ghagga-core 2.5.0 → 2.6.0

package/dist/providers/fallback.js

@@ -5,13 +5,17 @@
  * server error (5xx) or times out, it moves to the next provider.
  * Client errors (4xx) are NOT retried — they indicate misconfiguration.
  */
-import { generateText } from 'ai';
+import { generateTextWithTimeout } from '../utils/llm-timeout.js';
 import { createModel } from './index.js';
 // ─── Helpers ────────────────────────────────────────────────────
 /**
- * Check if an error is a retryable server-side error (5xx or timeout).
+ * Check if an error is retryable (should try the next provider in the chain).
+ *
+ * Retryable: 5xx, timeouts, rate limits (429), and payload-too-large (413).
+ * The 413 case is important for free-tier providers with low TPM limits —
+ * the next provider in the chain may have a higher limit.
  */
-function isRetryableError(error) {
+export function isRetryableError(error) {
     if (error instanceof Error) {
         const message = error.message.toLowerCase();
         // Network/timeout errors
@@ -24,10 +28,16 @@ function isRetryableError(error) {
         const statusMatch = /status[:\s]*(\d{3})/i.exec(message);
         if (statusMatch) {
             const status = parseInt(statusMatch[1] ?? '0', 10);
-            return status >= 500;
+            // 5xx server errors + 413 payload too large (TPM exceeded) + 429 rate limit
+            return status >= 500 || status === 413 || status === 429;
         }
-        // Rate limit (429) — also retryable with a different provider
-        if (message.includes('rate limit') || message.includes('429')) {
+        // Rate limit / TPM exceeded — also retryable with a different provider
+        if (message.includes('rate limit') ||
+            message.includes('rate_limit') ||
+            message.includes('429') ||
+            message.includes('413') ||
+            message.includes('request too large') ||
+            message.includes('tokens per minute')) {
             return true;
         }
     }
@@ -54,12 +64,18 @@ export async function generateWithFallback(options) {
     for (const { provider, model, apiKey } of providers) {
         try {
             const languageModel = createModel(provider, model, apiKey);
-            const result = await generateText({
+            const result = await generateTextWithTimeout({
                 model: languageModel,
                 system,
                 prompt,
                 temperature,
-            });
+            }, { provider, model });
+            // Timeout: treat as a retryable error and try next provider
+            if (result === null) {
+                lastError = new Error(`LLM call timed out for ${provider}/${model}`);
+                console.warn(`[ghagga] Provider ${provider}/${model} timed out, trying next...`);
+                continue;
+            }
             // Calculate tokens used from the response
             const tokensUsed = (result.usage?.inputTokens ?? 0) + (result.usage?.outputTokens ?? 0);
             return {

package/dist/providers/fallback.js.map

@@ -1 +1 @@
-{"version":3,"file":"fallback.js","sourceRoot":"","sources":["../../src/providers/fallback.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAElC,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAsCzC,mEAAmE;AAEnE;;GAEG;AACH,SAAS,gBAAgB,CAAC,KAAc;IACtC,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QAE5C,yBAAyB;QACzB,IACE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;YAC3B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;YAC9B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,EAChC,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,0EAA0E;QAC1E,MAAM,WAAW,GAAG,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzD,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,MAAM,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;YACnD,OAAO,MAAM,IAAI,GAAG,CAAC;QACvB,CAAC;QAED,8DAA8D;QAC9D,IAAI,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,mEAAmE;AAEnE;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAAwB;IACjE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,GAAG,EAAE,GAAG,OAAO,CAAC;IAEjE,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IAED,IAAI,SAAkB,CAAC;IAEvB,KAAK,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;QACpD,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,WAAW,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;YAE3D,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC;gBAChC,KAAK,EAAE,aAAa;gBACpB,MAAM;gBACN,MAAM;gBACN,WAAW;aACZ,CAAC,CAAC;YAEH,0CAA0C;YAC1C,MAAM,UAAU,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,WAAW,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,YAAY,IAAI,CAAC,CAAC,CAAC;YAExF,OAAO;gBACL,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,QAAQ;gBACR,KAAK;gBACL,UAAU;aACX,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,SAAS,GAAG,KAAK,CAAC;YAElB,IAAI,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC5B,oCAAoC;gBACpC,OAAO,CAAC,IAAI,CACV,qBAAqB,QAAQ,IAAI,KAAK,8CAA8C,EACpF,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CACvD,CAAC;gBACF,SAAS;YACX,CAAC;YAED,4DAA4D;YAC5D,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,6CAA6C;IAC7C,MAAM,SAAS,CAAC;AAClB,CAAC"}
+{"version":3,"file":"fallback.js","sourceRoot":"","sources":["../../src/providers/fallback.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAsCzC,mEAAmE;AAEnE;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QAE5C,yBAAyB;QACzB,IACE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;YAC3B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;YAC9B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,EAChC,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,0EAA0E;QAC1E,MAAM,WAAW,GAAG,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzD,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,MAAM,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;YACnD,4EAA4E;YAC5E,OAAO,MAAM,IAAI,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC;QAC3D,CAAC;QAED,uEAAuE;QACvE,IACE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;YAC9B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;YAC9B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;YACvB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;YACvB,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC;YACrC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EACrC,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,mEAAmE;AAEnE;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAAwB;IACjE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,GAAG,EAAE,GAAG,OAAO,CAAC;IAEjE,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IAED,IAAI,SAAkB,CAAC;IAEvB,KAAK,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;QACpD,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,WAAW,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;YAE3D,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAC1C;gBACE,KAAK,EAAE,aAAa;gBACpB,MAAM;gBACN,MAAM;gBACN,WAAW;aACZ,EACD,EAAE,QAAQ,EAAE,KAAK,EAAE,CACpB,CAAC;YAEF,4DAA4D;YAC5D,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBACpB,SAAS,GAAG,IAAI,KAAK,CAAC,0BAA0B,QAAQ,IAAI,KAAK,EAAE,CAAC,CAAC;gBACrE,OAAO,CAAC,IAAI,CAAC,qBAAqB,QAAQ,IAAI,KAAK,4BAA4B,CAAC,CAAC;gBACjF,SAAS;YACX,CAAC;YAED,0CAA0C;YAC1C,MAAM,UAAU,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,WAAW,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,YAAY,IAAI,CAAC,CAAC,CAAC;YAExF,OAAO;gBACL,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,QAAQ;gBACR,KAAK;gBACL,UAAU;aACX,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,SAAS,GAAG,KAAK,CAAC;YAElB,IAAI,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC5B,oCAAoC;gBACpC,OAAO,CAAC,IAAI,CACV,qBAAqB,QAAQ,IAAI,KAAK,8CAA8C,EACpF,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CACvD,CAAC;gBACF,SAAS;YACX,CAAC;YAED,4DAA4D;YAC5D,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,6CAA6C;IAC7C,MAAM,SAAS,CAAC;AAClB,CAAC"}

