ghagga-core 2.3.0 → 2.4.1

package/dist/tools/orchestrator.js

@@ -0,0 +1,127 @@
+/**
+ * Tool Orchestrator — runs tools sequentially with failure isolation.
+ *
+ * - Sequential install → run → parse loop
+ * - Per-tool try/catch for failure isolation
+ * - Timeout enforcement per tool
+ * - Budget rollover from fast tools
+ * - Legacy keys (semgrep, trivy, cpd) always present
+ */
+import { allocateTimeBudget, getEffectiveBudget } from './budget.js';
+/** Skipped result for tools that didn't run */
+const SKIPPED_RESULT = {
+    status: 'skipped',
+    findings: [],
+    error: undefined,
+    executionTimeMs: 0,
+};
+/** Legacy tool names that must always be present in results */
+const LEGACY_TOOL_NAMES = ['semgrep', 'trivy', 'cpd'];
+/**
+ * Run all activated tools sequentially with budget management and failure isolation.
+ *
+ * @param ctx - Execution context (Node, Actions, or Mock)
+ * @param activatedTools - Tools to execute (from resolveActivatedTools)
+ * @param targetDir - Repository directory to scan
+ * @param files - List of changed file paths
+ * @param totalBudgetMs - Total time budget in ms (default 600_000)
+ * @returns Record of tool name → ToolResult
+ */
+export async function runTools(ctx, activatedTools, targetDir, files, totalBudgetMs = 600_000) {
+    const results = {};
+    const budget = allocateTimeBudget(activatedTools, totalBudgetMs);
+    const elapsedByTool = new Map();
+    let totalElapsed = 0;
+    ctx.log('info', `[ghagga:tools] Running ${activatedTools.length} tools sequentially...`);
+    for (const activated of activatedTools) {
+        const tool = activated.definition;
+        // Check if total budget is exhausted
+        if (totalElapsed >= budget.totalMs) {
+            ctx.log('warn', `[ghagga:tools] Total budget exhausted, skipping ${tool.name}`);
+            results[tool.name] = {
+                status: 'skipped',
+                findings: [],
+                error: 'total-budget-exhausted',
+                executionTimeMs: 0,
+            };
+            continue;
+        }
+        const effectiveBudget = getEffectiveBudget(tool.name, budget, elapsedByTool);
+        const start = Date.now();
+        try {
+            // Install
+            await tool.install(ctx);
+            // Run
+            const raw = await tool.run(ctx, targetDir, files, effectiveBudget);
+            // Check for timeout
+            if (raw.timedOut) {
+                const durationMs = Date.now() - start;
+                ctx.log('warn', `[ghagga:tools] ${tool.name}: timeout after ${durationMs}ms`);
+                results[tool.name] = {
+                    status: 'error',
+                    findings: [],
+                    error: 'timeout',
+                    executionTimeMs: durationMs,
+                };
+                elapsedByTool.set(tool.name, durationMs);
+                totalElapsed += durationMs;
+                continue;
+            }
+            // Parse
+            const findings = parseSafe(tool, raw, targetDir, ctx);
+            const durationMs = Date.now() - start;
+            ctx.log('info', `[ghagga:tools] ${tool.name}: success (${findings.length} findings, ${durationMs}ms)`);
+            results[tool.name] = {
+                status: 'success',
+                findings,
+                executionTimeMs: durationMs,
+            };
+            elapsedByTool.set(tool.name, durationMs);
+            totalElapsed += durationMs;
+        }
+        catch (error) {
+            const durationMs = Date.now() - start;
+            const errorMessage = error instanceof Error ? error.message : String(error);
+            ctx.log('error', `[ghagga:tools] ${tool.name}: error — ${errorMessage}`);
+            results[tool.name] = {
+                status: 'error',
+                findings: [],
+                error: errorMessage,
+                executionTimeMs: durationMs,
+            };
+            elapsedByTool.set(tool.name, durationMs);
+            totalElapsed += durationMs;
+        }
+    }
+    // Ensure legacy keys always present
+    ensureLegacyKeys(results);
+    // Log summary
+    const totalFindings = Object.values(results).reduce((sum, r) => sum + r.findings.length, 0);
+    ctx.log('info', `[ghagga:tools] Complete: ${activatedTools.length} tools, ${totalFindings} findings, ${totalElapsed}ms total`);
+    return results;
+}
+/**
+ * Parse raw output safely — if parse throws, return empty findings.
+ */
+function parseSafe(tool, raw, repoDir, ctx) {
+    try {
+        return tool.parse(raw, repoDir);
+    }
+    catch (error) {
+        const msg = error instanceof Error ? error.message : String(error);
+        ctx.log('warn', `[ghagga:tools] ${tool.name}: parse error — ${msg}`);
+        return [];
+    }
+}
+/**
+ * Ensure semgrep, trivy, cpd keys are always present in results.
+ * Missing legacy tools get a skipped status.
+ */
+function ensureLegacyKeys(results) {
+    for (const name of LEGACY_TOOL_NAMES) {
+        if (!results[name]) {
+            results[name] = { ...SKIPPED_RESULT };
+        }
+    }
+}
+//# sourceMappingURL=orchestrator.js.map

