hex-audit 0.4.0

package/dist/commands/stats.js

@@ -0,0 +1,347 @@
+import { Command } from 'commander';
+import fs from 'node:fs';
+import path from 'node:path';
+import { logger } from '../core/logger.js';
+import { loadConfig } from '../core/config.js';
+import { getOutputDir, normalizePath } from '../core/paths.js';
+import { writeJsonOutput } from '../core/output.js';
+import { parseSolidity, parseSolidityCached } from '../parsers/solidity-parser.js';
+import { countNsloc, getCommentRanges, getAssemblyRanges } from '../analysis/nsloc.js';
+import { detectErcs } from '../analysis/erc-detection.js';
+import { parseLcov, coveragePct } from '../parsers/lcov.js';
+import { runForge, flattenFile } from '../core/external-tools.js';
+export const statsCommand = new Command('stats')
+    .description('Generate codebase statistics')
+    .option('--project <dir>', 'Project directory')
+    .option('--no-coverage', 'Skip test coverage')
+    .action(async (opts) => {
+    const spin = logger.spinner('Generating statistics...');
+    try {
+        const projectDir = opts.project ?? process.cwd();
+        const config = loadConfig(projectDir);
+        const outputDir = getOutputDir(config.project.project_dir, config.settings.output_dir);
+        const perContract = [];
+        const allErcs = new Set();
+        const dependencyMap = new Map();
+        let totalFiles = 0;
+        let totalContracts = 0;
+        let totalInterfaces = 0;
+        let totalLibraries = 0;
+        let totalAbstract = 0;
+        let totalLines = 0;
+        let totalNsloc = 0;
+        let totalComments = 0;
+        let totalBlanks = 0;
+        let totalAssembly = 0;
+        spin.text = 'Parsing scope files...';
+        for (const scopeFile of config.project.scope) {
+            const filePath = path.resolve(config.project.project_dir, scopeFile);
+            if (!fs.existsSync(filePath)) {
+                logger.warn(`Scope file not found: ${scopeFile}`);
+                continue;
+            }
+            totalFiles++;
+            const source = fs.readFileSync(filePath, 'utf-8');
+            const parsed = parseSolidityCached(source, scopeFile);
+            // Count lines
+            const commentRanges = getCommentRanges(parsed.comments);
+            const assemblyRanges = getAssemblyRanges(source);
+            const lineCounts = countNsloc(source, commentRanges, assemblyRanges);
+            totalLines += lineCounts.totalLines;
+            totalNsloc += lineCounts.nsloc;
+            totalComments += lineCounts.commentLines;
+            totalBlanks += lineCounts.blankLines;
+            totalAssembly += lineCounts.assemblyLines;
+            // Extract dependencies from imports
+            for (const imp of parsed.imports) {
+                const pkg = extractPackageName(imp.path);
+                if (pkg) {
+                    dependencyMap.set(pkg, (dependencyMap.get(pkg) ?? 0) + 1);
+                }
+            }
+            // Process each contract
+            for (const contract of parsed.contracts) {
+                switch (contract.type) {
+                    case 'interface':
+                        totalInterfaces++;
+                        break;
+                    case 'library':
+                        totalLibraries++;
+                        break;
+                    case 'abstract':
+                        totalAbstract++;
+                        break;
+                    default:
+                        totalContracts++;
+                        break;
+                }
+                const funcNames = contract.functions.map((f) => f.name);
+                const ercs = detectErcs(contract.baseContracts, funcNames);
+                for (const erc of ercs)
+                    allErcs.add(erc);
+                const extFuncs = contract.functions.filter((f) => f.visibility === 'external').length;
+                const pubFuncs = contract.functions.filter((f) => f.visibility === 'public').length;
+                const intFuncs = contract.functions.filter((f) => f.visibility === 'internal').length;
+                const privFuncs = contract.functions.filter((f) => f.visibility === 'private').length;
+                // Per-contract nSLOC using contract body line range
+                const contractNsloc = countNsloc(source, commentRanges, assemblyRanges, {
+                    start: contract.lineStart,
+                    end: contract.lineEnd,
+                });
+                perContract.push({
+                    file: normalizePath(scopeFile),
+                    contract: contract.name,
+                    type: contract.type,
+                    nsloc: contractNsloc.nsloc,
+                    functions: contract.functions.length,
+                    external_functions: extFuncs,
+                    public_functions: pubFuncs,
+                    internal_functions: intFuncs,
+                    private_functions: privFuncs,
+                    modifiers: contract.modifiers.length,
+                    events: contract.events.length,
+                    errors: contract.errors.length,
+                    assembly_lines: contractNsloc.assemblyLines,
+                    inherits: contract.baseContracts,
+                });
