ghagga-core 2.9.1 → 3.0.0

package/dist/pipeline/providers.js

@@ -0,0 +1,163 @@
+/**
+ * Provider resolution helpers for the review pipeline.
+ *
+ * Moved verbatim from pipeline.ts (split-review-pipeline refactor).
+ */
+import { resolveCredentialEnvVar } from '../providers/cli-bridge.js';
+import { createCLIBridgeGenerateFn, createGatewayGenerateFn, createOllamaGenerateFn, } from '../providers/generate-fn.js';
+// ─── Provider Resolution ────────────────────────────────────────
+/**
+ * Determine if AI review is enabled.
+ * Defaults to true for backward compatibility (CLI/Action don't set this).
+ */
+export function resolveAiEnabled(input) {
+    if (input.aiReviewEnabled === false)
+        return false;
+    // If chain is explicitly empty and no single provider, treat as disabled
+    if (input.providerChain && input.providerChain.length === 0 && !input.provider) {
+        console.warn('[ghagga] AI review enabled but provider chain is empty and no single provider — treating as disabled');
+        return false;
+    }
+    return true;
+}
+/**
+ * Resolve the primary provider from chain or flat fields.
+ * Returns the first entry in the chain, or builds one from flat fields.
+ */
+export function resolvePrimaryProvider(input) {
+    if (input.providerChain && input.providerChain.length > 0) {
+        const first = input.providerChain[0];
+        if (first)
+            return first;
+    }
+    // Backward compat: single provider from flat fields
+    if (!input.provider || !input.model || !input.apiKey) {
+        throw new Error('No provider chain and no single provider configured');
+    }
+    return {
+        provider: input.provider,
+        model: input.model,
+        apiKey: input.apiKey,
+    };
+}
+/**
+ * Build the 3-entry ConsensusModelConfig array for the for/against/neutral votes.
+ *
+ * Distribution rules (given a chain of length N):
+ *   N >= 3 : chain[0]→for, chain[1]→against, chain[2]→neutral
+ *   N == 2 : chain[0]→for, chain[1]→against, chain[0]→neutral
+ *   N == 1 : all 3 votes use chain[0]  (same as primary-only)
+ *   N == 0 : all 3 votes use `primary` (backward compat)
+ *
+ * This spreads consensus votes across providers so each vote hits a
+ * different TPM budget instead of all three hammering the same limit.
+ */
+export function buildConsensusModels(chain, primary) {
+    const stances = ['for', 'against', 'neutral'];
+    return stances.map((stance, i) => {
+        const entry = chain && chain.length > 0 ? chain[i % chain.length] : primary;
+        return {
+            provider: entry.provider,
+            model: entry.model,
+            apiKey: entry.apiKey,
+            stance,
+        };
+    });
+}
+/**
+ * Resolve the model name for token budget calculation.
+ */
+export function resolvePrimaryModel(input) {
+    if (input.providerChain && input.providerChain.length > 0) {
+        return input.providerChain[0]?.model ?? 'gpt-4o-mini';
+    }
+    return input.model ?? 'gpt-4o-mini';
+}
+// ─── GenerateTextFn Resolution ──────────────────────────────────
+/**
+ * Create the appropriate GenerateTextFn(s) based on the provider type.
+ *
+ * - cli-bridge: single fn wrapping generateViaCLI
+ * - gateway: one fn per gateway chain entry (for round-robin distribution)
+ * - ollama: single fn wrapping local Ollama OpenAI-compatible API
+ *
+ * Providers that are no longer supported directly (anthropic, openai, etc.)
+ * throw a migration error pointing users to gateway mode.
+ */
