hex-audit 0.4.0

package/dist/commands/init.js

@@ -0,0 +1,330 @@
+import { Command } from 'commander';
+import fs from 'node:fs';
+import path from 'node:path';
+import { glob } from 'glob';
+import { logger } from '../core/logger.js';
+import { createConfig } from '../core/config.js';
+import { normalizePath, getOutputDir } from '../core/paths.js';
+import { runForge, detectTools } from '../core/external-tools.js';
+import { parseSolidity, extractSolidityVersion } from '../parsers/solidity-parser.js';
+import { copySkillsToClaudeFormat, getClaudeSkillsDir } from '../core/skills.js';
+import { ProgressTracker } from '../core/progress.js';
+import { HexError, reportError } from '../core/errors.js';
+export const initCommand = new Command('init')
+    .description('Initialize a new audit project')
+    .option('--project <dir>', 'Project directory (default: cwd)')
+    .option('--scope <globs>', 'Comma-separated scope file globs')
+    .option('--commit <hash>', 'Git commit hash')
+    .option('--chain <chain>', 'Target chain', 'ethereum')
+    .option('--name <name>', 'Project name')
+    .option('--docs <url>', 'Documentation URL')
+    .option('--output-dir <dir>', 'Output directory', '.hex')
+    .option('--exclude <globs>', 'Comma-separated exclude globs')
+    .option('--no-verify', 'Skip build verification')
+    .action(async (opts) => {
+    const STEPS = [
+        'detect project',
+        'check tools',
+        'resolve scope',
+        'detect solidity version',
+        'create config',
+        'copy skills',
+        'verify build',
+        'write CLAUDE.md',
+    ];
+    const tracker = new ProgressTracker(STEPS);
+    tracker.start();
+    try {
+        const projectDir = path.resolve(opts.project ?? process.cwd());
+        if (!fs.existsSync(projectDir)) {
+            tracker.update('detect project', 'failed', 'project dir missing');
+            throw new HexError('project.foundry-missing', `path: ${projectDir}`);
+        }
+        tracker.update('detect project', 'running');
+        const isFoundry = fs.existsSync(path.join(projectDir, 'foundry.toml'));
+        const isHardhat = fs.existsSync(path.join(projectDir, 'hardhat.config.ts')) ||
+            fs.existsSync(path.join(projectDir, 'hardhat.config.js'));
+        const projectTypeDetail = isFoundry ? 'Foundry' : isHardhat ? 'Hardhat' : 'none detected';
+        tracker.update('detect project', 'ok', projectTypeDetail);
+        tracker.update('check tools', 'running');
+        const tools = await detectTools();
+        const toolDetails = [];
+        for (const tool of tools) {
+            if (tool.available) {
+                toolDetails.push(`${tool.name} ok`);
+            }
+            else {
+                toolDetails.push(`${tool.name} missing`);
+            }
+        }
+        const allMissing = tools.every((t) => !t.available);
+        tracker.update('check tools', allMissing ? 'failed' : 'ok', toolDetails.join(', '));
+        if (!tools.find((t) => t.name === 'forge')?.available) {
+            logger.warn('forge not found — compilation verification and test coverage will be unavailable');
+        }
+        if (!tools.find((t) => t.name === 'slither')?.available) {
+            logger.warn('slither not found — access control, state variable, and external call analysis will be limited');
+        }
+        if (!tools.find((t) => t.name === 'solc')?.available) {
+            logger.warn('solc not found — storage layout extraction will be unavailable');
+        }
+        // Resolve scope globs
+        if (!opts.scope) {
+            tracker.update('resolve scope', 'failed', '--scope missing');
+            throw new HexError('project.scope.empty');
+        }
+        tracker.update('resolve scope', 'running');
+        const scopeGlobs = opts.scope.split(',').map((g) => g.trim());
+        const excludeGlobs = opts.exclude ? opts.exclude.split(',').map((g) => g.trim()) : [];
+        const scopeFiles = [];
+        for (const pattern of scopeGlobs) {
+            const matches = await glob(pattern, {
+                cwd: projectDir,
+                ignore: excludeGlobs,
+                posix: true,
+            });
+            scopeFiles.push(...matches);
+        }
+        const uniqueScope = [...new Set(scopeFiles)].sort();
+        if (uniqueScope.length === 0) {
+            tracker.update('resolve scope', 'failed', `no match for ${scopeGlobs.join(', ')}`);
+            throw new HexError('project.scope.unmatched', `globs: ${scopeGlobs.join(', ')}`);
+        }
+        for (const file of uniqueScope) {
+            const fullPath = path.join(projectDir, file);
+            if (!fs.existsSync(fullPath)) {
+                tracker.update('resolve scope', 'failed', `missing file: ${file}`);
+                throw new HexError('project.scope.missing-file', `path: ${file}`);
+            }
+        }
+        tracker.update('resolve scope', 'ok', `${uniqueScope.length} files`);
+        // Detect Solidity version
+        tracker.update('detect solidity version', 'running');
+        let solidityVersion = '0.8.20'; // default
+        let versionSource = 'default';
+        if (isFoundry) {
+            const foundryToml = fs.readFileSync(path.join(projectDir, 'foundry.toml'), 'utf-8');
+            const versionMatch = foundryToml.match(/solc[_-]version\s*=\s*["']?([\d.]+)/);
+            if (versionMatch) {
+                solidityVersion = versionMatch[1];
+                versionSource = 'foundry.toml';
+            }
+        }
