multi-agents-custom 2.0.0 → 2.1.0

package/dist/index.mjs

@@ -1,21 +1,707 @@
 import {
+  AgentStatus,
   AntigravityWriter,
+  BaseAgent,
   ConfigGenerator,
   CopilotWriter,
   CursorWriter,
   DEFAULT_PERSONAS,
   Logger,
+  MasterAgent,
   QwenWriter,
   buildPersonas,
   resolveWriters
-} from "./chunk-C62CM2KR.mjs";
+} from "./chunk-PDPF4T5Z.mjs";
+
+// src/agents/devlead.ts
+import * as fs from "fs";
+import * as path from "path";
+
+// src/agents/reviewers/design.checker.ts
+var DesignChecker = class {
+  /**
+   * @param diff            Set of changed files.
+   * @param implDoc         Content of docs/ai/implementation/feature-{name}.md.
+   * @param designDoc       Content of docs/ai/design/feature-{name}.md.
+   */
+  check(diff, implDoc, designDoc) {
+    const findings = [];
+    const expectedComponents = this.extractComponents(designDoc);
+    const expectedInterfaces = this.extractInterfaces(designDoc);
+    for (const file of diff.files) {
+      findings.push(
+        ...this.checkComponentPresence(file.filePath, file.after, expectedComponents),
+        ...this.checkInterfaceConformance(file.filePath, file.after, expectedInterfaces),
+        ...this.checkNoNewUnlistedExports(file.filePath, file.before, file.after, expectedComponents)
+      );
+    }
+    findings.push(...this.checkImplDocCoverage(implDoc, expectedComponents));
+    return findings;
+  }
+  /**
+   * Extract bold component names from the design doc Components table.
+   * Matches `**ComponentName**` patterns.
+   */
+  extractComponents(designDoc) {
+    const matches = [...designDoc.matchAll(/\*\*([A-Z][A-Za-z]+(?:Agent|Checker|Builder|Gate|Registry|Router|Store)?)\*\*/g)];
+    return [...new Set(matches.map((m) => m[1]))];
+  }
+  /**
+   * Extract interface/type names from the design doc API/Data-model sections.
+   * Matches `interface FooBar` or `type FooBar` patterns.
+   */
+  extractInterfaces(designDoc) {
+    const matches = [...designDoc.matchAll(/(?:interface|type)\s+([A-Z][A-Za-z]+)/g)];
+    return [...new Set(matches.map((m) => m[1]))];
+  }
+  checkComponentPresence(filePath, after, components) {
+    const findings = [];
+    const isComponentFile = /\.(ts|tsx)$/.test(filePath) && !filePath.includes(".test.");
+    if (!isComponentFile || components.length === 0) return findings;
+    const matchedAny = components.some((c) => after.includes(c));
+    if (!matchedAny) {
+      findings.push({
+        file: filePath,
+        line: null,
+        severity: "MAJOR",
+        category: "DESIGN",
+        owaspCategory: null,
+        message: `None of the expected design components (${components.slice(0, 3).join(", ")}\u2026) are referenced in this file. Verify this file is aligned with the approved design.`,
+        suggestion: "Cross-reference docs/ai/design/*.md and ensure this file implements a documented component."
+      });
+    }
+    return findings;
+  }
+  checkInterfaceConformance(filePath, after, interfaces) {
+    const findings = [];
+    if (!filePath.endsWith(".ts") || filePath.includes(".test.")) return findings;
+    const importedTypes = [...after.matchAll(/import\s+(?:type\s+)?{([^}]+)}/g)].flatMap((m) => m[1].split(",").map((s) => s.trim().split(/\s+as\s+/)[0].trim())).filter(Boolean);
+    for (const imported of importedTypes) {
+      if (imported && /^[A-Z]/.test(imported) && imported.length > 1) {
+        const inDesign = interfaces.some(
+          (i) => i === imported || imported.startsWith(i) || i.startsWith(imported)
+        );
+        if (!inDesign && interfaces.length > 0) {
+          findings.push({
+            file: filePath,
+            line: null,
+            severity: "MINOR",
+            category: "DESIGN",
+            owaspCategory: null,
+            message: `Type "${imported}" is imported but not listed in the design doc interfaces. Confirm it is intentional or update the design doc.`,
+            suggestion: "Add the type to the Data Models section of the design doc, or remove it if unused."