+export function resolveGenerateTextFns(input, isCliBridge, isGateway, isOllama) {
+    if (isCliBridge) {
+        // Resolve CLI bridge options from provider chain or flat input fields
+        const cliBridgeEntry = input.providerChain?.[0];
+        const preferredCLI = (cliBridgeEntry?.model ?? input.model) !== 'auto'
+            ? (cliBridgeEntry?.model ?? input.model)
+            : undefined;
+        const cliModel = cliBridgeEntry?.cliModel;
+        // Build credentials from the decrypted API key
+        const decryptedKey = cliBridgeEntry?.apiKey || input.apiKey;
+        const credentialEnvName = resolveCredentialEnvVar(preferredCLI, cliModel);
+        const credentials = {};
+        if (preferredCLI && credentialEnvName && decryptedKey) {
+            credentials[credentialEnvName] = decryptedKey;
+        }
+        return [
+            createCLIBridgeGenerateFn({
+                preferredCLI,
+                cliModel,
+                credentials: Object.keys(credentials).length > 0 ? credentials : undefined,
+            }),
+        ];
+    }
+    if (isGateway) {
+        // Map ALL gateway entries in the chain — one GenerateTextFn per model
+        // for round-robin distribution in workflow/consensus modes
+        const chain = input.providerChain?.filter((e) => e.provider === 'gateway') ?? [];
+        if (chain.length > 0) {
+            // Use gatewayUrl and token from the first entry (shared across all)
+            const gatewayUrl = chain[0]?.gatewayUrl ?? '';
+            const gatewayToken = chain[0]?.apiKey || input.apiKey || '';
+            return chain.map((entry) => {
+                const model = entry.model !== 'auto' ? entry.model : undefined;
+                return createGatewayGenerateFn({
+                    gatewayUrl,
+                    gatewayToken,
+                    model,
+                    project: 'ghagga',
+                });
+            });
+        }
+        // Fallback: single entry from flat input fields
+        return [
+            createGatewayGenerateFn({
+                gatewayUrl: '',
+                gatewayToken: input.apiKey || '',
+                model: input.model !== 'auto' ? input.model : undefined,
+                project: 'ghagga',
+            }),
+        ];
+    }
+    if (isOllama) {
+        const model = input.model && input.model !== 'auto' ? input.model : 'llama3';
+        return [createOllamaGenerateFn(model, input.ollamaBaseURL)];
+    }
+    // Legacy provider migration guard — should never reach here with the narrowed type,
+    // but protects against runtime strings from older configs.
+    const legacyProvider = input.providerChain?.[0]?.provider ?? input.provider ?? 'unknown';
+    throw new Error(`Provider '${legacyProvider}' is no longer supported directly. ` +
+        `Set provider: 'gateway' and configure credentials in mcp-llm-bridge. ` +
+        `See docs/configuration.md#gateway-mode-mcp-llm-bridge`);
+}
+/**
+ * Resolve the effective review mode.
+ *
+ * Diagnostic mode requires direct model access. Ollama provides it
+ * (runDiagnosticReview uses createOllamaGenerateFn); CLI bridge and
+ * gateway do not, so they fall back to simple mode.
+ */
+export function resolveEffectiveMode(mode, isCliBridge, isGateway) {
+    if (mode === 'diagnostic' && (isCliBridge || isGateway)) {
+        return 'simple';
+    }
+    // Fan-out works with all backends (uses generateFns like workflow/consensus)
+    return mode;
+}
+//# sourceMappingURL=providers.js.map