+            }
+        }
+        // Second pass: resolve inherited members via forge flatten
+        spin.text = 'Resolving inherited members...';
+        let totalNslocWithDeps = 0;
+        let hasAnyFlattenedData = false;
+        for (const scopeFile of config.project.scope) {
+            const filePath = path.resolve(config.project.project_dir, scopeFile);
+            if (!fs.existsSync(filePath))
+                continue;
+            const flattenedSource = await flattenFile(config.project.project_dir, filePath);
+            if (!flattenedSource)
+                continue;
+            // Count nSLOC on flattened source
+            const flatParsed = parseSolidity(flattenedSource, scopeFile);
+            const flatCommentRanges = getCommentRanges(flatParsed.comments);
+            const flatAssemblyRanges = getAssemblyRanges(flattenedSource);
+            const flatLineCounts = countNsloc(flattenedSource, flatCommentRanges, flatAssemblyRanges);
+            // Assign nsloc_with_deps to each contract in this file using per-contract ranges
+            const fileContracts = perContract.filter((c) => c.file === normalizePath(scopeFile));
+            for (const entry of fileContracts) {
+                // Find the matching contract in the flattened parse to get its line range
+                const flatContract = flatParsed.contracts.find((c) => c.name === entry.contract);
+                if (flatContract) {
+                    const flatContractNsloc = countNsloc(flattenedSource, flatCommentRanges, flatAssemblyRanges, {
+                        start: flatContract.lineStart,
+                        end: flatContract.lineEnd,
+                    });
+                    entry.nsloc_with_deps = flatContractNsloc.nsloc;
+                }
+                else {
+                    entry.nsloc_with_deps = flatLineCounts.nsloc;
+                }
+                totalNslocWithDeps += entry.nsloc_with_deps;
+                hasAnyFlattenedData = true;
+                // Resolve inherited members
+                const resolved = resolveInheritedMembers(entry.contract, flatParsed.contracts);
+                if (resolved) {
+                    entry.total_functions = resolved.functions.length;
+                    entry.total_external_functions = resolved.functions.filter((f) => f.visibility === 'external').length;
+                    entry.total_public_functions = resolved.functions.filter((f) => f.visibility === 'public').length;
+                    entry.total_modifiers = resolved.modifiers.length;
+                    entry.total_events = resolved.events.length;
+                    entry.total_errors = resolved.errors.length;
+                }
+            }
+        }
+        // Resolve dependency versions
+        const dependencies = resolveDependencyVersions(dependencyMap, config.project.project_dir);
+        // Run coverage if enabled
+        let testCoverage = null;
+        if (opts.coverage !== false) {
+            spin.text = 'Running test coverage...';
+            testCoverage = await runTestCoverage(config.project.project_dir);
+        }
+        const stats = {
+            generated_at: new Date().toISOString(),
+            totals: {
+                files: totalFiles,
+                contracts: totalContracts,
+                interfaces: totalInterfaces,
+                libraries: totalLibraries,
+                abstract_contracts: totalAbstract,
+                total_lines: totalLines,
+                nsloc: totalNsloc,
+                comment_lines: totalComments,
+                blank_lines: totalBlanks,
+                assembly_lines: totalAssembly,
+                ...(hasAnyFlattenedData ? { nsloc_with_deps: totalNslocWithDeps } : {}),
+            },
+            solidity_version: config.project.solidity_version,
+            erc_eip_usage: [...allErcs].sort(),
+            dependencies,
+            test_coverage: testCoverage,
+            per_contract: perContract,
+        };
+        const outPath = writeJsonOutput(outputDir, 'stats.json', stats);
+        spin.succeed('Statistics generated');
+        logger.info(`Output: ${outPath}`);
+        logger.info(`Totals: ${totalFiles} files, ${totalContracts} contracts, ${totalNsloc} nSLOC`);
+    }
+    catch (err) {
+        spin.fail('Stats generation failed');
+        logger.error(err instanceof Error ? err.message : String(err));
+        process.exit(1);
+    }
+});
+function extractPackageName(importPath) {
+    // @openzeppelin/contracts/... → @openzeppelin/contracts
+    // solmate/... → solmate
+    if (importPath.startsWith('@')) {
+        const parts = importPath.split('/');
+        if (parts.length >= 2)
+            return `${parts[0]}/${parts[1]}`;
+    }
+    else if (!importPath.startsWith('.') && !importPath.startsWith('/')) {
+        const parts = importPath.split('/');
+        return parts[0];
+    }
+    return null;
+}
+function resolveDependencyVersions(depMap, projectDir) {
+    const deps = [];
+    for (const [pkg, imports] of depMap) {
+        let version = null;
+        // Try lib/<pkg>/package.json (Foundry)
+        const libPkg = path.join(projectDir, 'lib', pkg.replace('@', '').replace('/', '-'), 'package.json');
