guardlink 1.4.1 → 1.4.3

package/dist/agents/prompts.js.map

@@ -1 +1 @@
-{"version":3,"file":"prompts.js","sourceRoot":"","sources":["../../src/agents/prompts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGpC;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,UAAkB,EAClB,IAAY,EACZ,KAAyB;IAEzB,sCAAsC;IACtC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,YAAY,EAAE,wBAAwB,CAAC,CAAC;IACtE,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,MAAM,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC1C,CAAC;IACD,2CAA2C;IAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,wBAAwB,CAAC,CAAC;QACpE,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAC5B,MAAM,GAAG,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAED,IAAI,YAAY,GAAG,uGAAuG,CAAC;IAC3H,IAAI,WAAW,GAAG,EAAE,CAAC;IACrB,IAAI,aAAa,GAAG,EAAE,CAAC;IACvB,IAAI,iBAAiB,GAAG,EAAE,CAAC;IAC3B,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,KAAK,GAAG;YACZ,GAAG,KAAK,CAAC,kBAAkB,cAAc;YACzC,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,YAAY;YACrC,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,SAAS;YAC/B,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,UAAU;YACjC,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,WAAW;YACnC,GAAG,KAAK,CAAC,WAAW,CAAC,MAAM,cAAc;YACzC,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,QAAQ;YAC7B,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,aAAa;SACxC,CAAC;QACF,YAAY,GAAG,kBAAkB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;QAErD,+EAA+E;QAC/E,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACvE,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACrE,MAAM,UAAU,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACzE,IAAI,SAAS,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/D,MAAM,QAAQ,GAAa,EAAE,CAAC;YAC9B,IAAI,QAAQ,CAAC,MAAM;gBAAE,QAAQ,CAAC,IAAI,CAAC,WAAW,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACrE,IAAI,SAAS,CAAC,MAAM;gBAAE,QAAQ,CAAC,IAAI,CAAC,YAAY,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACxE,IAAI,UAAU,CAAC,MAAM;gBAAE,QAAQ,CAAC,IAAI,CAAC,aAAa,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC3E,WAAW,GAAG,8DAA8D,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACpG,CAAC;QAED,qEAAqE;QACrE,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CACjD,KAAK,CAAC,CAAC,MAAM,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,CAClH,CAAC;YACF,aAAa,GAAG,6DAA6D,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACpG,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,EAAE;gBAAE,aAAa,IAAI,eAAe,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,EAAE,OAAO,CAAC;QAC9F,CAAC;QAED,0EAA0E;QAC1E,8FAA8F;QAC9F,MAAM,oBAAoB,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;YACtD,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC;QACpF,CAAC,CAAC,CAAC;QACH,IAAI,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpC,MAAM,QAAQ,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CACzD,KAAK,CAAC,CAAC,KAAK,eAAe,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,QAAQ,IAAI,SAAS,MAAM,CAAC,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,CAC3G,CAAC;YACF,iBAAiB,GAAG,yHAAyH,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACnK,IAAI,oBAAoB,CAAC,MAAM,GAAG,EAAE;gBAAE,iBAAiB,IAAI,eAAe,oBAAoB,CAAC,MAAM,GAAG,EAAE,OAAO,CAAC;QACpH,CAAC;IACH,CAAC;IAED,OAAO;;;;;;EAMP,MAAM,CAAC,CAAC,CAAC,gDAAgD,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE;EAC/F,YAAY,GAAG,WAAW,GAAG,aAAa,GAAG,iBAAiB;;;EAG9D,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2PX,CAAC;AACF,CAAC"}
+{"version":3,"file":"prompts.js","sourceRoot":"","sources":["../../src/agents/prompts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAGlC,yEAAyE;AACzE,6EAA6E;AAC7E,uEAAuE;AACvE,6EAA6E;AAC7E,sEAAsE;AACtE,MAAM,gBAAgB,GAAG,OAAO,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;AACpF,MAAM,wBAAwB,GAAG,OAAO,CAAC,gBAAgB,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;AAEpF,SAAS,YAAY,CAAC,IAAY,EAAE,QAAQ,GAAG,IAAI;IACjD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAID,SAAS,mBAAmB,CAAC,IAAoB;IAC/C,OAAO,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,wBAAwB,CAAC;AACpF,CAAC;AAED,SAAS,0BAA0B,CAAC,IAAoB;IACtD,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QACxB,OAAO;;;;;;;;;CASV,CAAC;IACA,CAAC;IAED,OAAO;;;;;;CAMR,CAAC;AACF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,UAAkB,EAClB,IAAY,EACZ,KAAyB,EACzB,iBAAiC,QAAQ;IAEzC,sCAAsC;IACtC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,YAAY,EAAE,wBAAwB,CAAC,CAAC;IACtE,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,MAAM,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC1C,CAAC;IACD,2CAA2C;IAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,wBAAwB,CAAC,CAAC;QACpE,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAC5B,MAAM,GAAG,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAED,IAAI,YAAY,GAAG,uGAAuG,CAAC;IAC3H,IAAI,WAAW,GAAG,EAAE,CAAC;IACrB,IAAI,aAAa,GAAG,EAAE,CAAC;IACvB,IAAI,iBAAiB,GAAG,EAAE,CAAC;IAC3B,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,KAAK,GAAG;YACZ,GAAG,KAAK,CAAC,kBAAkB,cAAc;YACzC,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,YAAY;YACrC,GAAG,CAAC,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,wBAAwB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAClG,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,SAAS;YAC/B,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,UAAU;YACjC,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,WAAW;YACnC,GAAG,KAAK,CAAC,WAAW,CAAC,MAAM,cAAc;YACzC,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,QAAQ;YAC7B,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,aAAa;SACxC,CAAC;QACF,YAAY,GAAG,kBAAkB