+        if (versionSource === 'default') {
+            for (const file of uniqueScope.slice(0, 5)) {
+                const source = fs.readFileSync(path.join(projectDir, file), 'utf-8');
+                const result = parseSolidity(source, file);
+                const version = extractSolidityVersion(result.pragmas);
+                if (version) {
+                    solidityVersion = version;
+                    versionSource = 'pragma';
+                    break;
+                }
+            }
+        }
+        tracker.update('detect solidity version', 'ok', `${solidityVersion} (${versionSource})`);
+        // Detect commit hash
+        let commit = opts.commit;
+        if (!commit) {
+            try {
+                const { execSync } = await import('node:child_process');
+                commit = execSync('git rev-parse HEAD', {
+                    cwd: projectDir,
+                    encoding: 'utf-8',
+                }).trim();
+            }
+            catch {
+                commit = 'unknown';
+                logger.warn('Could not detect git commit hash. Use --commit to specify.');
+            }
+        }
+        // Determine project name
+        const name = opts.name ?? path.basename(projectDir);
+        // Create config
+        tracker.update('create config', 'running');
+        const config = createConfig({
+            name,
+            projectDir,
+            commit,
+            chain: opts.chain,
+            solidityVersion,
+            docsUrl: opts.docs,
+            scope: uniqueScope,
+            exclude: excludeGlobs,
+            outputDir: opts.outputDir,
+        });
+        const outputDir = getOutputDir(projectDir, config.settings.output_dir);
+        tracker.update('create config', 'ok', normalizePath(outputDir));
+        // Copy skill files to .claude/skills/<name>/SKILL.md
+        tracker.update('copy skills', 'running');
+        const claudeSkillsDir = getClaudeSkillsDir(projectDir);
+        const skillsResult = copySkillsToClaudeFormat({ targetDir: claudeSkillsDir });
+        tracker.update('copy skills', 'ok', `${skillsResult.updated + skillsResult.added} skill(s)`);
+        // Create subdirectories
+        for (const subdir of ['validations', 'ai-results']) {
+            const dir = path.join(outputDir, subdir);
+            if (!fs.existsSync(dir)) {
+                fs.mkdirSync(dir, { recursive: true });
+            }
+        }
+        // Create ai-results subdirectory for auditagent (the only supported AI tool)
+        const auditagentDir = path.join(outputDir, 'ai-results', 'auditagent');
+        if (!fs.existsSync(auditagentDir)) {
+            fs.mkdirSync(auditagentDir, { recursive: true });
+        }
+        // Optionally verify compilation
+        if (opts.verify !== false && isFoundry) {
+            tracker.update('verify build', 'running');
+            const result = await runForge(projectDir, ['build']);
+            if (result.exitCode === 0) {
+                tracker.update('verify build', 'ok');
+            }
+            else {
+                tracker.update('verify build', 'failed', 'forge build returned non-zero (non-fatal)');
+                logger.dim(result.stderr.slice(0, 500));
+            }
+        }
+        else {
+            tracker.update('verify build', 'skipped', isFoundry ? '--no-verify' : 'not a Foundry project');
+        }
+        // Create CLAUDE.md for Claude Code skill discovery
+        const claudeMdPath = path.join(projectDir, 'CLAUDE.md');
+        if (!fs.existsSync(claudeMdPath)) {
+            const claudeMd = `# Hex Project: ${config.project.name}
+
+This project is being audited with Hex.
+
+- **Chain:** ${config.project.chain}
+- **Solidity:** ${config.project.solidity_version}
+- **Commit:** \`${config.project.commit}\`${config.project.docs_url ? `\n- **Docs:** ${config.project.docs_url}` : ''}
+- **Config:** \`${config.settings.output_dir}/config.json\` — source of truth for all project metadata
+
+## Scope
+
+The following files are in audit scope:
+${uniqueScope.map((f) => `- \`${f}\``).join('\n')}
+
+## Output Directory (\`${config.settings.output_dir}/\`)
+
+All analysis outputs live here. Key files and what they answer:
+
+| File | Contains | Use when asked about... |
+|------|----------|------------------------|
+| \`config.json\` | Project config (scope, chain, docs URL, commit) | project setup, documentation, scope |
+| \`stats.json\` | nSLOC, contracts, functions, test coverage, dependencies | codebase size, complexity, coverage |
+| \`deps.json\` | Inheritance, imports, calls, clusters | contract relationships, dependency graph |
+| \`access-control.json\` | Roles, modifiers, function access | who can call what, privileged functions |
+| \`state-vars.json\` | State variables, types, visibility, read/write | storage, mutability, state layout |
+| \`external-calls.json\` | External calls, reentrancy guards, trust levels | external interactions, reentrancy risk |
+| \`overview.md\` | AI-generated protocol overview | what the protocol does, architecture |
+| \`invariants.md\` | Protocol invariants from docs and code | invariants, assumptions, properties |
+| \`spec-conformance.json\` | Spec vs code deviations | spec compliance, ERC conformance |
+| \`findings.json\` | Audit findings (canonical) | reported issues, vulnerabilities |
+| \`tracking.json\` | Finding status and duplicates | finding triage, status |
+| \`comparison.json\` | AI cross-check results | AI-found issues, novel findings |
