fivosense 0.1.5 → 0.1.6

package/dist/ai/client.d.ts

@@ -0,0 +1,27 @@
+/**
+ * AI Client - BYOK (Bring Your Own Key) support for multiple AI providers
+ */
+export interface AIProvider {
+    name: string;
+    endpoint?: string;
+    apiKey?: string;
+    model?: string;
+}
+export interface AIResponse {
+    text: string;
+    model: string;
+    usage?: {
+        promptTokens: number;
+        completionTokens: number;
+        totalTokens: number;
+    };
+}
+/**
+ * Main AI client - routes to correct provider
+ */
+export declare function callAI(provider: AIProvider, prompt: string): Promise<AIResponse>;
+/**
+ * Get AI provider from environment variables
+ */
+export declare function getAIProviderFromEnv(): AIProvider | null;
+//# sourceMappingURL=client.d.ts.map

package/dist/ai/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/ai/client.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE;QACN,YAAY,EAAE,MAAM,CAAC;QACrB,gBAAgB,EAAE,MAAM,CAAC;QACzB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;CACH;AA0ID;;GAEG;AACH,wBAAsB,MAAM,CAC1B,QAAQ,EAAE,UAAU,EACpB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,UAAU,CAAC,CAmBrB;AAED;;GAEG;AACH,wBAAgB,oBAAoB,IAAI,UAAU,GAAG,IAAI,CA+BxD"}

package/dist/ai/client.js

@@ -0,0 +1,167 @@
+/**
+ * AI Client - BYOK (Bring Your Own Key) support for multiple AI providers
+ */
+/**
+ * Call OpenAI-compatible API
+ */
+async function callOpenAI(provider, prompt) {
+    const endpoint = provider.endpoint || 'https://api.openai.com/v1/chat/completions';
+    const model = provider.model || 'gpt-4o-mini';
+    const response = await fetch(endpoint, {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/json',
+            'Authorization': `Bearer ${provider.apiKey}`,
+        },
+        body: JSON.stringify({
+            model,
+            messages: [
+                {
+                    role: 'system',
+                    content: 'You are a security expert analyzing code vulnerabilities. Respond only with valid JSON.',
+                },
+                {
+                    role: 'user',
+                    content: prompt,
+                },
+            ],
+            temperature: 0.3,
+            max_tokens: 500,
+        }),
+    });
+    if (!response.ok) {
+        throw new Error(`OpenAI API error: ${response.status} ${response.statusText}`);
+    }
+    const data = await response.json();
+    return {
+        text: data.choices[0].message.content,
+        model: data.model,
+        usage: {
+            promptTokens: data.usage.prompt_tokens,
+            completionTokens: data.usage.completion_tokens,
+            totalTokens: data.usage.total_tokens,
+        },
+    };
+}
+/**
+ * Call Anthropic Claude API
+ */
+async function callClaude(provider, prompt) {
+    const endpoint = provider.endpoint || 'https://api.anthropic.com/v1/messages';
+    const model = provider.model || 'claude-3-5-sonnet-20241022';
+    const response = await fetch(endpoint, {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/json',
+            'x-api-key': provider.apiKey,
+            'anthropic-version': '2023-06-01',
+        },
+        body: JSON.stringify({
+            model,
+            max_tokens: 500,
+            temperature: 0.3,
+            system: 'You are a security expert analyzing code vulnerabilities. Respond only with valid JSON.',
+            messages: [
+                {
+                    role: 'user',
+                    content: prompt,
+                },
+            ],
+        }),
+    });
+    if (!response.ok) {
+        throw new Error(`Claude API error: ${response.status} ${response.statusText}`);
+    }
+    const data = await response.json();
+    return {
+        text: data.content[0].text,
+        model: data.model,
+        usage: {
+            promptTokens: data.usage.input_tokens,
+            completionTokens: data.usage.output_tokens,
+            totalTokens: data.usage.input_tokens + data.usage.output_tokens,
+        },
+    };
+}
+/**
+ * Call Ollama (local)
+ */
+async function callOllama(provider, prompt) {
+    const endpoint = provider.endpoint || 'http://localhost:11434/api/generate';
+    const model = provider.model || 'llama3.2';
+    const response = await fetch(endpoint, {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/json',
+        },
+        body: JSON.stringify({
+            model,
+            prompt: `You are a security expert. ${prompt}`,
+            stream: false,
+            options: {
+                temperature: 0.3,
+                num_predict: 500,
+            },
+        }),
+    });
+    if (!response.ok) {
+        throw new Error(`Ollama API error: ${response.status} ${response.statusText}`);
+    }
+    const data = await response.json();
+    return {
+        text: data.response,
+        model: data.model,
+    };
+}
+/**
+ * Main AI client - routes to correct provider
+ */
+export async function callAI(provider, prompt) {
+    if (!provider.apiKey && provider.name !== 'ollama') {
+        throw new Error(`API key required for provider: ${provider.name}`);
+    }
+    switch (provider.name.toLowerCase()) {
+        case 'openai':
+            return callOpenAI(provider, prompt);
+        case 'claude':
+        case 'anthropic':
+            return callClaude(provider, prompt);
+        case 'ollama':
+            return callOllama(provider, prompt);
+        default:
+            throw new Error(`Unsupported AI provider: ${provider.name}`);
+    }
+}
+/**
+ * Get AI provider from environment variables
+ */
+export function getAIProviderFromEnv() {
+    // Check for OpenAI
+    if (process.env.OPENAI_API_KEY) {
+        return {
+            name: 'openai',
+            apiKey: process.env.OPENAI_API_KEY,
+            model: process.env.OPENAI_MODEL || 'gpt-4o-mini',
+            endpoint: process.env.OPENAI_ENDPOINT,
+        };
+    }
+    // Check for Claude
+    if (process.env.ANTHROPIC_API_KEY) {
+        return {
+            name: 'claude',
+            apiKey: process.env.ANTHROPIC_API_KEY,
+            model: process.env.ANTHROPIC_MODEL || 'claude-3-5-sonnet-20241022',
+            endpoint: process.env.ANTHROPIC_ENDPOINT,
+        };
+    }
+    // Check for Ollama
+    if (process.env.OLLAMA_ENDPOINT || process.env.OLLAMA_HOST) {
+        return {
+            name: 'ollama',
+            model: process.env.OLLAMA_MODEL || 'llama3.2',
+            endpoint: process.env.OLLAMA_ENDPOINT || process.env.OLLAMA_HOST || 'http://localhost:11434/api/generate',
+        };
+    }
+    return null;
+}
+//# sourceMappingURL=client.js.map