package/dist/tools/orchestrator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"orchestrator.js","sourceRoot":"","sources":["../../src/tools/orchestrator.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAIrE,+CAA+C;AAC/C,MAAM,cAAc,GAAe;IACjC,MAAM,EAAE,SAAS;IACjB,QAAQ,EAAE,EAAE;IACZ,KAAK,EAAE,SAAS;IAChB,eAAe,EAAE,CAAC;CACnB,CAAC;AAEF,+DAA+D;AAC/D,MAAM,iBAAiB,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,KAAK,CAAU,CAAC;AAE/D;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,GAAqB,EACrB,cAA+B,EAC/B,SAAiB,EACjB,KAAe,EACf,gBAAwB,OAAO;IAE/B,MAAM,OAAO,GAA+B,EAAE,CAAC;IAC/C,MAAM,MAAM,GAAG,kBAAkB,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC;IACjE,MAAM,aAAa,GAAG,IAAI,GAAG,EAAkB,CAAC;IAChD,IAAI,YAAY,GAAG,CAAC,CAAC;IAErB,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,0BAA0B,cAAc,CAAC,MAAM,wBAAwB,CAAC,CAAC;IAEzF,KAAK,MAAM,SAAS,IAAI,cAAc,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC;QAElC,qCAAqC;QACrC,IAAI,YAAY,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,mDAAmD,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YAChF,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;gBACnB,MAAM,EAAE,SAAS;gBACjB,QAAQ,EAAE,EAAE;gBACZ,KAAK,EAAE,wBAAwB;gBAC/B,eAAe,EAAE,CAAC;aACnB,CAAC;YACF,SAAS;QACX,CAAC;QAED,MAAM,eAAe,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC;QAC7E,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEzB,IAAI,CAAC;YACH,UAAU;YACV,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAExB,MAAM;YACN,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,eAAe,CAAC,CAAC;YAEnE,oBAAoB;YACpB,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;gBACjB,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;gBACtC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,kBAAkB,IAAI,CAAC,IAAI,mBAAmB,UAAU,IAAI,CAAC,CAAC;gBAC9E,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;oBACnB,MAAM,EAAE,OAAO;oBACf,QAAQ,EAAE,EAAE;oBACZ,KAAK,EAAE,SAAS;oBAChB,eAAe,EAAE,UAAU;iBAC5B,CAAC;gBACF,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;gBACzC,YAAY,IAAI,UAAU,CAAC;gBAC3B,SAAS;YACX,CAAC;YAED,QAAQ;YACR,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;YAEtD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;YACtC,GAAG,CAAC,GAAG,CACL,MAAM,EACN,kBAAkB,IAAI,CAAC,IAAI,cAAc,QAAQ,CAAC,MAAM,cAAc,UAAU,KAAK,CACtF,CAAC;YAEF,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;gBACnB,MAAM,EAAE,SAAS;gBACjB,QAAQ;gBACR,eAAe,EAAE,UAAU;aAC5B,CAAC;YACF,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YACzC,YAAY,IAAI,UAAU,CAAC;QAC7B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;YACtC,MAAM,YAAY,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC5E,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,kBAAkB,IAAI,CAAC,IAAI,aAAa,YAAY,EAAE,CAAC,CAAC;YAEzE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;gBACnB,MAAM,EAAE,OAAO;gBACf,QAAQ,EAAE,EAAE;gBACZ,KAAK,EAAE,YAAY;gBACnB,eAAe,EAAE,UAAU;aAC5B,CAAC;YACF,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YACzC,YAAY,IAAI,UAAU,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,oCAAoC;IACpC,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAE1B,cAAc;IACd,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC5F,GAAG,CAAC,GAAG,CACL,MAAM,EACN,4BAA4B,cAAc,CAAC,MAAM,WAAW,aAAa,cAAc,YAAY,UAAU,CAC9G,CAAC;IAEF,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,SAAS,SAAS,CAChB,IAAoB,EACpB,GAAkB,EAClB,OAAe,EACf,GAAqB;IAErB,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACnE,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,kBAAkB,IAAI,CAAC,IAAI,mBAAmB,GAAG,EAAE,CAAC,CAAC;QACrE,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CAAC,OAAmC;IAC3D,KAAK,MAAM,IAAI,IAAI,iBAAiB,EAAE,CAAC;QACrC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACnB,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc,EAAE,CAAC;QACxC,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/tools/plugins/bandit.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Bandit plugin — Python security analysis (auto-detect).
+ *
+ * Scans Python code for common security issues.
+ * Activates when Python files are detected.
+ *
+ * Uses ExecutionContext for DI instead of direct child_process.
+ */
+import type { FindingSeverity, ReviewFinding } from '../../types.js';
+import type { RawToolOutput, ToolDefinition } from '../types.js';
+/**
+ * Map Bandit severity to GHAGGA FindingSeverity.
+ * HIGH→high, MEDIUM→medium, LOW→low, default→info
+ */
+export declare function mapBanditSeverity(banditSeverity: string): FindingSeverity;
+/**
+ * Parse Bandit JSON output into ReviewFinding[].
+ * Exported for direct testing with fixture data.
+ */
+export declare function parseBanditOutput(raw: RawToolOutput, repoDir: string): ReviewFinding[];
+export declare const banditPlugin: ToolDefinition;
+//# sourceMappingURL=bandit.d.ts.map