+| \`progress.json\` | Audit progress tracking | what has been reviewed |
+| \`diagrams/\` | Mermaid architecture and flow diagrams | system diagrams, flows |
+
+Not all files exist initially — they are created as you run skills and CLI commands.
+
+## Skills (Slash Commands)
+
+Skills are in \`.claude/skills/\` and auto-discovered by Claude Code. Type \`/\` to list them.
+
+**Recommended workflow order:**
+
+1. \`/init-audit\` — Initialize project, audit dependencies, run analysis pipeline
+2. \`/generate-overview\` — Write protocol overview from analysis data
+3. \`/generate-diagram\` — Create Mermaid architecture diagram
+4. \`/generate-flows\` — Create Mermaid flow charts per user type
+5. \`/identify-invariants\` — Three-pass invariant identification (docs, code, comparison)
+6. \`/check-spec-conformance\` — Verify code matches docs, NatSpec, interfaces, ERCs
+7. \`/generate-poc\` — Validate an issue with a runnable proof-of-concept test
+8. \`/write-finding\` — Write a structured finding with severity and recommendation
+9. \`/conformance-to-findings\` — Batch-convert spec deviations into findings
+10. \`/run-ai-analysis\` — Orchestrate all AI audit tools with preflight checks
+11. \`/compare-findings\` — Cross-check findings against AI agent results
+12. \`/validate-ai-finding\` — Independently verify a novel AI-found issue
+
+Each skill builds on previous outputs. Run them in order for best results.
+
+## CLI Commands
+
+- \`npx hex analyze\` — Run all deterministic analysis (stats, deps, access, state, calls)
+- \`npx hex context\` — Assemble full codebase context for AI prompts
+- \`npx hex context --target <Contract>\` — Focused context for a single contract
+- \`npx hex dashboard\` — Open browser dashboard at http://localhost:3000
+
+## Writing Style (applies to every skill that produces text)
+
+Anything you write into \`.hex/\` files (findings, overview, invariants, spec conformance) ends up in front of a security team or in a public report. Write like a senior auditor, not like an AI model showing off. The detectable patterns below are off-limits:
+
+### Banned punctuation and words
+
+- **No em dashes (—)** anywhere. Use commas, parentheses, semicolons, or split into separate sentences. This is the single biggest AI tell in audit reports.
+- **No en dashes (–) in prose either.** Hyphens are fine for compounds (\`fee-on-transfer\`).
+- Avoid these words: *delve, moreover, furthermore, seamlessly, cutting-edge, revolutionize, unlock the potential, streamline, in essence, at its core, it is worth noting, indeed, harness, underscore, illuminate, pivotal, groundbreaking, multifaceted, robust (outside technical contexts), holistic, paradigm, synergy, empower, foster, facilitate*.
+- Avoid metaphorical *navigate*, *landscape*, *benchmark* (as a verb).
+- Avoid filler openings: *In today's world*, *When it comes to*, *In this article*, *As previously mentioned*, *It goes without saying*.
+
+### Structure
+
+- Don't force the rule of three. If two points cover it, stop at two.
+- Don't start consecutive paragraphs with the same syntactic pattern.
+- Skip the intro-body-summary shape. Not every paragraph needs a topic sentence and a wrap-up.
+- Don't pad bullet points to make the list look fuller.
+
+### Sentences
+
+- Vary sentence length. Mix short with long.
+- Don't use parallel grammatical construction across three or more consecutive sentences.
+- One present-participle opener per page max (\`Showcasing...\`, \`Leveraging...\`).
+- Don't over-hedge with *it could be said*, *one might argue*, *perhaps it is fair to say*.
+
+### Recommendation tone (specific to findings)
+
+Recommendations are suggestions, not orders. The protocol team owns the fix; you propose direction.
+
+- Start with *Consider...*, *One option is...*, *The team may want to...*, *It would be worth...*.
+- Avoid *Replace X with Y*, *You must...*, *Always do...*, *Never do...*.
+- If you point at a specific pattern (e.g. reentrancy guard, checks-effects-interactions), present it as the common fix rather than the only fix. The team may have constraints you can't see.
+
+### Tone
+
+- Match formality to context, not to a corporate default.
+- Be direct and specific over vaguely positive.
+- Use concrete numbers and details over generic descriptors.
+- Don't restate or summarise what you just said.
+- Don't add trailing summaries unless asked.
+
+### Content
+
+- Prefer specific facts over generic claims.
+- Don't pad with unnecessary comprehensiveness. Say what needs saying, then stop.
+- Avoid rhetorical questions as transitions.
+
+Apply these to every skill output without being reminded.
+`;
+            fs.writeFileSync(claudeMdPath, claudeMd, 'utf-8');
+            tracker.update('write CLAUDE.md', 'ok', normalizePath(claudeMdPath));
+        }
+        else {
+            tracker.update('write CLAUDE.md', 'skipped', 'already exists');
+        }
+        tracker.finish();
+        logger.success('Audit initialized');
+        logger.info(`Config: ${normalizePath(path.join(outputDir, 'config.json'))}`);
+        logger.info(`Output: ${normalizePath(outputDir)}`);
+        logger.info('');
+        logger.info('Next steps:');
+        logger.dim('  hex stats    # Generate codebase statistics');
+        logger.dim('  hex deps     # Build dependency graph');
+        logger.dim('  hex access   # Map access control');
+    }
+    catch (err) {
+        tracker.finish();
+        reportError(err);
+        process.exit(1);
+    }
+});
+//# sourceMappingURL=init.js.map