package/dist/ai/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/ai/client.ts"],"names":[],"mappings":"AAAA;;GAEG;AAmBH;;GAEG;AACH,KAAK,UAAU,UAAU,CACvB,QAAoB,EACpB,MAAc;IAEd,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,IAAI,4CAA4C,CAAC;IACnF,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,IAAI,aAAa,CAAC;IAE9C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;QACrC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,eAAe,EAAE,UAAU,QAAQ,CAAC,MAAM,EAAE;SAC7C;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,KAAK;YACL,QAAQ,EAAE;gBACR;oBACE,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,yFAAyF;iBACnG;gBACD;oBACE,IAAI,EAAE,MAAM;oBACZ,OAAO,EAAE,MAAM;iBAChB;aACF;YACD,WAAW,EAAE,GAAG;YAChB,UAAU,EAAE,GAAG;SAChB,CAAC;KACH,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,qBAAqB,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,IAAI,GAAQ,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAExC,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO;QACrC,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,KAAK,EAAE;YACL,YAAY,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa;YACtC,gBAAgB,EAAE,IAAI,CAAC,KAAK,CAAC,iBAAiB;YAC9C,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY;SACrC;KACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,UAAU,CACvB,QAAoB,EACpB,MAAc;IAEd,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,IAAI,uCAAuC,CAAC;IAC9E,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,IAAI,4BAA4B,CAAC;IAE7D,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;QACrC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,WAAW,EAAE,QAAQ,CAAC,MAAO;YAC7B,mBAAmB,EAAE,YAAY;SAClC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,KAAK;YACL,UAAU,EAAE,GAAG;YACf,WAAW,EAAE,GAAG;YAChB,MAAM,EAAE,yFAAyF;YACjG,QAAQ,EAAE;gBACR;oBACE,IAAI,EAAE,MAAM;oBACZ,OAAO,EAAE,MAAM;iBAChB;aACF;SACF,CAAC;KACH,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,qBAAqB,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,IAAI,GAAQ,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAExC,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI;QAC1B,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,KAAK,EAAE;YACL,YAAY,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY;YACrC,gBAAgB,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa;YAC1C,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa;SAChE;KACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,UAAU,CACvB,QAAoB,EACpB,MAAc;IAEd,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,IAAI,qCAAqC,CAAC;IAC5E,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,IAAI,UAAU,CAAC;IAE3C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;QACrC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,KAAK;YACL,MAAM,EAAE,8BAA8B,MAAM,EAAE;YAC9C,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,WAAW,EAAE,GAAG;gBAChB,WAAW,EAAE,GAAG;aACjB;SACF,CAAC;KACH,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,qBAAqB,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,IAAI,GAAQ,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAExC,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,QAAQ;QACnB,KAAK,EAAE,IAAI,CAAC,KAAK;KAClB,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAC1B,QAAoB,EACpB,MAAc;IAEd,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,kCAAkC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,QAAQ,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QACpC,KAAK,QAAQ;YACX,OAAO,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAEtC,KAAK,QAAQ,CAAC;QACd,KAAK,WAAW;YACd,OAAO,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAEtC,KAAK,QAAQ;YACX,OAAO,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAEtC;YACE,MAAM,IAAI,KAAK,CAAC,4BAA4B,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IACjE,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB;IAClC,mBAAmB;IACnB,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC;QAC/B,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc;YAClC,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,aAAa;YAChD,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe;SACtC,CAAC;IACJ,CAAC;IAED,mBAAmB;IACnB,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC;QAClC,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB;YACrC,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,4BAA4B;YAClE,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB;SACzC,CAAC;IACJ,CAAC;IAED,mBAAmB;IACnB,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;QAC3D,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,UAAU;YAC7C,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,qCAAqC;SAC1G,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/ai/judge.d.ts