+        if (fs.existsSync(libPkg)) {
+            try {
+                const json = JSON.parse(fs.readFileSync(libPkg, 'utf-8'));
+                version = json.version ?? null;
+            }
+            catch { /* ignore */ }
+        }
+        // Try node_modules/<pkg>/package.json (Hardhat)
+        if (!version) {
+            const nmPkg = path.join(projectDir, 'node_modules', pkg, 'package.json');
+            if (fs.existsSync(nmPkg)) {
+                try {
+                    const json = JSON.parse(fs.readFileSync(nmPkg, 'utf-8'));
+                    version = json.version ?? null;
+                }
+                catch { /* ignore */ }
+            }
+        }
+        deps.push({ package: pkg, version, imports });
+    }
+    return deps.sort((a, b) => a.package.localeCompare(b.package));
+}
+function resolveInheritedMembers(targetName, allContracts) {
+    const contractMap = new Map();
+    for (const c of allContracts) {
+        contractMap.set(c.name, c);
+    }
+    const target = contractMap.get(targetName);
+    if (!target)
+        return null;
+    const visited = new Set();
+    const allFunctions = [];
+    const allModifiers = [];
+    const allEvents = [];
+    const allErrors = [];
+    function walk(name) {
+        if (visited.has(name))
+            return;
+        visited.add(name);
+        const contract = contractMap.get(name);
+        if (!contract)
+            return;
+        // Walk parents first so child overrides come later
+        for (const base of contract.baseContracts) {
+            walk(base);
+        }
+        allFunctions.push(...contract.functions);
+        allModifiers.push(...contract.modifiers.map((m) => m.name));
+        allEvents.push(...contract.events);
+        allErrors.push(...contract.errors);
+    }
+    walk(targetName);
+    // Deduplicate functions: later entries (child) override earlier (parent) by name
+    const funcMap = new Map();
+    for (const f of allFunctions) {
+        funcMap.set(f.name, f);
+    }
+    // Deduplicate modifiers, events, errors by name
+    const uniqueModifiers = [...new Set(allModifiers)];
+    const uniqueEvents = [...new Set(allEvents)];
+    const uniqueErrors = [...new Set(allErrors)];
+    return {
+        functions: [...funcMap.values()],
+        modifiers: uniqueModifiers,
+        events: uniqueEvents,
+        errors: uniqueErrors,
+    };
+}
+async function runTestCoverage(projectDir) {
+    try {
+        const result = await runForge(projectDir, ['coverage', '--report', 'lcov']);
+        if (result.exitCode !== 0) {
+            const stderrLower = result.stderr.toLowerCase();
+            if (stderrLower.includes('ir-minimum') || stderrLower.includes('stack too deep')) {
+                console.warn('Retrying coverage with --ir-minimum due to stack depth issues...');
+                const retry = await runForge(projectDir, ['coverage', '--report', 'lcov', '--ir-minimum']);
+                if (retry.exitCode !== 0) {
+                    return {
+                        status: 'failed',
+                        failure_reason: `forge coverage exited with code ${retry.exitCode} (after --ir-minimum retry): ${retry.stderr.slice(0, 200)}`,
+                        overall_line_pct: null,
+                        overall_branch_pct: null,
+                        per_contract: [],
+                    };
+                }
+            }
+            else {
+                return {
+                    status: 'failed',
+                    failure_reason: `forge coverage exited with code ${result.exitCode}: ${result.stderr.slice(0, 200)}`,
+                    overall_line_pct: null,
+                    overall_branch_pct: null,
+                    per_contract: [],
+                };
+            }
+        }
+        // Read lcov.info
+        const lcovPath = path.join(projectDir, 'lcov.info');
+        if (!fs.existsSync(lcovPath)) {
+            return {
+                status: 'failed',
+                failure_reason: 'lcov.info not found after forge coverage',
+                overall_line_pct: null,
+                overall_branch_pct: null,
+                per_contract: [],
+            };
+        }
+        const lcovText = fs.readFileSync(lcovPath, 'utf-8');
+        const report = parseLcov(lcovText);
+        return {
+            status: 'available',
+            failure_reason: null,
+            overall_line_pct: coveragePct(report.totalLinesHit, report.totalLinesFound),
+            overall_branch_pct: coveragePct(report.totalBranchesHit, report.totalBranchesFound),
+            per_contract: report.records.map((r) => ({
+                contract: path.basename(r.sourceFile, '.sol'),
+                file: normalizePath(r.sourceFile),
+                line_pct: coveragePct(r.linesHit, r.linesFound),
+                branch_pct: coveragePct(r.branchesHit, r.branchesFound),
+                uncovered_lines: r.uncoveredLines,
+            })),
+        };
+    }
+    catch {
+        return {
+            status: 'failed',
+            failure_reason: 'forge command not available',
+            overall_line_pct: null,
+            overall_branch_pct: null,
+            per_contract: [],
+        };
+    }
+}
+//# sourceMappingURL=stats.js.map