package/dist/commands/init.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"init.js","sourceRoot":"","sources":["../../src/commands/init.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACtF,OAAO,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACjF,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAE1D,MAAM,CAAC,MAAM,WAAW,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC;KAC3C,WAAW,CAAC,gCAAgC,CAAC;KAC7C,MAAM,CAAC,iBAAiB,EAAE,kCAAkC,CAAC;KAC7D,MAAM,CAAC,iBAAiB,EAAE,kCAAkC,CAAC;KAC7D,MAAM,CAAC,iBAAiB,EAAE,iBAAiB,CAAC;KAC5C,MAAM,CAAC,iBAAiB,EAAE,cAAc,EAAE,UAAU,CAAC;KACrD,MAAM,CAAC,eAAe,EAAE,cAAc,CAAC;KACvC,MAAM,CAAC,cAAc,EAAE,mBAAmB,CAAC;KAC3C,MAAM,CAAC,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,CAAC;KACxD,MAAM,CAAC,mBAAmB,EAAE,+BAA+B,CAAC;KAC5D,MAAM,CAAC,aAAa,EAAE,yBAAyB,CAAC;KAChD,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IACrB,MAAM,KAAK,GAAG;QACZ,gBAAgB;QAChB,aAAa;QACb,eAAe;QACf,yBAAyB;QACzB,eAAe;QACf,aAAa;QACb,cAAc;QACd,iBAAiB;KAClB,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,eAAe,CAAC,KAAK,CAAC,CAAC;IAC3C,OAAO,CAAC,KAAK,EAAE,CAAC;IAEhB,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAE/D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/B,OAAO,CAAC,MAAM,CAAC,gBAAgB,EAAE,QAAQ,EAAE,qBAAqB,CAAC,CAAC;YAClE,MAAM,IAAI,QAAQ,CAAC,yBAAyB,EAAE,SAAS,UAAU,EAAE,CAAC,CAAC;QACvE,CAAC;QAED,OAAO,CAAC,MAAM,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;QAC5C,MAAM,SAAS,GAAG,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC,CAAC;QACvE,MAAM,SAAS,GACb,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAC;YACzD,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAC,CAAC;QAC5D,MAAM,iBAAiB,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC;QAC1F,OAAO,CAAC,MAAM,CAAC,gBAAgB,EAAE,IAAI,EAAE,iBAAiB,CAAC,CAAC;QAE1D,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;QACzC,MAAM,KAAK,GAAG,MAAM,WAAW,EAAE,CAAC;QAClC,MAAM,WAAW,GAAa,EAAE,CAAC;QACjC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;gBACnB,WAAW,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC;YACtC,CAAC;iBAAM,CAAC;gBACN,WAAW,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,UAAU,CAAC,CAAC;YAC3C,CAAC;QACH,CAAC;QACD,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACpD,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACpF,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,EAAE,SAAS,EAAE,CAAC;YACtD,MAAM,CAAC,IAAI,CACT,kFAAkF,CACnF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC;YACxD,MAAM,CAAC,IAAI,CACT,gGAAgG,CACjG,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC;YACrD,MAAM,CAAC,IAAI,CAAC,gEAAgE,CAAC,CAAC;QAChF,CAAC;QAED,sBAAsB;QACtB,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,QAAQ,EAAE,iBAAiB,CAAC,CAAC;YAC7D,MAAM,IAAI,QAAQ,CAAC,qBAAqB,CAAC,CAAC;QAC5C,CAAC;QAED,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;QAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACtE,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAE9F,MAAM,UAAU,GAAa,EAAE,CAAC;QAChC,KAAK,MAAM,OAAO,IAAI,UAAU,EAAE,CAAC;YACjC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE;gBAClC,GAAG,EAAE,UAAU;gBACf,MAAM,EAAE,YAAY;gBACpB,KAAK,EAAE,IAAI;aACZ,CAAC,CAAC;YACH,UAAU,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC;QAC9B,CAAC;QAED,MAAM,WAAW,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACpD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,QAAQ,EAAE,gBAAgB,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACnF,MAAM,IAAI,QAAQ,CAAC,yBAAyB,EAAE,UAAU,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACnF,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;YAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;YAC7C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC7B,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,QAAQ,EAAE,iBAAiB,IAAI,EAAE,CAAC,CAAC;gBACnE,MAAM,IAAI,QAAQ,CAAC,4BAA4B,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC;YACpE,CAAC;QACH,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,IAAI,EAAE,GAAG,WAAW,CAAC,MAAM,QAAQ,CAAC,CAAC;QAErE,0BAA0B;QAC1B,OAAO,CAAC,MAAM,CAAC,yBAAyB,EAAE,SAAS,CAAC,CAAC;QACrD,IAAI,eAAe,GAAG,QAAQ,CAAC,CAAC,UAAU;QAC1C,IAAI,aAAa,GAAG,SAAS,CAAC;QAE9B,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,WAAW,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,CAAC;YACpF,MAAM,YAAY,GAAG,WAAW,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC;YAC9E,IAAI,YAAY,EAAE,CAAC;gBACjB,eAAe,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;gBAClC,aAAa,GAAG,cAAc,CAAC;YACjC,CAAC;QACH,CAAC;QAED,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YAChC,