package/dist/tools/plugins/bandit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bandit.d.ts","sourceRoot":"","sources":["../../../src/tools/plugins/bandit.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACrE,OAAO,KAAK,EAAoB,aAAa,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAInF;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,cAAc,EAAE,MAAM,GAAG,eAAe,CAWzE;AAcD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,GAAG,aAAa,EAAE,CAiBtF;AAED,eAAO,MAAM,YAAY,EAAE,cAuC1B,CAAC"}

package/dist/tools/plugins/bandit.js

@@ -0,0 +1,79 @@
+/**
+ * Bandit plugin — Python security analysis (auto-detect).
+ *
+ * Scans Python code for common security issues.
+ * Activates when Python files are detected.
+ *
+ * Uses ExecutionContext for DI instead of direct child_process.
+ */
+const BANDIT_VERSION = '1.8.3';
+/**
+ * Map Bandit severity to GHAGGA FindingSeverity.
+ * HIGH→high, MEDIUM→medium, LOW→low, default→info
+ */
+export function mapBanditSeverity(banditSeverity) {
+    switch (banditSeverity.toUpperCase()) {
+        case 'HIGH':
+            return 'high';
+        case 'MEDIUM':
+            return 'medium';
+        case 'LOW':
+            return 'low';
+        default:
+            return 'info';
+    }
+}
+/**
+ * Parse Bandit JSON output into ReviewFinding[].
+ * Exported for direct testing with fixture data.
+ */
+export function parseBanditOutput(raw, repoDir) {
+    if (raw.timedOut)
+        return [];
+    try {
+        const result = JSON.parse(raw.stdout);
+        return (result.results ?? []).map((r) => ({
+            severity: mapBanditSeverity(r.issue_severity),
+            category: 'security',
+            file: r.filename.replace(`${repoDir}/`, ''),
+            line: r.line_number,
+            message: `${r.test_id}: ${r.issue_text} (confidence: ${r.issue_confidence})`,
+            source: 'bandit',
+        }));
+    }
+    catch {
+        return [];
+    }
+}
+export const banditPlugin = {
+    name: 'bandit',
+    displayName: 'Bandit',
+    category: 'security',
+    tier: 'auto-detect',
+    version: BANDIT_VERSION,
+    outputFormat: 'json',
+    detect(files) {
+        return files.some((f) => f.endsWith('.py'));
+    },
+    async install(ctx) {
+        try {
+            await ctx.exec('bandit', ['--version'], { timeoutMs: 10_000 });
+            return;
+        }
+        catch {
+            ctx.log('info', 'Bandit not found, installing...');
+        }
+        await ctx.exec('pip', ['install', '--quiet', `bandit==${BANDIT_VERSION}`], {
+            timeoutMs: 120_000,
+        });
+        await ctx.exec('bandit', ['--version'], { timeoutMs: 10_000 });
+    },
+    async run(ctx, repoDir, _files, timeout) {
+        return ctx.exec('bandit', ['-r', repoDir, '-f', 'json', '--quiet'], {
+            timeoutMs: timeout,
+            allowExitCodes: [1], // bandit returns 1 when findings are present
+        });
+    },
+    parse: parseBanditOutput,
+};
+//# sourceMappingURL=bandit.js.map

package/dist/tools/plugins/bandit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bandit.js","sourceRoot":"","sources":["../../../src/tools/plugins/bandit.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,MAAM,cAAc,GAAG,OAAO,CAAC;AAE/B;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,cAAsB;IACtD,QAAQ,cAAc,CAAC,WAAW,EAAE,EAAE,CAAC;QACrC,KAAK,MAAM;YACT,OAAO,MAAM,CAAC;QAChB,KAAK,QAAQ;YACX,OAAO,QAAQ,CAAC;QAClB,KAAK,KAAK;YACR,OAAO,KAAK,CAAC;QACf;YACE,OAAO,MAAM,CAAC;IAClB,CAAC;AACH,CAAC;AAcD;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAkB,EAAE,OAAe;IACnE,IAAI,GAAG,CAAC,QAAQ;QAAE,OAAO,EAAE,CAAC;IAE5B,IAAI,CAAC;QACH,MAAM,MAAM,GAAiB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAEpD,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACxC,QAAQ,EAAE,iBAAiB,CAAC,CAAC,CAAC,cAAc,CAAC;YAC7C,QAAQ,EAAE,UAAU;YACpB,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,OAAO,GAAG,EAAE,EAAE,CAAC;YAC3C,IAAI,EAAE,CAAC,CAAC,WAAW;YACnB,OAAO,EAAE,GAAG,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,UAAU,iBAAiB,CAAC,CAAC,gBAAgB,GAAG;YAC5E,MAAM,EAAE,QAAiB;SAC1B,CAAC,CAAC,CAAC;IACN,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,YAAY,GAAmB;IAC1C,IAAI,EAAE,QAAQ;IACd,WAAW,EAAE,QAAQ;IACrB,QAAQ,EAAE,UAAU;IACpB,IAAI,EAAE,aAAa;IACnB,OAAO,EAAE,cAAc;IACvB,YAAY,EAAE,MAAM;IAEpB,MAAM,CAAC,KAAe;QACpB,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,GAAqB;QACjC,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;YAC/D,OAAO;QACT,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,iCAAiC,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,WAAW,cAAc,EAAE,CAAC,EAAE;YACzE,SAAS,EAAE,OAAO;SACnB,CAAC,CAAC;QACH,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;IACjE,CAAC;IAED,KAAK,CAAC,GAAG,CACP,GAAqB,EACrB,OAAe,EACf,MAAgB,EAChB,OAAe;QAEf,OAAO,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE;YAClE,SAAS,EAAE,OAAO;YAClB,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,6CAA6C;SACnE,CAAC,CAAC;IACL,CAAC;IAED,KAAK,EAAE,iBAAiB;CACzB,CAAC"}