package/dist/providers/gateway.d.ts

@@ -0,0 +1,40 @@
+/**
+ * LLM Gateway provider — delegates LLM calls to a centralized gateway service.
+ *
+ * The gateway URL and token are configured per-installation via the dashboard
+ * (stored in the provider chain entry). No environment variables needed.
+ *
+ * API contract:
+ *   POST /v1/generate
+ *   Request:  { prompt, system, provider?, model?, project? }
+ *   Response: { text, provider, model, tokensUsed }
+ *
+ * This provider bypasses the AI SDK entirely — the gateway handles model
+ * selection, provider routing, and token management internally.
+ */
+export interface GatewayOptions {
+    /** Gateway base URL (e.g., "https://llm-gateway.javierzader.com") */
+    gatewayUrl: string;
+    /** Bearer token for gateway authentication */
+    gatewayToken: string;
+    /** Model to request (optional — gateway can auto-select) */
+    model?: string;
+    /** Project identifier for gateway tracking/routing */
+    project?: string;
+}
+export interface GatewayResponse {
+    text: string;
+    provider: string;
+    model: string;
+    tokensUsed?: number;
+}
+/**
+ * Generate text via the LLM Gateway.
+ *
+ * @param prompt - User prompt (typically includes the diff)
+ * @param systemPrompt - System prompt (review instructions, context, etc.)
+ * @param options - Gateway connection options (URL, token, model, project)
+ * @returns Gateway response with generated text and metadata
+ */
+export declare function generateViaGateway(prompt: string, systemPrompt?: string, options?: GatewayOptions): Promise<GatewayResponse>;
+//# sourceMappingURL=gateway.d.ts.map

package/dist/providers/gateway.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway.d.ts","sourceRoot":"","sources":["../../src/providers/gateway.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,MAAM,WAAW,cAAc;IAC7B,qEAAqE;IACrE,UAAU,EAAE,MAAM,CAAC;IACnB,8CAA8C;IAC9C,YAAY,EAAE,MAAM,CAAC;IACrB,4DAA4D;IAC5D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sDAAsD;IACtD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAID;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,MAAM,EACrB,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,eAAe,CAAC,CAiC1B"}