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;gBAC3C,MAAM,MAAM,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;gBACrE,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;gBAC3C,MAAM,OAAO,GAAG,sBAAsB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBACvD,IAAI,OAAO,EAAE,CAAC;oBACZ,eAAe,GAAG,OAAO,CAAC;oBAC1B,aAAa,GAAG,QAAQ,CAAC;oBACzB,MAAM;gBACR,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,yBAAyB,EAAE,IAAI,EAAE,GAAG,eAAe,KAAK,aAAa,GAAG,CAAC,CAAC;QAEzF,qBAAqB;QACrB,IAAI,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QACzB,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,CAAC;gBACH,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;gBACxD,MAAM,GAAG,QAAQ,CAAC,oBAAoB,EAAE;oBACtC,GAAG,EAAE,UAAU;oBACf,QAAQ,EAAE,OAAO;iBAClB,CAAC,CAAC,IAAI,EAAE,CAAC;YACZ,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,GAAG,SAAS,CAAC;gBACnB,MAAM,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAC;YAC5E,CAAC;QACH,CAAC;QAED,yBAAyB;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAEpD,gBAAgB;QAChB,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,YAAY,CAAC;YAC1B,IAAI;YACJ,UAAU;YACV,MAAM;YACN,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,eAAe;YACf,OAAO,EAAE,IAAI,CAAC,IAAI;YAClB,KAAK,EAAE,WAAW;YAClB,OAAO,EAAE,YAAY;YACrB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC,CAAC;QAEH,MAAM,SAAS,GAAG,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QACvE,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,IAAI,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;QAEhE,qDAAqD;QACrD,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;QACzC,MAAM,eAAe,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;QACvD,MAAM,YAAY,GAAG,wBAAwB,CAAC,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC,CAAC;QAC9E,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,IAAI,EAAE,GAAG,YAAY,CAAC,OAAO,GAAG,YAAY,CAAC,KAAK,WAAW,CAAC,CAAC;QAE7F,wBAAwB;QACxB,KAAK,MAAM,MAAM,IAAI,CAAC,aAAa,EAAE,YAAY,CAAC,EAAE,CAAC;YACnD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YACzC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACzC,CAAC;QACH,CAAC;QAED,6EAA6E;QAC7E,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;QACvE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YAClC,EAAE,CAAC,SAAS,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,CAAC;QAED,gCAAgC;QAChC,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,IAAI,SAAS,EAAE,CAAC;YACvC,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;YAC1C,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;YACrD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;gBAC1B,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;YACvC,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,QAAQ,EAAE,2CAA2C,CAAC,CAAC;gBACtF,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,MAAM,CACZ,cAAc,EACd,SAAS,EACT,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,uBAAuB,CACpD,CAAC;QACJ,CAAC;QAED,mDAAmD;QACnD,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QACxD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YACjC,MAAM,QAAQ,GAAG,kBAAkB,MAAM,CAAC,OAAO,CAAC,IAAI;;;;eAI/C,MAAM,CAAC,OAAO,CAAC,KAAK;kBACjB,MAAM,CAAC,OAAO,CAAC,gBAAgB;kBAC/B,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,iBAAiB,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE;kBACnG,MAAM,CAAC,QAAQ,CAAC,UAAU;;;;;EAK1C,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;;yBAExB,MAAM,CAAC,QAAQ,CAAC,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoGlD,CAAC;YACM,EAAE,CAAC,aAAa,CAAC,YAAY,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;YAClD,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE,IAAI,EAAE,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC;QACvE,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE,SAAS,EAAE,gBAAgB,CAAC,CAAC;QACjE,CAAC;QAED,OAAO,CAAC,MAAM,EAAE,CAAC;QACjB,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;QACpC,MAAM,CAAC,IAAI,CAAC,WAAW,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC;QAC7E,MAAM,CAAC,IAAI,CAAC,WAAW,aAAa,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACnD,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAChB,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC3B,MAAM,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC;QAC5D,MAAM,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC;QACtD,MAAM,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC;IACpD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,MAAM,EAAE,CAAC;QACjB,WAAW,CAAC,GAAG,CAAC,CAAC;QACjB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/commands/patterns.d.ts