package/dist/tools/plugins/biome.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Biome plugin — JavaScript/TypeScript linting (auto-detect).
+ *
+ * Fast linter and formatter for JS/TS. Activates when JS/TS files are detected.
+ * Maps diagnostic severity to FindingSeverity.
+ *
+ * Uses ExecutionContext for DI instead of direct child_process.
+ */
+import type { FindingSeverity, ReviewFinding } from '../../types.js';
+import type { RawToolOutput, ToolDefinition } from '../types.js';
+/**
+ * Map Biome diagnostic severity to GHAGGA FindingSeverity.
+ * error→high, warning→medium, information→low, hint→info
+ */
+export declare function mapBiomeSeverity(severity: string): FindingSeverity;
+/**
+ * Parse Biome JSON output into ReviewFinding[].
+ * Exported for direct testing with fixture data.
+ */
+export declare function parseBiomeOutput(raw: RawToolOutput, repoDir: string): ReviewFinding[];
+export declare const biomePlugin: ToolDefinition;
+//# sourceMappingURL=biome.d.ts.map

package/dist/tools/plugins/biome.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"biome.d.ts","sourceRoot":"","sources":["../../../src/tools/plugins/biome.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACrE,OAAO,KAAK,EAAoB,aAAa,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAInF;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,eAAe,CAalE;AAoBD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,GAAG,aAAa,EAAE,CAgBrF;AAED,eAAO,MAAM,WAAW,EAAE,cAuCzB,CAAC"}

package/dist/tools/plugins/biome.js

@@ -0,0 +1,80 @@
+/**
+ * Biome plugin — JavaScript/TypeScript linting (auto-detect).
+ *
+ * Fast linter and formatter for JS/TS. Activates when JS/TS files are detected.
+ * Maps diagnostic severity to FindingSeverity.
+ *
+ * Uses ExecutionContext for DI instead of direct child_process.
+ */
+const BIOME_VERSION = '1.9.4';
+/**
+ * Map Biome diagnostic severity to GHAGGA FindingSeverity.
+ * error→high, warning→medium, information→low, hint→info
+ */
+export function mapBiomeSeverity(severity) {
+    switch (severity.toLowerCase()) {
+        case 'error':
+            return 'high';
+        case 'warning':
+            return 'medium';
+        case 'information':
+            return 'low';
+        case 'hint':
+            return 'info';
+        default:
+            return 'low';
+    }
+}
+/**
+ * Parse Biome JSON output into ReviewFinding[].
+ * Exported for direct testing with fixture data.
+ */
+export function parseBiomeOutput(raw, repoDir) {
+    if (raw.timedOut)
+        return [];
+    try {
+        const result = JSON.parse(raw.stdout);
+        return (result.diagnostics ?? []).map((d) => ({
+            severity: mapBiomeSeverity(d.severity),
+            category: 'quality',
+            file: d.location.path.file.replace(`${repoDir}/`, ''),
+            message: `${d.category}: ${d.description}`,
+            source: 'biome',
+        }));
+    }
+    catch {
+        return [];
+    }
+}
+export const biomePlugin = {
+    name: 'biome',
+    displayName: 'Biome',
+    category: 'quality',
+    tier: 'auto-detect',
+    version: BIOME_VERSION,
+    outputFormat: 'json',
+    detect(files) {
+        return files.some((f) => /\.(ts|js|tsx|jsx|mts|mjs|cts|cjs)$/.test(f));
+    },
+    async install(ctx) {
+        try {
+            await ctx.exec('biome', ['--version'], { timeoutMs: 10_000 });
+            return;
+        }
+        catch {
+            ctx.log('info', 'Biome not found, installing...');
+        }
+        await ctx.exec('npm', ['install', '-g', `@biomejs/biome@${BIOME_VERSION}`], {
+            timeoutMs: 120_000,
+        });
+        await ctx.exec('biome', ['--version'], { timeoutMs: 10_000 });
+    },
+    async run(ctx, repoDir, _files, timeout) {
+        return ctx.exec('biome', ['lint', '--reporter', 'json', repoDir], {
+            timeoutMs: timeout,
+            allowExitCodes: [1], // biome returns 1 when findings are present
+        });
+    },
+    parse: parseBiomeOutput,
+};
+//# sourceMappingURL=biome.js.map