package/dist/commands/stats.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stats.js","sourceRoot":"","sources":["../../src/commands/stats.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAA4C,MAAM,+BAA+B,CAAC;AAC7H,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACvF,OAAO,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAGlE,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC;KAC7C,WAAW,CAAC,8BAA8B,CAAC;KAC3C,MAAM,CAAC,iBAAiB,EAAE,mBAAmB,CAAC;KAC9C,MAAM,CAAC,eAAe,EAAE,oBAAoB,CAAC;KAC7C,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IACrB,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC;IAExD,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QACjD,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;QACtC,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAEvF,MAAM,WAAW,GAAuB,EAAE,CAAC;QAC3C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAClC,MAAM,aAAa,GAAG,IAAI,GAAG,EAAkB,CAAC;QAEhD,IAAI,UAAU,GAAG,CAAC,CAAC;QACnB,IAAI,cAAc,GAAG,CAAC,CAAC;QACvB,IAAI,eAAe,GAAG,CAAC,CAAC;QACxB,IAAI,cAAc,GAAG,CAAC,CAAC;QACvB,IAAI,aAAa,GAAG,CAAC,CAAC;QACtB,IAAI,UAAU,GAAG,CAAC,CAAC;QACnB,IAAI,UAAU,GAAG,CAAC,CAAC;QACnB,IAAI,aAAa,GAAG,CAAC,CAAC;QACtB,IAAI,WAAW,GAAG,CAAC,CAAC;QACpB,IAAI,aAAa,GAAG,CAAC,CAAC;QAEtB,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;QAErC,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;YACrE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC7B,MAAM,CAAC,IAAI,CAAC,yBAAyB,SAAS,EAAE,CAAC,CAAC;gBAClD,SAAS;YACX,CAAC;YAED,UAAU,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAClD,MAAM,MAAM,GAAG,mBAAmB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YAEtD,cAAc;YACd,MAAM,aAAa,GAAG,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACxD,MAAM,cAAc,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;YACjD,MAAM,UAAU,GAAG,UAAU,CAAC,MAAM,EAAE,aAAa,EAAE,cAAc,CAAC,CAAC;YAErE,UAAU,IAAI,UAAU,CAAC,UAAU,CAAC;YACpC,UAAU,IAAI,UAAU,CAAC,KAAK,CAAC;YAC/B,aAAa,IAAI,UAAU,CAAC,YAAY,CAAC;YACzC,WAAW,IAAI,UAAU,CAAC,UAAU,CAAC;YACrC,aAAa,IAAI,UAAU,CAAC,aAAa,CAAC;YAE1C,oCAAoC;YACpC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACjC,MAAM,GAAG,GAAG,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACzC,IAAI,GAAG,EAAE,CAAC;oBACR,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC5D,CAAC;YACH,CAAC;YAED,wBAAwB;YACxB,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;gBACxC,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;oBACtB,KAAK,WAAW;wBAAE,eAAe,EAAE,CAAC;wBAAC,MAAM;oBAC3C,KAAK,SAAS;wBAAE,cAAc,EAAE,CAAC;wBAAC,MAAM;oBACxC,KAAK,UAAU;wBAAE,aAAa,EAAE,CAAC;wBAAC,MAAM;oBACxC;wBAAS,cAAc,EAAE,CAAC;wBAAC,MAAM;gBACnC,CAAC;gBAED,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBACxD,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;gBAC3D,KAAK,MAAM,GAAG,IAAI,IAAI;oBAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBAEzC,MAAM,QAAQ,GAAG,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC,MAAM,CAAC;gBACtF,MAAM,QAAQ,GAAG,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,MAAM,CAAC;gBACpF,MAAM,QAAQ,GAAG,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC,MAAM,CAAC;gBACtF,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,MAAM,CAAC;gBAEtF,oDAAoD;gBACpD,MAAM,aAAa,GAAG,UAAU,CAAC,MAAM,EAAE,aAAa,EAAE,cAAc,EAAE;oBACtE,KAAK,EAAE,QAAQ,CAAC,SAAS;oBACzB,GAAG,EAAE,QAAQ,CAAC,OAAO;iBACtB,CAAC,CAAC;gBAEH,WAAW,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,aAAa,CAAC,SAAS,CAAC;oBAC9B,QAAQ,EAAE,QAAQ,CAAC,IAAI;oBACvB,IAAI,EAAE,QAAQ,CAAC,IAAI;oBACnB,KAAK,EAAE,aAAa,CAAC,KAAK;oBAC1B,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,MAAM;oBACpC,kBAAkB,EAAE,QAAQ;oBAC5B,gBAAgB,EAAE,QAAQ;oBAC1B,kBAAkB,EAAE,QAAQ;oBAC5B,iBAAiB,EAAE,SAAS;oBAC5B,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,MAAM;oBACpC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM;oBAC9B,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM;oBAC9B,cAAc,EAAE,aAAa,CAAC,aAAa;oBAC3C,QAAQ,EAAE,QAAQ,CAAC,aAAa;iBACjC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,2DAA2D;QAC3D,IAAI,CAAC,IAAI,GAAG,gCAAgC,CAAC;QAC7C,IAAI,kBAAkB,GAAG,CAAC,CAAC;QAC3B,IAAI,mBAAmB,GAAG,KAAK,CAAC;QAEhC,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;YACrE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;gBAAE,SAAS;YAEvC,MAAM,eAAe,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;YAChF,IAAI,CAAC,eAAe;gBAAE,SAAS;YAE/B,kCAAkC;YAClC,MAAM,UAAU,GAAG,aAAa,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;YAC7D,MAAM,iBAAiB,GAAG,gBAAgB,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YAChE,MAAM,kBAAkB,GAAG,iBAAiB,CAAC,eAAe,CAAC,CAAC;YAC9D,MAAM,cAAc,GAAG,UAAU,CAAC,eAAe,EAAE,iBAAiB,EAAE,kBAAkB,CAAC,CAAC;YAE1F,iFAAiF;YACjF,MAAM,aAAa,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;YACrF,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;gBAClC,0EAA0E;gBAC1E,MAAM,YAAY,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,QAAQ,CAAC,CAAC;gBACjF,IAAI,YAAY,EAAE,CAAC;oBACjB,MAAM,iBAAiB,GAAG,UAAU,CAAC,eAAe,EAAE,iBAAiB,EAAE,kBAAkB,EAAE;wBAC3F,KAAK,EAAE,YAAY,CAAC,SAAS;wBAC7B,GAAG,EAAE,YAAY,CAAC,OAAO;qBAC1B,CAAC,CAAC;oBACH,KAAK,CAAC,eAAe,GAAG,iBAAiB,CAAC,KAAK,CAAC;gBAClD,CAAC;qBAAM,CAAC;oBACN,KAAK,CAAC,eAAe,GAAG,cAAc,CAAC,KAAK,CAAC;gBAC/C,CAAC;gBACD,kBAAkB,IAAI,KAAK,CAAC,eAAgB,CAAC;gBAC7C,mBAAmB,GAAG,IAAI,CAAC;gBAE3B,4BAA4B;gBAC5B,MAAM,QAAQ,GAAG,uBAAuB,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;gBAC/E,IAAI,QAAQ,EAAE,CAAC;oBACb,KAAK,CAAC,eAAe,GAAG,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC;oBAClD,KAAK,CAAC,wBAAwB,GAAG,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC,MAAM,CAAC;oBACtG,KAAK,CAAC,sBAAsB,GAAG,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,MAAM,CAAC;oBAClG,KAAK,CAAC,eAAe,GAAG,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC;oBAClD,KAAK,CAAC,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;oBAC5C,KAAK,CAAC,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;gBAC9C,CAAC;YACH,CAAC;QACH,CAAC;QAED,8BAA8B;QAC9B,MAAM,YAAY,GAAG,yBAAyB,CAC5C,aAAa,EACb,MAAM,CAAC,OAAO