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;QAErD,+EAA+E;QAC/E,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACvE,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACrE,MAAM,UAAU,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACzE,IAAI,SAAS,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/D,MAAM,QAAQ,GAAa,EAAE,CAAC;YAC9B,IAAI,QAAQ,CAAC,MAAM;gBAAE,QAAQ,CAAC,IAAI,CAAC,WAAW,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACrE,IAAI,SAAS,CAAC,MAAM;gBAAE,QAAQ,CAAC,IAAI,CAAC,YAAY,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACxE,IAAI,UAAU,CAAC,MAAM;gBAAE,QAAQ,CAAC,IAAI,CAAC,aAAa,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC3E,WAAW,GAAG,8DAA8D,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACpG,CAAC;QAED,qEAAqE;QACrE,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CACjD,KAAK,CAAC,CAAC,MAAM,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,CAClH,CAAC;YACF,aAAa,GAAG,6DAA6D,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACpG,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,EAAE;gBAAE,aAAa,IAAI,eAAe,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,EAAE,OAAO,CAAC;QAC9F,CAAC;QAED,0EAA0E;QAC1E,8FAA8F;QAC9F,MAAM,oBAAoB,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;YACtD,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC;QACpF,CAAC,CAAC,CAAC;QACH,IAAI,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpC,MAAM,QAAQ,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CACzD,KAAK,CAAC,CAAC,KAAK,eAAe,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,QAAQ,IAAI,SAAS,MAAM,CAAC,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,CAC3G,CAAC;YACF,iBAAiB,GAAG,yHAAyH,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACnK,IAAI,oBAAoB,CAAC,MAAM,GAAG,EAAE;gBAAE,iBAAiB,IAAI,eAAe,oBAAoB,CAAC,MAAM,GAAG,EAAE,OAAO,CAAC;QACpH,CAAC;IACH,CAAC;IAED,OAAO;;uCAE8B,mBAAmB,CAAC,cAAc,CAAC;;;;;EAKxE,MAAM,CAAC,CAAC,CAAC,gDAAgD,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE;EAC/F,YAAY,GAAG,WAAW,GAAG,aAAa,GAAG,iBAAiB;;;EAG9D,UAAU;;EAEV,0BAA0B,CAAC,cAAc,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAwG1C,cAAc,KAAK,UAAU;QAC3B,CAAC,CAAC,8GAA8G;QAChH,CAAC,CAAC,kGAAkG;;;EAGtG,cAAc,KAAK,UAAU;QAC3B,CAAC,CAAC;YACE,4EAA4E;YAC5E,4DAA4D;YAC5D,4FAA4F;YAC5F,yGAAyG;YACzG,8DAA8D;YAC9D,EAAE;YACF,4DAA4D;YAC5D,yDAAyD;YACzD,aAAa;SACd,CAAC,IAAI,CAAC,IAAI,CAAC;QACd,CAAC,CAAC;YACE,iEAAiE;YACjE,IAAI;YACJ,sEAAsE;YACtE,gGAAgG;YAChG,IAAI;YACJ,gFAAgF;YAChF,wFAAwF;YACxF,yEAAyE;YACzE,IAAI;YACJ,gBAAgB;SACjB,CAAC,IAAI,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAwKjB,CAAC;AACF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,UAAkB,EAClB,IAAY,EACZ,KAAyB;IAEzB,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,gBAAgB,CAAC;IACnE,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,IAAI,wBAAwB,CAAC;IAEvF,MAAM,aAAa,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,mBAAmB,CAAC,EAAE,IAAI,CAAC,CAAC;IACxF,yEAAyE;IACzE,uEAAuE;IACvE,yEAAyE;IACzE,sEAAsE;IACtE,0EAA0E;IAC1E,MAAM,YAAY,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,CAAC,EAAE,IAAI,CAAC,CAAC;IACpF,MAAM,YAAY,GAAG,YAAY,CAAC,OAAO,CAAC,WAAW,EAAE,6BAA6B,CAAC,EAAE,IAAI,CAAC,CAAC;IAC7F,MAAM,cAAc,GAAG,YAAY,CAAC,OAAO,CAAC,WAAW,EAAE,6BAA6B,CAAC,EAAE,IAAI,CAAC,CAAC;IAE/F,IAAI,YAAY,GAAG,6BAA6B,CAAC;IACjD,IAAI,kBAAkB,GAAG,EAAE,CAAC;IAC5B,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,WAAW,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAC/C,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,CAAC,CAC7E,CAAC;QAEF,YAAY,GAAG,kBAAkB,KAAK,CAAC,kBAAkB,iBAAiB,KAAK,CAAC,SAAS,CAAC,MAAM,eAAe,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,MAAM,eAAe,WAAW,CAAC,MAAM,2BAA2B,KAAK,CAAC,MAAM,CAAC,MAAM,YAAY,KAAK,CAAC,OAAO,CAAC,MAAM,WAAW,CAAC;QACxQ,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC/C,KAAK,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,QAAQ,IAAI,SAAS,MAAM,CAAC,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,CACnG,CAAC;YACF,kBAAkB,GAAG,yCAAyC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACjF,IAAI,WAAW,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;gBAC5B,kBAAkB,IAAI,eAAe,WAAW,CAAC,MAAM,GAAG,EAAE,OAAO,CAAC;YACtE,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,WAAW,GAAG,UAAU,CAAC,IAAI,EAAE;QACnC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE;QACnB,CAAC,CAAC,sGAAsG,CAAC;IAE3G,OAAO;;;;;;EAMP,YAAY,GAAG,kBAAkB;;;EAGjC,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA2CX,aAAa,CAAC,CAAC,CAAC,+BAA+B,aAAa,IAAI,CAAC,CAAC,CAAC,EAAE;EACrE,YAAY,CAAC,CAAC,CAAC,0BAA0B,YAAY,IAAI,CAAC,CAAC,CAAC,EAAE;EAC9D,YAAY,CAAC,CAAC,CAAC,8BAA8B,YAAY,IAAI,CAAC,CAAC,CAAC,EAAE;EAClE,cAAc,CAAC,CAAC,CAAC,gCAAgC,cAAc,IAAI,CAAC,CAAC,CAAC,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2CAyP/B,CAAC;AAC5C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAC5B,SAAiB,EACjB,IAAY,EACZ,KAAyB;IAEzB,IAAI,YAAY,GAAG,6BAA6B,CAAC;IACjD,IAAI,SAAS,GAAG,EAAE,CAAC;IACnB,IAAI,eAAe,GAAG,EAAE,CAAC;IACzB,IAAI,KAAK,EAAE,CAAC;QACV,YAAY,GAAG,kBAAkB,KAAK,CAAC,kBAAkB,iBAAiB,KAAK,CAAC,SAAS,CAAC,MAAM,eAAe,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,MAAM,eAAe,KAAK,CAAC,WAAW,CAAC,MAAM,iBAAiB,KAAK,CAAC,MAAM,CAAC,MAAM,YAAY,KAAK,CAAC,OAAO,CAAC,MAAM,aAAa,KAAK,CAAC,KAAK,CAAC,MAAM,SAAS,CAAC;QAEjS,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAClF,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACpF,MAAM,UAAU,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACtF,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,IAAI,QAAQ,CAAC,MAAM;YAAE,OAAO,CAAC,IAAI,CAAC,WAAW,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpE,IAAI,SAAS,CAAC,MAAM;YAAE,OAAO,CAAC,IAAI,CAAC,YAAY,