@@ -1,6 +1,7 @@
 /**
  * AI Path Judge - Uses host AI to determine exploitability
  */
+import { type AIProvider } from './client.js';
 export interface PathJudgment {
     exploitable: boolean;
     confidence: number;
@@ -29,8 +30,7 @@ export declare function buildPathJudgePrompt(context: PathContext): string;
  */
 export declare function parsePathJudgment(response: string): PathJudgment | null;
 /**
- * Placeholder for host AI integration
- * In Phase 2, this will call the actual host AI (Claude/etc.)
+ * Judge path exploitability using AI
  */
-export declare function judgePathWithAI(context: PathContext): Promise<PathJudgment>;
+export declare function judgePathWithAI(context: PathContext, provider?: AIProvider): Promise<PathJudgment>;
 //# sourceMappingURL=judge.d.ts.map

package/dist/ai/judge.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"judge.d.ts","sourceRoot":"","sources":["../../src/ai/judge.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,WAAW,YAAY;IAC3B,WAAW,EAAE,OAAO,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IACjD,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM,CA4BjE;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAkBvE;AAED;;;GAGG;AACH,wBAAsB,eAAe,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAcjF"}
+{"version":3,"file":"judge.d.ts","sourceRoot":"","sources":["../../src/ai/judge.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAgC,KAAK,UAAU,EAAE,MAAM,aAAa,CAAC;AAE5E,MAAM,WAAW,YAAY;IAC3B,WAAW,EAAE,OAAO,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IACjD,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM,CA4BjE;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAkBvE;AAED;;GAEG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,WAAW,EACpB,QAAQ,CAAC,EAAE,UAAU,GACpB,OAAO,CAAC,YAAY,CAAC,CA+CvB"}

package/dist/ai/judge.js

@@ -1,6 +1,7 @@
 /**
  * AI Path Judge - Uses host AI to determine exploitability
  */
+import { callAI, getAIProviderFromEnv } from './client.js';
 /**
  * Build prompt for AI path judgment
  */
@@ -56,20 +57,48 @@ export function parsePathJudgment(response) {
     }
 }
 /**
- * Placeholder for host AI integration
- * In Phase 2, this will call the actual host AI (Claude/etc.)
+ * Judge path exploitability using AI
  */
-export async function judgePathWithAI(context) {
-    const prompt = buildPathJudgePrompt(context);
-    // TODO: Phase 2 - integrate with host AI
-    // For now, return a conservative judgment
-    console.warn('⚠️  AI path judgment not yet integrated - using conservative defaults');
-    return {
-        exploitable: true, // Conservative: assume exploitable until AI confirms otherwise
-        confidence: 0.7,
-        reasoning: 'AI judgment not yet integrated - marked as potentially exploitable',
-        severity: 'high',
-        recommendation: 'Manual review required until AI integration complete',
-    };
+export async function judgePathWithAI(context, provider) {
+    // Get provider from env if not provided
+    const aiProvider = provider || getAIProviderFromEnv();
+    // If no AI provider available, return conservative judgment
+    if (!aiProvider) {
+        console.warn('⚠️  No AI provider configured - using conservative defaults');
+        console.warn('💡 Set OPENAI_API_KEY, ANTHROPIC_API_KEY, or OLLAMA_HOST to enable AI judgment');
+        return {
+            exploitable: true, // Conservative: assume exploitable
+            confidence: 0.7,
+            reasoning: 'AI judgment not configured - marked as potentially exploitable',
+            severity: 'high',
+            recommendation: 'Configure AI provider or review manually',
+        };
+    }
+    try {
+        const prompt = buildPathJudgePrompt(context);
+        const response = await callAI(aiProvider, prompt);
+        const judgment = parsePathJudgment(response.text);
+        if (!judgment) {
+            console.warn('⚠️  Failed to parse AI response - using conservative defaults');
+            return {
+                exploitable: true,
+                confidence: 0.6,
+                reasoning: 'Failed to parse AI response',
+                severity: 'high',
+                recommendation: 'Review manually',
+            };
+        }
+        return judgment;
+    }
+    catch (error) {
+        console.warn(`⚠️  AI judgment failed: ${error instanceof Error ? error.message : 'Unknown error'}`);
+        return {
+            exploitable: true,
+            confidence: 0.7,
+            reasoning: `AI judgment failed: ${error instanceof Error ? error.message : 'Unknown error'}`,
+            severity: 'high',
+            recommendation: 'Review manually',
+        };
+    }
 }
 //# sourceMappingURL=judge.js.map