,CAAC,WAAW,CAC3B,CAAC;QAEF,0BAA0B;QAC1B,IAAI,YAAY,GAAwB,IAAI,CAAC;QAC7C,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;YAC5B,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;YACvC,YAAY,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QACnE,CAAC;QAED,MAAM,KAAK,GAAU;YACnB,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACtC,MAAM,EAAE;gBACN,KAAK,EAAE,UAAU;gBACjB,SAAS,EAAE,cAAc;gBACzB,UAAU,EAAE,eAAe;gBAC3B,SAAS,EAAE,cAAc;gBACzB,kBAAkB,EAAE,aAAa;gBACjC,WAAW,EAAE,UAAU;gBACvB,KAAK,EAAE,UAAU;gBACjB,aAAa,EAAE,aAAa;gBAC5B,WAAW,EAAE,WAAW;gBACxB,cAAc,EAAE,aAAa;gBAC7B,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxE;YACD,gBAAgB,EAAE,MAAM,CAAC,OAAO,CAAC,gBAAgB;YACjD,aAAa,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE;YAClC,YAAY;YACZ,aAAa,EAAE,YAAY;YAC3B,YAAY,EAAE,WAAW;SAC1B,CAAC;QAEF,MAAM,OAAO,GAAG,eAAe,CAAC,SAAS,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC;QAChE,IAAI,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;QACrC,MAAM,CAAC,IAAI,CAAC,WAAW,OAAO,EAAE,CAAC,CAAC;QAClC,MAAM,CAAC,IAAI,CACT,WAAW,UAAU,WAAW,cAAc,eAAe,UAAU,QAAQ,CAChF,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;QACrC,MAAM,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,SAAS,kBAAkB,CAAC,UAAkB;IAC5C,wDAAwD;IACxD,wBAAwB;IACxB,IAAI,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC;YAAE,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1D,CAAC;SAAM,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACtE,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACpC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,yBAAyB,CAChC,MAA2B,EAC3B,UAAkB;IAElB,MAAM,IAAI,GAAwE,EAAE,CAAC;IAErF,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,MAAM,EAAE,CAAC;QACpC,IAAI,OAAO,GAAkB,IAAI,CAAC;QAElC,uCAAuC;QACvC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,cAAc,CAAC,CAAC;QACpG,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;gBAC1D,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC;YACjC,CAAC;YAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QAC1B,CAAC;QAED,gDAAgD;QAChD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC;YACzE,IAAI,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzB,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;oBACzD,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC;gBACjC,CAAC;gBAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;AACjE,CAAC;AASD,SAAS,uBAAuB,CAC9B,UAAkB,EAClB,YAA8B;IAE9B,MAAM,WAAW,GAAG,IAAI,GAAG,EAA0B,CAAC;IACtD,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;QAC7B,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC7B,CAAC;IAED,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,YAAY,GAAqB,EAAE,CAAC;IAC1C,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,MAAM,SAAS,GAAa,EAAE,CAAC;IAE/B,SAAS,IAAI,CAAC,IAAY;QACxB,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO;QAC9B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClB,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,QAAQ;YAAE,OAAO;QACtB,mDAAmD;QACnD,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,aAAa,EAAE,CAAC;YAC1C,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,CAAC;QACD,YAAY,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;QACzC,YAAY,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5D,SAAS,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;QACnC,SAAS,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;IAED,IAAI,CAAC,UAAU,CAAC,CAAC;IAEjB,iFAAiF;IACjF,MAAM,OAAO,GAAG,IAAI,GAAG,EAA0B,CAAC;IAClD,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACzB,CAAC;IAED,gDAAgD;IAChD,MAAM,eAAe,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC;IACnD,MAAM,YAAY,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;IAC7C,MAAM,YAAY,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;IAE7C,OAAO;QACL,SAAS,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;QAChC,SAAS,EAAE,eAAe;QAC1B,MAAM,EAAE,YAAY;QACpB,MAAM,EAAE,YAAY;KACrB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,UAAkB;IAC/C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;QAE5E,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAChD,IAAI,WAAW,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBACjF,OAAO,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAC;gBACjF,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC;gBAC3F,IAAI,KAAK,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;oBACzB,OAAO;wBACL,MAAM,EAAE,QAAQ;wBAChB,cAAc,EAAE,mCAAmC,KAAK,CAAC,QAAQ,gCAAgC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;wBAC7H,gBAAgB,EAAE,IAAI;wBACtB,kBAAkB,EAAE,IAAI;wBACxB,YAAY,EAAE,EAAE;qBACjB,CAAC;gBACJ,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,OAAO;oBACL,MAAM,EAAE,QAAQ;oBAChB,cAAc,EAAE,mCAAmC,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;oBACpG,gBAAgB,EAAE,IAAI;oBACtB,kBAAkB,EAAE,IAAI;oBACxB,YAAY,EAAE,EAAE;iBACjB,CAAC;YACJ,CAAC;QACH,CAAC;QAED,iBAAiB;QACjB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QACpD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7B,OAAO;gBACL,MAAM,EAAE,QAAQ;gBAChB,cAAc,EAAE,0CAA0C;gBAC1D,gBAAgB,EAAE,IAAI;gBACtB,kBAAkB,EAAE,IAAI;gBACxB,YAAY,EAAE,EAAE;aACjB,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;QAEnC,OAAO;YACL,MAAM,EAAE,WAAW;YACnB,cAAc,EAAE,IAAI;YACpB,gBAAgB,EAAE,WAAW,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,eAAe,CAAC;YAC3E,kBAAkB,EAAE,WAAW,CAAC,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,kBAAkB,CAAC;YACnF,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACvC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC;gBAC7C,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC;gBACjC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,UAAU,CAAC;gBAC/C,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,aAAa,CAAC;gBACvD,eAAe,EAAE,CAAC,CAAC,cAAc;aAClC,CAAC,CAAC;SACJ,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,cAAc,EAAE,6BAA6B;YAC7C,gBAAgB,EAAE,IAAI;YACtB,kBAAkB,EAAE,IAAI;YACxB,YAAY,EAAE,EAAE;SACjB,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/commands/surface.d.ts

