get staged scope:', error);
+        return scope;
+    }
+}
+/**
+ * Check if a line is in scope
+ */
+export function isLineInScope(file, line, scope) {
+    const changedLines = scope.lines.get(file);
+    if (!changedLines)
+        return false;
+    // Exact match
+    if (changedLines.has(line))
+        return true;
+    // Context match (within 5 lines)
+    for (const changedLine of changedLines) {
+        if (Math.abs(line - changedLine) <= 5)
+            return true;
+    }
+    return false;
+}
+//# sourceMappingURL=scope.js.map

package/dist/core/scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.js","sourceRoot":"","sources":["../../src/core/scope.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AACrC,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAEjC,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;AAQlC;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAe,MAAM;IACtD,MAAM,KAAK,GAAc;QACvB,KAAK,EAAE,EAAE;QACT,KAAK,EAAE,IAAI,GAAG,EAAE;QAChB,gBAAgB,EAAE,IAAI,GAAG,EAAE;KAC5B,CAAC;IAEF,IAAI,CAAC;QACH,oBAAoB;QACpB,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,SAAS,CAAC,wBAAwB,IAAI,SAAS,CAAC,CAAC;QACvF,MAAM,KAAK,GAAG,WAAW;aACtB,KAAK,CAAC,IAAI,CAAC;aACX,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;aAC/F,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAEpC,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC;QAEpB,kCAAkC;QAClC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,SAAS,CAAC,YAAY,IAAI,cAAc,IAAI,EAAE,CAAC,CAAC;gBACrF,MAAM,YAAY,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;gBAChD,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;YACtC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,IAAI,CAAC,0BAA0B,IAAI,GAAG,EAAE,KAAK,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,2BAA2B,EAAE,KAAK,CAAC,CAAC;QACjD,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,cAAc,CAAC,IAAY;IAClC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAEnC,IAAI,WAAW,GAAG,CAAC,CAAC;IAEpB,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,qCAAqC;QACrC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;QACtE,IAAI,SAAS,EAAE,CAAC;YACd,WAAW,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACzC,SAAS;QACX,CAAC;QAED,6BAA6B;QAC7B,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YACpD,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACvB,WAAW,EAAE,CAAC;QAChB,CAAC;aAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACjC,WAAW,EAAE,CAAC;QAChB,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB,CACnC,QAAa,EACb,IAAY,EACZ,KAAgB;IAEhB,MAAM,YAAY,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAE3C,IAAI,CAAC,YAAY,IAAI,YAAY,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QAC7C,sCAAsC;QACtC,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,OAAO,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE;QAC/B,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC;QACpC,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QAExB,gCAAgC;QAChC,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAExC,kDAAkD;QAClD,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;YACvC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC;QACrD,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc;IAClC,MAAM,KAAK,GAAc;QACvB,KAAK,EAAE,EAAE;QACT,KAAK,EAAE,IAAI,GAAG,EAAE;QAChB,gBAAgB,EAAE,IAAI,GAAG,EAAE;KAC5B,CAAC;IAEF,IAAI,CAAC;QACH,mBAAmB;QACnB,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,SAAS,CAAC,iDAAiD,CAAC,CAAC;QACnG,MAAM,KAAK,GAAG,WAAW;aACtB,KAAK,CAAC,IAAI,CAAC;aACX,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;aAC/F,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAEpC,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC;QAEpB,kCAAkC;QAClC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,SAAS,CAAC,wBAAwB,IAAI,EAAE,CAAC,CAAC;gBAC/E,MAAM,YAAY,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;gBAChD,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;YACtC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,IAAI,CAAC,iCAAiC,IAAI,GAAG,EAAE,KAAK,CAAC,CAAC;YAChE,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,6BAA6B,EAAE,KAAK,CAAC,CAAC;QACnD,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,IAAY,EAAE,KAAgB;IACxE,MAAM,YAAY,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,CAAC,YAAY;QAAE,OAAO,KAAK,CAAC;IAEhC,cAAc;IACd,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAExC,iCAAiC;IACjC,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;QACvC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IACrD,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/engine/adversary.d.ts