@@ -0,0 +1,3 @@
+import { Command } from 'commander';
+export declare const patternsCommand: Command;
+//# sourceMappingURL=patterns.d.ts.map

package/dist/commands/patterns.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"patterns.d.ts","sourceRoot":"","sources":["../../src/commands/patterns.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAOpC,eAAO,MAAM,eAAe,SAoCxB,CAAC"}

package/dist/commands/patterns.js

@@ -0,0 +1,40 @@
+import { Command } from 'commander';
+import { logger } from '../core/logger.js';
+import { loadConfig } from '../core/config.js';
+import { getOutputDir } from '../core/paths.js';
+import { writeJsonOutput } from '../core/output.js';
+import { detectPatterns } from '../analysis/pattern-detection.js';
+export const patternsCommand = new Command('patterns')
+    .description('Detect security-relevant patterns in scope files')
+    .option('--project <dir>', 'Project directory')
+    .action(async (opts) => {
+    const spin = logger.spinner('Detecting security patterns...');
+    try {
+        const projectDir = opts.project ?? process.cwd();
+        const config = loadConfig(projectDir);
+        const outputDir = getOutputDir(config.project.project_dir, config.settings.output_dir);
+        spin.text = 'Scanning scope files for security patterns...';
+        const result = detectPatterns(config.project.project_dir, config.project.scope);
+        const detectedFlags = Object.entries(result.flags)
+            .filter(([, v]) => v.detected)
+            .map(([k]) => k);
+        const outPath = writeJsonOutput(outputDir, 'patterns.json', result);
+        spin.succeed(`Detected ${detectedFlags.length} pattern flags`);
+        if (detectedFlags.length > 0) {
+            logger.info(`  Flags: ${detectedFlags.join(', ')}`);
+        }
+        if (result.protocol_hints.length > 0) {
+            logger.info(`  Protocol hints: ${result.protocol_hints.join(', ')}`);
+        }
+        if (result.risk_areas.length > 0) {
+            logger.info(`  Risk areas: ${result.risk_areas.length}`);
+        }
+        logger.dim(`  → ${outPath}`);
+    }
+    catch (err) {
+        spin.fail('Pattern detection failed');
+        logger.error(err instanceof Error ? err.message : String(err));
+        process.exit(1);
+    }
+});
+//# sourceMappingURL=patterns.js.map

