openpitstop 1.0.0

package/dist/analyzers/routes.d.ts

@@ -0,0 +1,17 @@
+/**
+ * routes.ts — language-aware HTTP route discovery shared by `pitstop pen`
+ * (dynamic route inventory) and ledger mode (endpoint discovery).
+ *
+ * Heuristic by design: a route match is a lead, never a proof. Frameworks
+ * covered: Express/Fastify/plain http (JS), Flask/FastAPI/Django (Python),
+ * gin/echo/chi/gorilla-mux/net-http (Go), axum/actix-web (Rust), Spring
+ * (Java), ASP.NET (C#), shelf (Dart).
+ */
+export interface RouteMatch {
+    method: string;
+    path: string;
+    line: number;
+}
+export declare const ROUTE_EXTS: string[];
+/** Discover routes in one source file by its extension. */
+export declare function findRoutesInFile(content: string, ext: string): RouteMatch[];

package/dist/analyzers/routes.js

@@ -0,0 +1,115 @@
+import { lineOf } from "./util.js";
+export const ROUTE_EXTS = [
+    ".js", ".jsx", ".ts", ".tsx", ".mjs", ".cjs",
+    ".py",
+    ".go",
+    ".rs",
+    ".java", ".kt",
+    ".cs",
+    ".dart",
+];
+/** Express / Fastify / plain Node. */
+const JS_ROUTE_RE = /(?:^|\s)(?:app|router|route|fastify|server|instance|application)\s*\.\s*(get|post|put|patch|delete|all)\s*\(\s*(['"`])([^'"`]+)\2/g;
+/** Flask / FastAPI decorators + Django urlpatterns. */
+const PY_ROUTE_RE = /@\s*[\w.]*\.\s*(route|get|post|put|patch|delete)\s*\(\s*(['"])([^'"]+)\2|\b(?:path|re_path)\s*\(\s*(['"])([^'"]+)\4\s*,\s*\s*views\.([\w]+)/g;
+/**
+ * Go: gin (r.GET), echo (e.GET), fiber (app.Get), chi/gorilla (r.Get,
+ * r.HandleFunc), net/http (http.HandleFunc/Handle). Chi/gorilla/net-http
+ * registrations are method-agnostic — probe as GET (least destructive).
+ */
+const GO_ROUTE_RE = /\.\s*(?:(GET|POST|PUT|PATCH|DELETE|Get|Post|Put|Patch|Delete|Any)\s*\(\s*(['"`])([^'"`]+)\2|(HandleFunc|Handle)\s*\(\s*(['"`])([^'"`]+)\5)/g;
+/** Rust: axum `.route("/x", get(handler))` and actix-web `#[get("/x")]` macros. */
+const RS_ROUTE_RE = /\.\s*route\s*\(\s*(['"])([^'"]+)\1\s*,\s*(get|post|put|patch|delete)\s*\(|#\s*\[\s*(get|post|put|patch|delete)\s*\(\s*(['"])([^'"]+)\5\s*\)\s*\]/g;
+/** Java Spring: @GetMapping / @PostMapping / @RequestMapping. */
+const JAVA_ROUTE_RE = /@\s*(GetMapping|PostMapping|PutMapping|PatchMapping|DeleteMapping|RequestMapping)\s*\(\s*(?:path\s*=\s*)?(["'])([^"']+)\2/g;
+/** ASP.NET: [HttpGet("...")] / [HttpPost("...")] / [Route("...")]. */
+const CS_ROUTE_RE = /#?\s*\[\s*(HttpGet|HttpPost|HttpPut|HttpPatch|HttpDelete|Route)\s*\(\s*(["'])([^"']+)\2/g;
+/** Dart shelf: router.get('/path', ...) etc. */
+const DART_ROUTE_RE = /\b(?:router|app|server|route)\s*\.\s*(get|post|put|patch|delete)\s*\(\s*(['"])([^'"]+)\2/g;
+const METHOD_OF = (m) => {
+    const u = m.toUpperCase();
+    if (u === "ANY" || u === "HANDLEFUNC" || u === "HANDLE" || u === "ROUTE")
+        return "GET";
+    return u;
+};
+/** Discover routes in one source file by its extension. */
+export function findRoutesInFile(content, ext) {
+    const routes = [];
+    let m;
+    switch (ext) {