package/dist/providers/gateway.js

@@ -0,0 +1,52 @@
+/**
+ * LLM Gateway provider — delegates LLM calls to a centralized gateway service.
+ *
+ * The gateway URL and token are configured per-installation via the dashboard
+ * (stored in the provider chain entry). No environment variables needed.
+ *
+ * API contract:
+ *   POST /v1/generate
+ *   Request:  { prompt, system, provider?, model?, project? }
+ *   Response: { text, provider, model, tokensUsed }
+ *
+ * This provider bypasses the AI SDK entirely — the gateway handles model
+ * selection, provider routing, and token management internally.
+ */
+// ─── Public API ─────────────────────────────────────────────────
+/**
+ * Generate text via the LLM Gateway.
+ *
+ * @param prompt - User prompt (typically includes the diff)
+ * @param systemPrompt - System prompt (review instructions, context, etc.)
+ * @param options - Gateway connection options (URL, token, model, project)
+ * @returns Gateway response with generated text and metadata
+ */
+export async function generateViaGateway(prompt, systemPrompt, options) {
+    const { gatewayUrl, gatewayToken, model, project } = options ?? {};
+    if (!gatewayUrl) {
+        throw new Error('Gateway URL not configured — set it in the dashboard provider chain settings');
+    }
+    if (!gatewayToken) {
+        throw new Error('Gateway token not configured — set the API key in the dashboard provider chain settings');
+    }
+    const response = await fetch(`${gatewayUrl}/v1/generate`, {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/json',
+            Authorization: `Bearer ${gatewayToken}`,
+        },
+        body: JSON.stringify({
+            prompt,
+            system: systemPrompt,
+            model,
+            project,
+        }),
+        signal: AbortSignal.timeout(180_000), // 3 min timeout (matches CLI bridge)
+    });
+    if (!response.ok) {
+        const error = await response.text().catch(() => 'unknown error');
+        throw new Error(`Gateway error (${response.status}): ${error}`);
+    }
+    return response.json();
+}
+//# sourceMappingURL=gateway.js.map

package/dist/providers/gateway.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway.js","sourceRoot":"","sources":["../../src/providers/gateway.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAsBH,mEAAmE;AAEnE;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAc,EACd,YAAqB,EACrB,OAAwB;IAExB,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,OAAO,IAAI,EAAE,CAAC;IAEnE,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CACb,yFAAyF,CAC1F,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,UAAU,cAAc,EAAE;QACxD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,aAAa,EAAE,UAAU,YAAY,EAAE;SACxC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,MAAM;YACN,MAAM,EAAE,YAAY;YACpB,KAAK;YACL,OAAO;SACR,CAAC;QACF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,qCAAqC;KAC5E,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,kBAAkB,QAAQ,CAAC,MAAM,MAAM,KAAK,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,OAAO,QAAQ,CAAC,IAAI,EAA8B,CAAC;AACrD,CAAC"}

package/dist/providers/generate-fn.d.ts

@@ -0,0 +1,62 @@
+/**
+ * GenerateTextFn abstraction — backend-agnostic LLM text generation.
+ *
+ * Decouples agent orchestration from the LLM backend. Agents call
+ * `generateFn(system, prompt)` instead of directly importing AI SDK,
+ * CLI bridge, or gateway functions.
+ *
+ * Three factory functions create GenerateTextFn instances for each backend:
+ *   - createAISDKGenerateFn    — wraps AI SDK's createModel + generateTextWithTimeout
+ *   - createCLIBridgeGenerateFn — wraps generateViaCLI (child_process)
+ *   - createGatewayGenerateFn   — wraps generateViaGateway (HTTP)
+ */
+import type { LLMProvider } from '../types.js';
+/** Result from any LLM text generation backend */
+export interface GenerateResult {
+    text: string;
+    tokensUsed: number;
+    provider: string;
+    model: string;
+}
+/** Generic text generation function — abstracts AI SDK, CLI bridge, and gateway */
+export type GenerateTextFn = (system: string, prompt: string) => Promise<GenerateResult>;
+/**
+ * Create a GenerateTextFn backed by the Vercel AI SDK.
+ *
+ * Wraps `createModel` + `generateTextWithTimeout`. Converts the
+ * `null` timeout sentinel into a thrown Error so agents get a
+ * clean exception (caught by `allSettled`).
+ *
+ * @param provider - LLM provider name (e.g., 'anthropic', 'openai')
+ * @param model - Model identifier (e.g., 'claude-sonnet-4-20250514')
+ * @param apiKey - Decrypted API key
+ */
+export declare function createAISDKGenerateFn(provider: LLMProvider, model: string, apiKey: string): GenerateTextFn;
+/**
+ * Create a GenerateTextFn backed by the CLI bridge (child_process).
+ *
+ * Wraps `generateViaCLI`. Returns `tokensUsed: 0` because CLI
+ * tools don't report token usage.
+ *
+ * @param options - CLI bridge options (preferredCLI, cliModel, credentials)
+ */
+export declare function createCLIBridgeGenerateFn(options: {
+    preferredCLI?: string;
+    cliModel?: string;
+    credentials?: Record<string, string>;
+}): GenerateTextFn;
+/**
+ * Create a GenerateTextFn backed by the LLM Gateway (HTTP).
+ *
+ * Wraps `generateViaGateway`. Maps gateway response fields into
+ * the GenerateResult shape.
+ *
+ * @param options - Gateway connection options (URL, token, model, project)
+ */
+export declare function createGatewayGenerateFn(options: {
+    gatewayUrl: string;
+    gatewayToken: string;
+    model?: string;
+    project?: string;
+}): GenerateTextFn;
+//# sourceMappingURL=generate-fn.d.ts.map