package/dist/commands/patterns.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"patterns.js","sourceRoot":"","sources":["../../src/commands/patterns.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAElE,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,OAAO,CAAC,UAAU,CAAC;KACnD,WAAW,CAAC,kDAAkD,CAAC;KAC/D,MAAM,CAAC,iBAAiB,EAAE,mBAAmB,CAAC;KAC9C,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IACrB,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,gCAAgC,CAAC,CAAC;IAE9D,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QACjD,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;QACtC,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAEvF,IAAI,CAAC,IAAI,GAAG,+CAA+C,CAAC;QAC5D,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAEhF,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;aAC/C,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;aAC7B,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QAEnB,MAAM,OAAO,GAAG,eAAe,CAAC,SAAS,EAAE,eAAe,EAAE,MAAM,CAAC,CAAC;QAEpE,IAAI,CAAC,OAAO,CAAC,YAAY,aAAa,CAAC,MAAM,gBAAgB,CAAC,CAAC;QAC/D,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,CAAC,IAAI,CAAC,YAAY,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,MAAM,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrC,MAAM,CAAC,IAAI,CAAC,qBAAqB,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjC,MAAM,CAAC,IAAI,CAAC,iBAAiB,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3D,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,OAAO,OAAO,EAAE,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACtC,MAAM,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/commands/state.d.ts

@@ -0,0 +1,3 @@
+import { Command } from 'commander';
+export declare const stateCommand: Command;
+//# sourceMappingURL=state.d.ts.map

package/dist/commands/state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"state.d.ts","sourceRoot":"","sources":["../../src/commands/state.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAcpC,eAAO,MAAM,YAAY,SA6FrB,CAAC"}

package/dist/commands/state.js

@@ -0,0 +1,92 @@
+import { Command } from 'commander';
+import fs from 'node:fs';
+import path from 'node:path';
+import { logger } from '../core/logger.js';
+import { loadConfig } from '../core/config.js';
+import { getOutputDir, normalizePath } from '../core/paths.js';
+import { writeJsonOutput } from '../core/output.js';
+import { parseSolidityCached } from '../parsers/solidity-parser.js';
+import { parseFunctionSummary } from '../parsers/slither.js';
+import { parseStorageLayout } from '../parsers/solc.js';
+import { extractStateVariables } from '../analysis/state-variables.js';
+import { getSlitherFunctionSummary } from '../core/external-tools.js';
+export const stateCommand = new Command('state')
+    .description('Generate state variable inventory')
+    .option('--project <dir>', 'Project directory')
+    .action(async (opts) => {
+    const spin = logger.spinner('Analyzing state variables...');
+    try {
+        const projectDir = opts.project ?? process.cwd();
+        const config = loadConfig(projectDir);
+        const outputDir = getOutputDir(config.project.project_dir, config.settings.output_dir);
+        // Parse all scope files
+        spin.text = 'Parsing contracts...';
+        const allContracts = [];
+        const fileMap = new Map();
+        for (const scopeFile of config.project.scope) {
+            const filePath = path.resolve(config.project.project_dir, scopeFile);
+            if (!fs.existsSync(filePath))
+                continue;
+            const source = fs.readFileSync(filePath, 'utf-8');
+            const parsed = parseSolidityCached(source, scopeFile);
+            for (const contract of parsed.contracts) {
+                allContracts.push(contract);
+                fileMap.set(contract.name, normalizePath(scopeFile));
+            }
+        }
+        // Try Slither for read/write data
+        spin.text = 'Running Slither data dependency analysis...';
+        let slitherSummary = null;
+        try {
+            const result = await getSlitherFunctionSummary(config.project.project_dir, outputDir);
+            if (result.exitCode === 0 && result.stdout) {
+                slitherSummary = parseFunctionSummary(JSON.parse(result.stdout));
+            }
+        }
+        catch {
+            logger.warn('Slither not available — read/write tracking limited');
+        }
+        // Try solc for storage layout
+        spin.text = 'Checking storage layout...';
+        let storageLayout = null;
+        try {
+            // Try reading from forge build artifacts
+            const outDir = path.join(config.project.project_dir, 'out');
+            if (fs.existsSync(outDir)) {
+                for (const contract of allContracts) {
+                    const artifactPath = path.join(outDir, `${contract.name}.sol`, `${contract.name}.json`);
+                    if (fs.existsSync(artifactPath)) {
+                        const artifact = JSON.parse(fs.readFileSync(artifactPath, 'utf-8'));
+                        if (artifact.storageLayout) {
+                            storageLayout = parseStorageLayout({ contracts: { '': { [contract.name]: { storageLayout: artifact.storageLayout } } } }, contract.name);
+                        }
+                    }
+                }
+            }
+        }
+        catch {
+            logger.dim('Storage layout not available from build artifacts');
+        }
+        // Extract state variables
+        const result = extractStateVariables(allContracts, fileMap, slitherSummary, storageLayout);
+        const stateVars = {
+            variables: result.variables,
+            storage_layout_source: result.storageLayoutSource,
+            storage_collisions: result.storageCollisions,
+        };
+        const outPath = writeJsonOutput(outputDir, 'state-vars.json', stateVars);
+        spin.succeed('State variable analysis complete');
+        logger.info(`Output: ${outPath}`);
+        logger.info(`Found: ${stateVars.variables.length} state variables`);
+        const unused = stateVars.variables.filter((v) => v.is_unused);
+        if (unused.length > 0) {
+            logger.warn(`${unused.length} potentially unused variables detected`);
+        }
+    }
+    catch (err) {
+        spin.fail('State variable analysis failed');
+        logger.error(err instanceof Error ? err.message : String(err));
+        process.exit(1);
+    }
+});
+//# sourceMappingURL=state.js.map