package/dist/ai/judge.js.map

@@ -1 +1 @@
-{"version":3,"file":"judge.js","sourceRoot":"","sources":["../../src/ai/judge.ts"],"names":[],"mappings":"AAAA;;GAEG;AAuBH;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAoB;IACvD,OAAO;;cAEK,OAAO,CAAC,MAAM;UAClB,OAAO,CAAC,UAAU;cACd,OAAO,CAAC,SAAS;;YAEnB,OAAO,CAAC,IAAI;UACd,OAAO,CAAC,QAAQ;cACZ,OAAO,CAAC,QAAQ;EAC5B,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE;;;EAG1C,OAAO,CAAC,QAAQ;;;QAGV,OAAO,CAAC,QAAQ;EACtB,OAAO,CAAC,WAAW;;;;;;;;;;EAUnB,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAChD,IAAI,CAAC;QACH,2DAA2D;QAC3D,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAChD,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QAE5B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;QAExC,OAAO;YACL,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC;YACxC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,GAAG;YAC5C,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,IAAI,uBAAuB,CAAC;YAC9D,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,QAAQ;YACrC,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,cAAc,IAAI,iBAAiB,CAAC;SACnE,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAAoB;IACxD,MAAM,MAAM,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAE7C,yCAAyC;IACzC,0CAA0C;IAC1C,OAAO,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAC;IAEtF,OAAO;QACL,WAAW,EAAE,IAAI,EAAE,+DAA+D;QAClF,UAAU,EAAE,GAAG;QACf,SAAS,EAAE,oEAAoE;QAC/E,QAAQ,EAAE,MAAM;QAChB,cAAc,EAAE,sDAAsD;KACvE,CAAC;AACJ,CAAC"}
+{"version":3,"file":"judge.js","sourceRoot":"","sources":["../../src/ai/judge.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,MAAM,EAAE,oBAAoB,EAAmB,MAAM,aAAa,CAAC;AAuB5E;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAoB;IACvD,OAAO;;cAEK,OAAO,CAAC,MAAM;UAClB,OAAO,CAAC,UAAU;cACd,OAAO,CAAC,SAAS;;YAEnB,OAAO,CAAC,IAAI;UACd,OAAO,CAAC,QAAQ;cACZ,OAAO,CAAC,QAAQ;EAC5B,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE;;;EAG1C,OAAO,CAAC,QAAQ;;;QAGV,OAAO,CAAC,QAAQ;EACtB,OAAO,CAAC,WAAW;;;;;;;;;;EAUnB,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAChD,IAAI,CAAC;QACH,2DAA2D;QAC3D,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAChD,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QAE5B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;QAExC,OAAO;YACL,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC;YACxC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,GAAG;YAC5C,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,IAAI,uBAAuB,CAAC;YAC9D,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,QAAQ;YACrC,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,cAAc,IAAI,iBAAiB,CAAC;SACnE,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAAoB,EACpB,QAAqB;IAErB,wCAAwC;IACxC,MAAM,UAAU,GAAG,QAAQ,IAAI,oBAAoB,EAAE,CAAC;IAEtD,4DAA4D;IAC5D,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,CAAC,IAAI,CAAC,6DAA6D,CAAC,CAAC;QAC5E,OAAO,CAAC,IAAI,CAAC,gFAAgF,CAAC,CAAC;QAE/F,OAAO;YACL,WAAW,EAAE,IAAI,EAAE,mCAAmC;YACtD,UAAU,EAAE,GAAG;YACf,SAAS,EAAE,gEAAgE;YAC3E,QAAQ,EAAE,MAAM;YAChB,cAAc,EAAE,0CAA0C;SAC3D,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAElD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAElD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,CAAC,IAAI,CAAC,+DAA+D,CAAC,CAAC;YAC9E,OAAO;gBACL,WAAW,EAAE,IAAI;gBACjB,UAAU,EAAE,GAAG;gBACf,SAAS,EAAE,6BAA6B;gBACxC,QAAQ,EAAE,MAAM;gBAChB,cAAc,EAAE,iBAAiB;aAClC,CAAC;QACJ,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,2BAA2B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC;QAEpG,OAAO;YACL,WAAW,EAAE,IAAI;YACjB,UAAU,EAAE,GAAG;YACf,SAAS,EAAE,uBAAuB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE;YAC5F,QAAQ,EAAE,MAAM;YAChB,cAAc,EAAE,iBAAiB;SAClC,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/core/orchestrator.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Orchestrator - Coordinates analysis pipeline and flow control
+ */
+import type { AuditResult } from '../index.js';
+import type { AIProvider } from '../ai/client.js';
+export interface OrchestratorOptions {
+    enableAI?: boolean;
+    enableAdversarial?: boolean;
+    enablePoC?: boolean;
+    scopeToDiff?: boolean;
+    diffBase?: string;
+    aiProvider?: AIProvider;
+    verbose?: boolean;
+}
+/**
+ * Main orchestration pipeline
+ */
+export declare function orchestrateAudit(code: string, filepath: string, options?: OrchestratorOptions): Promise<AuditResult>;
+/**
+ * Quick audit (no AI, no scope)
+ */
+export declare function quickAudit(code: string, filepath: string): Promise<AuditResult>;
+/**
+ * Full audit (with AI and adversarial)
+ */
+export declare function fullAudit(code: string, filepath: string, aiProvider?: AIProvider): Promise<AuditResult>;
+/**
+ * Diff-scoped audit (only changed code)
+ */
+export declare function diffAudit(code: string, filepath: string, diffBase?: string): Promise<AuditResult>;
+//# sourceMappingURL=orchestrator.d.ts.map