package/dist/pipeline/providers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"providers.js","sourceRoot":"","sources":["../../src/pipeline/providers.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,EACL,yBAAyB,EACzB,uBAAuB,EACvB,sBAAsB,GAEvB,MAAM,6BAA6B,CAAC;AAGrC,mEAAmE;AAEnE;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAkB;IACjD,IAAI,KAAK,CAAC,eAAe,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IAClD,yEAAyE;IACzE,IAAI,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC/E,OAAO,CAAC,IAAI,CACV,sGAAsG,CACvG,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAkB;IACvD,IAAI,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1D,MAAM,KAAK,GAAG,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;QACrC,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;IAC1B,CAAC;IAED,oDAAoD;IACpD,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,KAAK,CAAC,QAA0C;QAC1D,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,oBAAoB,CAClC,KAAuC,EACvC,OAA2B;IAE3B,MAAM,OAAO,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,SAAS,CAAU,CAAC;IAEvD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;QAC/B,MAAM,KAAK,GACT,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAE,KAAK,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,CAAwB,CAAC,CAAC,CAAC,OAAO,CAAC;QACxF,OAAO;YACL,QAAQ,EAAE,KAAK,CAAC,QAA6C;YAC7D,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM;SACP,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAkB;IACpD,IAAI,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1D,OAAO,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,aAAa,CAAC;IACxD,CAAC;IACD,OAAO,KAAK,CAAC,KAAK,IAAI,aAAa,CAAC;AACtC,CAAC;AAED,mEAAmE;AAEnE;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAAkB,EAClB,WAAoB,EACpB,SAAkB,EAClB,QAAiB;IAEjB,IAAI,WAAW,EAAE,CAAC;QAChB,sEAAsE;QACtE,MAAM,cAAc,GAAG,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC;QAChD,MAAM,YAAY,GAChB,CAAC,cAAc,EAAE,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,MAAM;YAC/C,CAAC,CAAC,CAAC,cAAc,EAAE,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC;YACxC,CAAC,CAAC,SAAS,CAAC;QAEhB,MAAM,QAAQ,GAAG,cAAc,EAAE,QAAQ,CAAC;QAE1C,+CAA+C;QAC/C,MAAM,YAAY,GAAG,cAAc,EAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC;QAC5D,MAAM,iBAAiB,GAAG,uBAAuB,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QAC1E,MAAM,WAAW,GAA2B,EAAE,CAAC;QAC/C,IAAI,YAAY,IAAI,iBAAiB,IAAI,YAAY,EAAE,CAAC;YACtD,WAAW,CAAC,iBAAiB,CAAC,GAAG,YAAY,CAAC;QAChD,CAAC;QAED,OAAO;YACL,yBAAyB,CAAC;gBACxB,YAAY;gBACZ,QAAQ;gBACR,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;aAC3E,CAAC;SACH,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,EAAE,CAAC;QACd,sEAAsE;QACtE,2DAA2D;QAC3D,MAAM,KAAK,GAAG,KAAK,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,IAAI,EAAE,CAAC;QAEjF,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,oEAAoE;YACpE,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,UAAU,IAAI,EAAE,CAAC;YAC9C,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,IAAI,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC;YAE5D,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