package/dist/tools/plugins/biome.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"biome.js","sourceRoot":"","sources":["../../../src/tools/plugins/biome.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,MAAM,aAAa,GAAG,OAAO,CAAC;AAE9B;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,QAAQ,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC;QAC/B,KAAK,OAAO;YACV,OAAO,MAAM,CAAC;QAChB,KAAK,SAAS;YACZ,OAAO,QAAQ,CAAC;QAClB,KAAK,aAAa;YAChB,OAAO,KAAK,CAAC;QACf,KAAK,MAAM;YACT,OAAO,MAAM,CAAC;QAChB;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAoBD;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAkB,EAAE,OAAe;IAClE,IAAI,GAAG,CAAC,QAAQ;QAAE,OAAO,EAAE,CAAC;IAE5B,IAAI,CAAC;QACH,MAAM,MAAM,GAAgB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAEnD,OAAO,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC5C,QAAQ,EAAE,gBAAgB,CAAC,CAAC,CAAC,QAAQ,CAAC;YACtC,QAAQ,EAAE,SAAS;YACnB,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,OAAO,GAAG,EAAE,EAAE,CAAC;YACrD,OAAO,EAAE,GAAG,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,WAAW,EAAE;YAC1C,MAAM,EAAE,OAAgB;SACzB,CAAC,CAAC,CAAC;IACN,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,WAAW,GAAmB;IACzC,IAAI,EAAE,OAAO;IACb,WAAW,EAAE,OAAO;IACpB,QAAQ,EAAE,SAAS;IACnB,IAAI,EAAE,aAAa;IACnB,OAAO,EAAE,aAAa;IACtB,YAAY,EAAE,MAAM;IAEpB,MAAM,CAAC,KAAe;QACpB,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,oCAAoC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACzE,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,GAAqB;QACjC,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;YAC9D,OAAO;QACT,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,gCAAgC,CAAC,CAAC;QACpD,CAAC;QAED,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,kBAAkB,aAAa,EAAE,CAAC,EAAE;YAC1E,SAAS,EAAE,OAAO;SACnB,CAAC,CAAC;QACH,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;IAChE,CAAC;IAED,KAAK,CAAC,GAAG,CACP,GAAqB,EACrB,OAAe,EACf,MAAgB,EAChB,OAAe;QAEf,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;YAChE,SAAS,EAAE,OAAO;YAClB,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,4CAA4C;SAClE,CAAC,CAAC;IACL,CAAC;IAED,KAAK,EAAE,gBAAgB;CACxB,CAAC"}

package/dist/tools/plugins/clippy.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Clippy plugin — Rust linting (auto-detect).
+ *
+ * Runs cargo clippy for Rust code analysis.
+ * Activates when Cargo.toml or .rs files are detected.
+ * Parses line-delimited JSON (compiler messages).
+ *
+ * Uses ExecutionContext for DI instead of direct child_process.
+ */
+import type { FindingSeverity, ReviewFinding } from '../../types.js';
+import type { RawToolOutput, ToolDefinition } from '../types.js';
+/**
+ * Map Rust compiler message level to GHAGGA FindingSeverity.
+ * error→high, warning→medium, note→low, help→info
+ */
+export declare function mapClippySeverity(level: string): FindingSeverity;
+/**
+ * Parse Clippy line-delimited JSON output into ReviewFinding[].
+ * Each line is a separate JSON object (not a JSON array).
+ * Only includes compiler-message entries with spans.
+ * Exported for direct testing with fixture data.
+ */
+export declare function parseClippyOutput(raw: RawToolOutput, repoDir: string): ReviewFinding[];
+export declare const clippyPlugin: ToolDefinition;
+//# sourceMappingURL=clippy.d.ts.map

package/dist/tools/plugins/clippy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clippy.d.ts","sourceRoot":"","sources":["../../../src/tools/plugins/clippy.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACrE,OAAO,KAAK,EAAoB,aAAa,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAEnF;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,eAAe,CAahE;AAeD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,GAAG,aAAa,EAAE,CAiCtF;AAED,eAAO,MAAM,YAAY,EAAE,cAsC1B,CAAC"}

