memorydetective 1.8.1 → 1.10.0

package/dist/runtime/responseFormatter.js

@@ -0,0 +1,307 @@
+/**
+ * Shared response formatter for MCP tool outputs.
+ *
+ * Tools can declare `outputFormat?: "markdown" | "json" | "both"` (defaults to
+ * `"json"`, preserving v1.8 behavior). When the caller asks for a different
+ * shape, the registration wrapper in `src/index.ts` calls
+ * {@link formatMcpResponse} to produce the actual response content.
+ *
+ * Two audiences are served at once:
+ *   - **AI agents** (the typical caller) want raw JSON they can parse and chain
+ *     into the next call without re-reasoning.
+ *   - **Humans reading the same response** (the typical second audience: the
+ *     dev pasting the result into a PR comment, a Slack thread, or a Jira
+ *     ticket) want a markdown view that highlights the key fields.
+ *
+ * `outputFormat: "both"` returns BOTH content items in a single response, so a
+ * client can display the markdown to the user AND parse the JSON for the
+ * agent loop without an extra round-trip.
+ */
+import { z } from "zod";
+import { getRedactionMode, redact } from "./redact.js";
+export const outputFormatField = z
+    .enum(["markdown", "json", "both", "verify-fix-table"])
+    .optional()
+    .describe("Response format. Omitted or `json` (default, preserves v1.8 behavior) returns JSON.stringify of the result. `markdown` renders a human-readable view of the same data. `both` returns both content items in one response, so a client can display markdown to the user and parse JSON for the agent loop without a second call. `verify-fix-table` (v1.10, applies to `analyzeAbandonedMemory` and `diffMemgraphs`) emits a focused 4-column markdown comparison table (Class | Before | After | Delta) of the actionable rows; other tools fall back to `markdown` for this value.");
+/**
+ * Pure: shape the MCP response based on the caller's `outputFormat`.
+ *
+ * For `json` and `both`, the JSON is `JSON.stringify(result, null, 2)`. For
+ * `markdown` and `both`, the markdown is rendered via {@link renderAsMarkdown}.
+ */
+export function formatMcpResponse(result, toolName, format) {
+    const mode = format ?? "json";
+    // Redaction happens at the structured-value level so both the JSON
+    // and the markdown views are scrubbed consistently. `off` short-circuits
+    // and returns the input unchanged; `balanced` (default) masks home-dir
+    // paths and common secret-shaped tokens; `strict` also masks hostnames,
+    // IPs, and bundle identifiers. See src/runtime/redact.ts.
+    const redacted = redact(result, getRedactionMode());
+    const json = JSON.stringify(redacted, null, 2);
+    if (mode === "json") {
+        return { content: [{ type: "text", text: json }] };
+    }
+    // `verify-fix-table` is a focused renderer that takes precedence over
+    // the generic markdown one. Falls back to standard markdown when the
+    // tool does not implement a verify-fix view.
+    if (mode === "verify-fix-table") {
+        const focused = renderVerifyFixTable(redacted, toolName);
+        if (focused != null) {
+            return { content: [{ type: "text", text: focused }] };
+        }
+        // Fall through to markdown for tools that don't implement it.
+        const fallback = renderAsMarkdown(redacted, toolName);
+        return { content: [{ type: "text", text: fallback }] };
+    }
+    const markdown = renderAsMarkdown(redacted, toolName);
+    if (mode === "markdown") {
+        return { content: [{ type: "text", text: markdown }] };
+    }
+    // "both": markdown first so a UI that picks content[0] gets the readable
+    // view, then JSON so an agent looking for the structured data finds it
+    // without having to parse the markdown.
+    return {
+        content: [
+            { type: "text", text: markdown },
+            { type: "text", text: json },
+        ],
+    };
+}
+/**
+ * Pure: render a verify-fix focused markdown table for tools that support
+ * it. Returns `null` if the tool's result does not match the expected
+ * verify-fix shape, signaling the caller to fall back to standard markdown.
+ *
+ * Supported tools:
+ *
+ * - `analyzeAbandonedMemory`: reads `actionableShrinkage[]` (the v1.10
+ *   verify-fix-default direction: classes that the fix freed) and
+ *   `actionableGrowth[]` (regressions the fix didn't address). Emits one
+ *   table for shrinkage and, when non-empty, a second smaller table for
+ *   growth. Threshold: |delta| >= 10 by default to filter cosmetic noise.
+ *
+ * - `diffMemgraphs`: reads `classCountChanges[]` (positive + negative).
+ *   Future expansion; for now returns null and falls back to standard
+ *   markdown.
+ *
+ * The 4-column layout is deliberately compact (Class | Before | After |
+ * Delta) so it renders cleanly in GitHub's markdown preview, dev.to, and
+ * agent chat contexts. A trailing `> Diagnosis: ...` blockquote carries
+ * the structured `diagnosis` field when present.
+ */
+export function renderVerifyFixTable(result, toolName) {
+    if (toolName !== "analyzeAbandonedMemory") {
+        return null;
+    }
+    if (result == null || typeof result !== "object") {
+        return null;
+    }
+    const obj = result;
+    const shrinkage = extractVerifyFixRows(obj["actionableShrinkage"]);
+    const growth = extractVerifyFixRows(obj["actionableGrowth"]);
+    const diagnosis = typeof obj["diagnosis"] === "string" ? obj["diagnosis"] : null;
+    // Threshold: filter cosmetic noise.
+    const DELTA_THRESHOLD = 10;
+    const filteredShrinkage = shrinkage.filter((r) => Math.abs(r.delta) >= DELTA_THRESHOLD);
+    const filteredGrowth = growth.filter((r) => Math.abs(r.delta) >= DELTA_THRESHOLD);
+    if (filteredShrinkage.length === 0 && filteredGrowth.length === 0) {
+        return [
+            "# analyzeAbandonedMemory: verify-fix",
+            "",
+            "_No class counts crossed the actionable threshold (|delta| >= 10)._",
+            diagnosis ? `\n> ${diagnosis}` : "",
+        ]
+            .join("\n")
+            .trim();
+    }
+    const sections = ["# analyzeAbandonedMemory: verify-fix", ""];
+    if (filteredShrinkage.length > 0) {
+        sections.push("## What the fix freed");
+        sections.push("");
+        sections.push("| Class | Before | After | Delta |");
+        sections.push("|---|---:|---:|---:|");
+        for (const row of filteredShrinkage) {
+            sections.push(`| \`${row.className}\` | ${row.beforeCount} | ${row.afterCount} | ${row.delta} |`);
+        }
+        sections.push("");
+    }