@@ -0,0 +1,3 @@
+import { Command } from 'commander';
+export declare const surfaceCommand: Command;
+//# sourceMappingURL=surface.d.ts.map

package/dist/commands/surface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"surface.d.ts","sourceRoot":"","sources":["../../src/commands/surface.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAWpC,eAAO,MAAM,cAAc,SAyCvB,CAAC"}

package/dist/commands/surface.js

@@ -0,0 +1,45 @@
+import { Command } from 'commander';
+import path from 'node:path';
+import { logger } from '../core/logger.js';
+import { loadConfig } from '../core/config.js';
+import { getOutputDir, normalizePath } from '../core/paths.js';
+import { writeJsonOutput, readJsonFile } from '../core/output.js';
+import { buildAttackSurface } from '../analysis/attack-surface.js';
+export const surfaceCommand = new Command('surface')
+    .description('Build attack surface summary from existing analysis data')
+    .option('--project <dir>', 'Project directory')
+    .action(async (opts) => {
+    const spin = logger.spinner('Building attack surface...');
+    try {
+        const projectDir = opts.project ?? process.cwd();
+        const config = loadConfig(projectDir);
+        const outputDir = getOutputDir(config.project.project_dir, config.settings.output_dir);
+        // Read existing analysis outputs
+        spin.text = 'Reading analysis artifacts...';
+        const access = readJsonFile(normalizePath(path.join(outputDir, 'access-control.json')));
+        const calls = readJsonFile(normalizePath(path.join(outputDir, 'external-calls.json')));
+        const stateVars = readJsonFile(normalizePath(path.join(outputDir, 'state-vars.json')));
+        const patterns = readJsonFile(normalizePath(path.join(outputDir, 'patterns.json')));
+        const constraints = readJsonFile(normalizePath(path.join(outputDir, 'constraints.json')));
+        if (!access && !calls) {
+            spin.fail('No analysis data found — run `hex analyze` first');
+            process.exit(1);
+        }
+        spin.text = 'Cross-referencing analysis data...';
+        const result = buildAttackSurface(access, calls, stateVars, patterns, constraints);
+        const outPath = writeJsonOutput(outputDir, 'attack-surface.json', result);
+        spin.succeed(`Attack surface: ${result.summary.total_entry_points} entry points`);
+        logger.info(`  Permissionless: ${result.summary.permissionless_count}, Role-gated: ${result.summary.role_gated_count}, Owner-only: ${result.summary.owner_only_count}`);
+        logger.info(`  External dependencies: ${result.summary.external_dependency_count}`);
+        if (result.summary.risk_signal_count > 0) {
+            logger.warn(`  Risk signals: ${result.summary.risk_signal_count}`);
+        }
+        logger.dim(`  → ${outPath}`);
+    }
+    catch (err) {
+        spin.fail('Attack surface analysis failed');
+        logger.error(err instanceof Error ? err.message : String(err));
+        process.exit(1);
+    }
+});
+//# sourceMappingURL=surface.js.map

package/dist/commands/surface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"surface.js","sourceRoot":"","sources":["../../src/commands/surface.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAClE,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AAKnE,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,OAAO,CAAC,SAAS,CAAC;KACjD,WAAW,CAAC,0DAA0D,CAAC;KACvE,MAAM,CAAC,iBAAiB,EAAE,mBAAmB,CAAC;KAC9C,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IACrB,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC;IAE1D,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QACjD,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;QACtC,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAEvF,iCAAiC;QACjC,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;QAC5C,MAAM,MAAM,GAAG,YAAY,CAAgB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACvG,MAAM,KAAK,GAAG,YAAY,CAAgB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACtG,MAAM,SAAS,GAAG,YAAY,CAAY,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC;QAClG,MAAM,QAAQ,GAAG,YAAY,CAAgB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC;QACnG,MAAM,WAAW,GAAG,YAAY,CAAmB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC;QAE5G,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;YACtB,IAAI,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC;YAC9D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,IAAI,CAAC,IAAI,GAAG,oCAAoC,CAAC;QACjD,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;QAEnF,MAAM,OAAO,GAAG,eAAe,CAAC,SAAS,EAAE,qBAAqB,EAAE,MAAM,CAAC,CAAC;QAE1E,IAAI,CAAC,OAAO,CAAC,mBAAmB,MAAM,CAAC,OAAO,CAAC,kBAAkB,eAAe,CAAC,CAAC;QAClF,MAAM,CAAC,IAAI,CAAC,qBAAqB,MAAM,CAAC,OAAO,CAAC,oBAAoB,iBAAiB,MAAM,CAAC,OAAO,CAAC,gBAAgB,iBAAiB,MAAM,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;QACxK,MAAM,CAAC,IAAI,CAAC,4BAA4B,MAAM,CAAC,OAAO,CAAC,yBAAyB,EAAE,CAAC,CAAC;QACpF,IAAI,MAAM,CAAC,OAAO,CAAC,iBAAiB,GAAG,CAAC,EAAE,CAAC;YACzC,MAAM,CAAC,IAAI,CAAC,mBAAmB,MAAM,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,OAAO,OAAO,EAAE,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;QAC5C,MAAM,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/commands/update-skills.d.ts