package/dist/providers/generate-fn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generate-fn.d.ts","sourceRoot":"","sources":["../../src/providers/generate-fn.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAQ/C,kDAAkD;AAClD,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,mFAAmF;AACnF,MAAM,MAAM,cAAc,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;AAIzF;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,WAAW,EACrB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,GACb,cAAc,CAiBhB;AAID;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE;IACjD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACtC,GAAG,cAAc,CAUjB;AAID;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE;IAC/C,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GAAG,cAAc,CAUjB"}

package/dist/providers/generate-fn.js

@@ -0,0 +1,84 @@
+/**
+ * GenerateTextFn abstraction — backend-agnostic LLM text generation.
+ *
+ * Decouples agent orchestration from the LLM backend. Agents call
+ * `generateFn(system, prompt)` instead of directly importing AI SDK,
+ * CLI bridge, or gateway functions.
+ *
+ * Three factory functions create GenerateTextFn instances for each backend:
+ *   - createAISDKGenerateFn    — wraps AI SDK's createModel + generateTextWithTimeout
+ *   - createCLIBridgeGenerateFn — wraps generateViaCLI (child_process)
+ *   - createGatewayGenerateFn   — wraps generateViaGateway (HTTP)
+ */
+import { generateTextWithTimeout } from '../utils/llm-timeout.js';
+import { generateViaCLI } from './cli-bridge.js';
+import { generateViaGateway } from './gateway.js';
+import { createModel } from './index.js';
+// ─── Factory: AI SDK ────────────────────────────────────────────
+/**
+ * Create a GenerateTextFn backed by the Vercel AI SDK.
+ *
+ * Wraps `createModel` + `generateTextWithTimeout`. Converts the
+ * `null` timeout sentinel into a thrown Error so agents get a
+ * clean exception (caught by `allSettled`).
+ *
+ * @param provider - LLM provider name (e.g., 'anthropic', 'openai')
+ * @param model - Model identifier (e.g., 'claude-sonnet-4-20250514')
+ * @param apiKey - Decrypted API key
+ */
+export function createAISDKGenerateFn(provider, model, apiKey) {
+    return async (system, prompt) => {
+        const languageModel = createModel(provider, model, apiKey);
+        const result = await generateTextWithTimeout({ model: languageModel, system, prompt, temperature: 0.3 }, { provider, model });
+        if (result === null) {
+            throw new Error(`LLM call timed out (${provider}/${model})`);
+        }
+        return {
+            text: result.text,
+            tokensUsed: (result.usage?.inputTokens ?? 0) + (result.usage?.outputTokens ?? 0),
+            provider,
+            model,
+        };
+    };
+}
+// ─── Factory: CLI Bridge ────────────────────────────────────────
+/**
+ * Create a GenerateTextFn backed by the CLI bridge (child_process).
+ *
+ * Wraps `generateViaCLI`. Returns `tokensUsed: 0` because CLI
+ * tools don't report token usage.
+ *
+ * @param options - CLI bridge options (preferredCLI, cliModel, credentials)
+ */
+export function createCLIBridgeGenerateFn(options) {
+    return async (system, prompt) => {
+        const result = generateViaCLI(prompt, system, options);
+        return {
+            text: result.text,
+            tokensUsed: 0, // CLI doesn't report tokens
+            provider: 'cli-bridge',
+            model: result.cli,
+        };
+    };
+}
+// ─── Factory: Gateway ───────────────────────────────────────────
+/**
+ * Create a GenerateTextFn backed by the LLM Gateway (HTTP).
+ *
+ * Wraps `generateViaGateway`. Maps gateway response fields into
+ * the GenerateResult shape.
+ *
+ * @param options - Gateway connection options (URL, token, model, project)
+ */
+export function createGatewayGenerateFn(options) {
+    return async (system, prompt) => {
+        const result = await generateViaGateway(prompt, system, options);
+        return {
+            text: result.text,
+            tokensUsed: result.tokensUsed ?? 0,
+            provider: result.provider,
+            model: result.model,
+        };
+    };
+}
+//# sourceMappingURL=generate-fn.js.map

package/dist/providers/generate-fn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generate-fn.js","sourceRoot":"","sources":["../../src/providers/generate-fn.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAezC,mEAAmE;AAEnE;;;;;;;;;;GAUG;AACH,MAAM,UAAU,qBAAqB,CACnC,QAAqB,EACrB,KAAa,EACb,MAAc;IAEd,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;QAC9B,MAAM,aAAa,GAAG,WAAW,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAC1C,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,EAC1D,EAAE,QAAQ,EAAE,KAAK,EAAE,CACpB,CAAC;QACF,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,uBAAuB,QAAQ,IAAI,KAAK,GAAG,CAAC,CAAC;QAC/D,CAAC;QACD,OAAO;YACL,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,UAAU,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,WAAW,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,YAAY,IAAI,CAAC,CAAC;YAChF,QAAQ;YACR,KAAK;SACN,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED,mEAAmE;AAEnE;;;;;;;GAOG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAIzC;IACC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;QAC9B,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QACvD,OAAO;YACL,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,UAAU,EAAE,CAAC,EAAE,4BAA4B;YAC3C,QAAQ,EAAE,YAAY;YACtB,KAAK,EAAE,MAAM,CAAC,GAAG;SAClB,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED,mEAAmE;AAEnE;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAKvC;IACC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;QAC9B,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QACjE,OAAO;YACL,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,CAAC;YAClC,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,KAAK,EAAE,MAAM,CAAC,KAAK;SACpB,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}