+    if (filteredGrowth.length > 0) {
+        sections.push("## Classes that grew (regressions or unrelated)");
+        sections.push("");
+        sections.push("| Class | Before | After | Delta |");
+        sections.push("|---|---:|---:|---:|");
+        for (const row of filteredGrowth) {
+            sections.push(`| \`${row.className}\` | ${row.beforeCount} | ${row.afterCount} | +${row.delta} |`);
+        }
+        sections.push("");
+    }
+    if (diagnosis) {
+        sections.push(`> ${diagnosis}`);
+    }
+    return sections.join("\n").trim();
+}
+function extractVerifyFixRows(value) {
+    if (!Array.isArray(value))
+        return [];
+    const rows = [];
+    for (const item of value) {
+        if (item == null || typeof item !== "object")
+            continue;
+        const r = item;
+        if (typeof r["className"] === "string" &&
+            typeof r["beforeCount"] === "number" &&
+            typeof r["afterCount"] === "number" &&
+            typeof r["delta"] === "number") {
+            rows.push({
+                className: r["className"],
+                beforeCount: r["beforeCount"],
+                afterCount: r["afterCount"],
+                delta: r["delta"],
+            });
+        }
+    }
+    return rows;
+}
+/**
+ * Pure: render an arbitrary JSON-shaped value as markdown.
+ *
+ * The rendering is intentionally generic: it does not have per-tool
+ * templates. A `# Tool name` header, a `## Key` for each top-level field, and
+ * smart formatting for arrays of objects (tables when the rows share a
+ * schema) and scalars. Per-tool overrides can land in v1.9.1+ if any
+ * specific tool's output deserves a more curated view.
+ *
+ * Exposed for tests.
+ */
+export function renderAsMarkdown(value, toolName) {
+    const lines = [`# ${toolName}`, ""];
+    if (value == null || typeof value !== "object") {
+        lines.push(formatScalar(value));
+        return lines.join("\n");
+    }
+    const obj = value;
+    for (const [key, val] of Object.entries(obj)) {
+        lines.push(`## ${key}`);
+        lines.push("");
+        lines.push(formatValue(val, 0));
+        lines.push("");
+    }
+    return lines.join("\n").trim() + "\n";
+}
+function formatValue(value, depth) {
+    if (value == null)
+        return "_(null)_";
+    if (typeof value === "string")
+        return value || "_(empty)_";
+    if (typeof value === "number" || typeof value === "boolean")
+        return formatScalar(value);
+    if (Array.isArray(value))
+        return formatArray(value, depth);
+    if (typeof value === "object")
+        return formatObject(value, depth);
+    return String(value);
+}
+function formatArray(arr, depth) {
+    if (arr.length === 0)
+        return "_(empty array)_";
+    // Table if all entries are objects with a shared key set.
+    if (arr.length > 0 &&
+        arr.every((e) => e != null && typeof e === "object" && !Array.isArray(e))) {
+        const objects = arr;
+        const cols = collectCommonKeys(objects);
+        if (cols.length > 0 && cols.length <= 8) {
+            const header = `| ${cols.join(" | ")} |`;
+            const sep = `| ${cols.map(() => "---").join(" | ")} |`;
+            const rows = objects.slice(0, 50).map((o) => {
+                const cells = cols.map((c) => formatCell(o[c]));
+                return `| ${cells.join(" | ")} |`;
+            });
+            const tail = objects.length > 50 ? `\n_(${objects.length - 50} more rows omitted)_` : "";
+            return [header, sep, ...rows].join("\n") + tail;
+        }
+    }
+    // Otherwise bullet list of scalars / mixed.
+    return arr
+        .slice(0, 50)
+        .map((e) => `- ${formatCell(e)}`)
+        .join("\n");
+}
+function formatObject(obj, depth) {
+    const entries = Object.entries(obj);
+    if (entries.length === 0)
+        return "_(empty object)_";
+    if (depth >= 2) {
+        // Deeply nested: collapse to inline JSON to keep the markdown tidy.
+        return "```json\n" + JSON.stringify(obj, null, 2) + "\n```";
+    }
+    return entries
+        .map(([k, v]) => `- **${k}**: ${formatInline(v, depth + 1)}`)
+        .join("\n");
+}
+function formatInline(value, depth) {
+    if (value == null)
+        return "_(null)_";
+    if (typeof value === "string")
+        return value || "_(empty)_";
+    if (typeof value === "number" || typeof value === "boolean")
+        return formatScalar(value);
+    if (Array.isArray(value)) {
+        if (value.length === 0)
+            return "_(empty array)_";
+        if (value.length <= 5 && value.every((e) => typeof e !== "object" || e == null)) {
+            return `[${value.map((e) => formatCell(e)).join(", ")}]`;
+        }
+        return `\n${formatArray(value, depth)}`;
+    }
+    if (typeof value === "object") {
+        return `\n${formatObject(value, depth)}`;
+    }
+    return String(value);
+}
+function formatScalar(value) {
+    if (value == null)
+        return "_(null)_";
+    if (typeof value === "boolean")
+        return value ? "`true`" : "`false`";
+    if (typeof value === "number")
+        return `\`${value}\``;
+    return String(value);
+}
+function formatCell(value) {
+    if (value == null)
+        return "_";
+    if (typeof value === "string") {
+        // Escape pipes for table safety, truncate long strings.
+        const escaped = value.replace(/\|/g, "\\|");
+        return escaped.length > 80 ? escaped.slice(0, 77) + "..." : escaped;
+    }
+    if (typeof value === "number" || typeof value === "boolean") {
+        return formatScalar(value);
+    }
+    if (Array.isArray(value))
+        return `[${value.length}]`;
+    if (typeof value === "object") {
+        // Compact inline JSON, truncated.
+        const s = JSON.stringify(value);
+        return s.length > 60 ? s.slice(0, 57) + "..." : s;
+    }
+    return String(value);
+}
+function collectCommonKeys(objects) {
+    // Use the keys of the FIRST object as the column set, filtered to those
+    // present in at least half of the rows. Keeps the table compact when rows
+    // have optional fields.
+    if (objects.length === 0)
+        return [];
+    const firstKeys = Object.keys(objects[0]);
+    const threshold = Math.ceil(objects.length / 2);
+    return firstKeys.filter((k) => {
+        let hits = 0;
+        for (const o of objects) {
+            if (Object.prototype.hasOwnProperty.call(o, k))
+                hits += 1;
+        }
+        return hits >= threshold;
+    });
+}
+//# sourceMappingURL=responseFormatter.js.map

