hex-audit 0.7.0 → 0.8.0

package/dist/core/dedup.d.ts

@@ -0,0 +1,56 @@
+import type { Facts } from '../types/index.js';
+export declare const DEDUP_RULES = "Compare the two findings on four signals:\n- contract (boolean): does the affected contract match?\n- function (boolean): does the affected function match?\n- root_cause: same / overlapping / different \u2014 the technical mechanism.\n- attack_vector: same / overlapping / different \u2014 what the attacker actually does.\n\nThey are duplicates when at least one holds:\n1. root_cause = same AND function = true\n2. root_cause = same AND contract = true AND attack_vector = same\n3. root_cause = overlapping AND function = true AND attack_vector = same\n\nThe canonical card is the earliest-created card that is not itself a duplicate.\nA synced (GitHub) card always wins over a local one.";
+interface FindingLike {
+    id: string;
+    title?: string;
+    description?: string;
+    created_at?: string;
+    root_cause?: {
+        locations?: Array<{
+            file: string;
+            snippet?: string;
+        }>;
+    };
+}
+export declare function projectDirOf(outputDir: string): string;
+/**
+ * Exact function ids a finding is about: snippet lines located in the cited
+ * files, plus backticked `name(...)` identifiers resolved within the cited
+ * contracts (or anywhere when no file is cited).
+ */
+export declare function functionsForFinding(facts: Facts, finding: FindingLike, projectDir: string): string[];
+export interface DedupCandidate {
+    id: string;
+    title: string;
+    status: string;
+    source: string;
+    same_function: boolean;
+    same_contract: boolean;
+    shared_functions: string[];
+    title_similarity: number;
+    strength: 'strong' | 'weak';
+}
+export interface DedupReport {
+    id: string;
+    functions: string[];
+    candidates: DedupCandidate[];
+    rules: string;
+}
+/** Rank existing cards that may duplicate `id`. Judgement stays with the caller. */
+export declare function dedupCandidates(outputDir: string, id: string, limit?: number): DedupReport;
+export interface MatchSignals {
+    contract: boolean;
+    function: boolean;
+    root_cause: 'same' | 'overlapping' | 'different';
+    attack_vector: 'same' | 'overlapping' | 'different';
+}
+/** Move `id` to Duplicate pointing at `of`, and record why — in one step. */
+export declare function markDuplicate(outputDir: string, id: string, of: string, input: {
+    signals: MatchSignals;
+    reasoning: string;
+    confidence: 'high' | 'medium' | 'low';
+}): void;
+/** Reject `id` because a triage rule covers it, and record which rule. */
+export declare function excludeByRule(outputDir: string, id: string, ruleId: string, ruleText: string): void;
+export {};
+//# sourceMappingURL=dedup.d.ts.map

package/dist/core/dedup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dedup.d.ts","sourceRoot":"","sources":["../../src/core/dedup.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,KAAK,EAAiB,MAAM,mBAAmB,CAAC;AAE9D,eAAO,MAAM,WAAW,urBAY6B,CAAC;AAEtD,UAAU,WAAW;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,OAAO,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC;CACxE;AAiBD,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAGtD;AAYD;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,KAAK,EACZ,OAAO,EAAE,WAAW,EACpB,UAAU,EAAE,MAAM,GACjB,MAAM,EAAE,CA6CV;AAsCD,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,QAAQ,GAAG,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,UAAU,EAAE,cAAc,EAAE,CAAC;IAC7B,KAAK,EAAE,MAAM,CAAC;CACf;AAED,oFAAoF;AACpF,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,SAAI,GAAG,WAAW,CA0CrF;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,aAAa,GAAG,WAAW,CAAC;IACjD,aAAa,EAAE,MAAM,GAAG,aAAa,GAAG,WAAW,CAAC;CACrD;AAmBD,6EAA6E;AAC7E,wBAAgB,aAAa,CAC3B,SAAS,EAAE,MAAM,EACjB,EAAE,EAAE,MAAM,EACV,EAAE,EAAE,MAAM,EACV,KAAK,EAAE;IAAE,OAAO,EAAE,YAAY,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAA;CAAE,GACzF,IAAI,CAaN;AAED,0EAA0E;AAC1E,wBAAgB,aAAa,CAC3B,SAAS,EAAE,MAAM,EACjB,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GACf,IAAI,CAMN"}