+        case ".js":
+        case ".jsx":
+        case ".ts":
+        case ".tsx":
+        case ".mjs":
+        case ".cjs":
+            JS_ROUTE_RE.lastIndex = 0;
+            while ((m = JS_ROUTE_RE.exec(content)) !== null) {
+                routes.push({ method: m[1].toUpperCase(), path: m[3], line: lineOf(content, m.index + m[0].length) });
+            }
+            break;
+        case ".py":
+            PY_ROUTE_RE.lastIndex = 0;
+            while ((m = PY_ROUTE_RE.exec(content)) !== null) {
+                if (m[3]) {
+                    routes.push({
+                        method: m[1] === "route" ? "POST" : m[1].toUpperCase(),
+                        path: m[3],
+                        line: lineOf(content, m.index + m[0].length),
+                    });
+                }
+                else if (m[5]) {
+                    routes.push({ method: "POST", path: m[5], line: lineOf(content, m.index + m[0].length) });
+                }
+            }
+            break;
+        case ".go":
+            GO_ROUTE_RE.lastIndex = 0;
+            while ((m = GO_ROUTE_RE.exec(content)) !== null) {
+                const method = m[1] || m[4] || "";
+                const p = m[3] || m[6] || "";
+                if (p)
+                    routes.push({ method: METHOD_OF(method), path: p, line: lineOf(content, m.index + m[0].length) });
+            }
+            break;
+        case ".rs":
+            RS_ROUTE_RE.lastIndex = 0;
+            while ((m = RS_ROUTE_RE.exec(content)) !== null) {
+                const method = m[3] || m[4] || "GET";
+                const p = m[2] || m[6] || "";
+                if (p)
+                    routes.push({ method: METHOD_OF(method), path: p, line: lineOf(content, m.index + m[0].length) });
+            }
+            break;
+        case ".java":
+        case ".kt":
+            JAVA_ROUTE_RE.lastIndex = 0;
+            while ((m = JAVA_ROUTE_RE.exec(content)) !== null) {
+                routes.push({
+                    method: m[1].toUpperCase().replace(/MAPPING$/, ""),
+                    path: m[3],
+                    line: lineOf(content, m.index + m[0].length),
+                });
+            }
+            break;
+        case ".cs":
+            CS_ROUTE_RE.lastIndex = 0;
+            while ((m = CS_ROUTE_RE.exec(content)) !== null) {
+                const u = m[1].toUpperCase();
+                routes.push({
+                    method: u === "ROUTE" ? "GET" : u.replace(/^HTTP/, ""),
+                    path: m[3],
+                    line: lineOf(content, m.index + m[0].length),
+                });
+            }
+            break;
+        case ".dart":
+            DART_ROUTE_RE.lastIndex = 0;
+            while ((m = DART_ROUTE_RE.exec(content)) !== null) {
+                routes.push({ method: m[1].toUpperCase(), path: m[3], line: lineOf(content, m.index + m[0].length) });
+            }
+            break;
+    }
+    return routes;
+}
+//# sourceMappingURL=routes.js.map