package/dist/runtime/responseFormatter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"responseFormatter.js","sourceRoot":"","sources":["../../src/runtime/responseFormatter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAEvD,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,IAAI,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,CAAC,CAAC;KACtD,QAAQ,EAAE;KACV,QAAQ,CACP,qjBAAqjB,CACtjB,CAAC;AAoBJ;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,MAAe,EACf,QAAgB,EAChB,MAAgC;IAEhC,MAAM,IAAI,GAAiB,MAAM,IAAI,MAAM,CAAC;IAC5C,mEAAmE;IACnE,yEAAyE;IACzE,uEAAuE;IACvE,wEAAwE;IACxE,0DAA0D;IAC1D,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC/C,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IACrD,CAAC;IACD,sEAAsE;IACtE,qEAAqE;IACrE,6CAA6C;IAC7C,IAAI,IAAI,KAAK,kBAAkB,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACzD,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;YACpB,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;QACxD,CAAC;QACD,8DAA8D;QAC9D,MAAM,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACtD,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACzD,CAAC;IACD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACtD,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QACxB,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACzD,CAAC;IACD,yEAAyE;IACzE,uEAAuE;IACvE,wCAAwC;IACxC,OAAO;QACL,OAAO,EAAE;YACP,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE;YAChC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE;SAC7B;KACF,CAAC;AACJ,CAAC;AASD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAe,EACf,QAAgB;IAEhB,IAAI,QAAQ,KAAK,wBAAwB,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAM,IAAI,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QACjD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,GAAG,GAAG,MAAiC,CAAC;IAC9C,MAAM,SAAS,GAAG,oBAAoB,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,oBAAoB,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,OAAO,GAAG,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,GAAG,CAAC,WAAW,CAAY,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7F,oCAAoC;IACpC,MAAM,eAAe,GAAG,EAAE,CAAC;IAC3B,MAAM,iBAAiB,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,eAAe,CAAC,CAAC;IACxF,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,eAAe,CAAC,CAAC;IAClF,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,OAAO;YACL,sCAAsC;YACtC,EAAE;YACF,qEAAqE;YACrE,SAAS,CAAC,CAAC,CAAC,OAAO,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE;SACpC;aACE,IAAI,CAAC,IAAI,CAAC;aACV,IAAI,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,QAAQ,GAAa,CAAC,sCAAsC,EAAE,EAAE,CAAC,CAAC;IACxE,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,QAAQ,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QACvC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClB,QAAQ,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;QACpD,QAAQ,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QACtC,KAAK,MAAM,GAAG,IAAI,iBAAiB,EAAE,CAAC;YACpC,QAAQ,CAAC,IAAI,CACX,OAAO,GAAG,CAAC,SAAS,QAAQ,GAAG,CAAC,WAAW,MAAM,GAAG,CAAC,UAAU,MAAM,GAAG,CAAC,KAAK,IAAI,CACnF,CAAC;QACJ,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpB,CAAC;IACD,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,QAAQ,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC;QACjE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClB,QAAQ,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;QACpD,QAAQ,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QACtC,KAAK,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;YACjC,QAAQ,CAAC,IAAI,CACX,OAAO,GAAG,CAAC,SAAS,QAAQ,GAAG,CAAC,WAAW,MAAM,GAAG,CAAC,UAAU,OAAO,GAAG,CAAC,KAAK,IAAI,CACpF,CAAC;QACJ,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpB,CAAC;IACD,IAAI,SAAS,EAAE,CAAC;QACd,QAAQ,CAAC,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc;IAC1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,MAAM,IAAI,GAAmB,EAAE,CAAC;IAChC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,SAAS;QACvD,MAAM,CAAC,GAAG,IAA+B,CAAC;QAC1C,IACE,OAAO,CAAC,CAAC,WAAW,CAAC,KAAK,QAAQ;YAClC,OAAO,CAAC,CAAC,aAAa,CAAC,KAAK,QAAQ;YACpC,OAAO,CAAC,CAAC,YAAY,CAAC,KAAK,QAAQ;YACnC,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,EAC9B,CAAC;YACD,IAAI,CAAC,IAAI,CAAC;gBACR,SAAS,EAAE,CAAC,CAAC,WAAW,CAAW;gBACnC,WAAW,EAAE,CAAC,CAAC,aAAa,CAAW;gBACvC,UAAU,EAAE,CAAC,CAAC,YAAY,CAAW;gBACrC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAW;aAC5B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAc,EAAE,QAAgB;IAC/D,MAAM,KAAK,GAAa,CAAC,KAAK,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;IAC9C,IAAI,KAAK,IAAI,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/C,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;QAChC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IACD,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7C,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;QACxB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAChC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC;AACxC,CAAC;AAED,SAAS,WAAW,CAAC,KAAc,EAAE,KAAa;IAChD,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,UAAU,CAAC;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,IAAI,WAAW,CAAC;IAC3D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS;QACzD,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC3D,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,YAAY,CAAC,KAAgC,EAAE,KAAK,CAAC,CAAC;IAC5F,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,WAAW,CAAC,GAAc,EAAE,KAAa;IAChD,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,iBAAiB,CAAC;IAC/C,0DAA0D;IAC1D,IACE,GAAG,CAAC,MAAM,GAAG,CAAC;QACd,GAAG,CAAC,KAAK,CACP,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAC/D,EACD,CAAC;QACD,MAAM,OAAO,GAAG,GAAgC,CAAC;QACjD,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YACxC,MAAM,MAAM,GAAG,KAAK,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;YACzC,MAAM,GAAG,GAAG,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;YACvD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;gBAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAChD,OAAO,KAAK,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;YACpC,CAAC,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,OAAO,CAAC,MAAM,GAAG,EAAE,sBAAsB,CAAC,CAAC,CAAC,EAAE,CAAC;YACzF,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;QAClD,CAAC;IACH,CAAC;IACD,4CAA4C;IAC5C,OAAO,GAAG;SACP,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;SACZ,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;SAChC,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,SAAS,YAAY,CAAC,GAA4B,EAAE,KAAa;IAC/D,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,kBAAkB,CAAC;IACpD,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QACf,oEAAoE;QACpE,OAAO,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,OAAO,CAAC;IAC9D,CAAC;IACD,OAAO,OAAO;SACX,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,YAAY,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC;SAC5D,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,SAAS,YAAY,CAAC,KAAc,EAAE,KAAa;IACjD,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,UAAU,CAAC;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,IAAI,WAAW,CAAC;IAC3D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS;QACzD,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,iBAAiB,CAAC;QACjD,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC;YAChF,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;QAC3D,CAAC;QACD,OAAO,KAAK,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;IAC1C,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,YAAY,CAAC,KAAgC,EAAE,KAAK,CAAC,EAAE,CAAC;IACtE,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,UAAU,CAAC;IACrC,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IACpE,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,KAAK,IAAI,CAAC;IACrD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,GAAG,CAAC;IAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,wDAAwD;QACxD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC5C,OAAO,OAAO,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC;IACtE,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;QAC5D,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;IACrD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,kCAAkC;QAClC,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAChC,OAAO,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAkC;IAC3D,wEAAwE;IACxE,0EAA0E;IAC1E,wBAAwB;IACxB,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAChD,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;gBAAE,IAAI,IAAI,CAAC,CAAC;QAC5D,CAAC;QACD,OAAO,IAAI,IAAI,SAAS,CAAC;IAC3B,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/runtime/securityFlags.d.ts