+          });
+        }
+      }
+    }
+    return findings;
+  }
+  checkNoNewUnlistedExports(filePath, before, after, components) {
+    const findings = [];
+    if (!filePath.endsWith(".ts") || filePath.includes(".test.")) return findings;
+    const exportPattern = /export\s+(?:class|function|const|interface|type)\s+([A-Za-z]+)/g;
+    const beforeExports = new Set([...before.matchAll(exportPattern)].map((m) => m[1]));
+    const afterExports = [...after.matchAll(exportPattern)].map((m) => m[1]);
+    for (const exp of afterExports) {
+      if (!beforeExports.has(exp)) {
+        const inDesign = components.some(
+          (c) => c === exp || exp.includes(c) || c.includes(exp)
+        );
+        if (!inDesign && components.length > 0) {
+          findings.push({
+            file: filePath,
+            line: null,
+            severity: "MINOR",
+            category: "DESIGN",
+            owaspCategory: null,
+            message: `New export "${exp}" was not listed in the approved design doc. If this is intentional, update the design doc first.`,
+            suggestion: "Add this component/type to the Components or Data Models section of the design doc."
+          });
+        }
+      }
+    }
+    return findings;
+  }
+  checkImplDocCoverage(implDoc, components) {
+    const findings = [];
+    if (!implDoc.trim() || components.length === 0) return findings;
+    const missing = components.filter((c) => !implDoc.includes(c));
+    if (missing.length > 0) {
+      findings.push({
+        file: "docs/ai/implementation/",
+        line: null,
+        severity: "MINOR",
+        category: "DESIGN",
+        owaspCategory: null,
+        message: `Implementation doc does not mention design component(s): ${missing.join(", ")}.`,
+        suggestion: "Update docs/ai/implementation/feature-{name}.md to cover all design components."
+      });
+    }
+    return findings;
+  }
+};
+
+// src/agents/reviewers/quality.checker.ts
+var _QualityChecker = class _QualityChecker {
+  /**
+   * @param diff  Set of changed files to analyse.
+   */
+  check(diff) {
+    const findings = [];
+    for (const file of diff.files) {
+      if (!file.filePath.endsWith(".ts") && !file.filePath.endsWith(".tsx")) continue;
+      if (file.filePath.includes(".test.") || file.filePath.includes(".spec.")) continue;
+      findings.push(
+        ...this.checkAnyUsage(file.filePath, file.after),
+        ...this.checkFunctionLength(file.filePath, file.after),
+        ...this.checkMissingReturnTypes(file.filePath, file.after),
+        ...this.checkTodoComments(file.filePath, file.after),
+        ...this.checkConsoleStatements(file.filePath, file.after),
+        ...this.checkNonNullAssertions(file.filePath, file.after)
+      );
+    }
+    return findings;
+  }
+  checkAnyUsage(filePath, content) {
+    const findings = [];
+    const lines = content.split("\n");
+    lines.forEach((line, idx) => {
+      if (/(?::\s*any\b|as\s+any\b)/.test(line) && !line.trimStart().startsWith("//")) {
+        findings.push({
+          file: filePath,
+          line: idx + 1,
+          severity: "MAJOR",
+          category: "QUALITY",
+          owaspCategory: null,
+          message: "`any` type used \u2014 disables TypeScript type safety.",
+          suggestion: "Replace `any` with a specific type or `unknown`. Use type guards where needed."
+        });
+      }
+    });
+    return findings;
+  }
+  checkFunctionLength(filePath, content) {
+    const findings = [];
+    const lines = content.split("\n");
+    let functionStart = -1;
+    let braceDepth = 0;
+    let inFunction = false;
+    for (let i = 0; i < lines.length; i++) {
+      const line = lines[i];
+      const isFunctionDecl = /(?:function\s+\w+|(?:public|private|protected|async)\s+\w+\s*\(|(?:const|let)\s+\w+\s*=\s*(?:async\s+)?\()/.test(line) && line.includes("{");
+      if (isFunctionDecl && !inFunction) {
+        functionStart = i;
+        braceDepth = (line.match(/{/g) ?? []).length - (line.match(/}/g) ?? []).length;
+        inFunction = braceDepth > 0;
+        continue;
+      }
+      if (inFunction) {
+        braceDepth += (line.match(/{/g) ?? []).length - (line.match(/}/g) ?? []).length;
+        if (braceDepth <= 0) {
+          const length = i - functionStart + 1;
+          if (length > _QualityChecker.MAX_FUNCTION_LINES) {
+            findings.push({
+              file: filePath,
+              line: functionStart + 1,
+              severity: "MINOR",
+              category: "QUALITY",
+              owaspCategory: null,
+              message: `Function starting at line ${functionStart + 1} is ${length} lines long (limit: ${_QualityChecker.MAX_FUNCTION_LINES}).`,
+              suggestion: "Extract sub-logic into smaller, single-responsibility helper functions."