package/dist/core/dedup.js

@@ -0,0 +1,208 @@
+/**
+ * One dedup engine for every finding source (manual, AuditAgent, /ai-audit,
+ * conformance, GitHub, prior-audit, invariant). The deterministic part —
+ * mapping cards to exact functions and ranking candidates — lives here; the
+ * semantic judgement (root cause, attack vector) is the agent's, against the
+ * rules below, which exist only in this file.
+ *
+ * Node builtins only (the dashboard and the MCP server import it).
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import { moveIssue } from './issues.js';
+export const DEDUP_RULES = `Compare the two findings on four signals:
+- contract (boolean): does the affected contract match?
+- function (boolean): does the affected function match?
+- root_cause: same / overlapping / different — the technical mechanism.
+- attack_vector: same / overlapping / different — what the attacker actually does.
+
+They are duplicates when at least one holds:
+1. root_cause = same AND function = true
+2. root_cause = same AND contract = true AND attack_vector = same
+3. root_cause = overlapping AND function = true AND attack_vector = same
+
+The canonical card is the earliest-created card that is not itself a duplicate.
+A synced (GitHub) card always wins over a local one.`;
+function readJson(file) {
+    try {
+        return JSON.parse(fs.readFileSync(file, 'utf-8'));
+    }
+    catch {
+        return null;
+    }
+}
+export function projectDirOf(outputDir) {
+    const cfg = readJson(path.join(outputDir, 'config.json'));
+    return cfg?.project?.project_dir ?? path.dirname(outputDir);
+}
+function loadFactsFile(outputDir) {
+    return readJson(path.join(outputDir, 'facts.json'));
+}
+function enclosing(facts, file, line) {
+    return facts.functions.filter((f) => f.file === file && f.line_start <= line && line <= f.line_end && f.kind !== 'modifier');
+}
+/**
+ * Exact function ids a finding is about: snippet lines located in the cited
+ * files, plus backticked `name(...)` identifiers resolved within the cited
+ * contracts (or anywhere when no file is cited).
+ */
+export function functionsForFinding(facts, finding, projectDir) {
+    const out = new Set();
+    const files = (finding.root_cause?.locations ?? []).map((l) => l.file);
+    const probeLines = (code) => code
+        .split(/\r?\n/)
+        .map((l) => l.trim())
+        .filter((l) => l.length > 8 && !l.startsWith('//') && l !== '// ....');
+    const locate = (file, probes) => {
+        let content;
+        try {
+            content = fs.readFileSync(path.join(projectDir, file), 'utf-8');
+        }
+        catch {
+            return;
+        }
+        const lines = content.split(/\r?\n/);
+        for (const probe of probes.slice(0, 6)) {
+            const idx = lines.findIndex((l) => l.trim() === probe || l.includes(probe));
+            if (idx >= 0)
+                for (const f of enclosing(facts, file, idx + 1))
+                    out.add(f.id);
+        }
+    };
+    for (const loc of finding.root_cause?.locations ?? []) {
+        if (loc.snippet)
+            locate(loc.file, probeLines(loc.snippet));
+    }
+    // Hex-standard descriptions carry the offending code in a fenced block.
+    const blocks = [...(finding.description ?? '').matchAll(/```[a-z]*\n([\s\S]*?)```/g)].map((m) => m[1]);
+    if (blocks.length) {
+        const searchFiles = files.length
+            ? [...new Set(files)]
+            : [...new Set(facts.functions.filter((f) => f.in_scope).map((f) => f.file))];
+        const probes = blocks.flatMap(probeLines);
+        for (const file of searchFiles)
+            locate(file, probes);
+    }
+    const text = `${finding.title ?? ''}\n${finding.description ?? ''}`;
+    const names = new Set([...text.matchAll(/`([A-Za-z_][A-Za-z0-9_]*)\(/g)].map((m) => m[1]));
+    for (const name of names) {
+        for (const f of facts.functions) {
+            if (f.name !== name || f.kind === 'modifier')
+                continue;
+            if (files.length && !files.includes(f.file))
+                continue;
+            out.add(f.id);
+        }
+    }
+    return [...out].sort();
+}
+function tokens(s) {
+    return new Set(s
+        .toLowerCase()
+        .replace(/[`*_()[\],.:;]/g, ' ')
+        .split(/\s+/)
+        .filter((t) => t.length > 2 && !STOP.has(t)));
+}
+const STOP = new Set([
+    'the',
+    'and',
+    'for',
+    'can',
+    'not',
+    'with',
+    'from',
+    'that',
+    'this',
+    'are',
+    'when',
+    'into',
+    'may',
+    'allows',
+    'missing',
+    'lack',
+    'lacks',
+]);
+function jaccard(a, b) {
+    if (a.size === 0 || b.size === 0)
+        return 0;
+    let inter = 0;
+    for (const x of a)
+        if (b.has(x))
+            inter++;
+    return inter / (a.size + b.size - inter);
+}
+/** Rank existing cards that may duplicate `id`. Judgement stays with the caller. */
+export function dedupCandidates(outputDir, id, limit = 8) {
+    const findings = readJson(path.join(outputDir, 'findings.json'))?.findings ?? [];
+    const tracking = readJson(path.join(outputDir, 'tracking.json'))?.findings ?? [];
+    const facts = loadFactsFile(outputDir);
+    const projectDir = projectDirOf(outputDir);
+    const byId = new Map(findings.map((f) => [f.id, f]));
+    const target = byId.get(id) ?? { id, title: tracking.find((t) => t.id === id)?.title ?? '' };
+    const targetFns = facts ? functionsForFinding(facts, target, projectDir) : [];
+    const contractsOf = (fns) => new Set(fns.map((f) => f.slice(0, f.indexOf('.'))));
+    const targetContracts = contractsOf(targetFns);
+    const targetTokens = tokens(target.title ?? '');
+    const candidates = [];
+    for (const t of tracking) {
+        if (t.id === id || t.status === 'duplicate')
+            continue;
+        const f = byId.get(t.id) ?? { id: t.id, title: t.title };
+        const fns = facts ? functionsForFinding(facts, f, projectDir) : [];
+        const shared = fns.filter((x) => targetFns.includes(x));
+        const sameContract = [...contractsOf(fns)].some((c) => targetContracts.has(c));
+        const sim = jaccard(targetTokens, tokens(f.title ?? t.title));
+        if (!shared.length && !sameContract && sim < 0.25)
+            continue;
+        candidates.push({
+            id: t.id,
+            title: t.title,
+            status: t.status,
+            source: t.source,
+            same_function: shared.length > 0,
+            same_contract: sameContract,
+            shared_functions: shared,
+            title_similarity: Math.round(sim * 100) / 100,
+            strength: shared.length > 0 || (sameContract && sim >= 0.3) ? 'strong' : 'weak',
+        });
+    }
+    candidates.sort((a, b) => Number(b.same_function) - Number(a.same_function) ||
+        Number(b.same_contract) - Number(a.same_contract) ||
+        b.title_similarity - a.title_similarity);
+    return { id, functions: targetFns, candidates: candidates.slice(0, limit), rules: DEDUP_RULES };
+}
+function readComparison(outputDir) {
+    const c = readJson(path.join(outputDir, 'comparison.json'));
+    return { duplicates: c?.duplicates ?? [], novel: c?.novel ?? [], rejected: c?.rejected ?? [] };
+}
+function writeComparison(outputDir, c) {
+    const p = path.join(outputDir, 'comparison.json');
+    const tmp = p + '.tmp';
+    fs.writeFileSync(tmp, JSON.stringify(c, null, 2) + '\n', 'utf-8');
+    fs.renameSync(tmp, p);
+}
+/** Move `id` to Duplicate pointing at `of`, and record why — in one step. */
+export function markDuplicate(outputDir, id, of, input) {
+    if (id === of)
+        throw new Error('A card cannot duplicate itself.');
+    moveIssue(outputDir, id, 'duplicate', of);
+    const c = readComparison(outputDir);
+    c.duplicates = c.duplicates.filter((d) => d.ai_finding !== id);
+    c.duplicates.push({
+        ai_finding: id,
+        matches: of,
+        confidence: input.confidence,
+        match_signals: input.signals,
+        reasoning: input.reasoning,
+    });
+    writeComparison(outputDir, c);
+}
+/** Reject `id` because a triage rule covers it, and record which rule. */
+export function excludeByRule(outputDir, id, ruleId, ruleText) {
+    moveIssue(outputDir, id, 'rejected');
+    const c = readComparison(outputDir);
+    c.rejected = c.rejected.filter((r) => r.id !== id);
+    c.rejected.push({ id, reason: `${ruleId}: ${ruleText}` });
+    writeComparison(outputDir, c);
+}
+//# sourceMappingURL=dedup.js.map