@@ -0,0 +1,74 @@
+/**
+ * Security and resource-limit flags read from the environment.
+ *
+ * These flags exist to make memorydetective safer to install in shared
+ * setups (CI runners, teammate's machine, automation pipelines) by
+ * gating operations that can execute arbitrary local programs, bound
+ * recording durations so an unattended agent does not pile up
+ * multi-GB traces, and centralize where `.trace` bundles get written
+ * by default so cleanup is predictable.
+ *
+ * The flags are read from `process.env` lazily (each tool call calls
+ * `getSecurityFlags()` fresh). Defaults preserve the v1.8 behavior
+ * for every existing caller; the new behavior is opt-in via the env
+ * var.
+ *
+ * - `MEMORYDETECTIVE_ALLOW_LAUNCH=1`: gates
+ *   `bootAndLaunchForLeakInvestigation`. Without it, the tool returns
+ *   `ok: false` with an explanation. With it, the tool runs normally.
+ *   Default is OFF because that tool executes `xcodebuild` and
+ *   `xcrun simctl launch`, which are "run arbitrary local program"
+ *   in a trusted-input sense.
+ *
+ * - `MEMORYDETECTIVE_MAX_RECORDING_SECONDS=300` (default 300): caps
+ *   `durationSec` for `recordTimeProfile`. A caller asking for a
+ *   recording longer than this gets a clear error rather than the
+ *   tool silently agreeing to a 10-minute trace.
+ *
+ * - `MEMORYDETECTIVE_TRACE_ROOT=<path>` (default
+ *   `~/Library/Application Support/memorydetective/traces`):
+ *   directory where `.trace` bundles are written when the caller
+ *   provides a relative `output` path. Absolute `output` paths
+ *   bypass this default, preserving existing behavior. Also used by
+ *   the upcoming `cleanup_traces` tool as the default scan path.
+ */
+export interface SecurityFlags {
+    allowLaunch: boolean;
+    maxRecordingSeconds: number;
+    traceRoot: string;
+}
+export declare const DEFAULT_MAX_RECORDING_SECONDS = 300;
+export declare function defaultTraceRoot(homeDir?: string): string;
+/**
+ * Pure: read the security flags from an env-like object. Threaded as
+ * a parameter for testability; production callers omit it and get
+ * `process.env`.
+ *
+ * Parse rules:
+ *
+ * - `MEMORYDETECTIVE_ALLOW_LAUNCH` is truthy only when the value is
+ *   literally `"1"`. Any other value (including `"true"` and `"yes"`)
+ *   leaves it off, to keep the gate explicit.
+ *
+ * - `MEMORYDETECTIVE_MAX_RECORDING_SECONDS` accepts a positive
+ *   integer string; anything else (missing, zero, negative, NaN)
+ *   falls back to the default 300. The cap is bounded at 3600s (1h)
+ *   to prevent obviously-bad configs from disabling the gate via
+ *   absurd values.
+ *
+ * - `MEMORYDETECTIVE_TRACE_ROOT` accepts any non-empty string; empty
+ *   or missing values fall back to the default location.
+ */
+export declare function getSecurityFlags(env?: Readonly<Record<string, string | undefined>>, homeDir?: string): SecurityFlags;
+/**
+ * Build the error message returned when `bootAndLaunchForLeakInvestigation`
+ * is invoked without `MEMORYDETECTIVE_ALLOW_LAUNCH=1`. Exposed as a
+ * named export so the same wording is used everywhere (and so the
+ * unit tests can assert on it).
+ */
+export declare const ALLOW_LAUNCH_REQUIRED_MESSAGE = "bootAndLaunchForLeakInvestigation requires MEMORYDETECTIVE_ALLOW_LAUNCH=1 in the environment, because this tool executes xcodebuild + xcrun simctl launch against the host. Set the env var only when you trust the inputs (workspace/project paths and bundle ids) the agent will pass.";
+/**
+ * Build the error message returned when `recordTimeProfile` is asked
+ * for a duration above the cap.
+ */
+export declare function maxRecordingExceededMessage(requested: number, cap: number): string;