package/dist/core/orchestrator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"orchestrator.d.ts","sourceRoot":"","sources":["../../src/core/orchestrator.ts"],"names":[],"mappings":"AAAA;;GAEG;AAUH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,mBAAwB,GAChC,OAAO,CAAC,WAAW,CAAC,CAiLtB;AAED;;GAEG;AACH,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAQrF;AAED;;GAEG;AACH,wBAAsB,SAAS,CAC7B,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,UAAU,CAAC,EAAE,UAAU,GACtB,OAAO,CAAC,WAAW,CAAC,CAStB;AAED;;GAEG;AACH,wBAAsB,SAAS,CAC7B,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,QAAQ,GAAE,MAAe,GACxB,OAAO,CAAC,WAAW,CAAC,CAStB"}

package/dist/core/orchestrator.js

@@ -0,0 +1,205 @@
+/**
+ * Orchestrator - Coordinates analysis pipeline and flow control
+ */
+import { buildDataFlowGraph } from '../engine/graph.js';
+import { generateTaintTraces } from '../engine/taint.js';
+import { detectSecrets } from '../rules/secrets.js';
+import { detectDestructive } from '../rules/destructive.js';
+import { judgePathWithAI } from '../ai/judge.js';
+import { verifyWithAdversary } from '../engine/adversary.js';
+import { generatePoC } from '../engine/poc.js';
+import { getDiffScope, filterFindingsByScope } from './scope.js';
+/**
+ * Main orchestration pipeline
+ */
+export async function orchestrateAudit(code, filepath, options = {}) {
+    const { enableAI = false, enableAdversarial = false, enablePoC = false, scopeToDiff = false, diffBase = 'main', aiProvider, verbose = false, } = options;
+    if (verbose) {
+        console.log(`🔍 Starting audit: ${filepath}`);
+        console.log(`   AI Judge: ${enableAI ? '✅' : '❌'}`);
+        console.log(`   Adversarial: ${enableAdversarial ? '✅' : '❌'}`);
+        console.log(`   PoC Generation: ${enablePoC ? '✅' : '❌'}`);
+        console.log(`   Scope to diff: ${scopeToDiff ? '✅' : '❌'}`);
+    }
+    // Step 1: Get scope if needed
+    let scope;
+    if (scopeToDiff) {
+        if (verbose)
+            console.log(`📋 Getting diff scope (base: ${diffBase})...`);
+        scope = await getDiffScope(diffBase);
+        if (verbose)
+            console.log(`   ${scope.files.length} files in scope`);
+    }
+    // Step 2: Build data-flow graph
+    if (verbose)
+        console.log(`🔨 Building data-flow graph...`);
+    const graph = buildDataFlowGraph(code, filepath);
+    // Step 3: Taint analysis
+    if (verbose)
+        console.log(`🔍 Running taint analysis...`);
+    const traces = generateTaintTraces(graph, filepath);
+    // Convert traces to vulnerabilities format
+    const allVulnerabilities = traces.map(trace => ({
+        finding: trace.finding,
+        severity: trace.severity,
+        category: trace.category,
+        cwe: trace.cwe,
+        path: trace.path.split(' → '),
+        evidence: trace.evidence,
+        location: trace.location,
+        sanitized: trace.sanitized,
+        confidence: 0.8,
+    }));
+    // Step 4: Filter by scope if enabled
+    let vulnerabilities = allVulnerabilities;
+    if (scope && scopeToDiff) {
+        if (verbose)
+            console.log(`🎯 Filtering by scope...`);
+        vulnerabilities = filterFindingsByScope(vulnerabilities, filepath, scope);
+        if (verbose)
+            console.log(`   ${vulnerabilities.length} vulnerabilities in scope`);
+    }
+    // Step 5: AI judgment (if enabled)
+    if (enableAI && vulnerabilities.length > 0) {
+        if (verbose)
+            console.log(`🤖 Running AI judgment...`);
+        for (let i = 0; i < vulnerabilities.length; i++) {
+            const vuln = vulnerabilities[i];
+            try {
+                const judgment = await judgePathWithAI({
+                    source: vuln.path[0] || 'unknown',
+                    sourceType: 'user input',
+                    sourceLoc: `line ${vuln.location.line}`,
+                    sink: vuln.path[vuln.path.length - 1] || 'unknown',
+                    sinkType: vuln.category,
+                    category: vuln.category,
+                    cwe: vuln.cwe,
+                    dataFlow: vuln.path.join(' → '),
+                    codeSnippet: code.split('\n').slice(Math.max(0, vuln.location.line - 3), vuln.location.line + 2).join('\n'),
+                    language: filepath.endsWith('.ts') || filepath.endsWith('.tsx') ? 'typescript' : 'javascript',
+                }, aiProvider);
+                // Update vulnerability with AI judgment
+                vuln.confidence = judgment.confidence;
+                if (verbose) {