package/dist/tools/plugins/clippy.js

@@ -0,0 +1,95 @@
+/**
+ * Clippy plugin — Rust linting (auto-detect).
+ *
+ * Runs cargo clippy for Rust code analysis.
+ * Activates when Cargo.toml or .rs files are detected.
+ * Parses line-delimited JSON (compiler messages).
+ *
+ * Uses ExecutionContext for DI instead of direct child_process.
+ */
+/**
+ * Map Rust compiler message level to GHAGGA FindingSeverity.
+ * error→high, warning→medium, note→low, help→info
+ */
+export function mapClippySeverity(level) {
+    switch (level.toLowerCase()) {
+        case 'error':
+            return 'high';
+        case 'warning':
+            return 'medium';
+        case 'note':
+            return 'low';
+        case 'help':
+            return 'info';
+        default:
+            return 'low';
+    }
+}
+/**
+ * Parse Clippy line-delimited JSON output into ReviewFinding[].
+ * Each line is a separate JSON object (not a JSON array).
+ * Only includes compiler-message entries with spans.
+ * Exported for direct testing with fixture data.
+ */
+export function parseClippyOutput(raw, repoDir) {
+    if (raw.timedOut)
+        return [];
+    try {
+        const findings = [];
+        const lines = raw.stdout.trim().split('\n');
+        for (const line of lines) {
+            if (!line.trim())
+                continue;
+            const entry = JSON.parse(line);
+            // Only process compiler messages with spans
+            if (entry.reason !== 'compiler-message' || !entry.message?.spans?.length)
+                continue;
+            const msg = entry.message;
+            const span = msg.spans[0];
+            if (!span)
+                continue;
+            findings.push({
+                severity: mapClippySeverity(msg.level),
+                category: 'quality',
+                file: span.file_name.replace(`${repoDir}/`, ''),
+                line: span.line_start,
+                message: msg.message,
+                source: 'clippy',
+            });
+        }
+        return findings;
+    }
+    catch {
+        return [];
+    }
+}
+export const clippyPlugin = {
+    name: 'clippy',
+    displayName: 'Clippy',
+    category: 'quality',
+    tier: 'auto-detect',
+    version: 'toolchain',
+    outputFormat: 'json',
+    detect(files) {
+        return files.some((f) => f === 'Cargo.toml' || f.endsWith('.rs'));
+    },
+    async install(ctx) {
+        // Clippy comes with rustup — just verify cargo is available
+        try {
+            await ctx.exec('cargo', ['--version'], { timeoutMs: 10_000 });
+            return;
+        }
+        catch {
+            throw new Error('Rust toolchain (cargo) is not available. clippy requires a Rust installation.');
+        }
+    },
+    async run(ctx, repoDir, _files, timeout) {
+        return ctx.exec('cargo', ['clippy', '--message-format=json', '--', '-W', 'clippy::all'], {
+            timeoutMs: timeout,
+            cwd: repoDir,
+            allowExitCodes: [1, 101], // clippy may return non-zero on findings or compilation errors
+        });
+    },
+    parse: parseClippyOutput,
+};
+//# sourceMappingURL=clippy.js.map

package/dist/tools/plugins/clippy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"clippy.js","sourceRoot":"","sources":["../../../src/tools/plugins/clippy.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,QAAQ,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;QAC5B,KAAK,OAAO;YACV,OAAO,MAAM,CAAC;QAChB,KAAK,SAAS;YACZ,OAAO,QAAQ,CAAC;QAClB,KAAK,MAAM;YACT,OAAO,KAAK,CAAC;QACf,KAAK,MAAM;YACT,OAAO,MAAM,CAAC;QAChB;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAeD;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAkB,EAAE,OAAe;IACnE,IAAI,GAAG,CAAC,QAAQ;QAAE,OAAO,EAAE,CAAC;IAE5B,IAAI,CAAC;QACH,MAAM,QAAQ,GAAoB,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAE5C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;gBAAE,SAAS;YAE3B,MAAM,KAAK,GAAkB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAE9C,4CAA4C;YAC5C,IAAI,KAAK,CAAC,MAAM,KAAK,kBAAkB,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM;gBAAE,SAAS;YAEnF,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC;YAC1B,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC1B,IAAI,CAAC,IAAI;gBAAE,SAAS;YAEpB,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC;gBACtC,QAAQ,EAAE,SAAS;gBACnB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,OAAO,GAAG,EAAE,EAAE,CAAC;gBAC/C,IAAI,EAAE,IAAI,CAAC,UAAU;gBACrB,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,MAAM,EAAE,QAAiB;aAC1B,CAAC,CAAC;QACL,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,YAAY,GAAmB;IAC1C,IAAI,EAAE,QAAQ;IACd,WAAW,EAAE,QAAQ;IACrB,QAAQ,EAAE,SAAS;IACnB,IAAI,EAAE,aAAa;IACnB,OAAO,EAAE,WAAW;IACpB,YAAY,EAAE,MAAM;IAEpB,MAAM,CAAC,KAAe;QACpB,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,YAAY,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,GAAqB;QACjC,4DAA4D;QAC5D,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;YAC9D,OAAO;QACT,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CACb,+EAA+E,CAChF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAG,CACP,GAAqB,EACrB,OAAe,EACf,MAAgB,EAChB,OAAe;QAEf,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,uBAAuB,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,CAAC,EAAE;YACvF,SAAS,EAAE,OAAO;YAClB,GAAG,EAAE,OAAO;YACZ,cAAc,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,+DAA+D;SAC1F,CAAC,CAAC;IACL,CAAC;IAED,KAAK,EAAE,iBAAiB;CACzB,CAAC"}

package/dist/tools/plugins/cpd.d.ts

@@ -0,0 +1,20 @@
+/**
+ * CPD plugin — duplication detection (always-on).
+ *
+ * Adapted from:
+ * - packages/core/src/tools/cpd.ts (parseCpdXml logic)
+ * - apps/action/src/tools/cpd.ts (install/run flow)
+ *
+ * Uses ExecutionContext for DI instead of direct child_process.
+ * CPD exits with code 4 when duplications are found — successExitCodes: [4].
+ */
+import type { ReviewFinding } from '../../types.js';
+import type { RawToolOutput, ToolDefinition } from '../types.js';
+/**
+ * Parse CPD XML output into ReviewFinding[].
+ * Regex-based XML parsing — same logic as packages/core/src/tools/cpd.ts.
+ * Exported for direct testing with fixture data.
+ */
+export declare function parseCpdOutput(raw: RawToolOutput, repoDir: string): ReviewFinding[];
+export declare const cpdPlugin: ToolDefinition;
+//# sourceMappingURL=cpd.d.ts.map