;gBACzB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;gBAC/D,OAAO,uBAAuB,CAAC;oBAC7B,UAAU;oBACV,YAAY;oBACZ,KAAK;oBACL,OAAO,EAAE,QAAQ;iBAClB,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC;QAED,gDAAgD;QAChD,OAAO;YACL,uBAAuB,CAAC;gBACtB,UAAU,EAAE,EAAE;gBACd,YAAY,EAAE,KAAK,CAAC,MAAM,IAAI,EAAE;gBAChC,KAAK,EAAE,KAAK,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;gBACvD,OAAO,EAAE,QAAQ;aAClB,CAAC;SACH,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC7E,OAAO,CAAC,sBAAsB,CAAC,KAAK,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC;IAC9D,CAAC;IAED,oFAAoF;IACpF,2DAA2D;IAC3D,MAAM,cAAc,GAAG,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,IAAI,KAAK,CAAC,QAAQ,IAAI,SAAS,CAAC;IACzF,MAAM,IAAI,KAAK,CACb,aAAa,cAAc,qCAAqC;QAC9D,uEAAuE;QACvE,uDAAuD,CAC1D,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAAgB,EAChB,WAAoB,EACpB,SAAkB;IAElB,IAAI,IAAI,KAAK,YAAY,IAAI,CAAC,WAAW,IAAI,SAAS,CAAC,EAAE,CAAC;QACxD,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,6EAA6E;IAC7E,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/pipeline/results.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Skipped / static-only result builders for the review pipeline.
+ *
+ * Moved verbatim from pipeline.ts (split-review-pipeline refactor).
+ */
+import type { ReviewFinding, ReviewInput, ReviewResult } from '../types.js';
+/**
+ * Whether a static-analysis finding may DRIVE the verdict (i.e. flip it to
+ * FAILED). Static tools scan the whole repo, so a 1-file change can surface
+ * pre-existing findings from unrelated files; those must stay informational
+ * and not fail the review.
+ *
+ * A finding is verdict-driving when it is:
+ *   - an SCA / dependency-vulnerability finding (exempt — see isScaFinding), OR
+ *   - located in one of the changed "affected" files.
+ *
+ * `affectedFiles` is the set of changed (diff) files that survived blast-radius
+ * filtering — a SUBSET of the diff. It does NOT include out-of-diff dependents.
+ * That is intentional: a static finding in an unchanged file is pre-existing and
+ * must not fail the change, even when that file depends on something we touched
+ * (the whole point is to stop failing on unrelated repo-wide debt). When
+ * affectedFiles is undefined or empty we fall back to legacy behavior (every
+ * finding counts) — never silently pass everything.
+ */
+export declare function isVerdictDrivingFinding(f: ReviewFinding, affectedFiles: ReadonlySet<string> | undefined): boolean;
+/**
+ * Create a SKIPPED result when all files are filtered out.
+ */
+export declare function createSkippedResult(input: ReviewInput, startTime: number): ReviewResult;
+/**
+ * Create a result with only static analysis findings (no AI).
+ * Used when AI review is disabled or when all providers fail.
+ */
+export declare function createStaticOnlyResult(staticResult: import('../types.js').StaticAnalysisResult, mode: import('../types.js').ReviewMode, startTime: number, affectedFiles?: readonly string[]): ReviewResult;
+//# sourceMappingURL=results.d.ts.map