+                    console.log(`   [${i + 1}/${vulnerabilities.length}] ${vuln.finding}: ${judgment.exploitable ? '❌ Exploitable' : '✅ Safe'} (confidence: ${judgment.confidence})`);
+                }
+            }
+            catch (error) {
+                if (verbose) {
+                    console.warn(`   [${i + 1}/${vulnerabilities.length}] AI judgment failed:`, error);
+                }
+            }
+        }
+    }
+    // Step 6: Adversarial verification (if enabled)
+    if (enableAdversarial && vulnerabilities.length > 0) {
+        if (verbose)
+            console.log(`⚔️  Running adversarial verification...`);
+        for (let i = 0; i < vulnerabilities.length; i++) {
+            const vuln = vulnerabilities[i];
+            try {
+                const trace = traces.find((t) => t.category === vuln.category && t.location.line === vuln.location.line);
+                if (trace) {
+                    const adversary = await verifyWithAdversary(trace, code, aiProvider);
+                    // Update confidence based on adversarial result
+                    vuln.confidence = Math.min(vuln.confidence, adversary.confidence);
+                    if (verbose) {
+                        console.log(`   [${i + 1}/${vulnerabilities.length}] ${adversary.exploitable ? '⚔️  Exploit found' : '🛡️  Defense holds'}`);
+                    }
+                }
+            }
+            catch (error) {
+                if (verbose) {
+                    console.warn(`   [${i + 1}/${vulnerabilities.length}] Adversarial verification failed:`, error);
+                }
+            }
+        }
+    }
+    // Step 7: PoC generation (if enabled)
+    if (enablePoC && vulnerabilities.length > 0) {
+        if (verbose)
+            console.log(`💣 Generating PoCs...`);
+        for (const vuln of vulnerabilities) {
+            try {
+                const trace = traces.find((t) => t.category === vuln.category && t.location.line === vuln.location.line);
+                if (trace) {
+                    const poc = generatePoC(trace);
+                    // Attach PoC to vulnerability (could extend Vulnerability type)
+                    vuln.poc = poc;
+                }
+            }
+            catch (error) {
+                if (verbose) {
+                    console.warn(`   Failed to generate PoC:`, error);
+                }
+            }
+        }
+    }
+    // Step 8: Secret detection
+    if (verbose)
+        console.log(`🔑 Detecting secrets...`);
+    const secrets = detectSecrets(code);
+    // Step 9: Destructive command detection
+    if (verbose)
+        console.log(`💥 Detecting destructive commands...`);
+    const destructive = detectDestructive(code);
+    // Step 10: Build summary
+    const summary = {
+        total: vulnerabilities.length + secrets.length + destructive.length,
+        critical: vulnerabilities.filter((v) => v.severity === 'critical').length,
+        high: vulnerabilities.filter((v) => v.severity === 'high').length + secrets.length,
+        medium: vulnerabilities.filter((v) => v.severity === 'medium').length + destructive.length,
+    };
+    if (verbose) {
+        console.log(`\n📊 Audit complete:`);
+        console.log(`   Total: ${summary.total}`);
+        console.log(`   Critical: ${summary.critical}`);
+        console.log(`   High: ${summary.high}`);
+        console.log(`   Medium: ${summary.medium}\n`);
+    }
+    return {
+        vulnerabilities,
+        secrets,
+        destructive,
+        summary,
+    };
+}
+/**
+ * Quick audit (no AI, no scope)
+ */
+export async function quickAudit(code, filepath) {
+    return orchestrateAudit(code, filepath, {
+        enableAI: false,
+        enableAdversarial: false,
+        enablePoC: false,
+        scopeToDiff: false,
+        verbose: false,
+    });
+}
+/**
+ * Full audit (with AI and adversarial)
+ */
+export async function fullAudit(code, filepath, aiProvider) {
+    return orchestrateAudit(code, filepath, {
+        enableAI: true,
+        enableAdversarial: true,
+        enablePoC: true,
+        scopeToDiff: false,
+        aiProvider,
+        verbose: true,
+    });
+}
+/**
+ * Diff-scoped audit (only changed code)
+ */
+export async function diffAudit(code, filepath, diffBase = 'main') {
+    return orchestrateAudit(code, filepath, {
+        enableAI: false,
+        enableAdversarial: false,
+        enablePoC: false,
+        scopeToDiff: true,
+        diffBase,
+        verbose: true,
+    });
+}
+//# sourceMappingURL=orchestrator.js.map