+            });
+          }
+          inFunction = false;
+          functionStart = -1;
+        }
+      }
+    }
+    return findings;
+  }
+  checkMissingReturnTypes(filePath, content) {
+    const findings = [];
+    const lines = content.split("\n");
+    lines.forEach((line, idx) => {
+      if (/(?:export\s+(?:async\s+)?function\s+\w+\s*\([^)]*\)\s*{|(?:public|private|protected)\s+(?:async\s+)?\w+\s*\([^)]*\)\s*{)/.test(line) && !line.includes(":")) {
+        findings.push({
+          file: filePath,
+          line: idx + 1,
+          severity: "MINOR",
+          category: "QUALITY",
+          owaspCategory: null,
+          message: "Function/method appears to be missing an explicit return type annotation.",
+          suggestion: "Add an explicit return type (e.g., `: void`, `: string`, `: Promise<T>`) for clarity and type-safety."
+        });
+      }
+    });
+    return findings;
+  }
+  checkTodoComments(filePath, content) {
+    const findings = [];
+    const lines = content.split("\n");
+    lines.forEach((line, idx) => {
+      if (/\b(TODO|FIXME|HACK|XXX)\b/.test(line)) {
+        findings.push({
+          file: filePath,
+          line: idx + 1,
+          severity: "MINOR",
+          category: "QUALITY",
+          owaspCategory: null,
+          message: `Unresolved ${(line.match(/\b(TODO|FIXME|HACK|XXX)\b/) ?? [])[0]} comment left in code.`,
+          suggestion: "Resolve or track this in the issue tracker, then remove the inline comment."
+        });
+      }
+    });
+    return findings;
+  }
+  checkConsoleStatements(filePath, content) {
+    const findings = [];
+    const lines = content.split("\n");
+    lines.forEach((line, idx) => {
+      if (/\bconsole\.(log|debug|warn|error|info)\b/.test(line) && !line.trimStart().startsWith("//")) {
+        findings.push({
+          file: filePath,
+          line: idx + 1,
+          severity: "MINOR",
+          category: "QUALITY",
+          owaspCategory: null,
+          message: "`console.*` statement found in production code.",
+          suggestion: "Use the project Logger utility instead of console.* for structured, level-aware logging."
+        });
+      }
+    });
+    return findings;
+  }
+  checkNonNullAssertions(filePath, content) {
+    const findings = [];
+    const lines = content.split("\n");
+    lines.forEach((line, idx) => {
+      if (/[A-Za-z0-9_)}\]]\s*!\s*[.[(]/.test(line) && !line.trimStart().startsWith("//")) {
+        findings.push({
+          file: filePath,
+          line: idx + 1,
+          severity: "MINOR",
+          category: "QUALITY",
+          owaspCategory: null,
+          message: "Non-null assertion operator (`!`) used \u2014 may cause runtime errors if value is null/undefined.",
+          suggestion: "Add an explicit null-check or use optional chaining (`?.`) instead."
+        });
+      }
+    });
+    return findings;
+  }
+};
+_QualityChecker.MAX_FUNCTION_LINES = 50;
+var QualityChecker = _QualityChecker;
+
+// src/agents/reviewers/owasp.checker.ts
+var OWASPChecker = class {
+  /**
+   * @param diff  Set of changed files to analyse.