@@ -0,0 +1,3 @@
+import { Command } from 'commander';
+export declare const updateSkillsCommand: Command;
+//# sourceMappingURL=update-skills.d.ts.map

package/dist/commands/update-skills.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"update-skills.d.ts","sourceRoot":"","sources":["../../src/commands/update-skills.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAMpC,eAAO,MAAM,mBAAmB,SAgC5B,CAAC"}

package/dist/commands/update-skills.js

@@ -0,0 +1,40 @@
+import { Command } from 'commander';
+import fs from 'node:fs';
+import path from 'node:path';
+import { logger } from '../core/logger.js';
+import { copySkillsToClaudeFormat, getClaudeSkillsDir } from '../core/skills.js';
+export const updateSkillsCommand = new Command('update-skills')
+    .description('Update skill files in .claude/skills/ from the bundled version')
+    .option('--project <dir>', 'Project directory')
+    .option('--keep-custom', 'Skip existing skill files instead of overwriting')
+    .action(async (opts) => {
+    try {
+        const projectDir = path.resolve(opts.project ?? process.cwd());
+        const claudeSkillsDir = getClaudeSkillsDir(projectDir);
+        // Warn about legacy skills directory
+        const legacyDir = path.join(projectDir, '.hex', 'skills');
+        if (fs.existsSync(legacyDir)) {
+            logger.warn(`Legacy skills directory found at .hex/skills/`);
+            logger.warn(`Skills now live in .claude/skills/ — you can remove the legacy directory.`);
+        }
+        const result = copySkillsToClaudeFormat({
+            targetDir: claudeSkillsDir,
+            keepCustom: opts.keepCustom,
+        });
+        const parts = [];
+        if (result.updated > 0)
+            parts.push(`Updated: ${result.updated} skills`);
+        if (result.added > 0)
+            parts.push(`Added: ${result.added} new skills`);
+        if (result.skipped > 0)
+            parts.push(`Skipped: ${result.skipped} (--keep-custom)`);
+        if (result.removed > 0)
+            parts.push(`Removed: ${result.removed} orphaned skills`);
+        logger.success(parts.join(', ') || 'No skill files to process');
+    }
+    catch (err) {
+        logger.error(err instanceof Error ? err.message : String(err));
+        process.exit(1);
+    }
+});
+//# sourceMappingURL=update-skills.js.map

package/dist/commands/update-skills.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"update-skills.js","sourceRoot":"","sources":["../../src/commands/update-skills.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAEjF,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,OAAO,CAAC,eAAe,CAAC;KAC5D,WAAW,CAAC,gEAAgE,CAAC;KAC7E,MAAM,CAAC,iBAAiB,EAAE,mBAAmB,CAAC;KAC9C,MAAM,CAAC,eAAe,EAAE,kDAAkD,CAAC;KAC3E,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IACrB,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAC/D,MAAM,eAAe,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;QAEvD,qCAAqC;QACrC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC1D,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7B,MAAM,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;YAC7D,MAAM,CAAC,IAAI,CAAC,2EAA2E,CAAC,CAAC;QAC3F,CAAC;QAED,MAAM,MAAM,GAAG,wBAAwB,CAAC;YACtC,SAAS,EAAE,eAAe;YAC1B,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC,CAAC;QAEH,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,IAAI,MAAM,CAAC,OAAO,GAAG,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,YAAY,MAAM,CAAC,OAAO,SAAS,CAAC,CAAC;QACxE,IAAI,MAAM,CAAC,KAAK,GAAG,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,KAAK,aAAa,CAAC,CAAC;QACtE,IAAI,MAAM,CAAC,OAAO,GAAG,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,YAAY,MAAM,CAAC,OAAO,kBAAkB,CAAC,CAAC;QACjF,IAAI,MAAM,CAAC,OAAO,GAAG,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,YAAY,MAAM,CAAC,OAAO,kBAAkB,CAAC,CAAC;QAEjF,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,2BAA2B,CAAC,CAAC;IAClE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/commands/update.d.ts

@@ -0,0 +1,3 @@
+import { Command } from 'commander';
+export declare const updateCommand: Command;
+//# sourceMappingURL=update.d.ts.map

package/dist/commands/update.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../../src/commands/update.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAmBpC,eAAO,MAAM,aAAa,SAqDtB,CAAC"}