package/dist/core/orchestrator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"orchestrator.js","sourceRoot":"","sources":["../../src/core/orchestrator.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAmB,MAAM,oBAAoB,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,qBAAqB,EAAkB,MAAM,YAAY,CAAC;AAcjF;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,IAAY,EACZ,QAAgB,EAChB,UAA+B,EAAE;IAEjC,MAAM,EACJ,QAAQ,GAAG,KAAK,EAChB,iBAAiB,GAAG,KAAK,EACzB,SAAS,GAAG,KAAK,EACjB,WAAW,GAAG,KAAK,EACnB,QAAQ,GAAG,MAAM,EACjB,UAAU,EACV,OAAO,GAAG,KAAK,GAChB,GAAG,OAAO,CAAC;IAEZ,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,CAAC,GAAG,CAAC,sBAAsB,QAAQ,EAAE,CAAC,CAAC;QAC9C,OAAO,CAAC,GAAG,CAAC,gBAAgB,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;QACpD,OAAO,CAAC,GAAG,CAAC,mBAAmB,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;QAChE,OAAO,CAAC,GAAG,CAAC,sBAAsB,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;QAC3D,OAAO,CAAC,GAAG,CAAC,qBAAqB,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,8BAA8B;IAC9B,IAAI,KAA4B,CAAC;IACjC,IAAI,WAAW,EAAE,CAAC;QAChB,IAAI,OAAO;YAAE,OAAO,CAAC,GAAG,CAAC,gCAAgC,QAAQ,MAAM,CAAC,CAAC;QACzE,KAAK,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC;QACrC,IAAI,OAAO;YAAE,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,KAAK,CAAC,MAAM,iBAAiB,CAAC,CAAC;IACtE,CAAC;IAED,gCAAgC;IAChC,IAAI,OAAO;QAAE,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;IAC3D,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAEjD,yBAAyB;IACzB,IAAI,OAAO;QAAE,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAEpD,2CAA2C;IAC3C,MAAM,kBAAkB,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC9C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;QAC7B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,UAAU,EAAE,GAAG;KAChB,CAAC,CAAC,CAAC;IAEJ,qCAAqC;IACrC,IAAI,eAAe,GAAG,kBAAkB,CAAC;IACzC,IAAI,KAAK,IAAI,WAAW,EAAE,CAAC;QACzB,IAAI,OAAO;YAAE,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;QACrD,eAAe,GAAG,qBAAqB,CAAC,eAAe,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC1E,IAAI,OAAO;YAAE,OAAO,CAAC,GAAG,CAAC,MAAM,eAAe,CAAC,MAAM,2BAA2B,CAAC,CAAC;IACpF,CAAC;IAED,mCAAmC;IACnC,IAAI,QAAQ,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3C,IAAI,OAAO;YAAE,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;QAEtD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,eAAe,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAChD,MAAM,IAAI,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;YAEhC,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC;oBACrC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,SAAS;oBACjC,UAAU,EAAE,YAAY;oBACxB,SAAS,EAAE,QAAQ,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE;oBACvC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,SAAS;oBAClD,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;oBAC/B,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CACjC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,EACnC,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,CACvB,CAAC,IAAI,CAAC,IAAI,CAAC;oBACZ,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,YAAY;iBAC9F,EAAE,UAAU,CAAC,CAAC;gBAEf,wCAAwC;gBACxC,IAAI,CAAC,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC;gBAEtC,IAAI,OAAO,EAAE,CAAC;oBACZ,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,eAAe,CAAC,MAAM,KAAK,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,QAAQ,iBAAiB,QAAQ,CAAC,UAAU,GAAG,CAAC,CAAC;gBACpK,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,OAAO,EAAE,CAAC;oBACZ,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,eAAe,CAAC,MAAM,uBAAuB,EAAE,KAAK,CAAC,CAAC;gBACrF,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,gDAAgD;IAChD,IAAI,iBAAiB,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpD,IAAI,OAAO;YAAE,OAAO,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC;QAEpE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,eAAe,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAChD,MAAM,IAAI,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;YAEhC,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAa,EAAE,EAAE,CAC1C,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,KAAK,IAAI,CAAC,QAAQ,CAAC,IAAI,CACvE,CAAC;gBAEF,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,KAAK,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;oBAErE,gDAAgD;oBAChD,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC;oBAElE,IAAI,OAAO,EAAE,CAAC;wBACZ,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,eAAe,CAAC,MAAM,KAAK,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,oBAAoB,EAAE,CAAC,CAAC;oBAC/H,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,OAAO,EAAE,CAAC;oBACZ,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,eAAe,CAAC,MAAM,oCAAoC,EAAE,KAAK,CAAC,CAAC;gBAClG,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,sCAAsC;IACtC,IAAI,SAAS,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,IAAI,OAAO;YAAE,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;QAElD,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;YACnC,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAa,EAAE,EAAE,CAC1C,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,KAAK,IAAI,CAAC,QAAQ,CAAC,IAAI,CACvE,CAAC;gBAEF,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,GAAG,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;oBAC/B,gEAAgE;oBAC/D,IAAY,CAAC,GAAG,GAAG,GAAG,CAAC;gBAC1B,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,OAAO,EAAE,CAAC;oBACZ,OAAO,CAAC,IAAI,CAAC,4BAA4B,EAAE,KAAK,CAAC,CAAC;gBACpD,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,2BAA2B;IAC3B,IAAI,OAAO;QAAE,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAEpC,wCAAwC;IACxC,IAAI,OAAO;QAAE,OAAO,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;IACjE,MAAM,WAAW,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAE5C,yBAAyB;IACzB,MAAM,OAAO,GAAG;QACd,KAAK,EAAE,eAAe,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,WAAW,CAAC,MAAM;QACnE,QAAQ,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,MAAM;QAC9E,IAAI,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM;QACvF,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,MAAM,GAAG,WAAW,CAAC,MAAM;KAChG,CAAC;IAEF,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;QACpC,OAAO,CAAC,GAAG,CAAC,aAAa,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,gBAAgB,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QAChD,OAAO,CAAC,GAAG,CAAC,YAAY,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,cAAc,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC;IAChD,CAAC;IAED,OAAO;QACL,eAAe;QACf,OAAO;QACP,WAAW;QACX,OAAO;KACR,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAY,EAAE,QAAgB;IAC7D,OAAO,gBAAgB,CAAC,IAAI,EAAE,QAAQ,EAAE;QACtC,QAAQ,EAAE,KAAK;QACf,iBAAiB,EAAE,KAAK;QACxB,SAAS,EAAE,KAAK;QAChB,WAAW,EAAE,KAAK;QAClB,OAAO,EAAE,KAAK;KACf,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAY,EACZ,QAAgB,EAChB,UAAuB;IAEvB,OAAO,gBAAgB,CAAC,IAAI,EAAE,QAAQ,EAAE;QACtC,QAAQ,EAAE,IAAI;QACd,iBAAiB,EAAE,IAAI;QACvB,SAAS,EAAE,IAAI;QACf,WAAW,EAAE,KAAK;QAClB,UAAU;QACV,OAAO,EAAE,IAAI;KACd,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAY,EACZ,QAAgB,EAChB,WAAmB,MAAM;IAEzB,OAAO,gBAAgB,CAAC,IAAI,EAAE,QAAQ,EAAE;QACtC,QAAQ,EAAE,KAAK;QACf,iBAAiB,EAAE,KAAK;QACxB,SAAS,EAAE,KAAK;QAChB,WAAW,EAAE,IAAI;QACjB,QAAQ;QACR,OAAO,EAAE,IAAI;KACd,CAAC,CAAC;AACL,CAAC"}