package/dist/core/dedup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dedup.js","sourceRoot":"","sources":["../../src/core/dedup.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAGxC,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;;qDAY0B,CAAC;AAiBtD,SAAS,QAAQ,CAAI,IAAY;IAC/B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAM,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,SAAiB;IAC5C,MAAM,GAAG,GAAG,QAAQ,CAAyC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC;IAClG,OAAO,GAAG,EAAE,OAAO,EAAE,WAAW,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,aAAa,CAAC,SAAiB;IACtC,OAAO,QAAQ,CAAQ,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,SAAS,CAAC,KAAY,EAAE,IAAY,EAAE,IAAY;IACzD,OAAO,KAAK,CAAC,SAAS,CAAC,MAAM,CAC3B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,UAAU,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,CAC9F,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAAY,EACZ,OAAoB,EACpB,UAAkB;IAElB,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACvE,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,EAAE,CAClC,IAAI;SACD,KAAK,CAAC,OAAO,CAAC;SACd,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,MAAgB,EAAE,EAAE;QAChD,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;QAClE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACrC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YACvC,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,KAAK,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;YAC5E,IAAI,GAAG,IAAI,CAAC;gBAAE,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,CAAC;oBAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,UAAU,EAAE,SAAS,IAAI,EAAE,EAAE,CAAC;QACtD,IAAI,GAAG,CAAC,OAAO;YAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7D,CAAC;IACD,wEAAwE;IACxE,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,2BAA2B,CAAC,CAAC,CAAC,GAAG,CACvF,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CACZ,CAAC;IACF,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM;YAC9B,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC/E,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC1C,KAAK,MAAM,IAAI,IAAI,WAAW;YAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,OAAO,CAAC,KAAK,IAAI,EAAE,KAAK,OAAO,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC;IACpE,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,8BAA8B,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3F,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YAChC,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU;gBAAE,SAAS;YACvD,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;gBAAE,SAAS;YACtD,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAChB,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AACzB,CAAC;AAED,SAAS,MAAM,CAAC,CAAS;IACvB,OAAO,IAAI,GAAG,CACZ,CAAC;SACE,WAAW,EAAE;SACb,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC;SAC/B,KAAK,CAAC,KAAK,CAAC;SACZ,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAC/C,CAAC;AACJ,CAAC;AACD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC;IACnB,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;IACN,KAAK;IACL,QAAQ;IACR,SAAS;IACT,MAAM;IACN,OAAO;CACR,CAAC,CAAC;AAEH,SAAS,OAAO,CAAC,CAAc,EAAE,CAAc;IAC7C,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IAC3C,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,CAAC,IAAI,CAAC;QAAE,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,KAAK,EAAE,CAAC;IACzC,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC;AAC3C,CAAC;AAqBD,oFAAoF;AACpF,MAAM,UAAU,eAAe,CAAC,SAAiB,EAAE,EAAU,EAAE,KAAK,GAAG,CAAC;IACtE,MAAM,QAAQ,GACZ,QAAQ,CAA8B,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC,EAAE,QAAQ,IAAI,EAAE,CAAC;IAC/F,MAAM,QAAQ,GACZ,QAAQ,CAA+B,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC,EAAE,QAAQ,IAAI,EAAE,CAAC;IAChG,MAAM,KAAK,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IACvC,MAAM,UAAU,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC;IAC7F,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9E,MAAM,WAAW,GAAG,CAAC,GAAa,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3F,MAAM,eAAe,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IAC/C,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IAEhD,MAAM,UAAU,GAAqB,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,MAAM,KAAK,WAAW;YAAE,SAAS;QACtD,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;QACzD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,mBAAmB,CAAC,KAAK,EAAE,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACxD,MAAM,YAAY,GAAG,CAAC,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/E,MAAM,GAAG,GAAG,OAAO,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QAC9D,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,YAAY,IAAI,GAAG,GAAG,IAAI;YAAE,SAAS;QAC5D,UAAU,CAAC,IAAI,CAAC;YACd,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,aAAa,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC;YAChC,aAAa,EAAE,YAAY;YAC3B,gBAAgB,EAAE,MAAM;YACxB,gBAAgB,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,GAAG,CAAC,GAAG,GAAG;YAC7C,QAAQ,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM;SAChF,CAAC,CAAC;IACL,CAAC;IACD,UAAU,CAAC,IAAI,CACb,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACP,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC;QACjD,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC;QACjD,CAAC,CAAC,gBAAgB,GAAG,CAAC,CAAC,gBAAgB,CAC1C,CAAC;IACF,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;AAClG,CAAC;AAeD,SAAS,cAAc,CAAC,SAAiB;IACvC,MAAM,CAAC,GAAG,QAAQ,CAA0B,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC,CAAC;IACrF,OAAO,EAAE,UAAU,EAAE,CAAC,EAAE,UAAU,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,IAAI,EAAE,EAAE,CAAC;AACjG,CAAC;AACD,SAAS,eAAe,CAAC,SAAiB,EAAE,CAAiB;IAC3D,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;IAClD,MAAM,GAAG,GAAG,CAAC,GAAG,MAAM,CAAC;IACvB,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;IAClE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;AACxB,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,aAAa,CAC3B,SAAiB,EACjB,EAAU,EACV,EAAU,EACV,KAA0F;IAE1F,IAAI,EAAE,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IAClE,SAAS,CAAC,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC;IAC1C,MAAM,CAAC,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;IACpC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC;IAC/D,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;QAChB,UAAU,EAAE,EAAE;QACd,OAAO,EAAE,EAAE;QACX,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,aAAa,EAAE,KAAK,CAAC,OAAO;QAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC,CAAC;IACH,eAAe,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;AAChC,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,aAAa,CAC3B,SAAiB,EACjB,EAAU,EACV,MAAc,EACd,QAAgB;IAEhB,SAAS,CAAC,SAAS,EAAE,EAAE,EAAE,UAAU,CAAC,CAAC;IACrC,MAAM,CAAC,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;IACpC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IACnD,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,MAAM,KAAK,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC1D,eAAe,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;AAChC,CAAC"}