package/dist/tools/plugins/cpd.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cpd.d.ts","sourceRoot":"","sources":["../../../src/tools/plugins/cpd.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,KAAK,EAAoB,aAAa,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAMnF;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,GAAG,aAAa,EAAE,CA8CnF;AAED,eAAO,MAAM,SAAS,EAAE,cA+DvB,CAAC"}

package/dist/tools/plugins/cpd.js

@@ -0,0 +1,111 @@
+/**
+ * CPD plugin — duplication detection (always-on).
+ *
+ * Adapted from:
+ * - packages/core/src/tools/cpd.ts (parseCpdXml logic)
+ * - apps/action/src/tools/cpd.ts (install/run flow)
+ *
+ * Uses ExecutionContext for DI instead of direct child_process.
+ * CPD exits with code 4 when duplications are found — successExitCodes: [4].
+ */
+const PMD_VERSION = '7.8.0';
+const PMD_HOME = '/opt/pmd';
+const PMD_BIN = `${PMD_HOME}/bin/pmd`;
+/**
+ * Parse CPD XML output into ReviewFinding[].
+ * Regex-based XML parsing — same logic as packages/core/src/tools/cpd.ts.
+ * Exported for direct testing with fixture data.
+ */
+export function parseCpdOutput(raw, repoDir) {
+    if (raw.timedOut)
+        return [];
+    const xml = raw.stdout;
+    if (!xml)
+        return [];
+    try {
+        const findings = [];
+        const dupRegex = /<duplication lines="(\d+)" tokens="(\d+)">([\s\S]*?)<\/duplication>/g;
+        const fileRegex = /<file\s+path="([^"]+)"\s+line="(\d+)"/g;
+        let dupMatch = dupRegex.exec(xml);
+        while (dupMatch !== null) {
+            const lines = parseInt(dupMatch[1] ?? '0', 10);
+            const tokens = parseInt(dupMatch[2] ?? '0', 10);
+            const inner = dupMatch[3] ?? '';
+            const files = [];
+            fileRegex.lastIndex = 0;
+            let fileMatch = fileRegex.exec(inner);
+            while (fileMatch !== null) {
+                files.push({
+                    path: (fileMatch[1] ?? '').replace(`${repoDir}/`, ''),
+                    line: parseInt(fileMatch[2] ?? '0', 10),
+                });
+                fileMatch = fileRegex.exec(inner);
+            }
+            if (files.length >= 2) {
+                const locations = files.map((f) => `${f.path}:${f.line}`).join(', ');
+                findings.push({
+                    severity: 'medium',
+                    category: 'duplication',
+                    file: files[0]?.path,
+                    line: files[0]?.line,
+                    message: `Duplicated code block (${lines} lines, ${tokens} tokens) found in: ${locations}`,
+                    source: 'cpd',
+                });
+            }
+            dupMatch = dupRegex.exec(xml);
+        }
+        return findings;
+    }
+    catch {
+        return [];
+    }
+}
+export const cpdPlugin = {
+    name: 'cpd',
+    displayName: 'PMD/CPD',
+    category: 'duplication',
+    tier: 'always-on',
+    version: PMD_VERSION,
+    outputFormat: 'xml',
+    cachePaths: [PMD_HOME],
+    successExitCodes: [4], // CPD returns 4 when duplications are found
+    async install(ctx) {
+        const cached = await ctx.cacheRestore('cpd', [PMD_HOME]);
+        if (cached) {
+            try {
+                await ctx.exec(PMD_BIN, ['--version'], { timeoutMs: 10_000 });
+                return;
+            }
+            catch {
+                ctx.log('warn', 'PMD cache restored but binary not functional, reinstalling');
+            }
+        }
+        // Download PMD zip from GitHub Releases and extract to /opt/pmd/
+        await ctx.exec('bash', [
+            '-c',
+            `curl -sL "https://github.com/pmd/pmd/releases/download/pmd_releases%2F${PMD_VERSION}/pmd-dist-${PMD_VERSION}-bin.zip" -o /tmp/pmd.zip && ` +
+                `unzip -q /tmp/pmd.zip -d /opt && ` +
+                `mv /opt/pmd-bin-${PMD_VERSION} ${PMD_HOME} && ` +
+                `rm -f /tmp/pmd.zip`,
+        ], { timeoutMs: 120_000 });
+        await ctx.exec(PMD_BIN, ['--version'], { timeoutMs: 10_000 });
+        await ctx.cacheSave('cpd', [PMD_HOME]);
+    },
+    async run(ctx, repoDir, _files, timeout) {
+        return ctx.exec(PMD_BIN, [
+            'cpd',
+            '--format',
+            'xml',
+            '--minimum-tokens',
+            '100',
+            '--dir',
+            repoDir,
+            '--skip-lexical-errors',
+        ], {
+            timeoutMs: timeout,
+            allowExitCodes: [4], // CPD returns 4 when duplications are found
+        });
+    },
+    parse: parseCpdOutput,
+};
+//# sourceMappingURL=cpd.js.map