package/dist/core/scope.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Scope Management - Track and filter relevant code changes
+ */
+export interface CodeScope {
+    files: string[];
+    lines: Map<string, Set<number>>;
+    changedFunctions: Map<string, string[]>;
+}
+/**
+ * Get diff scope for current changes
+ */
+export declare function getDiffScope(base?: string): Promise<CodeScope>;
+/**
+ * Filter findings to only those in changed scope
+ */
+export declare function filterFindingsByScope<T extends {
+    location?: {
+        line: number;
+    };
+}>(findings: T[], file: string, scope: CodeScope): T[];
+/**
+ * Get scope for staged changes
+ */
+export declare function getStagedScope(): Promise<CodeScope>;
+/**
+ * Check if a line is in scope
+ */
+export declare function isLineInScope(file: string, line: number, scope: CodeScope): boolean;
+//# sourceMappingURL=scope.d.ts.map

package/dist/core/scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.d.ts","sourceRoot":"","sources":["../../src/core/scope.ts"],"names":[],"mappings":"AAAA;;GAEG;AAOH,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IAChC,gBAAgB,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;CACzC;AAED;;GAEG;AACH,wBAAsB,YAAY,CAAC,IAAI,GAAE,MAAe,GAAG,OAAO,CAAC,SAAS,CAAC,CAiC5E;AA+BD;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,SAAS;IAAE,QAAQ,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,EAC7E,QAAQ,EAAE,CAAC,EAAE,EACb,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,SAAS,GACf,CAAC,EAAE,CAsBL;AAED;;GAEG;AACH,wBAAsB,cAAc,IAAI,OAAO,CAAC,SAAS,CAAC,CAiCzD;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAanF"}