package/dist/commands/state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"state.js","sourceRoot":"","sources":["../../src/commands/state.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAiB,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACnF,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAW,MAAM,2BAA2B,CAAC;AAG/E,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC;KAC7C,WAAW,CAAC,mCAAmC,CAAC;KAChD,MAAM,CAAC,iBAAiB,EAAE,mBAAmB,CAAC;KAC9C,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IACrB,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,8BAA8B,CAAC,CAAC;IAE5D,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QACjD,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;QACtC,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAEvF,wBAAwB;QACxB,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;QACnC,MAAM,YAAY,GAAkD,EAAE,CAAC;QACvE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;QAE1C,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;YACrE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;gBAAE,SAAS;YAEvC,MAAM,MAAM,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAClD,MAAM,MAAM,GAAG,mBAAmB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YAEtD,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;gBACxC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAC5B,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;YACvD,CAAC;QACH,CAAC;QAED,kCAAkC;QAClC,IAAI,CAAC,IAAI,GAAG,6CAA6C,CAAC;QAC1D,IAAI,cAAc,GAAG,IAAI,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;YACtF,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;gBAC3C,cAAc,GAAG,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC;QACrE,CAAC;QAED,8BAA8B;QAC9B,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;QACzC,IAAI,aAAa,GAAG,IAAI,CAAC;QACzB,IAAI,CAAC;YACH,yCAAyC;YACzC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;YAC5D,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC1B,KAAK,MAAM,QAAQ,IAAI,YAAY,EAAE,CAAC;oBACpC,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,OAAO,CAAC,CAAC;oBACxF,IAAI,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;wBAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC;wBACpE,IAAI,QAAQ,CAAC,aAAa,EAAE,CAAC;4BAC3B,aAAa,GAAG,kBAAkB,CAChC,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,aAAa,EAAE,QAAQ,CAAC,aAAa,EAAE,EAAE,EAAE,EAAE,EACrF,QAAQ,CAAC,IAAI,CACd,CAAC;wBACJ,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC;QAClE,CAAC;QAED,0BAA0B;QAC1B,MAAM,MAAM,GAAG,qBAAqB,CAClC,YAAY,EACZ,OAAO,EACP,cAAc,EACd,aAAa,CACd,CAAC;QAEF,MAAM,SAAS,GAAc;YAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,qBAAqB,EAAE,MAAM,CAAC,mBAAmB;YACjD,kBAAkB,EAAE,MAAM,CAAC,iBAAiB;SAC7C,CAAC;QAEF,MAAM,OAAO,GAAG,eAAe,CAAC,SAAS,EAAE,iBAAiB,EAAE,SAAS,CAAC,CAAC;QACzE,IAAI,CAAC,OAAO,CAAC,kCAAkC,CAAC,CAAC;QACjD,MAAM,CAAC,IAAI,CAAC,WAAW,OAAO,EAAE,CAAC,CAAC;QAClC,MAAM,CAAC,IAAI,CAAC,UAAU,SAAS,CAAC,SAAS,CAAC,MAAM,kBAAkB,CAAC,CAAC;QAEpE,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC9D,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,wCAAwC,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;QAC5C,MAAM,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/commands/stats.d.ts

@@ -0,0 +1,3 @@
+import { Command } from 'commander';
+export declare const statsCommand: Command;
+//# sourceMappingURL=stats.d.ts.map

package/dist/commands/stats.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stats.d.ts","sourceRoot":"","sources":["../../src/commands/stats.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAcpC,eAAO,MAAM,YAAY,SAoMrB,CAAC"}