package/dist/providers/index.d.ts

@@ -15,6 +15,11 @@
  * Qwen (Alibaba Cloud DashScope) uses the OpenAI-compatible endpoint at
  * https://dashscope-intl.aliyuncs.com/compatible-mode/v1. Requires a
  * DashScope API key (DASHSCOPE_API_KEY).
+ *
+ * Groq uses https://api.groq.com/openai/v1 (free tier: 1K–14.4K RPD).
+ * Cerebras uses https://api.cerebras.ai/v1 (free tier: 14.4K RPD, ~3000 tok/s).
+ * DeepSeek uses https://api.deepseek.com/v1 (near-free, no rate limit).
+ * OpenRouter uses https://openrouter.ai/api/v1 (gateway to 200+ models).
  */
 import type { LanguageModel } from 'ai';
 import type { LLMProvider } from '../types.js';

package/dist/providers/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/providers/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAKH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;AACxC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAa/C;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,iJAgCnE;AAID;;;;;;;;;;GAUG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,aAAa,CAG/F"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/providers/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAMH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;AACxC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAyB/C;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,iJAiFnE;AAID;;;;;;;;;;GAUG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,aAAa,CAG/F"}

package/dist/providers/index.js

@@ -15,16 +15,30 @@
  * Qwen (Alibaba Cloud DashScope) uses the OpenAI-compatible endpoint at
  * https://dashscope-intl.aliyuncs.com/compatible-mode/v1. Requires a
  * DashScope API key (DASHSCOPE_API_KEY).
+ *
+ * Groq uses https://api.groq.com/openai/v1 (free tier: 1K–14.4K RPD).
+ * Cerebras uses https://api.cerebras.ai/v1 (free tier: 14.4K RPD, ~3000 tok/s).
+ * DeepSeek uses https://api.deepseek.com/v1 (near-free, no rate limit).
+ * OpenRouter uses https://openrouter.ai/api/v1 (gateway to 200+ models).
  */
 import { createAnthropic } from '@ai-sdk/anthropic';
 import { createGoogleGenerativeAI } from '@ai-sdk/google';
 import { createOpenAI } from '@ai-sdk/openai';
+import { createOpenAICompatible } from '@ai-sdk/openai-compatible';
 /** GitHub Models inference endpoint (OpenAI-compatible) */
 const GITHUB_MODELS_BASE_URL = 'https://models.inference.ai.azure.com';
 /** Ollama local inference endpoint (OpenAI-compatible) */
 const OLLAMA_BASE_URL = 'http://localhost:11434/v1';
 /** Qwen / DashScope international endpoint (OpenAI-compatible) */
 const QWEN_BASE_URL = 'https://dashscope-intl.aliyuncs.com/compatible-mode/v1';
+/** Groq Cloud inference endpoint (OpenAI-compatible) */
+const GROQ_BASE_URL = 'https://api.groq.com/openai/v1';
+/** Cerebras inference endpoint (OpenAI-compatible) */
+const CEREBRAS_BASE_URL = 'https://api.cerebras.ai/v1';
+/** DeepSeek inference endpoint (OpenAI-compatible) */
+const DEEPSEEK_BASE_URL = 'https://api.deepseek.com/v1';
+/** OpenRouter gateway endpoint (OpenAI-compatible) */
+const OPENROUTER_BASE_URL = 'https://openrouter.ai/api/v1';
 // ─── Provider Factory ───────────────────────────────────────────
 /**
  * Create a provider instance configured with the given API key.
@@ -62,6 +76,45 @@ export function createProvider(provider, apiKey) {
                 baseURL: QWEN_BASE_URL,
                 name: 'qwen',
             });
+        case 'groq':
+            return createOpenAI({
+                apiKey,
+                baseURL: GROQ_BASE_URL,
+                name: 'groq',
+            });
+        case 'cerebras': {
+            const provider = createOpenAICompatible({
+                name: 'cerebras',
+                baseURL: CEREBRAS_BASE_URL,
+                apiKey,
+            });
+            return ((modelId) => provider.chatModel(modelId));
+        }
+        case 'deepseek': {
+            const provider = createOpenAICompatible({
+                name: 'deepseek',
+                baseURL: DEEPSEEK_BASE_URL,
+                apiKey,
+            });
+            return ((modelId) => provider.chatModel(modelId));
+        }
+        case 'openrouter': {
+            const provider = createOpenAICompatible({
+                name: 'openrouter',
+                baseURL: OPENROUTER_BASE_URL,
+                apiKey,
+            });
+            return ((modelId) => provider.chatModel(modelId));
+        }
+        case 'cli-bridge':
+            // CLI Bridge does not use the AI SDK — it calls CLIs via child_process.
+            // Return a dummy provider that throws if accidentally called via createModel().
+            // The pipeline intercepts cli-bridge before reaching createModel().
+            throw new Error('cli-bridge provider cannot be used with createModel(). Use generateViaCLI() from providers/cli-bridge.js instead.');
+        case 'gateway':
+            // Gateway does not use the AI SDK — it delegates to an external LLM Gateway service.
+            // The pipeline intercepts gateway before reaching createModel().
+            throw new Error('gateway provider cannot be used with createModel(). Use generateViaGateway() from providers/gateway.js instead.');
         default: {
             // Exhaustive check — TypeScript will error if a provider is missing
             const _exhaustive = provider;