package/dist/tools/plugins/cpd.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cpd.js","sourceRoot":"","sources":["../../../src/tools/plugins/cpd.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH,MAAM,WAAW,GAAG,OAAO,CAAC;AAC5B,MAAM,QAAQ,GAAG,UAAU,CAAC;AAC5B,MAAM,OAAO,GAAG,GAAG,QAAQ,UAAU,CAAC;AAEtC;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,GAAkB,EAAE,OAAe;IAChE,IAAI,GAAG,CAAC,QAAQ;QAAE,OAAO,EAAE,CAAC;IAE5B,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC;IACvB,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IAEpB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAoB,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAG,sEAAsE,CAAC;QACxF,MAAM,SAAS,GAAG,wCAAwC,CAAC;QAE3D,IAAI,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClC,OAAO,QAAQ,KAAK,IAAI,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;YAC/C,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;YAChD,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAEhC,MAAM,KAAK,GAA0C,EAAE,CAAC;YACxD,SAAS,CAAC,SAAS,GAAG,CAAC,CAAC;YACxB,IAAI,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACtC,OAAO,SAAS,KAAK,IAAI,EAAE,CAAC;gBAC1B,KAAK,CAAC,IAAI,CAAC;oBACT,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,OAAO,GAAG,EAAE,EAAE,CAAC;oBACrD,IAAI,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC;iBACxC,CAAC,CAAC;gBACH,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACpC,CAAC;YAED,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;gBACtB,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACrE,QAAQ,CAAC,IAAI,CAAC;oBACZ,QAAQ,EAAE,QAAQ;oBAClB,QAAQ,EAAE,aAAa;oBACvB,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI;oBACpB,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI;oBACpB,OAAO,EAAE,0BAA0B,KAAK,WAAW,MAAM,sBAAsB,SAAS,EAAE;oBAC1F,MAAM,EAAE,KAAc;iBACvB,CAAC,CAAC;YACL,CAAC;YACD,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChC,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,SAAS,GAAmB;IACvC,IAAI,EAAE,KAAK;IACX,WAAW,EAAE,SAAS;IACtB,QAAQ,EAAE,aAAa;IACvB,IAAI,EAAE,WAAW;IACjB,OAAO,EAAE,WAAW;IACpB,YAAY,EAAE,KAAK;IACnB,UAAU,EAAE,CAAC,QAAQ,CAAC;IACtB,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,4CAA4C;IAEnE,KAAK,CAAC,OAAO,CAAC,GAAqB;QACjC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QACzD,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC;gBACH,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;gBAC9D,OAAO;YACT,CAAC;YAAC,MAAM,CAAC;gBACP,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,4DAA4D,CAAC,CAAC;YAChF,CAAC;QACH,CAAC;QAED,iEAAiE;QACjE,MAAM,GAAG,CAAC,IAAI,CACZ,MAAM,EACN;YACE,IAAI;YACJ,yEAAyE,WAAW,aAAa,WAAW,+BAA+B;gBACzI,mCAAmC;gBACnC,mBAAmB,WAAW,IAAI,QAAQ,MAAM;gBAChD,oBAAoB;SACvB,EACD,EAAE,SAAS,EAAE,OAAO,EAAE,CACvB,CAAC;QACF,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QAC9D,MAAM,GAAG,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,GAAG,CACP,GAAqB,EACrB,OAAe,EACf,MAAgB,EAChB,OAAe;QAEf,OAAO,GAAG,CAAC,IAAI,CACb,OAAO,EACP;YACE,KAAK;YACL,UAAU;YACV,KAAK;YACL,kBAAkB;YAClB,KAAK;YACL,OAAO;YACP,OAAO;YACP,uBAAuB;SACxB,EACD;YACE,SAAS,EAAE,OAAO;YAClB,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,4CAA4C;SAClE,CACF,CAAC;IACJ,CAAC;IAED,KAAK,EAAE,cAAc;CACtB,CAAC"}

package/dist/tools/plugins/gitleaks.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Gitleaks plugin — secret detection (always-on).
+ *
+ * Scans the repository for hardcoded secrets, API keys, and credentials.
+ * All secret findings are reported as critical severity.
+ *
+ * Uses ExecutionContext for DI instead of direct child_process.
+ */
+import type { ReviewFinding } from '../../types.js';
+import type { RawToolOutput, ToolDefinition } from '../types.js';
+/**
+ * Parse Gitleaks JSON output into ReviewFinding[].
+ * Gitleaks writes results to a report file; we read from stdout or the report.
+ * Exported for direct testing with fixture data.
+ */
+export declare function parseGitleaksOutput(raw: RawToolOutput, repoDir: string): ReviewFinding[];
+export declare const gitleaksPlugin: ToolDefinition;
+//# sourceMappingURL=gitleaks.d.ts.map