package/dist/pipeline/results.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"results.d.ts","sourceRoot":"","sources":["../../src/pipeline/results.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,YAAY,EAAgB,MAAM,aAAa,CAAC;AAc1F;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,uBAAuB,CACrC,CAAC,EAAE,aAAa,EAChB,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,SAAS,GAC7C,OAAO,CAIT;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,GAAG,YAAY,CA2CvF;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,YAAY,EAAE,OAAO,aAAa,EAAE,oBAAoB,EACxD,IAAI,EAAE,OAAO,aAAa,EAAE,UAAU,EACtC,SAAS,EAAE,MAAM,EACjB,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,GAChC,YAAY,CAqCd"}

package/dist/pipeline/results.js

@@ -0,0 +1,122 @@
+/**
+ * Skipped / static-only result builders for the review pipeline.
+ *
+ * Moved verbatim from pipeline.ts (split-review-pipeline refactor).
+ */
+import { initializeDefaultTools } from '../tools/plugins/index.js';
+import { toolRegistry } from '../tools/registry.js';
+import { isToolRegistryEnabled } from '../tools/runner.js';
+/**
+ * Dependency / SCA (software-composition-analysis) findings are EXEMPT from
+ * the changed-file scope filter. They live in lockfiles / manifests
+ * (package-lock.json, go.sum, …) that are usually NOT in the staged diff, yet
+ * a vulnerable transitive dependency is still a real risk for the change. We
+ * match EITHER the `source` (Trivy is the SCA scanner) or the
+ * `dependency-vulnerability` category to be robust against future SCA tools.
+ */
+function isScaFinding(f) {
+    return f.source === 'trivy' || f.category === 'dependency-vulnerability';
+}
+/**
+ * Whether a static-analysis finding may DRIVE the verdict (i.e. flip it to
+ * FAILED). Static tools scan the whole repo, so a 1-file change can surface
+ * pre-existing findings from unrelated files; those must stay informational
+ * and not fail the review.
+ *
+ * A finding is verdict-driving when it is:
+ *   - an SCA / dependency-vulnerability finding (exempt — see isScaFinding), OR
+ *   - located in one of the changed "affected" files.
+ *
+ * `affectedFiles` is the set of changed (diff) files that survived blast-radius
+ * filtering — a SUBSET of the diff. It does NOT include out-of-diff dependents.
+ * That is intentional: a static finding in an unchanged file is pre-existing and
+ * must not fail the change, even when that file depends on something we touched
+ * (the whole point is to stop failing on unrelated repo-wide debt). When
+ * affectedFiles is undefined or empty we fall back to legacy behavior (every
+ * finding counts) — never silently pass everything.
+ */
+export function isVerdictDrivingFinding(f, affectedFiles) {
+    if (isScaFinding(f))
+        return true;
+    if (!affectedFiles || affectedFiles.size === 0)
+        return true;
+    return affectedFiles.has(f.file);
+}
+/**
+ * Create a SKIPPED result when all files are filtered out.
+ */
+export function createSkippedResult(input, startTime) {
+    const primary = input.providerChain?.[0];
+    // Build a dynamic skipped result (legacy keys always present)
+    const skippedToolResult = { status: 'skipped', findings: [], executionTimeMs: 0 };
+    const staticAnalysis = {
+        semgrep: { ...skippedToolResult },
+        trivy: { ...skippedToolResult },
+        cpd: { ...skippedToolResult },
+    };
+    // Collect all tool names for the toolsSkipped metadata
+    const allToolNames = ['semgrep', 'trivy', 'cpd'];
+    // When registry is enabled, include all registered tools as skipped
+    if (isToolRegistryEnabled()) {
+        initializeDefaultTools();
+        for (const tool of toolRegistry.getAll()) {
+            if (!staticAnalysis[tool.name]) {
+                staticAnalysis[tool.name] = { ...skippedToolResult };
+            }
+            if (!allToolNames.includes(tool.name)) {
+                allToolNames.push(tool.name);
+            }
+        }
+    }
+    return {
+        status: 'SKIPPED',
+        summary: 'All files in the diff matched ignore patterns. No review was performed.',
+        findings: [],
+        staticAnalysis,
+        memoryContext: null,
+        metadata: {
+            mode: input.mode,
+            provider: primary?.provider ?? input.provider ?? 'none',
+            model: primary?.model ?? input.model ?? 'unknown',
+            tokensUsed: 0,
+            executionTimeMs: Date.now() - startTime,
+            toolsRun: [],
+            toolsSkipped: allToolNames,
+        },
+    };
+}
+/**
+ * Create a result with only static analysis findings (no AI).
+ * Used when AI review is disabled or when all providers fail.
+ */
+export function createStaticOnlyResult(staticResult, mode, startTime, affectedFiles) {
+    // Determine status from static findings severity (dynamic — all tools)
+    const allFindings = Object.values(staticResult).flatMap((toolResult) => toolResult && typeof toolResult === 'object' && 'findings' in toolResult
+        ? toolResult.findings
+        : []);
+    // Only IN-SCOPE (changed-file) findings + SCA/dependency findings may
+    // drive the verdict. Repo-wide pre-existing findings from unrelated files
+    // stay visible (merged informational in enrich step 7) but do NOT fail it.
+    const affectedSet = affectedFiles && affectedFiles.length > 0 ? new Set(affectedFiles) : undefined;
+    const verdictFindings = allFindings.filter((f) => isVerdictDrivingFinding(f, affectedSet));
+    const hasCriticalOrHigh = verdictFindings.some((f) => f.severity === 'critical' || f.severity === 'high');
+    return {
+        status: hasCriticalOrHigh ? 'FAILED' : 'PASSED',
+        summary: allFindings.length > 0
+            ? `Static analysis found ${allFindings.length} finding(s). AI review was not performed.`
+            : 'Static analysis found no issues. AI review was not performed.',
+        findings: [], // Will be merged in step 7
+        staticAnalysis: staticResult,
+        memoryContext: null,
+        metadata: {
+            mode,
+            provider: 'none',
+            model: 'static-only',
+            tokensUsed: 0,
+            executionTimeMs: Date.now() - startTime,
+            toolsRun: [],
+            toolsSkipped: [],
+        },
+    };
+}
+//# sourceMappingURL=results.js.map