package/dist/providers/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/providers/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAI9C,2DAA2D;AAC3D,MAAM,sBAAsB,GAAG,uCAAuC,CAAC;AAEvE,0DAA0D;AAC1D,MAAM,eAAe,GAAG,2BAA2B,CAAC;AAEpD,kEAAkE;AAClE,MAAM,aAAa,GAAG,wDAAwD,CAAC;AAE/E,mEAAmE;AAEnE;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAAC,QAAqB,EAAE,MAAc;IAClE,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,WAAW;YACd,OAAO,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QACrC,KAAK,QAAQ;YACX,OAAO,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAClC,KAAK,QAAQ;YACX,OAAO,wBAAwB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAC9C,KAAK,QAAQ;YACX,OAAO,YAAY,CAAC;gBAClB,MAAM;gBACN,OAAO,EAAE,sBAAsB;gBAC/B,IAAI,EAAE,eAAe;aACtB,CAAC,CAAC;QACL,KAAK,QAAQ;YACX,OAAO,YAAY,CAAC;gBAClB,MAAM,EAAE,MAAM,IAAI,QAAQ;gBAC1B,OAAO,EAAE,eAAe;gBACxB,IAAI,EAAE,QAAQ;aACf,CAAC,CAAC;QACL,KAAK,MAAM;YACT,OAAO,YAAY,CAAC;gBAClB,MAAM;gBACN,OAAO,EAAE,aAAa;gBACtB,IAAI,EAAE,MAAM;aACb,CAAC,CAAC;QACL,OAAO,CAAC,CAAC,CAAC;YACR,oEAAoE;YACpE,MAAM,WAAW,GAAU,QAAQ,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,qBAAqB,WAAW,EAAE,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;AACH,CAAC;AAED,mEAAmE;AAEnE;;;;;;;;;;GAUG;AACH,MAAM,UAAU,WAAW,CAAC,QAAqB,EAAE,KAAa,EAAE,MAAc;IAC9E,MAAM,gBAAgB,GAAG,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC1D,OAAO,gBAAgB,CAAC,KAAK,CAAkB,CAAC;AAClD,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/providers/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAInE,2DAA2D;AAC3D,MAAM,sBAAsB,GAAG,uCAAuC,CAAC;AAEvE,0DAA0D;AAC1D,MAAM,eAAe,GAAG,2BAA2B,CAAC;AAEpD,kEAAkE;AAClE,MAAM,aAAa,GAAG,wDAAwD,CAAC;AAE/E,wDAAwD;AACxD,MAAM,aAAa,GAAG,gCAAgC,CAAC;AAEvD,sDAAsD;AACtD,MAAM,iBAAiB,GAAG,4BAA4B,CAAC;AAEvD,sDAAsD;AACtD,MAAM,iBAAiB,GAAG,6BAA6B,CAAC;AAExD,sDAAsD;AACtD,MAAM,mBAAmB,GAAG,8BAA8B,CAAC;AAE3D,mEAAmE;AAEnE;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAAC,QAAqB,EAAE,MAAc;IAClE,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,WAAW;YACd,OAAO,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QACrC,KAAK,QAAQ;YACX,OAAO,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAClC,KAAK,QAAQ;YACX,OAAO,wBAAwB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAC9C,KAAK,QAAQ;YACX,OAAO,YAAY,CAAC;gBAClB,MAAM;gBACN,OAAO,EAAE,sBAAsB;gBAC/B,IAAI,EAAE,eAAe;aACtB,CAAC,CAAC;QACL,KAAK,QAAQ;YACX,OAAO,YAAY,CAAC;gBAClB,MAAM,EAAE,MAAM,IAAI,QAAQ;gBAC1B,OAAO,EAAE,eAAe;gBACxB,IAAI,EAAE,QAAQ;aACf,CAAC,CAAC;QACL,KAAK,MAAM;YACT,OAAO,YAAY,CAAC;gBAClB,MAAM;gBACN,OAAO,EAAE,aAAa;gBACtB,IAAI,EAAE,MAAM;aACb,CAAC,CAAC;QACL,KAAK,MAAM;YACT,OAAO,YAAY,CAAC;gBAClB,MAAM;gBACN,OAAO,EAAE,aAAa;gBACtB,IAAI,EAAE,MAAM;aACb,CAAC,CAAC;QACL,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,MAAM,QAAQ,GAAG,sBAAsB,CAAC;gBACtC,IAAI,EAAE,UAAU;gBAChB,OAAO,EAAE,iBAAiB;gBAC1B,MAAM;aACP,CAAC,CAAC;YACH,OAAO,CAAC,CAAC,OAAe,EAAE,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,CAEvD,CAAC;QACJ,CAAC;QACD,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,MAAM,QAAQ,GAAG,sBAAsB,CAAC;gBACtC,IAAI,EAAE,UAAU;gBAChB,OAAO,EAAE,iBAAiB;gBAC1B,MAAM;aACP,CAAC,CAAC;YACH,OAAO,CAAC,CAAC,OAAe,EAAE,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,CAEvD,CAAC;QACJ,CAAC;QACD,KAAK,YAAY,CAAC,CAAC,CAAC;YAClB,MAAM,QAAQ,GAAG,sBAAsB,CAAC;gBACtC,IAAI,EAAE,YAAY;gBAClB,OAAO,EAAE,mBAAmB;gBAC5B,MAAM;aACP,CAAC,CAAC;YACH,OAAO,CAAC,CAAC,OAAe,EAAE,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,CAEvD,CAAC;QACJ,CAAC;QACD,KAAK,YAAY;YACf,wEAAwE;YACxE,gFAAgF;YAChF,oEAAoE;YACpE,MAAM,IAAI,KAAK,CACb,mHAAmH,CACpH,CAAC;QACJ,KAAK,SAAS;YACZ,qFAAqF;YACrF,iEAAiE;YACjE,MAAM,IAAI,KAAK,CACb,iHAAiH,CAClH,CAAC;QACJ,OAAO,CAAC,CAAC,CAAC;YACR,oEAAoE;YACpE,MAAM,WAAW,GAAU,QAAQ,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,qBAAqB,WAAW,EAAE,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;AACH,CAAC;AAED,mEAAmE;AAEnE;;;;;;;;;;GAUG;AACH,MAAM,UAAU,WAAW,CAAC,QAAqB,EAAE,KAAa,EAAE,MAAc;IAC9E,MAAM,gBAAgB,GAAG,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC1D,OAAO,gBAAgB,CAAC,KAAK,CAAkB,CAAC;AAClD,CAAC"}