+   */
+  check(diff) {
+    const findings = [];
+    for (const file of diff.files) {
+      if (!file.filePath.endsWith(".ts") && !file.filePath.endsWith(".tsx") && !file.filePath.endsWith(".js")) continue;
+      findings.push(
+        ...this.checkHardcodedSecrets(file.filePath, file.after),
+        ...this.checkWeakCrypto(file.filePath, file.after),
+        ...this.checkInjection(file.filePath, file.after),
+        ...this.checkMissingAuthChecks(file.filePath, file.after),
+        ...this.checkSSRF(file.filePath, file.after),
+        ...this.checkInsecureConfigs(file.filePath, file.after)
+      );
+    }
+    return findings;
+  }
+  // ── A02 / A07 — Hardcoded secrets ────────────────────────────────────────
+  checkHardcodedSecrets(filePath, content) {
+    const findings = [];
+    const lines = content.split("\n");
+    const secretPatterns = [
+      { pattern: /(?:password|passwd|pwd)\s*[:=]\s*['"`][^'"`]{4,}/i, label: "hardcoded password" },
+      { pattern: /(?:api[_-]?key|apikey|secret[_-]?key)\s*[:=]\s*['"`][A-Za-z0-9+/=]{8,}/i, label: "hardcoded API key" },
+      { pattern: /(?:token|bearer)\s*[:=]\s*['"`][A-Za-z0-9._-]{16,}/i, label: "hardcoded token" },
+      { pattern: /-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/, label: "embedded private key" }
+    ];
+    lines.forEach((line, idx) => {
+      if (line.trimStart().startsWith("//") || line.trimStart().startsWith("*")) return;
+      for (const { pattern, label } of secretPatterns) {
+        if (pattern.test(line)) {
+          findings.push({
+            file: filePath,
+            line: idx + 1,
+            severity: "BLOCKER",
+            category: "OWASP",
+            owaspCategory: "A02 Cryptographic Failures / A07 Authentication Failures",
+            message: `Possible ${label} detected. Hardcoded secrets must never appear in source code.`,
+            suggestion: "Move secrets to environment variables and access them via `process.env`. Never commit credentials."
+          });
+        }
+      }
+    });
+    return findings;
+  }
+  // ── A02 — Weak cryptography ───────────────────────────────────────────────
+  checkWeakCrypto(filePath, content) {
+    const findings = [];
+    const lines = content.split("\n");
+    const weakAlgos = [
+      { pattern: /\bMD5\b/i, label: "MD5" },
+      { pattern: /\bSHA1\b|['"`]sha1['"`]/i, label: "SHA-1" },
+      { pattern: /createCipher\b/, label: "createCipher (deprecated \u2014 use createCipheriv)" },
+      { pattern: /Math\.random\(\)/, label: "Math.random() for security-sensitive context" }
+    ];
+    lines.forEach((line, idx) => {
+      if (line.trimStart().startsWith("//")) return;
+      for (const { pattern, label } of weakAlgos) {
+        if (pattern.test(line)) {
+          findings.push({
+            file: filePath,
+            line: idx + 1,
+            severity: "BLOCKER",
+            category: "OWASP",
+            owaspCategory: "A02 Cryptographic Failures",
+            message: `Weak or deprecated cryptographic function/algorithm used: ${label}.`,
+            suggestion: "Use crypto.randomBytes() for randomness, SHA-256+ for hashing, and AES-GCM for encryption."
+          });
+        }
+      }
+    });
+    return findings;
+  }
+  // ── A03 — Injection ───────────────────────────────────────────────────────
+  checkInjection(filePath, content) {
+    const findings = [];
+    const lines = content.split("\n");
+    lines.forEach((line, idx) => {
+      if (line.trimStart().startsWith("//")) return;
+      if (/\beval\s*\(/.test(line)) {
+        findings.push({
+          file: filePath,
+          line: idx + 1,
+          severity: "BLOCKER",
+          category: "OWASP",
+          owaspCategory: "A03 Injection",
+          message: "`eval()` detected \u2014 executes arbitrary code and is a severe injection risk.",
+          suggestion: "Remove eval(). Use JSON.parse() for JSON, or restructure the logic to avoid dynamic code execution."
+        });
+      }
+      if (/new\s+Function\s*\(/.test(line)) {
+        findings.push({
+          file: filePath,
+          line: idx + 1,
+          severity: "BLOCKER",
+          category: "OWASP",
+          owaspCategory: "A03 Injection",
+          message: "`new Function(...)` constructs and executes code from a string \u2014 injection risk.",
+          suggestion: "Refactor to avoid dynamic code construction."