package/dist/pipeline/results.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"results.js","sourceRoot":"","sources":["../../src/pipeline/results.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAG3D;;;;;;;GAOG;AACH,SAAS,YAAY,CAAC,CAAgB;IACpC,OAAO,CAAC,CAAC,MAAM,KAAK,OAAO,IAAI,CAAC,CAAC,QAAQ,KAAK,0BAA0B,CAAC;AAC3E,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,uBAAuB,CACrC,CAAgB,EAChB,aAA8C;IAE9C,IAAI,YAAY,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACjC,IAAI,CAAC,aAAa,IAAI,aAAa,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5D,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AACnC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAkB,EAAE,SAAiB;IACvE,MAAM,OAAO,GAAG,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC;IAEzC,8DAA8D;IAC9D,MAAM,iBAAiB,GAAG,EAAE,MAAM,EAAE,SAAkB,EAAE,QAAQ,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC,EAAE,CAAC;IAC3F,MAAM,cAAc,GAA+C;QACjE,OAAO,EAAE,EAAE,GAAG,iBAAiB,EAAE;QACjC,KAAK,EAAE,EAAE,GAAG,iBAAiB,EAAE;QAC/B,GAAG,EAAE,EAAE,GAAG,iBAAiB,EAAE;KAC9B,CAAC;IAEF,uDAAuD;IACvD,MAAM,YAAY,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAEjD,oEAAoE;IACpE,IAAI,qBAAqB,EAAE,EAAE,CAAC;QAC5B,sBAAsB,EAAE,CAAC;QACzB,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,MAAM,EAAE,EAAE,CAAC;YACzC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC/B,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,iBAAiB,EAAE,CAAC;YACvD,CAAC;YACD,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,MAAM,EAAE,SAAyB;QACjC,OAAO,EAAE,yEAAyE;QAClF,QAAQ,EAAE,EAAE;QACZ,cAAc;QACd,aAAa,EAAE,IAAI;QACnB,QAAQ,EAAE;YACR,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,QAAQ,EAAE,OAAO,EAAE,QAAQ,IAAI,KAAK,CAAC,QAAQ,IAAI,MAAM;YACvD,KAAK,EAAE,OAAO,EAAE,KAAK,IAAI,KAAK,CAAC,KAAK,IAAI,SAAS;YACjD,UAAU,EAAE,CAAC;YACb,eAAe,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;YACvC,QAAQ,EAAE,EAAE;YACZ,YAAY,EAAE,YAAY;SAC3B;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CACpC,YAAwD,EACxD,IAAsC,EACtC,SAAiB,EACjB,aAAiC;IAEjC,uEAAuE;IACvE,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,EAAE,CACrE,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,IAAI,UAAU;QACtE,CAAC,CAAC,UAAU,CAAC,QAAQ;QACrB,CAAC,CAAC,EAAE,CACP,CAAC;IAEF,sEAAsE;IACtE,0EAA0E;IAC1E,2EAA2E;IAC3E,MAAM,WAAW,GACf,aAAa,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACjF,MAAM,eAAe,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC;IAC3F,MAAM,iBAAiB,GAAG,eAAe,CAAC,IAAI,CAC5C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,IAAI,CAAC,CAAC,QAAQ,KAAK,MAAM,CAC1D,CAAC;IAEF,OAAO;QACL,MAAM,EAAE,iBAAiB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;QAC/C,OAAO,EACL,WAAW,CAAC,MAAM,GAAG,CAAC;YACpB,CAAC,CAAC,yBAAyB,WAAW,CAAC,MAAM,2CAA2C;YACxF,CAAC,CAAC,+DAA+D;QACrE,QAAQ,EAAE,EAAE,EAAE,2BAA2B;QACzC,cAAc,EAAE,YAAY;QAC5B,aAAa,EAAE,IAAI;QACnB,QAAQ,EAAE;YACR,IAAI;YACJ,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,aAAa;YACpB,UAAU,EAAE,CAAC;YACb,eAAe,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;YACvC,QAAQ,EAAE,EAAE;YACZ,YAAY,EAAE,EAAE;SACjB;KACF,CAAC;AACJ,CAAC"}