package/dist/tools/plugins/index.d.ts

@@ -8,6 +8,7 @@
  * Phase 3: gitleaks, shellcheck, markdownlint, lizard (always-on)
  * Phase 4: ruff, bandit, golangci-lint (auto-detect)
  * Phase 5: biome, pmd, psalm, clippy, hadolint (auto-detect)
+ * Phase 6: zizmor (auto-detect — CI/CD security)
  */
 /**
  * Register all default tool plugins with the registry.
@@ -34,4 +35,5 @@ export { ruffPlugin } from './ruff.js';
 export { semgrepPlugin } from './semgrep.js';
 export { shellcheckPlugin } from './shellcheck.js';
 export { trivyPlugin } from './trivy.js';
+export { zizmorPlugin } from './zizmor.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/tools/plugins/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/tools/plugins/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAgDH;;;GAGG;AACH,wBAAgB,sBAAsB,IAAI,IAAI,CAQ7C;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,IAAI,IAAI,CAE1C;AAED,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAErC,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEzC,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/tools/plugins/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAoDH;;;GAGG;AACH,wBAAgB,sBAAsB,IAAI,IAAI,CAQ7C;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,IAAI,IAAI,CAE1C;AAED,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAErC,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEzC,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEzC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC"}

package/dist/tools/plugins/index.js

@@ -8,6 +8,7 @@
  * Phase 3: gitleaks, shellcheck, markdownlint, lizard (always-on)
  * Phase 4: ruff, bandit, golangci-lint (auto-detect)
  * Phase 5: biome, pmd, psalm, clippy, hadolint (auto-detect)
+ * Phase 6: zizmor (auto-detect — CI/CD security)
  */
 import { toolRegistry } from '../registry.js';
 // Phase 4: auto-detect (Python + Go)
@@ -29,6 +30,8 @@ import { ruffPlugin } from './ruff.js';
 import { semgrepPlugin } from './semgrep.js';
 import { shellcheckPlugin } from './shellcheck.js';
 import { trivyPlugin } from './trivy.js';
+// Phase 6: auto-detect (CI/CD security)
+import { zizmorPlugin } from './zizmor.js';
 /** All built-in plugins. Grows as more phases are implemented. */
 const DEFAULT_PLUGINS = [
     // Phase 2: always-on (adapted)
@@ -50,6 +53,8 @@ const DEFAULT_PLUGINS = [
     psalmPlugin,
     clippyPlugin,
     hadolintPlugin,
+    // Phase 6: auto-detect (CI/CD security)
+    zizmorPlugin,
 ];
 let initialized = false;
 /**
@@ -90,4 +95,6 @@ export { ruffPlugin } from './ruff.js';
 export { semgrepPlugin } from './semgrep.js';
 export { shellcheckPlugin } from './shellcheck.js';
 export { trivyPlugin } from './trivy.js';
+// Phase 6
+export { zizmorPlugin } from './zizmor.js';
 //# sourceMappingURL=index.js.map