package/dist/runtime/securityFlags.js

@@ -0,0 +1,90 @@
+/**
+ * Security and resource-limit flags read from the environment.
+ *
+ * These flags exist to make memorydetective safer to install in shared
+ * setups (CI runners, teammate's machine, automation pipelines) by
+ * gating operations that can execute arbitrary local programs, bound
+ * recording durations so an unattended agent does not pile up
+ * multi-GB traces, and centralize where `.trace` bundles get written
+ * by default so cleanup is predictable.
+ *
+ * The flags are read from `process.env` lazily (each tool call calls
+ * `getSecurityFlags()` fresh). Defaults preserve the v1.8 behavior
+ * for every existing caller; the new behavior is opt-in via the env
+ * var.
+ *
+ * - `MEMORYDETECTIVE_ALLOW_LAUNCH=1`: gates
+ *   `bootAndLaunchForLeakInvestigation`. Without it, the tool returns
+ *   `ok: false` with an explanation. With it, the tool runs normally.
+ *   Default is OFF because that tool executes `xcodebuild` and
+ *   `xcrun simctl launch`, which are "run arbitrary local program"
+ *   in a trusted-input sense.
+ *
+ * - `MEMORYDETECTIVE_MAX_RECORDING_SECONDS=300` (default 300): caps
+ *   `durationSec` for `recordTimeProfile`. A caller asking for a
+ *   recording longer than this gets a clear error rather than the
+ *   tool silently agreeing to a 10-minute trace.
+ *
+ * - `MEMORYDETECTIVE_TRACE_ROOT=<path>` (default
+ *   `~/Library/Application Support/memorydetective/traces`):
+ *   directory where `.trace` bundles are written when the caller
+ *   provides a relative `output` path. Absolute `output` paths
+ *   bypass this default, preserving existing behavior. Also used by
+ *   the upcoming `cleanup_traces` tool as the default scan path.
+ */
+import os from "node:os";
+import { join as joinPath } from "node:path";
+export const DEFAULT_MAX_RECORDING_SECONDS = 300;
+export function defaultTraceRoot(homeDir = os.homedir()) {
+    return joinPath(homeDir, "Library", "Application Support", "memorydetective", "traces");
+}
+/**
+ * Pure: read the security flags from an env-like object. Threaded as
+ * a parameter for testability; production callers omit it and get
+ * `process.env`.
+ *
+ * Parse rules:
+ *
+ * - `MEMORYDETECTIVE_ALLOW_LAUNCH` is truthy only when the value is
+ *   literally `"1"`. Any other value (including `"true"` and `"yes"`)
+ *   leaves it off, to keep the gate explicit.
+ *
+ * - `MEMORYDETECTIVE_MAX_RECORDING_SECONDS` accepts a positive
+ *   integer string; anything else (missing, zero, negative, NaN)
+ *   falls back to the default 300. The cap is bounded at 3600s (1h)
+ *   to prevent obviously-bad configs from disabling the gate via
+ *   absurd values.
+ *
+ * - `MEMORYDETECTIVE_TRACE_ROOT` accepts any non-empty string; empty
+ *   or missing values fall back to the default location.
+ */
+export function getSecurityFlags(env = process.env, homeDir = os.homedir()) {
+    const allowLaunch = env.MEMORYDETECTIVE_ALLOW_LAUNCH === "1";
+    const rawMax = env.MEMORYDETECTIVE_MAX_RECORDING_SECONDS;
+    let maxRecordingSeconds = DEFAULT_MAX_RECORDING_SECONDS;
+    if (rawMax != null && rawMax !== "") {
+        const parsed = Number.parseInt(rawMax, 10);
+        if (Number.isFinite(parsed) && parsed > 0) {
+            maxRecordingSeconds = Math.min(parsed, 3600);
+        }
+    }
+    const rawRoot = env.MEMORYDETECTIVE_TRACE_ROOT;
+    const traceRoot = rawRoot != null && rawRoot.length > 0 ? rawRoot : defaultTraceRoot(homeDir);
+    return { allowLaunch, maxRecordingSeconds, traceRoot };
+}
+/**
+ * Build the error message returned when `bootAndLaunchForLeakInvestigation`
+ * is invoked without `MEMORYDETECTIVE_ALLOW_LAUNCH=1`. Exposed as a
+ * named export so the same wording is used everywhere (and so the
+ * unit tests can assert on it).
+ */
+export const ALLOW_LAUNCH_REQUIRED_MESSAGE = "bootAndLaunchForLeakInvestigation requires MEMORYDETECTIVE_ALLOW_LAUNCH=1 in the environment, because this tool executes xcodebuild + xcrun simctl launch against the host. Set the env var only when you trust the inputs (workspace/project paths and bundle ids) the agent will pass.";
+/**
+ * Build the error message returned when `recordTimeProfile` is asked
+ * for a duration above the cap.
+ */
+export function maxRecordingExceededMessage(requested, cap) {
+    return (`recordTimeProfile durationSec=${requested} exceeds the configured cap of ${cap}s ` +
+        `(MEMORYDETECTIVE_MAX_RECORDING_SECONDS). Lower durationSec, or raise the cap with the env var.`);
+}
+//# sourceMappingURL=securityFlags.js.map

package/dist/runtime/securityFlags.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"securityFlags.js","sourceRoot":"","sources":["../../src/runtime/securityFlags.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,IAAI,IAAI,QAAQ,EAAE,MAAM,WAAW,CAAC;AAQ7C,MAAM,CAAC,MAAM,6BAA6B,GAAG,GAAG,CAAC;AAEjD,MAAM,UAAU,gBAAgB,CAAC,UAAkB,EAAE,CAAC,OAAO,EAAE;IAC7D,OAAO,QAAQ,CACb,OAAO,EACP,SAAS,EACT,qBAAqB,EACrB,iBAAiB,EACjB,QAAQ,CACT,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAoD,OAAO,CAAC,GAAG,EAC/D,UAAkB,EAAE,CAAC,OAAO,EAAE;IAE9B,MAAM,WAAW,GAAG,GAAG,CAAC,4BAA4B,KAAK,GAAG,CAAC;IAE7D,MAAM,MAAM,GAAG,GAAG,CAAC,qCAAqC,CAAC;IACzD,IAAI,mBAAmB,GAAG,6BAA6B,CAAC;IACxD,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC3C,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1C,mBAAmB,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,CAAC,0BAA0B,CAAC;IAC/C,MAAM,SAAS,GACb,OAAO,IAAI,IAAI,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAE9E,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,SAAS,EAAE,CAAC;AACzD,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,6BAA6B,GACxC,0RAA0R,CAAC;AAE7R;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CACzC,SAAiB,EACjB,GAAW;IAEX,OAAO,CACL,iCAAiC,SAAS,kCAAkC,GAAG,IAAI;QACnF,gGAAgG,CACjG,CAAC;AACJ,CAAC"}

package/dist/runtime/staticAnalysisHints.js

@@ -203,7 +203,20 @@ const HINTS = {
     "swiftdata.modelcontext-actor-cycle": {
         rule: null,
         url: "https://developer.apple.com/forums/thread/748042",
-        explanation: "No static rule. The cycle is between Apple-provided types (`Actor` / `DefaultSerialModelExecutor` / `ModelContext`) — SwiftLint can't reason about Apple-framework retain semantics. Apple fixed the framework-level shape in iOS 18 beta 1 (FB13844786). Until your minimum target is iOS 18+, the user-code shape persists.",
+        explanation: "No static rule. The cycle is between Apple-provided types (`Actor` / `DefaultSerialModelExecutor` / `ModelContext`); SwiftLint can't reason about Apple-framework retain semantics. Apple fixed the framework-level shape in iOS 18 beta 1 (FB13844786). Until your minimum target is iOS 18+, the user-code shape persists.",
+    },
+    // ─────────────────────────────────────────────────────────────────────────
+    // v1.9 catalog (DebugSwift borrow)
+    // ─────────────────────────────────────────────────────────────────────────
+    "uikit.viewcontroller-retained-after-pop": {
+        rule: "weak_delegate",
+        url: "https://realm.github.io/SwiftLint/weak_delegate.html",
+        explanation: "`weak_delegate` catches the most common shape (delegate property without `weak`), and the project-wide `weak_self` rule covers closure-captured self in `viewDidLoad`/`viewWillAppear`. Neither catches Combine sinks stored on the VC nor KVO observations that never `invalidate()`; for those you need the offline catalog match.",
+    },
+    "swiftui.observable-write-on-every-render": {
+        rule: null,
+        url: "https://developer.apple.com/documentation/swiftui/managing-model-data-in-your-app",
+        explanation: "No static rule. SwiftLint cannot prove that an `@Observable` mutation happens inside a `View.body` chain (it would need to reason about View body resolution, which is compiler-internal). The cycle catalog catches the heap shape it leaves behind; the trace-side perf signal (excessive body re-evaluations on the same view) is a parallel detector.",
     },
 };
 /** Returns the static-analysis hint for a given pattern, or null if unknown. */