package/dist/core/errors.d.ts

@@ -3,7 +3,7 @@ export interface ErrorHint {
     fix: string;
     docs?: string;
 }
-export type ErrorCode = 'tool.slither.missing' | 'tool.slither.failed' | 'tool.forge.missing' | 'tool.forge.failed' | 'tool.solc.missing' | 'tool.claude.missing' | 'tool.node.outdated' | 'project.scope.empty' | 'project.scope.unmatched' | 'project.scope.missing-file' | 'project.missing-config' | 'project.foundry-missing' | 'output.dir.unwritable' | 'output.file.unparseable' | 'ai-tool.missing-scan-id' | 'ai-tool.scan-failed' | 'analysis.no-data' | 'diff.base-required' | 'diff.base-missing' | 'diff.not-git' | 'diff.not-diff-mode';
+export type ErrorCode = 'tool.forge.missing' | 'tool.forge.failed' | 'tool.claude.missing' | 'tool.node.outdated' | 'project.scope.empty' | 'project.scope.unmatched' | 'project.scope.missing-file' | 'project.missing-config' | 'project.foundry-missing' | 'output.dir.unwritable' | 'output.file.unparseable' | 'ai-tool.missing-scan-id' | 'ai-tool.scan-failed' | 'analysis.no-data' | 'diff.base-required' | 'diff.base-missing' | 'diff.not-git' | 'diff.not-diff-mode';
 export declare const ERROR_HINTS: Record<ErrorCode, ErrorHint>;
 export declare class HexError extends Error {
     code: ErrorCode;

package/dist/core/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/core/errors.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,MAAM,SAAS,GACjB,sBAAsB,GACtB,qBAAqB,GACrB,oBAAoB,GACpB,mBAAmB,GACnB,mBAAmB,GACnB,qBAAqB,GACrB,oBAAoB,GACpB,qBAAqB,GACrB,yBAAyB,GACzB,4BAA4B,GAC5B,wBAAwB,GACxB,yBAAyB,GACzB,uBAAuB,GACvB,yBAAyB,GACzB,yBAAyB,GACzB,qBAAqB,GACrB,kBAAkB,GAClB,oBAAoB,GACpB,mBAAmB,GACnB,cAAc,GACd,oBAAoB,CAAC;AAEzB,eAAO,MAAM,WAAW,EAAE,MAAM,CAAC,SAAS,EAAE,SAAS,CA0FpD,CAAC;AAEF,qBAAa,QAAS,SAAQ,KAAK;IACjC,IAAI,EAAE,SAAS,CAAC;IAChB,IAAI,EAAE,SAAS,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;gBAEJ,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM;CAO7C;AAED,wBAAgB,UAAU,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,QAAQ,CAExD;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,QAAQ,GAAG,MAAM,CAYpD;AAED,wBAAgB,WAAW,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CAO9C"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/core/errors.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,MAAM,SAAS,GACjB,oBAAoB,GACpB,mBAAmB,GACnB,qBAAqB,GACrB,oBAAoB,GACpB,qBAAqB,GACrB,yBAAyB,GACzB,4BAA4B,GAC5B,wBAAwB,GACxB,yBAAyB,GACzB,uBAAuB,GACvB,yBAAyB,GACzB,yBAAyB,GACzB,qBAAqB,GACrB,kBAAkB,GAClB,oBAAoB,GACpB,mBAAmB,GACnB,cAAc,GACd,oBAAoB,CAAC;AAEzB,eAAO,MAAM,WAAW,EAAE,MAAM,CAAC,SAAS,EAAE,SAAS,CA2EpD,CAAC;AAEF,qBAAa,QAAS,SAAQ,KAAK;IACjC,IAAI,EAAE,SAAS,CAAC;IAChB,IAAI,EAAE,SAAS,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;gBAEJ,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM;CAO7C;AAED,wBAAgB,UAAU,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,QAAQ,CAExD;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,QAAQ,GAAG,MAAM,CAYpD;AAED,wBAAgB,WAAW,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CAO9C"}

package/dist/core/errors.js

@@ -1,15 +1,5 @@
 import chalk from 'chalk';
 export const ERROR_HINTS = {
-    'tool.slither.missing': {
-        cause: "Slither isn't installed or isn't on PATH.",
-        fix: 'Install with: pip install slither-analyzer',
-        docs: 'https://github.com/crytic/slither#how-to-install',
-    },
-    'tool.slither.failed': {
-        cause: 'Slither ran but exited with a non-zero code.',
-        fix: 'Re-run `slither <project>` manually to see the underlying compilation error.',
-        docs: 'https://github.com/crytic/slither/wiki/Usage',
-    },
     'tool.forge.missing': {
         cause: 'Foundry (forge/cast) is not installed or not on PATH.',
         fix: 'Install with: curl -L https://foundry.paradigm.xyz | bash && foundryup',
@@ -19,11 +9,6 @@ export const ERROR_HINTS = {
         cause: 'forge build failed before analysis could finish.',
         fix: 'Run `forge build` directly and fix the compilation errors first.',
     },
-    'tool.solc.missing': {
-        cause: 'solc was not found on PATH.',
-        fix: 'Install with `solc-select install <version> && solc-select use <version>`, or rely on Foundry.',
-        docs: 'https://github.com/crytic/solc-select#quickstart',
-    },
     'tool.claude.missing': {
         cause: 'Claude Code CLI is not installed (hex skills run via Claude Code).',
         fix: 'Install Claude Code, then re-run `hex claude` to copy skills into the project.',