package/dist/tools/plugins/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/tools/plugins/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,qCAAqC;AACrC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,mCAAmC;AACnC,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,+BAA+B;AAC/B,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,2BAA2B;AAC3B,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEzC,kEAAkE;AAClE,MAAM,eAAe,GAAG;IACtB,+BAA+B;IAC/B,aAAa;IACb,WAAW;IACX,SAAS;IACT,2BAA2B;IAC3B,cAAc;IACd,gBAAgB;IAChB,kBAAkB;IAClB,YAAY;IACZ,qCAAqC;IACrC,UAAU;IACV,YAAY;IACZ,kBAAkB;IAClB,mCAAmC;IACnC,WAAW;IACX,SAAS;IACT,WAAW;IACX,YAAY;IACZ,cAAc;CACf,CAAC;AAEF,IAAI,WAAW,GAAG,KAAK,CAAC;AAExB;;;GAGG;AACH,MAAM,UAAU,sBAAsB;IACpC,IAAI,WAAW;QAAE,OAAO;IAExB,KAAK,MAAM,MAAM,IAAI,eAAe,EAAE,CAAC;QACrC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IAED,WAAW,GAAG,IAAI,CAAC;AACrB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB;IACjC,WAAW,GAAG,KAAK,CAAC;AACtB,CAAC;AAED,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,UAAU;AACV,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,sCAAsC;AACtC,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,UAAU;AACV,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,UAAU;AACV,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/tools/plugins/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,qCAAqC;AACrC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,mCAAmC;AACnC,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,+BAA+B;AAC/B,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,2BAA2B;AAC3B,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,wCAAwC;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,kEAAkE;AAClE,MAAM,eAAe,GAAG;IACtB,+BAA+B;IAC/B,aAAa;IACb,WAAW;IACX,SAAS;IACT,2BAA2B;IAC3B,cAAc;IACd,gBAAgB;IAChB,kBAAkB;IAClB,YAAY;IACZ,qCAAqC;IACrC,UAAU;IACV,YAAY;IACZ,kBAAkB;IAClB,mCAAmC;IACnC,WAAW;IACX,SAAS;IACT,WAAW;IACX,YAAY;IACZ,cAAc;IACd,wCAAwC;IACxC,YAAY;CACb,CAAC;AAEF,IAAI,WAAW,GAAG,KAAK,CAAC;AAExB;;;GAGG;AACH,MAAM,UAAU,sBAAsB;IACpC,IAAI,WAAW;QAAE,OAAO;IAExB,KAAK,MAAM,MAAM,IAAI,eAAe,EAAE,CAAC;QACrC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IAED,WAAW,GAAG,IAAI,CAAC;AACrB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB;IACjC,WAAW,GAAG,KAAK,CAAC;AACtB,CAAC;AAED,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,UAAU;AACV,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,sCAAsC;AACtC,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,UAAU;AACV,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,UAAU;AACV,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,UAAU;AACV,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC"}

package/dist/tools/plugins/zizmor.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Zizmor plugin — GitHub Actions security analysis (auto-detect).
+ *
+ * Scans .github/workflows/*.{yml,yaml} files for security vulnerabilities
+ * including template injection, unpinned actions, and excessive permissions.
+ *
+ * Uses ExecutionContext for DI instead of direct child_process.
+ */
+import type { FindingSeverity, ReviewFinding } from '../../types.js';
+import type { RawToolOutput, ToolDefinition } from '../types.js';
+/**
+ * Map zizmor SARIF severity level to GHAGGA FindingSeverity.
+ * Exported for direct unit testing.
+ */
+export declare function mapZizmorSeverity(level: string, ruleId?: string): FindingSeverity;
+/**
+ * Parse zizmor SARIF v2.1.0 output into ReviewFinding[].
+ * Exported for direct testing with fixture data.
+ */
+export declare function parseZizmorOutput(raw: RawToolOutput, repoDir: string): ReviewFinding[];
+export declare const zizmorPlugin: ToolDefinition;
+//# sourceMappingURL=zizmor.d.ts.map

package/dist/tools/plugins/zizmor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"zizmor.d.ts","sourceRoot":"","sources":["../../../src/tools/plugins/zizmor.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACrE,OAAO,KAAK,EAAoB,aAAa,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAiDnF;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,eAAe,CAKjF;AAID;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,GAAG,aAAa,EAAE,CA4BtF;AAID,eAAO,MAAM,YAAY,EAAE,cAuD1B,CAAC"}