@@ -2,6 +2,7 @@
  * Adversarial Verification - AI attacker proves exploitability
  */
 import { TaintTrace } from './taint.js';
+import { type AIProvider } from '../ai/client.js';
 export interface AdversarialResult {
     exploitable: boolean;
     confidence: number;
@@ -18,7 +19,7 @@ export declare function buildAdversarialPrompt(trace: TaintTrace, code: string):
  */
 export declare function parseAdversarialResult(response: string): AdversarialResult | null;
 /**
- * Placeholder for adversarial verification
+ * Verify exploitability using adversarial AI
  */
-export declare function verifyWithAdversary(trace: TaintTrace, code: string): Promise<AdversarialResult>;
+export declare function verifyWithAdversary(trace: TaintTrace, code: string, provider?: AIProvider): Promise<AdversarialResult>;
 //# sourceMappingURL=adversary.d.ts.map

package/dist/engine/adversary.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"adversary.d.ts","sourceRoot":"","sources":["../../src/engine/adversary.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExC,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,OAAO,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAuC9E;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI,CAiBjF;AAED;;GAEG;AACH,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,UAAU,EACjB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,iBAAiB,CAAC,CAa5B"}
+{"version":3,"file":"adversary.d.ts","sourceRoot":"","sources":["../../src/engine/adversary.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAgC,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAEhF,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,OAAO,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAuC9E;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI,CAiBjF;AAED;;GAEG;AACH,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,UAAU,EACjB,IAAI,EAAE,MAAM,EACZ,QAAQ,CAAC,EAAE,UAAU,GACpB,OAAO,CAAC,iBAAiB,CAAC,CA+C5B"}

package/dist/engine/adversary.js

@@ -1,6 +1,7 @@
 /**
  * Adversarial Verification - AI attacker proves exploitability
  */
+import { callAI, getAIProviderFromEnv } from '../ai/client.js';
 /**
  * Generate adversarial attack prompt
  */
@@ -66,18 +67,48 @@ export function parseAdversarialResult(response) {
     }
 }
 /**
- * Placeholder for adversarial verification
+ * Verify exploitability using adversarial AI
  */
-export async function verifyWithAdversary(trace, code) {
-    const prompt = buildAdversarialPrompt(trace, code);
-    // TODO: Phase 3 - integrate with host AI
-    console.warn('⚠️  Adversarial verification not yet integrated');
-    return {
-        exploitable: true,
-        confidence: 0.7,
-        attackVector: 'Adversarial verification not yet integrated',
-        payload: '',
-        reasoning: 'Marked as potentially exploitable until AI attacker confirms',
-    };
+export async function verifyWithAdversary(trace, code, provider) {
+    // Get provider from env if not provided
+    const aiProvider = provider || getAIProviderFromEnv();
+    // If no AI provider available, return conservative result
+    if (!aiProvider) {
+        console.warn('⚠️  No AI provider configured for adversarial verification');
+        console.warn('💡 Set OPENAI_API_KEY, ANTHROPIC_API_KEY, or OLLAMA_HOST to enable');
+        return {
+            exploitable: true,
+            confidence: 0.7,
+            attackVector: 'Adversarial verification not configured',
+            payload: '',
+            reasoning: 'Marked as potentially exploitable - configure AI provider to verify',
+        };
+    }
+    try {
+        const prompt = buildAdversarialPrompt(trace, code);
+        const response = await callAI(aiProvider, prompt);
+        const result = parseAdversarialResult(response.text);
+        if (!result) {
+            console.warn('⚠️  Failed to parse adversarial response');
+            return {
+                exploitable: true,
+                confidence: 0.6,
+                attackVector: 'Failed to parse AI response',
+                payload: '',
+                reasoning: 'Parser error - marked as potentially exploitable',
+            };
+        }
+        return result;
+    }
+    catch (error) {
+        console.warn(`⚠️  Adversarial verification failed: ${error instanceof Error ? error.message : 'Unknown error'}`);
+        return {
+            exploitable: true,
+            confidence: 0.7,
+            attackVector: `AI verification failed: ${error instanceof Error ? error.message : 'Unknown error'}`,
+            payload: '',
+            reasoning: 'Marked as potentially exploitable due to verification error',
+        };
+    }
 }
 //# sourceMappingURL=adversary.js.map