package/dist/core/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/core/errors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AA+B1B,MAAM,CAAC,MAAM,WAAW,GAAiC;IACvD,sBAAsB,EAAE;QACtB,KAAK,EAAE,2CAA2C;QAClD,GAAG,EAAE,4CAA4C;QACjD,IAAI,EAAE,kDAAkD;KACzD;IACD,qBAAqB,EAAE;QACrB,KAAK,EAAE,8CAA8C;QACrD,GAAG,EAAE,8EAA8E;QACnF,IAAI,EAAE,8CAA8C;KACrD;IACD,oBAAoB,EAAE;QACpB,KAAK,EAAE,uDAAuD;QAC9D,GAAG,EAAE,wEAAwE;QAC7E,IAAI,EAAE,yDAAyD;KAChE;IACD,mBAAmB,EAAE;QACnB,KAAK,EAAE,kDAAkD;QACzD,GAAG,EAAE,kEAAkE;KACxE;IACD,mBAAmB,EAAE;QACnB,KAAK,EAAE,6BAA6B;QACpC,GAAG,EAAE,gGAAgG;QACrG,IAAI,EAAE,kDAAkD;KACzD;IACD,qBAAqB,EAAE;QACrB,KAAK,EAAE,oEAAoE;QAC3E,GAAG,EAAE,gFAAgF;QACrF,IAAI,EAAE,qCAAqC;KAC5C;IACD,oBAAoB,EAAE;QACpB,KAAK,EAAE,kDAAkD;QACzD,GAAG,EAAE,sDAAsD;KAC5D;IACD,qBAAqB,EAAE;QACrB,KAAK,EAAE,2BAA2B;QAClC,GAAG,EAAE,uEAAuE;KAC7E;IACD,yBAAyB,EAAE;QACzB,KAAK,EAAE,0CAA0C;QACjD,GAAG,EAAE,2GAA2G;KACjH;IACD,4BAA4B,EAAE;QAC5B,KAAK,EAAE,+DAA+D;QACtE,GAAG,EAAE,0GAA0G;KAChH;IACD,wBAAwB,EAAE;QACxB,KAAK,EAAE,yDAAyD;QAChE,GAAG,EAAE,yDAAyD;KAC/D;IACD,yBAAyB,EAAE;QACzB,KAAK,EAAE,wGAAwG;QAC/G,GAAG,EAAE,qEAAqE;KAC3E;IACD,uBAAuB,EAAE;QACvB,KAAK,EAAE,2CAA2C;QAClD,GAAG,EAAE,2EAA2E;KACjF;IACD,yBAAyB,EAAE;QACzB,KAAK,EAAE,6CAA6C;QACpD,GAAG,EAAE,uFAAuF;KAC7F;IACD,yBAAyB,EAAE;QACzB,KAAK,EAAE,oEAAoE;QAC3E,GAAG,EAAE,qEAAqE;KAC3E;IACD,qBAAqB,EAAE;QACrB,KAAK,EAAE,sCAAsC;QAC7C,GAAG,EAAE,uEAAuE;KAC7E;IACD,kBAAkB,EAAE;QAClB,KAAK,EAAE,4EAA4E;QACnF,GAAG,EAAE,sFAAsF;KAC5F;IACD,oBAAoB,EAAE;QACpB,KAAK,EAAE,2EAA2E;QAClF,GAAG,EAAE,0FAA0F;KAChG;IACD,mBAAmB,EAAE;QACnB,KAAK,EAAE,gEAAgE;QACvE,GAAG,EAAE,+HAA+H;KACrI;IACD,cAAc,EAAE;QACd,KAAK,EAAE,sFAAsF;QAC7F,GAAG,EAAE,kFAAkF;KACxF;IACD,oBAAoB,EAAE;QACpB,KAAK,EAAE,6EAA6E;QACpF,GAAG,EAAE,2FAA2F;KACjG;CACF,CAAC;AAEF,MAAM,OAAO,QAAS,SAAQ,KAAK;IACjC,IAAI,CAAY;IAChB,IAAI,CAAY;IAChB,MAAM,CAAU;IAEhB,YAAY,IAAe,EAAE,MAAe;QAC1C,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QAC/B,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,MAAM,UAAU,UAAU,CAAC,GAAY;IACrC,OAAO,GAAG,YAAY,QAAQ,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,GAAa;IAC1C,MAAM,KAAK,GAAG;QACZ,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;KAClD,CAAC;IACF,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC3C,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACnD,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,GAAY;IACtC,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACpB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;QACjD,OAAO;IACT,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,OAAO,IAAI,CAAC,CAAC;AACzD,CAAC"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/core/errors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AA4B1B,MAAM,CAAC,MAAM,WAAW,GAAiC;IACvD,oBAAoB,EAAE;QACpB,KAAK,EAAE,uDAAuD;QAC9D,GAAG,EAAE,wEAAwE;QAC7E,IAAI,EAAE,yDAAyD;KAChE;IACD,mBAAmB,EAAE;QACnB,KAAK,EAAE,kDAAkD;QACzD,GAAG,EAAE,kEAAkE;KACxE;IACD,qBAAqB,EAAE;QACrB,KAAK,EAAE,oEAAoE;QAC3E,GAAG,EAAE,gFAAgF;QACrF,IAAI,EAAE,qCAAqC;KAC5C;IACD,oBAAoB,EAAE;QACpB,KAAK,EAAE,kDAAkD;QACzD,GAAG,EAAE,sDAAsD;KAC5D;IACD,qBAAqB,EAAE;QACrB,KAAK,EAAE,2BAA2B;QAClC,GAAG,EAAE,uEAAuE;KAC7E;IACD,yBAAyB,EAAE;QACzB,KAAK,EAAE,0CAA0C;QACjD,GAAG,EAAE,2GAA2G;KACjH;IACD,4BAA4B,EAAE;QAC5B,KAAK,EAAE,+DAA+D;QACtE,GAAG,EAAE,0GAA0G;KAChH;IACD,wBAAwB,EAAE;QACxB,KAAK,EAAE,yDAAyD;QAChE,GAAG,EAAE,yDAAyD;KAC/D;IACD,yBAAyB,EAAE;QACzB,KAAK,EAAE,wGAAwG;QAC/G,GAAG,EAAE,qEAAqE;KAC3E;IACD,uBAAuB,EAAE;QACvB,KAAK,EAAE,2CAA2C;QAClD,GAAG,EAAE,2EAA2E;KACjF;IACD,yBAAyB,EAAE;QACzB,KAAK,EAAE,6CAA6C;QACpD,GAAG,EAAE,uFAAuF;KAC7F;IACD,yBAAyB,EAAE;QACzB,KAAK,EAAE,oEAAoE;QAC3E,GAAG,EAAE,qEAAqE;KAC3E;IACD,qBAAqB,EAAE;QACrB,KAAK,EAAE,sCAAsC;QAC7C,GAAG,EAAE,uEAAuE;KAC7E;IACD,kBAAkB,EAAE;QAClB,KAAK,EAAE,4EAA4E;QACnF,GAAG,EAAE,sFAAsF;KAC5F;IACD,oBAAoB,EAAE;QACpB,KAAK,EAAE,2EAA2E;QAClF,GAAG,EAAE,0FAA0F;KAChG;IACD,mBAAmB,EAAE;QACnB,KAAK,EAAE,gEAAgE;QACvE,GAAG,EAAE,+HAA+H;KACrI;IACD,cAAc,EAAE;QACd,KAAK,EAAE,sFAAsF;QAC7F,GAAG,EAAE,kFAAkF;KACxF;IACD,oBAAoB,EAAE;QACpB,KAAK,EAAE,6EAA6E;QACpF,GAAG,EAAE,2FAA2F;KACjG;CACF,CAAC;AAEF,MAAM,OAAO,QAAS,SAAQ,KAAK;IACjC,IAAI,CAAY;IAChB,IAAI,CAAY;IAChB,MAAM,CAAU;IAEhB,YAAY,IAAe,EAAE,MAAe;QAC1C,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QAC/B,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,MAAM,UAAU,UAAU,CAAC,GAAY;IACrC,OAAO,GAAG,YAAY,QAAQ,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,GAAa;IAC1C,MAAM,KAAK,GAAG;QACZ,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;KAClD,CAAC;IACF,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC3C,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACnD,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,GAAY;IACtC,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACpB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;QACjD,OAAO;IACT,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,OAAO,IAAI,CAAC,CAAC;AACzD,CAAC"}