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACvE,IAAI,UAAU,CAAC,MAAM;YAAE,OAAO,CAAC,IAAI,CAAC,aAAa,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC1E,IAAI,OAAO,CAAC,MAAM;YAAE,SAAS,GAAG,mBAAmB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAExE,MAAM,WAAW,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAC/C,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,CAAC,CAC7E,CAAC;QACF,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC/C,KAAK,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,QAAQ,IAAI,SAAS,MAAM,CAAC,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,CACnG,CAAC;YACF,eAAe,GAAG,oCAAoC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACzE,IAAI,WAAW,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;gBAC5B,eAAe,IAAI,eAAe,WAAW,CAAC,MAAM,GAAG,EAAE,OAAO,CAAC;YACnE,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;;;EAGP,IAAI;;;EAGJ,YAAY,GAAG,SAAS,GAAG,eAAe;;;EAG1C,SAAS;;;;;;;;;;;;;;;;CAgBV,CAAC;AACF,CAAC"}

package/dist/analyze/format.d.ts

@@ -0,0 +1,72 @@
+/**
+ * GuardLink — Pentest finding format helpers.
+ *
+ * Defensive normalizers for fields whose shape varies across CXG versions
+ * and template authors. Keep these tiny and pure — no I/O, no side effects.
+ */
+/**
+ * Render a confidence value for display, regardless of how the upstream
+ * scanner emitted it.
+ *
+ * CXG output has historically emitted confidence in three different shapes:
+ *   - integer percentage (most current versions): `50` → `"50%"`
+ *   - severity-style string (some templates pre-normalization): `"high"` → `"HIGH"`
+ *   - missing / null / undefined (older or partial scans): → `"—"`
+ *
+ * Returns a display string that's safe to drop into HTML or terminal output.
+ * Never throws — always returns *something* renderable.
+ */
+export declare function formatConfidence(value: unknown): string;
+/**
+ * Mirrors the shape of the `evidence` slot on a PentestFinding without
+ * pulling the full PentestFinding type from src/analyze/index.ts (would
+ * create a circular import). Any object matching this structural shape
+ * can be passed to redactEvidence().
+ */
+export interface EvidenceLike {
+    request: string | null;
+    response: string | null;
+    matched_patterns: string[];
+    data: Record<string, unknown>;
+    timestamp?: string;
+}
+/**
+ * Surgical redactor for sensitive tokens. Designed to preserve the
+ * confirmation evidence of a pentest finding while removing material that
+ * would enable replay attacks if a screenshot or exported HTML escaped the
+ * customer's perimeter.
+ *
+ * The principle: redact what enables replay, keep what proves the exploit.
+ *
+ * Patterns:
+ *   - JWT (eyJ-prefixed three-segment): keep header and payload (the
+ *     claims — these are the proof of what role/scope/sub was achieved),
+ *     replace the signature segment with `<signature-redacted>`. Anyone
+ *     screenshotting can still decode the payload at jwt.io to see the
+ *     claims; nobody can replay the token because the signature is gone.
+ *   - Authorization: Bearer <jwt>: same JWT split rule.
+ *   - Authorization: Bearer <opaque>: show first 4 + last 4 chars only,
+ *     enough for correlation/fingerprinting but not replay.
+ *   - Authorization: Basic|Digest|NTLM <value>: fully replace value with
+ *     `<redacted>`. These ARE the credential — no useful prefix.
+ *   - JSON credential fields (password, api_key, access_token, etc.):
+ *     keep field name (structural proof that the request used this
+ *     credential type), replace value with `<redacted>`.
+ *   - Query-string credentials: same — keep field name, redact value.
+ *   - Cookie / Set-Cookie values: keep cookie name (proves session-based
+ *     auth was used), redact value.
+ *
+ * Idempotent: re-running on already-redacted output is a no-op since the
+ * redaction markers themselves don't match any of the input patterns.
+ *
+ * Returns input unchanged for null / undefined / empty / non-string.
+ */
+export declare function redactSensitiveTokens(text: string | null | undefined): string | null | undefined;
+/**
+ * Redacts an entire `evidence` object — request, response, and the
+ * unstructured `data` field. Returns a new object; does not mutate the
+ * input. Non-string fields (matched_patterns, timestamp) pass through
+ * unchanged since they don't carry secret material.
+ */
+export declare function redactEvidence(ev: EvidenceLike): EvidenceLike;
+//# sourceMappingURL=format.d.ts.map

package/dist/analyze/format.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"format.d.ts","sourceRoot":"","sources":["../../src/analyze/format.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CA8BvD;AAYD;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,CAsEhG;AAgCD;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,EAAE,EAAE,YAAY,GAAG,YAAY,CAQ7D"}

package/dist/analyze/format.js

@@ -0,0 +1,176 @@
+/**
+ * GuardLink — Pentest finding format helpers.
+ *
+ * Defensive normalizers for fields whose shape varies across CXG versions
+ * and template authors. Keep these tiny and pure — no I/O, no side effects.
+ */
+/**
+ * Render a confidence value for display, regardless of how the upstream
+ * scanner emitted it.
+ *
+ * CXG output has historically emitted confidence in three different shapes:
+ *   - integer percentage (most current versions): `50` → `"50%"`
+ *   - severity-style string (some templates pre-normalization): `"high"` → `"HIGH"`
+ *   - missing / null / undefined (older or partial scans): → `"—"`
+ *
+ * Returns a display string that's safe to drop into HTML or terminal output.