package/dist/pipeline/state.d.ts

@@ -0,0 +1,92 @@
+/**
+ * Shared pipeline state threaded through the review pipeline phases.
+ *
+ * A single mutable `PipelineState` object is created by the orchestrator
+ * and passed to each phase (`prepare → gather-context → execute → enrich
+ * → finalize`). Phases mutate it in-place — `state.result` is the SAME
+ * `ReviewResult` object the phases mutate directly, preserving the
+ * read-your-writes semantics of the original monolithic pipeline
+ * (e.g. exploitability mutates findings in-place; the step-7.4 gate
+ * reads `result.findings.length` populated by the step-7 merge).
+ */
+import type { ChecklistConfig } from '../checklist/index.js';
+import type { CodeIntelMetadata, CodeIntelResult } from '../code-intel/types.js';
+import type { EnhanceMetadata } from '../enhance/types.js';
+import type { BlastRadiusMetadata } from '../graph/schema.js';
+import type { ProgressEvent, ReviewFinding, ReviewInput, ReviewMode, ReviewResult, StaticAnalysisResult } from '../types.js';
+import type { DiffFile } from '../utils/diff.js';
+/**
+ * A pipeline step that failed but was gracefully degraded.
+ * Derived from `ReviewResult['failedSteps']` so the internal accumulator
+ * and the public result shape can never drift apart.
+ */
+export type FailedStep = NonNullable<ReviewResult['failedSteps']>[number];
+/**
+ * Pipeline state WITHOUT `result` — the shape available to phases that
+ * run BEFORE the dispatch creates the `ReviewResult` (prepare,
+ * gather-context, execute). `execute` RETURNS the result; the
+ * orchestrator attaches it via `Object.assign(base, { result })` —
+ * same object, no copy — upgrading the base to a full `PipelineState`
+ * for enrich/finalize. This keeps `result` non-optional downstream.
+ */
+export interface PipelineStateBase {
+    readonly input: ReviewInput;
+    readonly startTime: number;
+    readonly emit: (event: ProgressEvent) => void;
+    readonly aiEnabled: boolean;
+    /** All files parsed from the raw diff (pre-filtering). */
+    readonly allFiles: DiffFile[];
+    /**
+     * ⚠️ LOAD-BEARING: captured PRE-blast-radius (right after ignore-pattern
+     * filtering, BEFORE the blast-radius filter narrows `filteredFiles`).
+     * Consumed by call-chain, static analysis, code-intel and
+     * negative-examples — they must see the PRE-filter list.
+     * Do NOT recompute from `filteredFiles`.
+     * Note: `result.metadata.fileList` is built from `allFiles` instead —
+     * a different list. Preserve both as-is.
+     */
+    readonly fileList: string[];
+    filteredFiles: DiffFile[];
+    filteredDiff: string;
+    blastRadiusMetadata?: BlastRadiusMetadata;
+    callChainContext: string;
+    stacks: string[];
+    stackHints: string;
+    truncatedDiff: string;
+    diffBudget: number;
+    contextBudget: number;
+    staticResult: StaticAnalysisResult;
+    rawMemoryContext: string | null;
+    codeIntelResults: CodeIntelResult[];
+    codeIntelMetadata?: CodeIntelMetadata;
+    staticContext: string;
+    memoryContext: string | null;
+    codeIntelContext: string;
+    checklistContext: string;
+    resolvedChecklist: ChecklistConfig | null;
+    negativeExamplesPrompt: string;
+    selfImproveRulesPrompt: string;
+    activeProvider: string;
+    isCliBridge: boolean;
+    isGateway: boolean;
+    isOllama: boolean;
+    enhancedStaticFindings?: ReviewFinding[];
+    enhanceMetadata?: EnhanceMetadata;
+    trustOverrideMode?: ReviewMode;
+    resolvedInputMode: ReviewMode;
+    failedSteps: FailedStep[];
+    /**
+     * Step names of warn-only degradations (`runDegradable` with
+     * `reportFailure: false` — call-chain, negative-examples, self-improve,
+     * semantic-diff).
+     * These steps degrade WITHOUT entering `failedSteps` (no PARTIAL
+     * downgrade, no wire exposure of the step names), but they still count
+     * against `coverageComplete` — the signal must tell the WHOLE truth
+     * about coverage, tracked or not (see pipeline/finalize.ts).
+     */
+    warnOnlyDegradations: string[];
+}
+export interface PipelineState extends PipelineStateBase {
+    result: ReviewResult;
+}
+//# sourceMappingURL=state.d.ts.map