+        });
+      }
+      if (/(?:SELECT|INSERT|UPDATE|DELETE|DROP)\s+.+\s*\+\s*(?:req|input|params|body|query)/i.test(line)) {
+        findings.push({
+          file: filePath,
+          line: idx + 1,
+          severity: "BLOCKER",
+          category: "OWASP",
+          owaspCategory: "A03 Injection",
+          message: "Possible SQL injection: user-controlled input appears to be concatenated into an SQL string.",
+          suggestion: "Use parameterised queries or a prepared statement library. Never interpolate user input into SQL."
+        });
+      }
+      if (/\.innerHTML\s*=/.test(line)) {
+        findings.push({
+          file: filePath,
+          line: idx + 1,
+          severity: "MAJOR",
+          category: "OWASP",
+          owaspCategory: "A03 Injection",
+          message: "`innerHTML` assignment may enable cross-site scripting (XSS) if the value contains user input.",
+          suggestion: "Use `textContent` for plain text, or sanitise HTML with a trusted library (e.g., DOMPurify)."
+        });
+      }
+      if (/(?:exec|spawn|execSync|spawnSync)\s*\([^)]*(?:req|input|params|body|query)/.test(line)) {
+        findings.push({
+          file: filePath,
+          line: idx + 1,
+          severity: "BLOCKER",
+          category: "OWASP",
+          owaspCategory: "A03 Injection",
+          message: "Possible command injection: user-controlled input passed to a shell execution function.",
+          suggestion: "Never pass user input to exec/spawn. Use an allowlist of accepted commands. Prefer child_process.execFile with explicit args."
+        });
+      }
+    });
+    return findings;
+  }
+  // ── A07 — Authentication failures ────────────────────────────────────────
+  checkMissingAuthChecks(filePath, content) {
+    const findings = [];
+    const routePattern = /(?:app|router)\s*\.(?:get|post|put|patch|delete)\s*\(/g;
+    const hasAuth = /(?:authenticate|authorize|isAuth|verifyToken|requireAuth|middleware)/i.test(content);
+    if (routePattern.test(content) && !hasAuth) {
+      findings.push({
+        file: filePath,
+        line: null,
+        severity: "MAJOR",
+        category: "OWASP",
+        owaspCategory: "A07 Identification and Authentication Failures",
+        message: "HTTP route handlers found with no apparent authentication middleware. Public routes may expose protected resources.",
+        suggestion: "Add authentication/authorisation middleware to all routes that handle sensitive data or privileged operations."
+      });
+    }
+    return findings;
+  }
+  // ── A10 — SSRF ────────────────────────────────────────────────────────────
+  checkSSRF(filePath, content) {
+    const findings = [];
+    const lines = content.split("\n");
+    lines.forEach((line, idx) => {
+      if (line.trimStart().startsWith("//")) return;
+      if (/(?:fetch|axios\.get|axios\.post|http\.get|https\.get)\s*\(\s*(?:[A-Za-z_$][A-Za-z0-9_$]*(?:\s*\+|\s*`|\[))/.test(line)) {
+        findings.push({
+          file: filePath,
+          line: idx + 1,
+          severity: "MAJOR",
+          category: "OWASP",
+          owaspCategory: "A10 Server-Side Request Forgery (SSRF)",
+          message: "HTTP request to a dynamic URL \u2014 if the URL is derived from user input, this may be a SSRF vector.",
+          suggestion: "Validate and restrict allowed URL targets via an allowlist. Never forward raw user-supplied URLs to server-side HTTP calls."
+        });
+      }
+    });
+    return findings;
+  }
+  // ── A05 — Security misconfiguration ──────────────────────────────────────
+  checkInsecureConfigs(filePath, content) {
+    const findings = [];
+    const lines = content.split("\n");
+    lines.forEach((line, idx) => {
+      if (line.trimStart().startsWith("//")) return;
+      if (/cors\s*\(\s*\{\s*origin\s*:\s*['"`]\*['"`]/.test(line)) {
+        findings.push({
+          file: filePath,
+          line: idx + 1,
+          severity: "MAJOR",
+          category: "OWASP",
+          owaspCategory: "A05 Security Misconfiguration",
+          message: "CORS configured with a wildcard origin (`*`) \u2014 allows any domain to access the API.",
+          suggestion: "Restrict CORS origins to a specific list of trusted domains."