+ * Never throws — always returns *something* renderable.
+ */
+export function formatConfidence(value) {
+    if (value === null || value === undefined || value === '')
+        return '—';
+    if (typeof value === 'number' && Number.isFinite(value)) {
+        // Clamp into [0, 100] so a malformed `150` doesn't print "150%".
+        const clamped = Math.max(0, Math.min(100, Math.round(value)));
+        return `${clamped}%`;
+    }
+    if (typeof value === 'string') {
+        const trimmed = value.trim();
+        if (!trimmed)
+            return '—';
+        // String might still be numeric: "50" or "50%"
+        const numericMatch = trimmed.match(/^(-?\d+(?:\.\d+)?)\s*%?$/);
+        if (numericMatch) {
+            const n = Number.parseFloat(numericMatch[1]);
+            if (Number.isFinite(n)) {
+                const clamped = Math.max(0, Math.min(100, Math.round(n)));
+                return `${clamped}%`;
+            }
+        }
+        // Severity-word style — uppercase for visual weight, no other transform.
+        return trimmed.toUpperCase();
+    }
+    // Anything else (boolean, object, array) — render the placeholder rather
+    // than letting `[object Object]` leak into the dashboard.
+    return '—';
+}
+/* ── Evidence redaction (bug #11) ──────────────────────────────────── */
+/** Credential field-name pattern used for both string-form (JSON / query
+ *  string) matching and object-form key inspection. Includes bare `token`
+ *  because it's a common session/CSRF/auth token name. */
+const CREDENTIAL_FIELD_PATTERN = '(?:password|passwd|pwd|secret|api[_-]?key|apiKey|access[_-]?token|accessToken|refresh[_-]?token|refreshToken|token)';
+/** Regex form for key-name testing — anchored, case-insensitive. */
+const CREDENTIAL_KEY_RE = new RegExp(`^${CREDENTIAL_FIELD_PATTERN}$`, 'i');
+/**
+ * Surgical redactor for sensitive tokens. Designed to preserve the
+ * confirmation evidence of a pentest finding while removing material that
+ * would enable replay attacks if a screenshot or exported HTML escaped the
+ * customer's perimeter.
+ *
+ * The principle: redact what enables replay, keep what proves the exploit.
+ *
+ * Patterns:
+ *   - JWT (eyJ-prefixed three-segment): keep header and payload (the
+ *     claims — these are the proof of what role/scope/sub was achieved),
+ *     replace the signature segment with `<signature-redacted>`. Anyone
+ *     screenshotting can still decode the payload at jwt.io to see the
+ *     claims; nobody can replay the token because the signature is gone.
+ *   - Authorization: Bearer <jwt>: same JWT split rule.
+ *   - Authorization: Bearer <opaque>: show first 4 + last 4 chars only,
+ *     enough for correlation/fingerprinting but not replay.
+ *   - Authorization: Basic|Digest|NTLM <value>: fully replace value with
+ *     `<redacted>`. These ARE the credential — no useful prefix.
+ *   - JSON credential fields (password, api_key, access_token, etc.):
+ *     keep field name (structural proof that the request used this
+ *     credential type), replace value with `<redacted>`.
+ *   - Query-string credentials: same — keep field name, redact value.
+ *   - Cookie / Set-Cookie values: keep cookie name (proves session-based
+ *     auth was used), redact value.
+ *
+ * Idempotent: re-running on already-redacted output is a no-op since the
+ * redaction markers themselves don't match any of the input patterns.
+ *
+ * Returns input unchanged for null / undefined / empty / non-string.
+ */
+export function redactSensitiveTokens(text) {
+    if (text === null || text === undefined || text === '')
+        return text;
+    if (typeof text !== 'string')
+        return text;
+    let result = text;
+    // 1. JWTs: keep header.payload, redact signature.
+    //    The \b anchors ensure dotted identifiers like App.Auth.Login don't match.
+    result = result.replace(/\b(eyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+)\.[A-Za-z0-9_-]+\b/g, '$1.<signature-redacted>');
+    // 2. Authorization: Bearer <opaque token> (NOT a JWT — the JWT case was
+    //    handled in step 1 already, so any Bearer value here is either opaque
+    //    or a partial/malformed JWT). Negative lookahead `(?!eyJ)` skips
+    //    JWT-shaped values. Min length 8 to avoid matching nothing-tokens.
+    result = result.replace(/(Authorization:\s*Bearer\s+)(?!eyJ)([A-Za-z0-9_\-\.=]{8,})/gi, (_match, prefix, token) => {
+        // First 4 + last 4 chars: fingerprint for correlation, no replay value.
+        const fingerprint = token.length > 12
+            ? `${token.slice(0, 4)}...${token.slice(-4)}`
+            : '...';
+        return `${prefix}${fingerprint} <bearer-redacted>`;
+    });
+    // 3. Authorization: Basic / Digest / NTLM <value> — full redact.
+    //    Match the whole value through to the end of the header line so multi-
+    //    word Digest values (e.g. `Digest username="x", response="y"`) are
+    //    redacted entirely, not just up to the first whitespace.
+    result = result.replace(/(Authorization:\s*(?:Basic|Digest|NTLM)\s+)[^\r\n]+/gi, (_match, prefix) => `${prefix}<redacted>`);
+    // 4. JSON credential fields: keep field name, redact value.
+    //    Supports both snake_case (api_key) and camelCase (apiKey) variants.
+    //    The value character class excludes `<` so values that already contain
+    //    a redaction marker (e.g. a JWT split in step 1 produced
+    //    `"token":"eyJ.eyJ.<signature-redacted>"`) don't get over-redacted —
+    //    we'd otherwise wipe the preserved JWT payload here.
+    const credentialFieldNames = CREDENTIAL_FIELD_PATTERN;
+    result = result.replace(new RegExp(`("${credentialFieldNames}"\\s*:\\s*")(?:[^"\\\\<]|\\\\.)*(")`, 'gi'), (_match, prefix, suffix) => `${prefix}<redacted>${suffix}`);
+    // 5. Query-string credentials: name=value pairs.
+    //    Stops at the typical separators (& ; whitespace , " ').