package/dist/analyzers/routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.js","sourceRoot":"","sources":["../../src/analyzers/routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAkBnC,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IAC5C,KAAK;IACL,KAAK;IACL,KAAK;IACL,OAAO,EAAE,KAAK;IACd,KAAK;IACL,OAAO;CACR,CAAC;AAEF,sCAAsC;AACtC,MAAM,WAAW,GACf,oIAAoI,CAAC;AAEvI,uDAAuD;AACvD,MAAM,WAAW,GACf,8IAA8I,CAAC;AAEjJ;;;;GAIG;AACH,MAAM,WAAW,GACf,6IAA6I,CAAC;AAEhJ,mFAAmF;AACnF,MAAM,WAAW,GACf,mJAAmJ,CAAC;AAEtJ,iEAAiE;AACjE,MAAM,aAAa,GACjB,4HAA4H,CAAC;AAE/H,sEAAsE;AACtE,MAAM,WAAW,GACf,0FAA0F,CAAC;AAE7F,gDAAgD;AAChD,MAAM,aAAa,GACjB,2FAA2F,CAAC;AAE9F,MAAM,SAAS,GAAG,CAAC,CAAS,EAAU,EAAE;IACtC,MAAM,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IAC1B,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,YAAY,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IACvF,OAAO,CAAC,CAAC;AACX,CAAC,CAAC;AAEF,2DAA2D;AAC3D,MAAM,UAAU,gBAAgB,CAAC,OAAe,EAAE,GAAW;IAC3D,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,CAAyB,CAAC;IAC9B,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,KAAK,CAAC;QACX,KAAK,MAAM,CAAC;QACZ,KAAK,KAAK,CAAC;QACX,KAAK,MAAM,CAAC;QACZ,KAAK,MAAM,CAAC;QACZ,KAAK,MAAM;YACT,WAAW,CAAC,SAAS,GAAG,CAAC,CAAC;YAC1B,OAAO,CAAC,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAChD,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACxG,CAAC;YACD,MAAM;QACR,KAAK,KAAK;YACR,WAAW,CAAC,SAAS,GAAG,CAAC,CAAC;YAC1B,OAAO,CAAC,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAChD,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBACT,MAAM,CAAC,IAAI,CAAC;wBACV,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;wBACtD,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;wBACV,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;qBAC7C,CAAC,CAAC;gBACL,CAAC;qBAAM,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBAChB,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAC5F,CAAC;YACH,CAAC;YACD,MAAM;QACR,KAAK,KAAK;YACR,WAAW,CAAC,SAAS,GAAG,CAAC,CAAC;YAC1B,OAAO,CAAC,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAChD,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAClC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC7B,IAAI,CAAC;oBAAE,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC3G,CAAC;YACD,MAAM;QACR,KAAK,KAAK;YACR,WAAW,CAAC,SAAS,GAAG,CAAC,CAAC;YAC1B,OAAO,CAAC,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAChD,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC;gBACrC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC7B,IAAI,CAAC;oBAAE,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC3G,CAAC;YACD,MAAM;QACR,KAAK,OAAO,CAAC;QACb,KAAK,KAAK;YACR,aAAa,CAAC,SAAS,GAAG,CAAC,CAAC;YAC5B,OAAO,CAAC,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAClD,MAAM,CAAC,IAAI,CAAC;oBACV,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;oBAClD,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;oBACV,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;iBAC7C,CAAC,CAAC;YACL,CAAC;YACD,MAAM;QACR,KAAK,KAAK;YACR,WAAW,CAAC,SAAS,GAAG,CAAC,CAAC;YAC1B,OAAO,CAAC,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAChD,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;gBAC7B,MAAM,CAAC,IAAI,CAAC;oBACV,MAAM,EAAE,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;oBACtD,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;oBACV,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;iBAC7C,CAAC,CAAC;YACL,CAAC;YACD,MAAM;QACR,KAAK,OAAO;YACV,aAAa,CAAC,SAAS,GAAG,CAAC,CAAC;YAC5B,OAAO,CAAC,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAClD,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACxG,CAAC;YACD,MAAM;IACV,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/analyzers/security.d.ts