package/dist/engine/adversary.js.map

@@ -1 +1 @@
-{"version":3,"file":"adversary.js","sourceRoot":"","sources":["../../src/engine/adversary.ts"],"names":[],"mappings":"AAAA;;GAEG;AAYH;;GAEG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAiB,EAAE,IAAY;IACpE,OAAO;;qBAEY,KAAK,CAAC,OAAO;gBAClB,KAAK,CAAC,QAAQ;WACnB,KAAK,CAAC,GAAG,IAAI,KAAK;;;EAG3B,KAAK,CAAC,IAAI;;;;EAIV,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BC,CAAC;AACR,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAAgB;IACrD,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAChD,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QAE5B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;QAExC,OAAO;YACL,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC;YACxC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,GAAG;YAC5C,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC;YAC/C,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;YACrC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC;SAC1C,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAAiB,EACjB,IAAY;IAEZ,MAAM,MAAM,GAAG,sBAAsB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAEnD,yCAAyC;IACzC,OAAO,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC;IAEhE,OAAO;QACL,WAAW,EAAE,IAAI;QACjB,UAAU,EAAE,GAAG;QACf,YAAY,EAAE,6CAA6C;QAC3D,OAAO,EAAE,EAAE;QACX,SAAS,EAAE,8DAA8D;KAC1E,CAAC;AACJ,CAAC"}
+{"version":3,"file":"adversary.js","sourceRoot":"","sources":["../../src/engine/adversary.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAE,MAAM,EAAE,oBAAoB,EAAmB,MAAM,iBAAiB,CAAC;AAUhF;;GAEG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAiB,EAAE,IAAY;IACpE,OAAO;;qBAEY,KAAK,CAAC,OAAO;gBAClB,KAAK,CAAC,QAAQ;WACnB,KAAK,CAAC,GAAG,IAAI,KAAK;;;EAG3B,KAAK,CAAC,IAAI;;;;EAIV,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BC,CAAC;AACR,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAAgB;IACrD,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAChD,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QAE5B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;QAExC,OAAO;YACL,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC;YACxC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,GAAG;YAC5C,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC;YAC/C,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;YACrC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC;SAC1C,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAAiB,EACjB,IAAY,EACZ,QAAqB;IAErB,wCAAwC;IACxC,MAAM,UAAU,GAAG,QAAQ,IAAI,oBAAoB,EAAE,CAAC;IAEtD,0DAA0D;IAC1D,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAC;QAC3E,OAAO,CAAC,IAAI,CAAC,oEAAoE,CAAC,CAAC;QAEnF,OAAO;YACL,WAAW,EAAE,IAAI;YACjB,UAAU,EAAE,GAAG;YACf,YAAY,EAAE,yCAAyC;YACvD,OAAO,EAAE,EAAE;YACX,SAAS,EAAE,qEAAqE;SACjF,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,sBAAsB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACnD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAElD,MAAM,MAAM,GAAG,sBAAsB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAErD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;YACzD,OAAO;gBACL,WAAW,EAAE,IAAI;gBACjB,UAAU,EAAE,GAAG;gBACf,YAAY,EAAE,6BAA6B;gBAC3C,OAAO,EAAE,EAAE;gBACX,SAAS,EAAE,kDAAkD;aAC9D,CAAC;QACJ,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,wCAAwC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC;QAEjH,OAAO;YACL,WAAW,EAAE,IAAI;YACjB,UAAU,EAAE,GAAG;YACf,YAAY,EAAE,2BAA2B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE;YACnG,OAAO,EAAE,EAAE;YACX,SAAS,EAAE,6DAA6D;SACzE,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/engine/poc.d.ts

@@ -0,0 +1,20 @@
+/**
+ * PoC Generator - Generate proof-of-concept exploits
+ */
+import { TaintTrace } from '../engine/taint.js';
+export interface PoCTest {
+    category: string;
+    payload: string;
+    expectedBehavior: string;
+    testCode: string;
+    curlCommand?: string;
+}
+/**
+ * Generate PoC based on vulnerability type
+ */
+export declare function generatePoC(trace: TaintTrace): PoCTest;
+/**
+ * Format PoC as markdown
+ */
+export declare function formatPoCMarkdown(poc: PoCTest): string;
+//# sourceMappingURL=poc.d.ts.map