+    result = result.replace(new RegExp(`(\\b${credentialFieldNames}=)[^&\\s;,"']+`, 'gi'), (_match, prefix) => `${prefix}<redacted>`);
+    // 6. Cookie values: keep cookie name (the structural proof that
+    //    cookie-based auth was used), redact value. Handles both `Set-Cookie:`
+    //    response headers (with attributes like Path=, HttpOnly) and `Cookie:`
+    //    request headers (semicolon-separated name=value pairs).
+    result = result.replace(/(Set-Cookie:\s*[^=;\s]+=)[^;\r\n]+/gi, (_match, prefix) => `${prefix}<redacted>`);
+    result = result.replace(/(Cookie:\s*[^=;\s]+=)[^;\r\n]+/gi, (_match, prefix) => `${prefix}<redacted>`);
+    return result;
+}
+/**
+ * Recursively walks any value, applying redactSensitiveTokens to every
+ * string leaf. Used to scrub the unstructured `evidence.data` field where
+ * templates may place arbitrary scan output (extracted tokens, response
+ * bodies, captured headers).
+ *
+ * When walking an object, this function also inspects each key — if the
+ * key name matches a credential field (e.g. `api_key`, `password`), the
+ * value is replaced with `<redacted>` directly, regardless of its
+ * content. This catches the parsed-object form (`{api_key: "sk-live-..."}`)
+ * which the string-pattern matcher cannot see, since the key/value
+ * relationship is only visible structurally.
+ */
+function deepRedact(value) {
+    if (typeof value === 'string')
+        return redactSensitiveTokens(value);
+    if (Array.isArray(value))
+        return value.map(deepRedact);
+    if (value && typeof value === 'object') {
+        const out = {};
+        for (const [k, v] of Object.entries(value)) {
+            if (CREDENTIAL_KEY_RE.test(k) && typeof v === 'string') {
+                out[k] = '<redacted>';
+            }
+            else {
+                out[k] = deepRedact(v);
+            }
+        }
+        return out;
+    }
+    return value;
+}
+/**
+ * Redacts an entire `evidence` object — request, response, and the
+ * unstructured `data` field. Returns a new object; does not mutate the
+ * input. Non-string fields (matched_patterns, timestamp) pass through
+ * unchanged since they don't carry secret material.
+ */
+export function redactEvidence(ev) {
+    return {
+        request: redactSensitiveTokens(ev.request) ?? null,
+        response: redactSensitiveTokens(ev.response) ?? null,
+        matched_patterns: ev.matched_patterns,
+        data: deepRedact(ev.data),
+        timestamp: ev.timestamp,
+    };
+}
+//# sourceMappingURL=format.js.map

package/dist/analyze/format.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"format.js","sourceRoot":"","sources":["../../src/analyze/format.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,GAAG,CAAC;IAEtE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACxD,iEAAiE;QACjE,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC9D,OAAO,GAAG,OAAO,GAAG,CAAC;IACvB,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,CAAC,OAAO;YAAE,OAAO,GAAG,CAAC;QAEzB,+CAA+C;QAC/C,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC/D,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7C,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvB,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC1D,OAAO,GAAG,OAAO,GAAG,CAAC;YACvB,CAAC;QACH,CAAC;QAED,yEAAyE;QACzE,OAAO,OAAO,CAAC,WAAW,EAAE,CAAC;IAC/B,CAAC;IAED,yEAAyE;IACzE,0DAA0D;IAC1D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,0EAA0E;AAE1E;;0DAE0D;AAC1D,MAAM,wBAAwB,GAAG,qHAAqH,CAAC;AAEvJ,oEAAoE;AACpE,MAAM,iBAAiB,GAAG,IAAI,MAAM,CAAC,IAAI,wBAAwB,GAAG,EAAE,GAAG,CAAC,CAAC;AAgB3E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAA+B;IACnE,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACpE,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE1C,IAAI,MAAM,GAAG,IAAI,CAAC;IAElB,kDAAkD;IAClD,+EAA+E;IAC/E,MAAM,GAAG,MAAM,CAAC,OAAO,CACrB,6DAA6D,EAC7D,yBAAyB,CAC1B,CAAC;IAEF,wEAAwE;IACxE,0EAA0E;IAC1E,qEAAqE;IACrE,uEAAuE;IACvE,MAAM,GAAG,MAAM,CAAC,OAAO,CACrB,8DAA8D,EAC9D,CAAC,MAAM,EAAE,MAAc,EAAE,KAAa,EAAE,EAAE;QACxC,wEAAwE;QACxE,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,GAAG,EAAE;YACnC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE;YAC7C,CAAC,CAAC,KAAK,CAAC;QACV,OAAO,GAAG,MAAM,GAAG,WAAW,oBAAoB,CAAC;IACrD,CAAC,CACF,CAAC;IAEF,iEAAiE;IACjE,2EAA2E;IAC3E,uEAAuE;IACvE,6DAA6D;IAC7D,MAAM,GAAG,MAAM,CAAC,OAAO,CACrB,uDAAuD,EACvD,CAAC,MAAM,EAAE,MAAc,EAAE,EAAE,CAAC,GAAG,MAAM,YAAY,CAClD,CAAC;IAEF,4DAA4D;IAC5D,yEAAyE;IACzE,2EAA2E;IAC3E,6DAA6D;IAC7D,yEAAyE;IACzE,yDAAyD;IACzD,MAAM,oBAAoB,GAAG,wBAAwB,CAAC;IACtD,MAAM,GAAG,MAAM,CAAC,OAAO,CACrB,IAAI,MAAM,CAAC,KAAK,oBAAoB,qCAAqC,EAAE,IAAI,CAAC,EAChF,CAAC,MAAM,EAAE,MAAc,EAAE,MAAc,EAAE,EAAE,CAAC,GAAG,MAAM,aAAa,MAAM,EAAE,CAC3E,CAAC;IAEF,iDAAiD;IACjD,6DAA6D;IAC7D,MAAM,GAAG,MAAM,CAAC,OAAO,CACrB,IAAI,MAAM,CAAC,OAAO,oBAAoB,gBAAgB,EAAE,IAAI,CAAC,EAC7D,CAAC,MAAM,EAAE,MAAc,EAAE,EAAE,CAAC,GAAG,MAAM,YAAY,CAClD,CAAC;IAEF,gEAAgE;IAChE,2EAA2E;IAC3E,2EAA2E;IAC3E,6DAA6D;IAC7D,MAAM,GAAG,MAAM,CAAC,OAAO,CACrB,sCAAsC,EACtC,CAAC,MAAM,EAAE,MAAc,EAAE,EAAE,CAAC,GAAG,MAAM,YAAY,CAClD,CAAC;IACF,MAAM,GAAG,MAAM,CAAC,OAAO,CACrB,kCAAkC,EAClC,CAAC,MAAM,EAAE,MAAc,EAAE,EAAE,CAAC,GAAG,MAAM,YAAY,CAClD,CAAC;IAEF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,qBAAqB,CAAC,KAAK,CAAC,CAAC;IACnE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACvD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;YACtE,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;gBACvD,GAAG,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC;YACxB,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,EAAgB;IAC7C,OAAO;QACL,OAAO,EAAE,qBAAqB,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,IAAI;QAClD,QAAQ,EAAE,qBAAqB,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,IAAI;QACpD,gBAAgB,EAAE,EAAE,CAAC,gBAAgB;QACrC,IAAI,EAAE,UAAU,CAAC,EAAE,CAAC,IAAI,CAA4B;QACpD,SAAS,EAAE,EAAE,CAAC,SAAS;KACxB,CAAC;AACJ,CAAC"}