package/dist/runtime/staticAnalysisHints.js.map

@@ -1 +1 @@
-{"version":3,"file":"staticAnalysisHints.js","sourceRoot":"","sources":["../../src/runtime/staticAnalysisHints.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAWH;;;GAGG;AACH,MAAM,KAAK,GAAuC;IAChD,4EAA4E;IAC5E,YAAY;IACZ,4EAA4E;IAE5E,8BAA8B,EAAE;QAC9B,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,IAAI;QACT,WAAW,EACT,8KAA8K;KACjL;IACD,mCAAmC,EAAE;QACnC,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,IAAI;QACT,WAAW,EACT,2JAA2J;KAC9J;IACD,2BAA2B,EAAE;QAC3B,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,IAAI;QACT,WAAW,EACT,mKAAmK;KACtK;IACD,kCAAkC,EAAE;QAClC,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,+CAA+C;QACpD,WAAW,EACT,uLAAuL;KAC1L;IACD,4CAA4C,EAAE;QAC5C,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,IAAI;QACT,WAAW,EACT,2NAA2N;KAC9N;IACD,iCAAiC,EAAE;QACjC,IAAI,EAAE,WAAW;QACjB,GAAG,EAAE,kDAAkD;QACvD,WAAW,EACT,yQAAyQ;KAC5Q;IACD,oCAAoC,EAAE;QACpC,IAAI,EAAE,WAAW;QACjB,GAAG,EAAE,kDAAkD;QACvD,WAAW,EACT,wKAAwK;KAC3K;IACD,oCAAoC,EAAE;QACpC,IAAI,EAAE,WAAW;QACjB,GAAG,EAAE,kDAAkD;QACvD,WAAW,EACT,4LAA4L;KAC/L;IAED,4EAA4E;IAC5E,iBAAiB;IACjB,4EAA4E;IAE5E,+BAA+B,EAAE;QAC/B,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,IAAI;QACT,WAAW,EACT,gKAAgK;KACnK;IACD,2BAA2B,EAAE;QAC3B,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,IAAI;QACT,WAAW,EACT,yGAAyG;KAC5G;IACD,uBAAuB,EAAE;QACvB,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,IAAI;QACT,WAAW,EACT,mKAAmK;KACtK;IACD,iCAAiC,EAAE;QACjC,IAAI,EAAE,WAAW;QACjB,GAAG,EAAE,kDAAkD;QACvD,WAAW,EACT,oKAAoK;KACvK;IACD,4BAA4B,EAAE;QAC5B,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,IAAI;QACT,WAAW,EACT,iKAAiK;KACpK;IACD,oCAAoC,EAAE;QACpC,IAAI,EAAE,WAAW;QACjB,GAAG,EAAE,kDAAkD;QACvD,WAAW,EACT,6HAA6H;KAChI;IACD,yCAAyC,EAAE;QACzC,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,IAAI;QACT,WAAW,EACT,yIAAyI;KAC5I;IACD,2BAA2B,EAAE;QAC3B,IAAI,EAAE,eAAe;QACrB,GAAG,EAAE,sDAAsD;QAC3D,WAAW,EACT,8HAA8H;KACjI;IACD,kCAAkC,EAAE;QAClC,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,IAAI;QACT,WAAW,EACT,mJAAmJ;KACtJ;IACD,wBAAwB,EAAE;QACxB,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,IAAI;QACT,WAAW,EACT,kHAAkH;KACrH;IACD,iCAAiC,EAAE;QACjC,IAAI,EAAE,WAAW;QACjB,GAAG,EAAE,kDAAkD;QACvD,WAAW,EACT,qLAAqL;KACxL;IACD,2CAA2C,EAAE;QAC3C,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,IAAI;QACT,WAAW,EACT,kIAAkI;KACrI;IACD,qCAAqC,EAAE;QACrC,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,IAAI;QACT,WAAW,EACT,wJAAwJ;KAC3J;IACD,0CAA0C,EAAE;QAC1C,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,IAAI;QACT,WAAW,EACT,+OAA+O;KAClP;IACD,+BAA+B,EAAE;QAC/B,IAAI,EAAE,WAAW;QACjB,GAAG,EAAE,kDAAkD;QACvD,WAAW,EACT,sMAAsM;KACzM;IACD,kCAAkC,EAAE;QAClC,IAAI,EAAE,WAAW;QACjB,GAAG,EAAE,kDAAkD;QACvD,WAAW,EACT,wGAAwG;KAC3G;IAED,4EAA4E;IAC5E,0BAA0B;IAC1B,4EAA4E;IAE5E,yCAAyC,EAAE;QACzC,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,IAAI;QACT,WAAW,EACT,kPAAkP;KACrP;IACD,oCAAoC,EAAE;QACpC,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,IAAI;QACT,WAAW,EACT,yIAAyI;KAC5I;IACD,4CAA4C,EAAE;QAC5C,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,IAAI;QACT,WAAW,EACT,kNAAkN;KACrN;IAED,4EAA4E;IAC5E,yBAAyB;IACzB,4EAA4E;IAE5E,qCAAqC,EAAE;QACrC,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,IAAI;QACT,WAAW,EACT,8HAA8H;KACjI;IACD,4CAA4C,EAAE;QAC5C,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,IAAI;QACT,WAAW,EACT,iLAAiL;KACpL;IACD,oCAAoC,EAAE;QACpC,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,uGAAuG;QAC5G,WAAW,EACT,8OAA8O;KACjP;IACD,oDAAoD,EAAE;QACpD,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,iGAAiG;QACtG,WAAW,EACT,yLAAyL;KAC5L;IACD,0CAA0C,EAAE;QAC1C,IAAI,EAAE,WAAW;QACjB,GAAG,EAAE,kDAAkD;QACvD,WAAW,EACT,4LAA4L;KAC/L;IACD,sCAAsC,EAAE;QACtC,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,IAAI;QACT,WAAW,EACT,0MAA0M;KAC7M;IAED,4EAA4E;IAC5E,eAAe;IACf,4EAA4E;IAE5E,oCAAoC,EAAE;QACpC,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,kDAAkD;QACvD,WAAW,EACT,+TAA+T;KAClU;CACF,CAAC;AAEF,gFAAgF;AAChF,MAAM,UAAU,qBAAqB,CACnC,SAAiB;IAEjB,OAAO,KAAK,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC;AAClC,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,mBAAmB;IACjC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC"}