package/dist/core/external-tools.d.ts

@@ -16,24 +16,10 @@ export declare function detectTools(): Promise<ToolInfo[]>;
  * Require a tool to be available, throwing if not found.
  */
 export declare function requireTool(name: string): Promise<void>;
-/**
- * Run Slither with JSON output.
- */
-export declare function runSlither(dir: string, args: string[]): Promise<ExecResult>;
-/**
- * Get Slither function-summary output with file-based caching.
- * access.ts and state.ts both run the identical `slither . --print function-summary --json -`
- * command. This cache ensures it only runs once per analysis session.
- */
-export declare function getSlitherFunctionSummary(projectDir: string, outputDir: string): Promise<ExecResult>;
 /**
  * Run Forge (Foundry).
  */
 export declare function runForge(dir: string, args: string[]): Promise<ExecResult>;
 export declare function flattenFile(projectDir: string, filePath: string): Promise<string | null>;
-/**
- * Run solc.
- */
-export declare function runSolc(dir: string, args: string[]): Promise<ExecResult>;
 export {};
 //# sourceMappingURL=external-tools.d.ts.map

package/dist/core/external-tools.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"external-tools.d.ts","sourceRoot":"","sources":["../../src/core/external-tools.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED,UAAU,UAAU;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAgED;;GAEG;AACH,wBAAsB,WAAW,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC,CAOvD;AAED;;GAEG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAQ7D;AAED;;GAEG;AACH,wBAAsB,UAAU,CAC9B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EAAE,GACb,OAAO,CAAC,UAAU,CAAC,CAGrB;AAED;;;;GAIG;AACH,wBAAsB,yBAAyB,CAC7C,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,UAAU,CAAC,CA6BrB;AAED;;GAEG;AACH,wBAAsB,QAAQ,CAC5B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EAAE,GACb,OAAO,CAAC,UAAU,CAAC,CAGrB;AASD,wBAAsB,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAiB9F;AAED;;GAEG;AACH,wBAAsB,OAAO,CAC3B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EAAE,GACb,OAAO,CAAC,UAAU,CAAC,CAGrB"}
+{"version":3,"file":"external-tools.d.ts","sourceRoot":"","sources":["../../src/core/external-tools.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED,UAAU,UAAU;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAiED;;GAEG;AACH,wBAAsB,WAAW,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC,CAKvD;AAED;;GAEG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAQ7D;AAED;;GAEG;AACH,wBAAsB,QAAQ,CAC5B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EAAE,GACb,OAAO,CAAC,UAAU,CAAC,CAGrB;AASD,wBAAsB,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAiB9F"}

package/dist/core/external-tools.js

@@ -1,6 +1,4 @@
 import { spawn } from 'node:child_process';
-import fs from 'node:fs';
-import path from 'node:path';
 import { logger } from './logger.js';
 /**
  * Run a command and capture output.
@@ -15,7 +13,8 @@ function exec(command, args, options = {}) {
         const child = spawn(command, args, {
             cwd: options.cwd,
             env,
-            shell: true,
+            // No shell: arguments are passed as-is (never concatenated into a command line).
+            shell: process.platform === 'win32',
             timeout: options.timeout ?? 120_000,
         });
         const stdout = [];
@@ -54,8 +53,6 @@ async function checkTool(name, command, args) {
  */
 export async function detectTools() {
     const checks = await Promise.all([
-        checkTool('solc', 'solc', ['--version']),
-        checkTool('slither', 'slither', ['--version']),
         checkTool('forge', 'forge', ['--version']),
     ]);
     return checks;
@@ -70,46 +67,6 @@ export async function requireTool(name) {
         throw new Error(`Required tool '${name}' not found. Please install it and ensure it's in your PATH.`);
     }
 }
-/**
- * Run Slither with JSON output.
- */
-export async function runSlither(dir, args) {
-    logger.dim(`Running: slither ${args.join(' ')}`);
-    return exec('slither', args, { cwd: dir, timeout: 300_000 });
-}
-/**
- * Get Slither function-summary output with file-based caching.
- * access.ts and state.ts both run the identical `slither . --print function-summary --json -`
- * command. This cache ensures it only runs once per analysis session.
- */
-export async function getSlitherFunctionSummary(projectDir, outputDir) {
-    const cacheDir = path.join(outputDir, '.cache');
-    const cachePath = path.join(cacheDir, 'slither-function-summary.json');
-    // Use cache if it exists and is less than 5 minutes old
-    try {
-        const stat = fs.statSync(cachePath);
-        if (Date.now() - stat.mtimeMs < 5 * 60 * 1000) {
-            const cached = JSON.parse(fs.readFileSync(cachePath, 'utf-8'));
-            logger.dim('Using cached Slither function-summary');
-            return cached;
-        }
-    }
-    catch {
-        // Cache miss — run Slither
-    }
-    const result = await runSlither(projectDir, ['.', '--print', 'function-summary', '--json', '-']);
-    // Cache the result on success
-    if (result.exitCode === 0) {
-        try {
-            fs.mkdirSync(cacheDir, { recursive: true });
-            fs.writeFileSync(cachePath, JSON.stringify(result));
-        }
-        catch {
-            // Non-fatal — caching is best-effort
-        }
-    }
-    return result;
-}
 /**
  * Run Forge (Foundry).
  */
@@ -141,11 +98,4 @@ export async function flattenFile(projectDir, filePath) {
         return null;
     }
 }
-/**
- * Run solc.
- */
-export async function runSolc(dir, args) {
-    logger.dim(`Running: solc ${args.join(' ')}`);
-    return exec('solc', args, { cwd: dir });
-}
 //# sourceMappingURL=external-tools.js.map