package/dist/analyze/index.d.ts

@@ -113,4 +113,80 @@ export interface ThreatReportWithContent extends SavedThreatReport {
     content: string;
 }
 export declare function loadThreatReportsForDashboard(root: string): ThreatReportWithContent[];
+/**
+ * @flows PentestFindings -> #llm-client via readFileSync -- "Reads CXG scan results for dashboard and report context"
+ * @handles internal on #llm-client -- "Processes pentest scan output (JSON/SARIF)"
+ */
+export interface PentestFinding {
+    id: string;
+    target: string;
+    template_id: string;
+    severity: string;
+    /** CXG emits this in different shapes across versions: integer percentage,
+     *  severity-style string ("high"), or missing entirely. Render via
+     *  formatConfidence() rather than assuming a specific type. */
+    confidence: number | string | null;
+    title: string;
+    description: string;
+    evidence: {
+        request: string | null;
+        response: string | null;
+        matched_patterns: string[];
+        data: Record<string, unknown>;
+        timestamp?: string;
+    };
+    cve_ids: string[];
+    cwe_ids: string[];
+    cvss_score: number | null;
+    remediation: string;
+    references: string[];
+    tags: string[];
+    timestamp: string;
+}
+export interface PentestScanResult {
+    scan_id: string;
+    started_at: string;
+    completed_at: string;
+    findings: PentestFinding[];
+    statistics: {
+        targets_scanned: number;
+        templates_executed: number;
+        findings_by_severity: Record<string, number>;
+        success_rate: number;
+        duration?: {
+            secs: number;
+            nanos: number;
+        };
+    };
+    source_file: string;
+}
+export interface PentestTemplate {
+    filename: string;
+    id: string;
+    tags: string[];
+    severity: string;
+    language: string;
+}
+export interface PentestData {
+    scans: PentestScanResult[];
+    templates: PentestTemplate[];
+    totalFindings: number;
+    findingsBySeverity: Record<string, number>;
+    /** True when surgical evidence redaction was applied during load (because
+     *  the project config has `redactEvidence: true`). Consumers can use this
+     *  to render a visual indicator so users of the dashboard / report know
+     *  whether they're seeing full or redacted evidence. See bug #11. */
+    redactionApplied?: boolean;
+}
+/**
+ * Load pentest findings from .guardlink/pentest-findings/ and template
+ * metadata from .guardlink/cxg-templates/.
+ *
+ * @mitigates #llm-client against #path-traversal using #path-validation -- "join() constrains reads to .guardlink/"
+ */
+export declare function loadPentestData(root: string): PentestData;
+/**
+ * Serialize pentest findings into a compact text summary for LLM context.
+ */
+export declare function serializePentestFindings(data: PentestData): string;
 //# sourceMappingURL=index.d.ts.map

package/dist/analyze/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/analyze/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,KAAK,iBAAiB,EAAyD,MAAM,cAAc,CAAC;AAC7G,OAAO,EAAE,KAAK,SAAS,EAA+B,MAAM,UAAU,CAAC;AAGvE,OAAO,EAAE,KAAK,iBAAiB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAC7G,OAAO,EAAE,KAAK,SAAS,EAAE,KAAK,WAAW,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAC3F,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AACjE,YAAY,EAAE,cAAc,EAAE,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAInF,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,WAAW,CAAC;IACnB,SAAS,EAAE,iBAAiB,CAAC;IAC7B,SAAS,EAAE,SAAS,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACjC,8EAA8E;IAC9E,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,2EAA2E;IAC3E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,yDAAyD;IACzD,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,kEAAkE;IAClE,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,iDAAiD;IACjD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,8EAA8E;IAC9E,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,iBAAiB,CAAC;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAID;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAoIxD;AAID;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,WAAW,EAClB,YAAY,SAAI,EAChB,WAAW,SAAS,GACnB,MAAM,CA+FR;AAID;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,CAsFzD;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,CAwEhE;AASD,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CA0EjG;AAID,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+CAA+C;IAC/C,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AA8BD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,EAAE,CAenE;AAID,MAAM,WAAW,uBAAwB,SAAQ,iBAAiB;IAChE,OAAO,EAAE,MAAM,CAAC;CACjB;AAID,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,MAAM,GAAG,uBAAuB,EAAE,CAcrF"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/analyze/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,KAAK,iBAAiB,EAAyD,MAAM,cAAc,CAAC;AAC7G,OAAO,EAAE,KAAK,SAAS,EAA+B,MAAM,UAAU,CAAC;AAKvE,OAAO,EAAE,KAAK,iBAAiB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAC7G,OAAO,EAAE,KAAK,SAAS,EAAE,KAAK,WAAW,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAC3F,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AACjE,YAAY,EAAE,cAAc,EAAE,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAInF,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,WAAW,CAAC;IACnB,SAAS,EAAE,iBAAiB,CAAC;IAC7B,SAAS,EAAE,SAAS,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACjC,8EAA8E;IAC9E,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,2EAA2E;IAC3E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,yDAAyD;IACzD,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,kEAAkE;IAClE,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,iDAAiD;IACjD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,8EAA8E;IAC9E,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,iBAAiB,CAAC;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAID;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAoIxD;AAID;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,WAAW,EAClB,YAAY,SAAI,EAChB,WAAW,SAAS,GACnB,MAAM,CA+FR;AAID;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,CA4FzD;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,CAwEhE;AASD,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CA4EjG;AAID,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+CAA+C;IAC/C,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AA8BD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,EAAE,CAenE;AAID,MAAM,WAAW,uBAAwB,SAAQ,iBAAiB;IAChE,OAAO,EAAE,MAAM,CAAC;CACjB;AAID,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,MAAM,GAAG,uBAAuB,EAAE,CAcrF;AAID;;;GAGG;AAEH,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB;;mEAE+D;IAC/D,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE;QACR,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;QACvB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QACxB,gBAAgB,EAAE,MAAM,EAAE,CAAC;QAC3B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;IACF,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,cAAc,EAAE,CAAC;IAC3B,UAAU,EAAE;QACV,eAAe,EAAE,MAAM,CAAC;QACxB,kBAAkB,EAAE,MAAM,CAAC;QAC3B,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC7C,YAAY,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,CAAC;KAC5C,CAAC;IACF,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,iBAAiB,EAAE,CAAC;IAC3B,SAAS,EAAE,eAAe,EAAE,CAAC;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3C;;;yEAGqE;IACrE,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAKD;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,CAsGzD;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAyClE"}

package/dist/analyze/index.js

@@ -21,6 +21,8 @@ import { join, relative } from 'node:path';
 import { FRAMEWORK_LABELS, FRAMEWORK_PROMPTS, buildUserMessage } from './prompts.js';
 import { chatCompletion } from './llm.js';
 import { GUARDLINK_TOOLS, createToolExecutor } from './tools.js';
+import { formatConfidence, redactEvidence } from './format.js';
+import { loadProjectConfig } from '../agents/config.js';
 export { FRAMEWORK_LABELS, FRAMEWORK_PROMPTS, buildUserMessage } from './prompts.js';
 export { buildConfig, autoDetectConfig } from './llm.js';
 export { GUARDLINK_TOOLS, createToolExecutor } from './tools.js';
@@ -304,6 +306,13 @@ export function serializeModel(model) {
             description: e.description,
             file: e.location.file, line: e.location.line,
         }));
+    if (model.confirmed.length)
+        compact.confirmed = model.confirmed.map(c => ({
+            threat: c.threat, asset: c.asset, severity: c.severity,
+            refs: c.external_refs.length ? c.external_refs : undefined,
+            description: c.description,
+            file: c.location.file, line: c.location.line,
+        }));
     if (model.acceptances.length)
         compact.acceptances = model.acceptances.map(a => ({
             asset: a.asset, threat: a.threat, description: a.description,
@@ -401,7 +410,7 @@ export function serializeModelCompact(model) {
     }
     const compact = {
         project: model.project,
-        summary: `${model.annotations_parsed} annotations, ${model.assets.length} assets, ${model.threats.length} threats, ${model.controls.length} controls, ${model.exposures.length} exposures (${unmitigated.length} unmitigated), ${model.mitigations.length} mitigations`,
+        summary: `${model.annotations_parsed} annotations, ${model.assets.length} assets, ${model.threats.length} threats, ${model.controls.length} controls, ${model.exposures.length} exposures (${unmitigated.length} unmitigated), ${model.confirmed.length} confirmed, ${model.mitigations.length} mitigations`,
         severity_breakdown: sevCounts,
     };
     // Assets — just path + id, no descriptions
@@ -465,8 +474,10 @@ export async function generateThreatReport(opts) {
     const modelJson = serializeModel(model);
     const projectContext = buildProjectContext(root);
     const codeSnippets = extractCodeSnippets(root, model, snippetContext, snippetBudget);
+    const pentestData = loadPentestData(root);
+    const pentestContext = serializePentestFindings(pentestData);
     const systemPrompt = FRAMEWORK_PROMPTS[framework];
-    const userMessage = buildUserMessage(modelJson, framework, customPrompt, projectContext || undefined, codeSnippets || undefined);
+    const userMessage = buildUserMessage(modelJson, framework, customPrompt, projectContext || undefined, codeSnippets || undefined, pentestContext || undefined);
     const timestamp = new Date().toISOString().replace(/[:.]/g, '-').slice(0, 19);
     // Build enhanced config with optional upgrades
     const enhancedConfig = { ...llmConfig };
@@ -579,4 +590,156 @@ export function loadThreatReportsForDashboard(root) {
     }
     return result;
 }
+const PENTEST_FINDINGS_DIR = 'pentest-findings';
+const CXG_TEMPLATES_DIR = 'cxg-templates';
+/**
+ * Load pentest findings from .guardlink/pentest-findings/ and template
+ * metadata from .guardlink/cxg-templates/.