+        });
+      }
+      if (/rejectUnauthorized\s*:\s*false/.test(line)) {
+        findings.push({
+          file: filePath,
+          line: idx + 1,
+          severity: "BLOCKER",
+          category: "OWASP",
+          owaspCategory: "A05 Security Misconfiguration",
+          message: "`rejectUnauthorized: false` disables TLS certificate validation \u2014 enables MITM attacks.",
+          suggestion: "Remove `rejectUnauthorized: false`. Use a properly trusted certificate chain."
+        });
+      }
+    });
+    return findings;
+  }
+};
+
+// src/agents/reviewers/report.builder.ts
+var ReportBuilder = class {
+  /**
+   * @param featureName  Kebab-case feature name.
+   * @param findings     All findings from all checkers.
+   */
+  build(featureName, findings) {
+    const timestamp = (/* @__PURE__ */ new Date()).toISOString();
+    const hasBlocker = findings.some((f) => f.severity === "BLOCKER");
+    const outcome = hasBlocker ? "CHANGES_REQUESTED" : "PASS";
+    return {
+      featureName,
+      timestamp,
+      outcome,
+      findings,
+      summary: this.buildSummary(featureName, findings, outcome)
+    };
+  }
+  buildSummary(featureName, findings, outcome) {
+    const blockers = findings.filter((f) => f.severity === "BLOCKER").length;
+    const majors = findings.filter((f) => f.severity === "MAJOR").length;
+    const minors = findings.filter((f) => f.severity === "MINOR").length;
+    const total = findings.length;
+    const byCategory = {
+      DESIGN: findings.filter((f) => f.category === "DESIGN").length,
+      QUALITY: findings.filter((f) => f.category === "QUALITY").length,
+      OWASP: findings.filter((f) => f.category === "OWASP").length
+    };
+    const lines = [
+      `## Dev Lead Review \u2014 ${featureName}`,
+      "",
+      `**Outcome**: ${outcome === "PASS" ? "\u2705 PASS" : "\u274C CHANGES REQUESTED"}`,
+      `**Timestamp**: ${(/* @__PURE__ */ new Date()).toUTCString()}`,
+      "",
+      "### Finding Summary",
+      `| Severity | Count |`,
+      `|---|---|`,
+      `| BLOCKER  | ${blockers} |`,
+      `| MAJOR    | ${majors} |`,
+      `| MINOR    | ${minors} |`,
+      `| **Total**| **${total}** |`,
+      "",
+      "### By Category",
+      `| Category | Count |`,
+      `|---|---|`,
+      `| Design Adherence | ${byCategory.DESIGN} |`,
+      `| Code Quality     | ${byCategory.QUALITY} |`,
+      `| OWASP Security   | ${byCategory.OWASP} |`
+    ];
+    if (outcome === "CHANGES_REQUESTED") {
+      lines.push(
+        "",
+        "### \u26D4 Blockers \u2014 must be resolved before advancing to Tester",
+        ...findings.filter((f) => f.severity === "BLOCKER").map((f) => `- **${f.file}${f.line ? `:${f.line}` : ""}** [${f.owaspCategory ?? f.category}]: ${f.message}`)
+      );
+    }
+    if (outcome === "PASS" && total === 0) {
+      lines.push("", "> All checks passed with no findings. Ready for Tester.");
+    }
+    return lines.join("\n");
+  }
+};
+
+// src/agents/reviewers/confirmation.gate.ts
+import * as readline from "readline";
+var ConfirmationGate = class {
+  /**
+   * Display the report and wait for human confirmation.
+   *
+   * @param report  The completed ReviewReport from the ReportBuilder.
+   * @returns       The human's decision plus any rejection note.