package/dist/core/external-tools.js.map

@@ -1 +1 @@
-{"version":3,"file":"external-tools.js","sourceRoot":"","sources":["../../src/core/external-tools.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAcrC;;GAEG;AACH,SAAS,IAAI,CACX,OAAe,EACf,IAAc,EACd,UAA4E,EAAE;IAE9E,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,GAAG,GAAG;YACV,GAAG,OAAO,CAAC,GAAG;YACd,gBAAgB,EAAE,OAAO;YACzB,GAAG,OAAO,CAAC,GAAG;SACf,CAAC;QAEF,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE;YACjC,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,GAAG;YACH,KAAK,EAAE,IAAI;YACX,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,OAAO;SACpC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAa,EAAE,CAAC;QAE5B,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7D,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAE7D,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,OAAO,CAAC;gBACN,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAC/C,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAC/C,QAAQ,EAAE,IAAI,IAAI,CAAC;aACpB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACrB,OAAO,CAAC;gBACN,MAAM,EAAE,EAAE;gBACV,MAAM,EAAE,oBAAoB,OAAO,EAAE;gBACrC,QAAQ,EAAE,CAAC;aACZ,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,SAAS,CACtB,IAAY,EACZ,OAAe,EACf,IAAc;IAEd,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACzC,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;QAC5D,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC5C,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACnD,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW;IAC/B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC/B,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC;QACxC,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE,CAAC,WAAW,CAAC,CAAC;QAC9C,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,WAAW,CAAC,CAAC;KAC3C,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAY;IAC5C,MAAM,KAAK,GAAG,MAAM,WAAW,EAAE,CAAC;IAClC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAChD,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CACb,kBAAkB,IAAI,8DAA8D,CACrF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,GAAW,EACX,IAAc;IAEd,MAAM,CAAC,GAAG,CAAC,oBAAoB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACjD,OAAO,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;AAC/D,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,UAAkB,EAClB,SAAiB;IAEjB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAChD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,+BAA+B,CAAC,CAAC;IAEvE,wDAAwD;IACxD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACpC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;YAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAe,CAAC;YAC7E,MAAM,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;YACpD,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,2BAA2B;IAC7B,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,UAAU,EAAE,CAAC,GAAG,EAAE,SAAS,EAAE,kBAAkB,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;IAEjG,8BAA8B;IAC9B,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5C,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QACtD,CAAC;QAAC,MAAM,CAAC;YACP,qCAAqC;QACvC,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,GAAW,EACX,IAAc;IAEd,MAAM,CAAC,GAAG,CAAC,kBAAkB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC/C,OAAO,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED;;;;GAIG;AACH,MAAM,YAAY,GAAG,IAAI,GAAG,EAAyB,CAAC;AAEtD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,UAAkB,EAAE,QAAgB;IACpE,MAAM,GAAG,GAAG,GAAG,UAAU,IAAI,QAAQ,EAAE,CAAC;IACxC,IAAI,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,YAAY,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC;IAChC,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;QACjE,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;YACpE,CAAC,CAAC,MAAM,CAAC,MAAM;YACf,CAAC,CAAC,IAAI,CAAC;QACT,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC7B,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,GAAW,EACX,IAAc;IAEd,MAAM,CAAC,GAAG,CAAC,iBAAiB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC9C,OAAO,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;AAC1C,CAAC"}
+{"version":3,"file":"external-tools.js","sourceRoot":"","sources":["../../src/core/external-tools.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAcrC;;GAEG;AACH,SAAS,IAAI,CACX,OAAe,EACf,IAAc,EACd,UAA4E,EAAE;IAE9E,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,GAAG,GAAG;YACV,GAAG,OAAO,CAAC,GAAG;YACd,gBAAgB,EAAE,OAAO;YACzB,GAAG,OAAO,CAAC,GAAG;SACf,CAAC;QAEF,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE;YACjC,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,GAAG;YACH,iFAAiF;YACjF,KAAK,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO;YACnC,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,OAAO;SACpC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAa,EAAE,CAAC;QAE5B,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7D,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAE7D,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,OAAO,CAAC;gBACN,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAC/C,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAC/C,QAAQ,EAAE,IAAI,IAAI,CAAC;aACpB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACrB,OAAO,CAAC;gBACN,MAAM,EAAE,EAAE;gBACV,MAAM,EAAE,oBAAoB,OAAO,EAAE;gBACrC,QAAQ,EAAE,CAAC;aACZ,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,SAAS,CACtB,IAAY,EACZ,OAAe,EACf,IAAc;IAEd,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACzC,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;QAC5D,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC5C,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACnD,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW;IAC/B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC/B,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,WAAW,CAAC,CAAC;KAC3C,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAY;IAC5C,MAAM,KAAK,GAAG,MAAM,WAAW,EAAE,CAAC;IAClC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAChD,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CACb,kBAAkB,IAAI,8DAA8D,CACrF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,GAAW,EACX,IAAc;IAEd,MAAM,CAAC,GAAG,CAAC,kBAAkB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC/C,OAAO,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED;;;;GAIG;AACH,MAAM,YAAY,GAAG,IAAI,GAAG,EAAyB,CAAC;AAEtD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,UAAkB,EAAE,QAAgB;IACpE,MAAM,GAAG,GAAG,GAAG,UAAU,IAAI,QAAQ,EAAE,CAAC;IACxC,IAAI,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,YAAY,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC;IAChC,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;QACjE,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;YACpE,CAAC,CAAC,MAAM,CAAC,MAAM;YACf,CAAC,CAAC,IAAI,CAAC;QACT,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC7B,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/core/fix-review.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Fix review: pure helpers (classification, commit mapping, GitHub body
+ * rewriting). Orchestration with git/forge lives in src/commands/fix-review.ts.
+ */
+import type { FixReviewCard } from '../types/index.js';
+export type PocResult = 'passing' | 'failing' | 'error' | 'missing';
+/**
+ * Status from the evidence, most decisive first:
+ *  - the PoC fails at the fix commit → fixed (it reproduced at audit time)
+ *  - the PoC still passes → not_fixed
+ *  - every function the card is about was removed → fixed (code path gone)
+ *  - code or commits touch the card but no PoC verdict → unknown (agent judges)
+ *  - nothing touches it → unaddressed
+ */
+export declare function classifyCard(input: {
+    pocBefore?: PocResult;
+    pocAfter?: PocResult;
+    cardFunctions: string[];
+    changedFunctions: string[];
+    removedFunctions: string[];
+    commits: string[];
+}): {
+    status: FixReviewCard['status'];
+    evidence: string;
+};
+/** Commits whose message cites the card id (`H-012`) or its GitHub issue (`#12`, `fixes #12`). */
+export declare function commitsForCard(commits: Array<{
+    sha: string;
+    subject: string;
+    body?: string;
+}>, card: {
+    id: string;
+    github_issue?: number;
+}): string[];
+/**
+ * Rewrite only the Status and "Update from the client" fields of a Hex-format
+ * issue body; every other byte is preserved. Missing fields are appended in
+ * template order.
+ */
+export declare function rewriteIssueBody(body: string, fields: {
+    status?: string;
+    update?: string;
+}): string;
+/**
+ * Index of the unmapped change a reference names: `Contract.entity` with or
+ * without the signature (`Vault.sweep`, `Vault.sweep(address,address,uint256)`),
+ * or the bare entity name when it is unique. Throws when nothing or more than
+ * one change matches.
+ */
+export declare function findUnmappedChange(changes: ReadonlyArray<{
+    contract: string;
+    entity: string;
+}>, ref: string): number;
+//# sourceMappingURL=fix-review.d.ts.map