+ *
+ * @mitigates #llm-client against #path-traversal using #path-validation -- "join() constrains reads to .guardlink/"
+ */
+export function loadPentestData(root) {
+    const data = { scans: [], templates: [], totalFindings: 0, findingsBySeverity: {} };
+    // Load scan results (JSON files)
+    const findingsDir = join(root, '.guardlink', PENTEST_FINDINGS_DIR);
+    if (existsSync(findingsDir)) {
+        try {
+            const files = readdirSync(findingsDir).filter(f => f.endsWith('.json'));
+            for (const file of files) {
+                try {
+                    const raw = readFileSync(join(findingsDir, file), 'utf-8');
+                    const parsed = JSON.parse(raw);
+                    if (parsed.findings && Array.isArray(parsed.findings)) {
+                        data.scans.push({ ...parsed, source_file: file });
+                        data.totalFindings += parsed.findings.length;
+                        for (const f of parsed.findings) {
+                            const sev = (f.severity || 'unknown').toLowerCase();
+                            data.findingsBySeverity[sev] = (data.findingsBySeverity[sev] || 0) + 1;
+                        }
+                    }
+                }
+                catch { /* skip malformed JSON */ }
+            }
+        }
+        catch { /* dir not readable */ }
+    }
+    // Also check repo root for legacy guardlink-pentest.json
+    for (const name of ['guardlink-pentest.json']) {
+        const rootFile = join(root, name);
+        if (existsSync(rootFile)) {
+            try {
+                const raw = readFileSync(rootFile, 'utf-8');
+                const parsed = JSON.parse(raw);
+                if (parsed.findings && Array.isArray(parsed.findings)) {
+                    const alreadyLoaded = data.scans.some(s => s.scan_id === parsed.scan_id);
+                    if (!alreadyLoaded) {
+                        data.scans.push({ ...parsed, source_file: name });
+                        data.totalFindings += parsed.findings.length;
+                        for (const f of parsed.findings) {
+                            const sev = (f.severity || 'unknown').toLowerCase();
+                            data.findingsBySeverity[sev] = (data.findingsBySeverity[sev] || 0) + 1;
+                        }
+                    }
+                }
+            }
+            catch { /* skip */ }
+        }
+    }
+    // Sort scans newest first
+    data.scans.sort((a, b) => (b.completed_at || '').localeCompare(a.completed_at || ''));
+    // Bug #11: surgical evidence redaction. When the project config has
+    // `redactEvidence: true`, walk every finding and replace evidence
+    // request/response strings + the recursive `data` blob with redacted
+    // forms. Default is OFF — OSS users running against test targets
+    // (Juice Shop, their own staging) see full evidence. Enterprise
+    // customers with audit policies enable the flag once via
+    // `guardlink config set redact-evidence true`.
+    const projectConfig = loadProjectConfig(root);
+    if (projectConfig?.redactEvidence) {
+        for (const scan of data.scans) {
+            scan.findings = scan.findings.map((f) => ({
+                ...f,
+                evidence: f.evidence ? redactEvidence(f.evidence) : f.evidence,
+            }));
+        }
+        data.redactionApplied = true;
+    }
+    // Load template metadata from .guardlink/cxg-templates/
+    const templatesDir = join(root, '.guardlink', CXG_TEMPLATES_DIR);
+    if (existsSync(templatesDir)) {
+        try {
+            const files = readdirSync(templatesDir).filter(f => f.endsWith('.py') || f.endsWith('.yaml') || f.endsWith('.yml') ||
+                f.endsWith('.go') || f.endsWith('.rs') || f.endsWith('.js') || f.endsWith('.sh'));
+            for (const file of files) {
+                try {
+                    const raw = readFileSync(join(templatesDir, file), 'utf-8');
+                    const ext = file.split('.').pop() || '';
+                    // Anchor on complete field names: `id: "x"`, `"id": "x"`, `template_id = "x"`.
+                    // The previous loose regex matched "id" inside words like `bridge`
+                    // (captured "ge") and `guide` (captured "e"); the severity regex
+                    // missed Python `severity = "critical"` because it required a colon.
+                    const idMatch = raw.match(/["']?(?:template_)?id["']?\s*[:=]\s*["']([a-z0-9_-]+)["']/i);
+                    const sevMatch = raw.match(/["']?severity["']?\s*[:=]\s*["']?(critical|high|medium|low|info)["']?/i);
+                    const tagsMatch = raw.match(/tags[:\s]*\[([^\]]*)\]/);
+                    data.templates.push({
+                        filename: file,
+                        id: idMatch?.[1] || file.replace(/\.[^.]+$/, ''),
+                        severity: sevMatch?.[1] || 'medium',
+                        language: ext === 'py' ? 'python' : ext === 'yml' || ext === 'yaml' ? 'yaml' : ext,
+                        tags: tagsMatch?.[1]
+                            ? tagsMatch[1].split(',').map(t => t.trim().replace(/["']/g, '')).filter(Boolean)
+                            : [],
+                    });
+                }
+                catch { /* skip unreadable */ }
+            }
+        }
+        catch { /* dir not readable */ }
+    }
+    return data;
+}
+/**
+ * Serialize pentest findings into a compact text summary for LLM context.
+ */
+export function serializePentestFindings(data) {
+    if (data.scans.length === 0 && data.templates.length === 0)
+        return '';
+    const lines = ['## Pentest Findings (CXG Scan Results)', ''];
+    if (data.templates.length > 0) {
+        lines.push(`### Templates (${data.templates.length})`);
+        for (const t of data.templates) {
+            lines.push(`- ${t.id} [${t.severity}] (${t.language}) — ${t.tags.slice(0, 5).join(', ')}`);
+        }
+        lines.push('');
+    }
+    if (data.scans.length > 0) {
+        lines.push(`### Scan Results (${data.totalFindings} findings across ${data.scans.length} scan(s))`);
+        const sevSummary = Object.entries(data.findingsBySeverity)
+            .sort(([, a], [, b]) => b - a)
+            .map(([sev, count]) => `${sev}: ${count}`)
+            .join(', ');
+        if (sevSummary)
+            lines.push(`Severity breakdown: ${sevSummary}`);
+        lines.push('');
+        for (const scan of data.scans) {
+            lines.push(`#### Scan ${scan.scan_id.slice(0, 8)} (${scan.completed_at?.slice(0, 19) || 'unknown'}) — ${scan.source_file}`);
+            lines.push(`Templates executed: ${scan.statistics?.templates_executed || '?'} | Success rate: ${((scan.statistics?.success_rate || 0) * 100).toFixed(0)}%`);
+            lines.push('');
+            for (const f of scan.findings) {
+                lines.push(`**[${f.severity.toUpperCase()}] ${f.title}** (${f.template_id})`);
+                lines.push(`  CWE: ${f.cwe_ids.join(', ') || 'none'} | Confidence: ${formatConfidence(f.confidence)}`);
+                lines.push(`  ${f.description}`);
+                if (f.evidence?.request)
+                    lines.push(`  Request: ${String(f.evidence.request).slice(0, 300)}`);
+                if (f.evidence?.response)
+                    lines.push(`  Response: ${String(f.evidence.response).slice(0, 300)}`);
+                if (f.evidence?.matched_patterns?.length)
+                    lines.push(`  Patterns: ${f.evidence.matched_patterns.join(', ')}`);
+                lines.push(`  Remediation: ${f.remediation}`);
+                lines.push('');
+            }
+        }
+    }
+    return lines.join('\n');
+}
 //# sourceMappingURL=index.js.map