+{"version":3,"file":"staticAnalysisHints.js","sourceRoot":"","sources":["../../src/runtime/staticAnalysisHints.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAWH;;;GAGG;AACH,MAAM,KAAK,GAAuC;IAChD,4EAA4E;IAC5E,YAAY;IACZ,4EAA4E;IAE5E,8BAA8B,EAAE;QAC9B,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,IAAI;QACT,WAAW,EACT,8KAA8K;KACjL;IACD,mCAAmC,EAAE;QACnC,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,IAAI;QACT,WAAW,EACT,2JAA2J;KAC9J;IACD,2BAA2B,EAAE;QAC3B,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,IAAI;QACT,WAAW,EACT,mKAAmK;KACtK;IACD,kCAAkC,EAAE;QAClC,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,+CAA+C;QACpD,WAAW,EACT,uLAAuL;KAC1L;IACD,4CAA4C,EAAE;QAC5C,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,IAAI;QACT,WAAW,EACT,2NAA2N;KAC9N;IACD,iCAAiC,EAAE;QACjC,IAAI,EAAE,WAAW;QACjB,GAAG,EAAE,kDAAkD;QACvD,WAAW,EACT,yQAAyQ;KAC5Q;IACD,oCAAoC,EAAE;QACpC,IAAI,EAAE,WAAW;QACjB,GAAG,EAAE,kDAAkD;QACvD,WAAW,EACT,wKAAwK;KAC3K;IACD,oCAAoC,EAAE;QACpC,IAAI,EAAE,WAAW;QACjB,GAAG,EAAE,kDAAkD;QACvD,WAAW,EACT,4LAA4L;KAC/L;IAED,4EAA4E;IAC5E,iBAAiB;IACjB,4EAA4E;IAE5E,+BAA+B,EAAE;QAC/B,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,IAAI;QACT,WAAW,EACT,gKAAgK;KACnK;IACD,2BAA2B,EAAE;QAC3B,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,IAAI;QACT,WAAW,EACT,yGAAyG;KAC5G;IACD,uBAAuB,EAAE;QACvB,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,IAAI;QACT,WAAW,EACT,mKAAmK;KACtK;IACD,iCAAiC,EAAE;QACjC,IAAI,EAAE,WAAW;QACjB,GAAG,EAAE,kDAAkD;QACvD,WAAW,EACT,oKAAoK;KACvK;IACD,4BAA4B,EAAE;QAC5B,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,IAAI;QACT,WAAW,EACT,iKAAiK;KACpK;IACD,oCAAoC,EAAE;QACpC,IAAI,EAAE,WAAW;QACjB,GAAG,EAAE,kDAAkD;QACvD,WAAW,EACT,6HAA6H;KAChI;IACD,yCAAyC,EAAE;QACzC,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,IAAI;QACT,WAAW,EACT,yIAAyI;KAC5I;IACD,2BAA2B,EAAE;QAC3B,IAAI,EAAE,eAAe;QACrB,GAAG,EAAE,sDAAsD;QAC3D,WAAW,EACT,8HAA8H;KACjI;IACD,kCAAkC,EAAE;QAClC,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,IAAI;QACT,WAAW,EACT,mJAAmJ;KACtJ;IACD,wBAAwB,EAAE;QACxB,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,IAAI;QACT,WAAW,EACT,kHAAkH;KACrH;IACD,iCAAiC,EAAE;QACjC,IAAI,EAAE,WAAW;QACjB,GAAG,EAAE,kDAAkD;QACvD,WAAW,EACT,qLAAqL;KACxL;IACD,2CAA2C,EAAE;QAC3C,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,IAAI;QACT,WAAW,EACT,kIAAkI;KACrI;IACD,qCAAqC,EAAE;QACrC,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,IAAI;QACT,WAAW,EACT,wJAAwJ;KAC3J;IACD,0CAA0C,EAAE;QAC1C,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,IAAI;QACT,WAAW,EACT,+OAA+O;KAClP;IACD,+BAA+B,EAAE;QAC/B,IAAI,EAAE,WAAW;QACjB,GAAG,EAAE,kDAAkD;QACvD,WAAW,EACT,sMAAsM;KACzM;IACD,kCAAkC,EAAE;QAClC,IAAI,EAAE,WAAW;QACjB,GAAG,EAAE,kDAAkD;QACvD,WAAW,EACT,wGAAwG;KAC3G;IAED,4EAA4E;IAC5E,0BAA0B;IAC1B,4EAA4E;IAE5E,yCAAyC,EAAE;QACzC,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,IAAI;QACT,WAAW,EACT,kPAAkP;KACrP;IACD,oCAAoC,EAAE;QACpC,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,IAAI;QACT,WAAW,EACT,yIAAyI;KAC5I;IACD,4CAA4C,EAAE;QAC5C,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,IAAI;QACT,WAAW,EACT,kNAAkN;KACrN;IAED,4EAA4E;IAC5E,yBAAyB;IACzB,4EAA4E;IAE5E,qCAAqC,EAAE;QACrC,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,IAAI;QACT,WAAW,EACT,8HAA8H;KACjI;IACD,4CAA4C,EAAE;QAC5C,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,IAAI;QACT,WAAW,EACT,iLAAiL;KACpL;IACD,oCAAoC,EAAE;QACpC,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,uGAAuG;QAC5G,WAAW,EACT,8OAA8O;KACjP;IACD,oDAAoD,EAAE;QACpD,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,iGAAiG;QACtG,WAAW,EACT,yLAAyL;KAC5L;IACD,0CAA0C,EAAE;QAC1C,IAAI,EAAE,WAAW;QACjB,GAAG,EAAE,kDAAkD;QACvD,WAAW,EACT,4LAA4L;KAC/L;IACD,sCAAsC,EAAE;QACtC,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,IAAI;QACT,WAAW,EACT,0MAA0M;KAC7M;IAED,4EAA4E;IAC5E,eAAe;IACf,4EAA4E;IAE5E,oCAAoC,EAAE;QACpC,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,kDAAkD;QACvD,WAAW,EACT,8TAA8T;KACjU;IAED,4EAA4E;IAC5E,mCAAmC;IACnC,4EAA4E;IAE5E,yCAAyC,EAAE;QACzC,IAAI,EAAE,eAAe;QACrB,GAAG,EAAE,sDAAsD;QAC3D,WAAW,EACT,sUAAsU;KACzU;IAED,0CAA0C,EAAE;QAC1C,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,mFAAmF;QACxF,WAAW,EACT,2VAA2V;KAC9V;CACF,CAAC;AAEF,gFAAgF;AAChF,MAAM,UAAU,qBAAqB,CACnC,SAAiB;IAEjB,OAAO,KAAK,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC;AAClC,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,mBAAmB;IACjC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC"}