+   */
+  async wait(report) {
+    this.printReport(report);
+    return this.promptUser();
+  }
+  printReport(report) {
+    const divider = "\u2500".repeat(72);
+    console.log(`
+${divider}`);
+    console.log(report.summary);
+    console.log(`
+${divider}`);
+    if (report.findings.length > 0) {
+      console.log("\n### All Findings\n");
+      for (const f of report.findings) {
+        const loc = f.line ? `:${f.line}` : "";
+        const owasp = f.owaspCategory ? ` [${f.owaspCategory}]` : "";
+        console.log(`[${f.severity}] ${f.category}${owasp}`);
+        console.log(`  File: ${f.file}${loc}`);
+        console.log(`  ${f.message}`);
+        if (f.suggestion) {
+          console.log(`  \u2192 ${f.suggestion}`);
+        }
+        console.log();
+      }
+    }
+    console.log(`${divider}
+`);
+    console.log("Please review the findings above and respond:");
+    console.log("  /approve          \u2014 advance pipeline to Tester");
+    console.log("  /reject [note]    \u2014 send back to Developer with this note\n");
+  }
+  promptUser() {
+    return new Promise((resolve) => {
+      const rl = readline.createInterface({
+        input: process.stdin,
+        output: process.stdout,
+        terminal: false
+      });
+      const ask = () => {
+        rl.question("> ", (answer) => {
+          const trimmed = answer.trim();
+          if (trimmed === "/approve") {
+            rl.close();
+            resolve({ decision: "approved" });
+            return;
+          }
+          if (trimmed.startsWith("/reject")) {
+            const note = trimmed.slice("/reject".length).trim();
+            rl.close();
+            resolve({ decision: "rejected", note });
+            return;
+          }
+          console.log("Unknown command. Use `/approve` or `/reject [note]`.");
+          ask();
+        });
+      };
+      ask();
+    });
+  }
+};
+
+// src/agents/devlead.ts
+var DevLeadAgent = class {
+  constructor(designChecker, qualityChecker, owaspChecker, reportBuilder, confirmationGate) {
+    this.designChecker = designChecker ?? new DesignChecker();
+    this.qualityChecker = qualityChecker ?? new QualityChecker();
+    this.owaspChecker = owaspChecker ?? new OWASPChecker();
+    this.reportBuilder = reportBuilder ?? new ReportBuilder();
+    this.confirmationGate = confirmationGate ?? new ConfirmationGate();
+  }
+  /**
+   * Run a full review cycle for a feature's code changes.
+   *
+   * 1. Loads the design doc and implementation doc from disk.
+   * 2. Runs all three checkers against the diff.
+   * 3. Builds and persists the ReviewReport.
+   * 4. Presents the report to the human and waits for /approve or /reject.
+   *
+   * @returns The completed ReviewReport (includes human decision in calling context).
+   * @throws  If required doc files cannot be read.
+   */
+  async review(context) {
+    const designDoc = this.readDoc(context.designDocPath);
+    const implDoc = this.readDoc(context.implementationDocPath);
+    const designFindings = this.designChecker.check(context.diff, implDoc, designDoc);
+    const qualityFindings = this.qualityChecker.check(context.diff);
+    const owaspFindings = this.owaspChecker.check(context.diff);
+    const allFindings = [...designFindings, ...qualityFindings, ...owaspFindings];
+    const report = this.reportBuilder.build(context.featureName, allFindings);
+    this.persistReport(report, context);
+    await this.confirmationGate.wait(report);
+    return report;
+  }
+  readDoc(docPath) {
+    try {
+      return fs.readFileSync(docPath, "utf-8");
+    } catch {
+      return "";
+    }
+  }
+  persistReport(report, context) {
+    const ts = report.timestamp.replace(/[-:]/g, "").replace("T", "-").slice(0, 15);
+    const reviewDir = path.join(
+      path.dirname(path.dirname(context.designDocPath)),
+      "review"
+    );
+    try {
+      fs.mkdirSync(reviewDir, { recursive: true });
+      const reportPath = path.join(reviewDir, `feature-${context.featureName}-${ts}.md`);
+      fs.writeFileSync(reportPath, report.summary, "utf-8");
+    } catch {
+      console.warn(`[DevLeadAgent] Could not persist review report to ${reviewDir}`);
+    }
+  }
+};
 export {
+  AgentStatus,
   AntigravityWriter,
+  BaseAgent,
   ConfigGenerator,
   CopilotWriter,
   CursorWriter,
   DEFAULT_PERSONAS,
+  DevLeadAgent,
   Logger,
+  MasterAgent,
   QwenWriter,
   buildPersonas,
   resolveWriters