package/dist/commands/update.js

@@ -0,0 +1,157 @@
+import { Command } from 'commander';
+import { spawn, execSync } from 'node:child_process';
+import { createInterface } from 'node:readline/promises';
+import { stdin, stdout } from 'node:process';
+import path from 'node:path';
+import fs from 'node:fs';
+import { logger } from '../core/logger.js';
+import { copySkillsToClaudeFormat, getClaudeSkillsDir } from '../core/skills.js';
+export const updateCommand = new Command('update')
+    .description("Update hex-audit to the latest version, then re-sync skills in the current project")
+    .option('-y, --yes', 'Skip the post-install skill-sync prompt (treat as yes)')
+    .option('--check', "Only show current vs latest version, don't install")
+    .option('--project <dir>', 'Project directory for the post-install skill sync (default: cwd)')
+    .action(async (opts) => {
+    try {
+        const ctx = detectInstall();
+        const current = readCurrentVersion(ctx.packageDir);
+        const latest = fetchLatestVersion();
+        logger.info(`current: ${current}`);
+        logger.info(`latest:  ${latest}`);
+        if (current === latest) {
+            logger.success('Already on latest.');
+            if (!opts.check)
+                await maybeRunSkillSync(opts);
+            return;
+        }
+        if (opts.check) {
+            logger.info(`An update is available (${current} → ${latest}). Run \`hex update\` to install.`);
+            return;
+        }
+        if (ctx.kind === 'unknown') {
+            logger.warn('Could not determine how hex-audit was installed. Looks like you ran via npx or a cache.');
+            logger.info('Run `npx hex-audit@latest <command>` next time, or install globally: `npm install -g hex-audit@latest`.');
+            process.exit(1);
+        }
+        const installCmd = ctx.kind === 'global'
+            ? ['npm', 'install', '-g', 'hex-audit@latest']
+            : ['npm', 'install', 'hex-audit@latest'];
+        const cwd = ctx.kind === 'global' ? process.cwd() : (ctx.installDir ?? process.cwd());
+        logger.info(`Running: ${installCmd.join(' ')}${ctx.kind === 'local' ? ` (in ${cwd})` : ''}`);
+        const ok = await runInstall(installCmd, cwd);
+        if (!ok) {
+            logger.error('Install failed. See the npm output above.');
+            process.exit(1);
+        }
+        logger.success(`Updated ${current} → ${latest}.`);
+        await maybeRunSkillSync(opts);
+    }
+    catch (err) {
+        logger.error(err instanceof Error ? err.message : String(err));
+        process.exit(1);
+    }
+});
+function detectInstall() {
+    // Resolve the real path of the binary that was launched, so symlinks
+    // (npm's global bin shim → actual file) don't confuse us.
+    const argv1 = process.argv[1] ?? '';
+    let realScript = argv1;
+    try {
+        realScript = fs.realpathSync(argv1);
+    }
+    catch {
+        /* leave argv1 as-is */
+    }
+    // package root is two levels up from <pkg>/dist/index.js
+    const packageDir = path.resolve(path.dirname(realScript), '..');
+    // Compare against npm's reported global prefix.
+    let globalRoot = '';
+    try {
+        globalRoot = execSync('npm root -g', { encoding: 'utf-8' }).trim();
+    }
+    catch {
+        /* npm might be missing — treat as unknown */
+    }
+    if (globalRoot && realScript.startsWith(globalRoot)) {
+        return { kind: 'global', packageDir };
+    }
+    // Local install: package dir is somewhere under a project's node_modules.
+    const nodeModulesIdx = packageDir.lastIndexOf(`${path.sep}node_modules${path.sep}`);
+    if (nodeModulesIdx !== -1) {
+        const installDir = packageDir.slice(0, nodeModulesIdx);
+        return { kind: 'local', packageDir, installDir };
+    }
+    // Could be in dev (running from a checkout) or via npx cache.
+    if (fs.existsSync(path.join(packageDir, 'package.json'))) {
+        // Heuristic: if .git exists at packageDir, we're in a dev checkout — no update needed.
+        if (fs.existsSync(path.join(packageDir, '.git'))) {
+            logger.warn('Running from a git checkout — `hex update` is for installed packages.');
+            logger.info('To update your checkout: `git pull && npm install && npm run build`.');
+            process.exit(0);
+        }
+    }
+    return { kind: 'unknown', packageDir };
+}
+function readCurrentVersion(packageDir) {
+    const pkgPath = path.join(packageDir, 'package.json');
+    try {
+        const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf-8'));
+        return pkg.version ?? '0.0.0';
+    }
+    catch {
+        return '0.0.0';
+    }
+}
+function fetchLatestVersion() {
+    try {
+        return execSync('npm view hex-audit version', { encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
+    }
+    catch {
+        throw new Error('Could not fetch the latest version from the npm registry. Are you online?');
+    }
+}
+function runInstall(cmd, cwd) {
+    return new Promise((resolve) => {
+        const [bin, ...args] = cmd;
+        const child = spawn(bin, args, { cwd, stdio: 'inherit', shell: true });
+        child.on('close', (code) => resolve(code === 0));
+        child.on('error', () => resolve(false));
+    });
+}
+async function maybeRunSkillSync(opts) {
+    const projectDir = path.resolve(opts.project ?? process.cwd());
+    const claudeSkillsDir = getClaudeSkillsDir(projectDir);
+    if (!fs.existsSync(claudeSkillsDir)) {
+        logger.dim(`Skills: skipped (no .claude/skills/ in ${projectDir}).`);
+        return;
+    }
+    if (!opts.yes) {
+        const answer = await prompt(`Re-copy skills into ${claudeSkillsDir}? [Y/n] `);
+        const yes = answer.trim() === '' || /^y(es)?$/i.test(answer.trim());
+        if (!yes) {
+            logger.dim('Skills: skipped (declined).');
+            return;
+        }
+    }
+    const result = copySkillsToClaudeFormat({ targetDir: claudeSkillsDir });
+    const parts = [];
+    if (result.updated > 0)
+        parts.push(`Updated: ${result.updated}`);
+    if (result.added > 0)
+        parts.push(`Added: ${result.added}`);
+    if (result.removed > 0)
+        parts.push(`Removed: ${result.removed}`);
+    logger.success(`Skills: ${parts.join(', ') || 'no changes'}.`);
+}
+async function prompt(question) {
+    if (!stdin.isTTY)
+        return '';
+    const rl = createInterface({ input: stdin, output: stdout });
+    try {
+        return await rl.question(question);
+    }
+    finally {
+        rl.close();
+    }
+}
+//# sourceMappingURL=update.js.map