package/dist/core/fix-review.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fix-review.d.ts","sourceRoot":"","sources":["../../src/core/fix-review.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEvD,MAAM,MAAM,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,CAAC;AAEpE;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE;IAClC,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,QAAQ,CAAC,EAAE,SAAS,CAAC;IACrB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB,GAAG;IAAE,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAiCxD;AAED,kGAAkG;AAClG,wBAAgB,cAAc,CAC5B,OAAO,EAAE,KAAK,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,EAC/D,IAAI,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,GAC1C,MAAM,EAAE,CASV;AAKD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAC3C,MAAM,CAgBR;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,aAAa,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,EAC5D,GAAG,EAAE,MAAM,GACV,MAAM,CAiBR"}

package/dist/core/fix-review.js

@@ -0,0 +1,98 @@
+/**
+ * Status from the evidence, most decisive first:
+ *  - the PoC fails at the fix commit → fixed (it reproduced at audit time)
+ *  - the PoC still passes → not_fixed
+ *  - every function the card is about was removed → fixed (code path gone)
+ *  - code or commits touch the card but no PoC verdict → unknown (agent judges)
+ *  - nothing touches it → unaddressed
+ */
+export function classifyCard(input) {
+    const { pocBefore, pocAfter, cardFunctions, changedFunctions, removedFunctions, commits } = input;
+    if (pocAfter === 'failing' && pocBefore !== 'failing') {
+        return {
+            status: 'fixed',
+            evidence: 'The PoC reproduced the issue at the audited commit and fails at the fix commit.',
+        };
+    }
+    if (pocAfter === 'passing') {
+        return {
+            status: 'not_fixed',
+            evidence: changedFunctions.length
+                ? `The code changed (${changedFunctions.join(', ')}) but the PoC still reproduces the issue.`
+                : 'The PoC still reproduces the issue at the fix commit.',
+        };
+    }
+    if (cardFunctions.length && cardFunctions.every((f) => removedFunctions.includes(f))) {
+        return {
+            status: 'fixed',
+            evidence: `The affected code was removed (${cardFunctions.join(', ')}).`,
+        };
+    }
+    if (changedFunctions.length || commits.length) {
+        const why = pocAfter === 'error' ? ' The PoC no longer compiles against the new code.' : '';
+        return {
+            status: 'unknown',
+            evidence: `Touched by ${[changedFunctions.length ? changedFunctions.join(', ') : '', commits.length ? `commit${commits.length > 1 ? 's' : ''} ${commits.map((c) => c.slice(0, 7)).join(', ')}` : ''].filter(Boolean).join(' and ')}; needs a judgement.${why}`,
+        };
+    }
+    return {
+        status: 'unaddressed',
+        evidence: 'No change between the audited and fix commits touches this issue.',
+    };
+}
+/** Commits whose message cites the card id (`H-012`) or its GitHub issue (`#12`, `fixes #12`). */
+export function commitsForCard(commits, card) {
+    const idRe = new RegExp(`\\b${card.id}\\b`);
+    const ghRe = card.github_issue ? new RegExp(`#${card.github_issue}\\b`) : null;
+    return commits
+        .filter((c) => {
+        const text = `${c.subject}\n${c.body ?? ''}`;
+        return idRe.test(text) || (ghRe ? ghRe.test(text) : false);
+    })
+        .map((c) => c.sha);
+}
+const STATUS_RE = /(\*\*Status\*\*:)[^\n]*(\n|$)/;
+const UPDATE_RE = /(\*\*Update from the client\*\*:)[\s\S]*$/;
+/**
+ * Rewrite only the Status and "Update from the client" fields of a Hex-format
+ * issue body; every other byte is preserved. Missing fields are appended in
+ * template order.
+ */
+export function rewriteIssueBody(body, fields) {
+    let out = body;
+    if (fields.status !== undefined) {
+        if (STATUS_RE.test(out))
+            out = out.replace(STATUS_RE, (_m, label, nl) => `${label} ${fields.status}${nl}`);
+        else
+            out = `${out.replace(/\s*$/, '')}\n\n**Status**: ${fields.status}\n`;
+    }
+    if (fields.update !== undefined) {
+        if (UPDATE_RE.test(out))
+            out = out.replace(UPDATE_RE, (_m, label) => `${label} ${fields.update}\n`);
+        else
+            out = `${out.replace(/\s*$/, '')}\n\n**Update from the client**: ${fields.update}\n`;
+    }
+    return out;
+}
+/**
+ * Index of the unmapped change a reference names: `Contract.entity` with or
+ * without the signature (`Vault.sweep`, `Vault.sweep(address,address,uint256)`),
+ * or the bare entity name when it is unique. Throws when nothing or more than
+ * one change matches.
+ */
+export function findUnmappedChange(changes, ref) {
+    const name = (e) => e.split('(')[0];
+    const hits = changes
+        .map((c, i) => ({ c, i }))
+        .filter(({ c }) => ref.includes('.')
+        ? `${c.contract}.${c.entity}` === ref || `${c.contract}.${name(c.entity)}` === ref
+        : c.entity === ref || name(c.entity) === ref);
+    if (hits.length === 0)
+        throw new Error(`No unmapped change matches ${ref}`);
+    if (hits.length > 1)
+        throw new Error(`${ref} matches ${hits.length} unmapped changes; use Contract.entity(signature): ${hits
+            .map(({ c }) => `${c.contract}.${c.entity}`)
+            .join(', ')}`);
+    return hits[0].i;
+}
+//# sourceMappingURL=fix-review.js.map