package/dist/pipeline/state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"state.d.ts","sourceRoot":"","sources":["../../src/pipeline/state.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACjF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,KAAK,EACV,aAAa,EACb,aAAa,EACb,WAAW,EACX,UAAU,EACV,YAAY,EACZ,oBAAoB,EACrB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAEjD;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAAG,WAAW,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1E;;;;;;;GAOG;AACH,MAAM,WAAW,iBAAiB;IAEhC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,CAAC;IAC9C,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAG5B,0DAA0D;IAC1D,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,CAAC;IAC9B;;;;;;;;OAQG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAI5B,aAAa,EAAE,QAAQ,EAAE,CAAC;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C,gBAAgB,EAAE,MAAM,CAAC;IACzB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IAMtB,YAAY,EAAE,oBAAoB,CAAC;IACnC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,gBAAgB,EAAE,eAAe,EAAE,CAAC;IACpC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,eAAe,GAAG,IAAI,CAAC;IAC1C,sBAAsB,EAAE,MAAM,CAAC;IAC/B,sBAAsB,EAAE,MAAM,CAAC;IAI/B,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,OAAO,CAAC;IACrB,SAAS,EAAE,OAAO,CAAC;IACnB,QAAQ,EAAE,OAAO,CAAC;IAGlB,sBAAsB,CAAC,EAAE,aAAa,EAAE,CAAC;IACzC,eAAe,CAAC,EAAE,eAAe,CAAC;IAKlC,iBAAiB,CAAC,EAAE,UAAU,CAAC;IAC/B,iBAAiB,EAAE,UAAU,CAAC;IAE9B,WAAW,EAAE,UAAU,EAAE,CAAC;IAE1B;;;;;;;;OAQG;IACH,oBAAoB,EAAE,MAAM,EAAE,CAAC;CAChC;AAED,MAAM,WAAW,aAAc,SAAQ,iBAAiB;IAGtD,MAAM,EAAE,YAAY,CAAC;CACtB"}

package/dist/pipeline/state.js

@@ -0,0 +1,13 @@
+/**
+ * Shared pipeline state threaded through the review pipeline phases.
+ *
+ * A single mutable `PipelineState` object is created by the orchestrator
+ * and passed to each phase (`prepare → gather-context → execute → enrich
+ * → finalize`). Phases mutate it in-place — `state.result` is the SAME
+ * `ReviewResult` object the phases mutate directly, preserving the
+ * read-your-writes semantics of the original monolithic pipeline
+ * (e.g. exploitability mutates findings in-place; the step-7.4 gate
+ * reads `result.findings.length` populated by the step-7 merge).
+ */
+export {};
+//# sourceMappingURL=state.js.map

package/dist/pipeline/state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"state.js","sourceRoot":"","sources":["../../src/pipeline/state.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG"}

package/dist/pipeline.d.ts

@@ -1,15 +1,16 @@
 /**
  * Main review pipeline orchestrator.
  *
- * Coordinates the entire review flow:
- *   1. Validate input
- *   2. Parse and filter the diff
- *   3. Detect tech stacks
- *   4. Run static analysis tools
- *   5. Search memory for past context
- *   6. Execute the selected agent mode
- *   7. Persist new observations to memory
- *   8. Return the final result
+ * Coordinates the entire review flow as a thin sequence of phases
+ * (each phase lives in `pipeline/` and shares a single mutable
+ * `PipelineState` — see `pipeline/state.ts`):
+ *
+ *   prepare        → validate, parse/filter diff, flood check,
+ *                    blast-radius, call-chain, stacks, token budget
+ *   gather-context → static analysis ∥ memory ∥ code-intel + prompts
+ *   execute        → enhance compute, trust scoring, agent dispatch
+ *   enrich         → merge findings + post-processing (7 → 7.8)
+ *   finalize       → persist to memory + status downgrade
  *
  * Each step degrades gracefully — if static analysis fails, or
  * memory is unavailable, the pipeline continues with what it has.

package/dist/pipeline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pipeline.d.ts","sourceRoot":"","sources":["../src/pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AA8CH,OAAO,KAAK,EAIV,WAAW,EAEX,YAAY,EAEb,MAAM,YAAY,CAAC;AAqEpB;;;;;;;;;;GAUG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAy5B9E"}
+{"version":3,"file":"pipeline.d.ts","sourceRoot":"","sources":["../src/pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAQH,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE5D;;;;;;;;;;GAUG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CA4B9E"}