package/dist/templates/leak-report.html

@@ -0,0 +1,39 @@
+<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="generator" content="memorydetective">
+<title>{{TITLE}}</title>
+<style>
+  :root { color-scheme: light dark; }
+  body { font: 14px/1.5 -apple-system, BlinkMacSystemFont, "Segoe UI", system-ui, sans-serif; margin: 0; padding: 2rem; max-width: 960px; background: #fafafa; color: #1c1c1e; }
+  @media (prefers-color-scheme: dark) { body { background: #1c1c1e; color: #f2f2f7; } .card { background: #2c2c2e; } th { background: #3a3a3c; } code { background: #3a3a3c; } }
+  h1 { font-size: 1.6rem; margin: 0 0 .5rem; }
+  h2 { font-size: 1.1rem; margin: 2rem 0 .5rem; }
+  .meta { font-size: .8rem; opacity: .65; margin-bottom: 1.5rem; }
+  .card { background: #fff; border: 1px solid rgba(127,127,127,.2); border-radius: 8px; padding: 1rem 1.25rem; margin-bottom: 1rem; }
+  .verdict { display: inline-block; padding: .25rem .75rem; border-radius: 999px; font-weight: 600; font-size: .8rem; letter-spacing: .02em; }
+  .verdict.pass { background: #34c759; color: #fff; }
+  .verdict.fail { background: #ff3b30; color: #fff; }
+  .verdict.skip { background: #8e8e93; color: #fff; }
+  table { border-collapse: collapse; width: 100%; margin: .5rem 0; font-size: .85rem; }
+  th, td { text-align: left; padding: .4rem .6rem; border-bottom: 1px solid rgba(127,127,127,.2); }
+  th { background: #f2f2f7; font-weight: 600; }
+  code { font: .85rem/1.2 ui-monospace, SFMono-Regular, Menlo, monospace; background: #f2f2f7; padding: .15rem .35rem; border-radius: 4px; }
+  .badge { font-size: .7rem; padding: .1rem .4rem; border-radius: 4px; }
+  .badge.allow { background: rgba(142,142,147,.2); }
+  .badge.fail { background: rgba(255,59,48,.15); color: #ff3b30; }
+  .stat { display: inline-block; margin-right: 1.5rem; }
+  .stat .n { font-size: 1.4rem; font-weight: 600; }
+  .stat .label { font-size: .75rem; opacity: .65; text-transform: uppercase; letter-spacing: .05em; }
+  .steps { font-family: ui-monospace, SFMono-Regular, Menlo, monospace; font-size: .75rem; opacity: .7; white-space: pre-wrap; word-break: break-all; }
+  details { margin-top: .5rem; }
+  summary { cursor: pointer; font-size: .8rem; opacity: .7; }
+</style>
+</head>
+<body>
+<h1>{{TITLE}}</h1>
+<div class="meta">Generated by memorydetective {{VERSION}} at {{TIMESTAMP}}</div>
+{{BODY}}
+</body>
+</html>

package/dist/templates/templates/leak-report.html

@@ -0,0 +1,39 @@
+<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="generator" content="memorydetective">
+<title>{{TITLE}}</title>
+<style>
+  :root { color-scheme: light dark; }
+  body { font: 14px/1.5 -apple-system, BlinkMacSystemFont, "Segoe UI", system-ui, sans-serif; margin: 0; padding: 2rem; max-width: 960px; background: #fafafa; color: #1c1c1e; }
+  @media (prefers-color-scheme: dark) { body { background: #1c1c1e; color: #f2f2f7; } .card { background: #2c2c2e; } th { background: #3a3a3c; } code { background: #3a3a3c; } }
+  h1 { font-size: 1.6rem; margin: 0 0 .5rem; }
+  h2 { font-size: 1.1rem; margin: 2rem 0 .5rem; }
+  .meta { font-size: .8rem; opacity: .65; margin-bottom: 1.5rem; }
+  .card { background: #fff; border: 1px solid rgba(127,127,127,.2); border-radius: 8px; padding: 1rem 1.25rem; margin-bottom: 1rem; }
+  .verdict { display: inline-block; padding: .25rem .75rem; border-radius: 999px; font-weight: 600; font-size: .8rem; letter-spacing: .02em; }
+  .verdict.pass { background: #34c759; color: #fff; }
+  .verdict.fail { background: #ff3b30; color: #fff; }
+  .verdict.skip { background: #8e8e93; color: #fff; }
+  table { border-collapse: collapse; width: 100%; margin: .5rem 0; font-size: .85rem; }
+  th, td { text-align: left; padding: .4rem .6rem; border-bottom: 1px solid rgba(127,127,127,.2); }
+  th { background: #f2f2f7; font-weight: 600; }
+  code { font: .85rem/1.2 ui-monospace, SFMono-Regular, Menlo, monospace; background: #f2f2f7; padding: .15rem .35rem; border-radius: 4px; }
+  .badge { font-size: .7rem; padding: .1rem .4rem; border-radius: 4px; }
+  .badge.allow { background: rgba(142,142,147,.2); }
+  .badge.fail { background: rgba(255,59,48,.15); color: #ff3b30; }
+  .stat { display: inline-block; margin-right: 1.5rem; }
+  .stat .n { font-size: 1.4rem; font-weight: 600; }
+  .stat .label { font-size: .75rem; opacity: .65; text-transform: uppercase; letter-spacing: .05em; }
+  .steps { font-family: ui-monospace, SFMono-Regular, Menlo, monospace; font-size: .75rem; opacity: .7; white-space: pre-wrap; word-break: break-all; }
+  details { margin-top: .5rem; }
+  summary { cursor: pointer; font-size: .8rem; opacity: .7; }
+</style>
+</head>
+<body>
+<h1>{{TITLE}}</h1>
+<div class="meta">Generated by memorydetective {{VERSION}} at {{TIMESTAMP}}</div>
+{{BODY}}
+</body>
+</html>