@@ -0,0 +1,2 @@
+import type { SecurityResult } from "./types.js";
+export declare function analyzeSecurity(repo: string): Promise<SecurityResult>;

package/dist/analyzers/security.js

@@ -0,0 +1,302 @@
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { commandExists, detectLanguage, safeExecAsync } from "./util.js";
+/** How long an npm-audit result is reused before re-fetching from the registry. */
+const AUDIT_TTL_MS = 24 * 60 * 60 * 1000;
+export async function analyzeSecurity(repo) {
+    const lang = detectLanguage(repo);
+    const issues = [];
+    let depNote;
+    if (lang === "js") {
+        // npm audit exits 1 when vulnerabilities exist but still prints the full
+        // JSON — capture stdout and persist it for parsing either way. The result
+        // is cached keyed on the lockfile hash: an unchanged lockfile (the common
+        // case inside one fix loop) makes the audit network call disappear.
+        const stdout = await npmAudit(repo);
+        if (stdout) {
+            const auditFile = path.join(repo, ".pitstop", "npm-audit.json");
+            fs.mkdirSync(path.dirname(auditFile), { recursive: true });
+            fs.writeFileSync(auditFile, stdout);
+            issues.push(...parseNpmAudit(stdout));
+        }
+    }
+    else if (lang === "python") {
+        if (commandExists("pip-audit")) {
+            const r = await safeExecAsync("pip-audit", ["-f", "json"], repo, 120000);
+            if (r.stdout)
+                issues.push(...parsePipAudit(r.stdout));
+        }
+        else {
+            // pip-audit missing — OSV understands pyproject.toml / poetry.lock etc.
+            issues.push(...(await osvScan(repo)));
+        }
+    }
+    else if (lang !== "unknown") {
+        if (commandExists("osv-scanner")) {
+            issues.push(...(await osvScan(repo)));
+        }
+        else {
+            depNote = `install osv-scanner (go install github.com/google/osv-scanner/cmd/osv-scanner@latest) to scan ${lang} dependencies`;
+        }
+    }
+    if (commandExists("gitleaks")) {
+        const tmp = path.join(repo, ".pitstop", `gitleaks-${Date.now()}.json`);
+        fs.mkdirSync(path.dirname(tmp), { recursive: true });
+        const r = await safeExecAsync("gitleaks", ["detect", "--no-git", "--report-format", "json", "--report-path", tmp, "-v"], repo, 120000);
+        if (fs.existsSync(tmp)) {
+            try {
+                issues.push(...parseGitleaks(fs.readFileSync(tmp, "utf8")));
+            }
+            catch {
+                /* ignore */
+            }
+            try {
+                fs.rmSync(tmp);
+            }
+            catch {
+                /* ignore */
+            }
+        }
+    }
+    if (commandExists("semgrep")) {
+        const r = await safeExecAsync("semgrep", ["--config", "auto", "--json"], repo, 180000);
+        if (r.stdout)
+            issues.push(...parseSemgrep(r.stdout));
+    }
+    if (issues.length === 0 && lang === "unknown") {
+        return {
+            status: "skipped",
+            note: "unsupported language / no security tooling",
+            issues: [],
+        };
+    }
+    if (issues.length === 0 && depNote) {
+        return { status: "skipped", note: depNote, issues: [] };
+    }
+    return { status: "ok", issues };
+}
+async function npmAudit(repo) {
+    const lockCandidate = ["package-lock.json", "npm-shrinkwrap.json", "package.json"].find((f) => fs.existsSync(path.join(repo, f)));
+    if (!lockCandidate)
+        return null;
+    const hash = crypto
+        .createHash("sha1")
+        .update(fs.readFileSync(path.join(repo, lockCandidate)))
+        .digest("hex")
+        .slice(0, 12);
+    const cacheDir = path.join(repo, ".pitstop", "cache");
+    fs.mkdirSync(cacheDir, { recursive: true });
+    const cachePath = path.join(cacheDir, `npm-audit-${hash}.json`);
+    if (fs.existsSync(cachePath)) {
+        try {
+            const cached = JSON.parse(fs.readFileSync(cachePath, "utf8"));
+            if (cached &&
+                typeof cached.stdout === "string" &&
+                typeof cached.at === "string" &&
+                Date.now() - Date.parse(cached.at) < AUDIT_TTL_MS) {
+                return cached.stdout;
+            }
+        }
+        catch {
+            /* stale or corrupt — re-fetch */
+        }
+    }
+    const r = await safeExecAsync("npm", ["audit", "--json"], repo, 120000);
+    if (r.stdout) {
+        try {
+            fs.writeFileSync(cachePath, JSON.stringify({ at: new Date().toISOString(), stdout: r.stdout }));
+        }
+        catch {
+            /* cache write is best-effort */
+        }
+    }
+    return r.stdout || null;
+}
+/** Root-level manifests/lockfiles OSV understands (nested ones are scanned too). */
+const OSV_ROOT_LOCKFILES = [
+    "go.mod",
+    "go.sum",
+    "Cargo.lock",
+    "Cargo.toml",
+    "pubspec.lock",
+    "pubspec.yaml",
+    "pom.xml",
+    "build.gradle",
+    "build.gradle.kts",
+    "packages.lock.json",
+    "requirements.txt",
+    "pyproject.toml",
+    "poetry.lock",
+];
+/**
+ * Universal dependency scan via google/osv-scanner (`scan --format json <dir>`
+ * walks the tree for supported manifests: go.mod, Cargo.lock, pubspec.lock,
+ * pom.xml, build.gradle, *.csproj, ...). Result is cached like npm-audit,
+ * keyed on root lockfile names + sizes.
+ */
+async function osvScan(repo) {
+    const lockKey = OSV_ROOT_LOCKFILES.filter((f) => fs.existsSync(path.join(repo, f)))
+        .map((f) => {
+        try {
+            return `${f}:${fs.statSync(path.join(repo, f)).size}`;
+        }
+        catch {
+            return f;
+        }
+    })
+        .join("|");
+    const hash = crypto.createHash("sha1").update(lockKey || "dir").digest("hex").slice(0, 12);
+    const cacheDir = path.join(repo, ".pitstop", "cache");
+    fs.mkdirSync(cacheDir, { recursive: true });
+    const cachePath = path.join(cacheDir, `osv-${hash}.json`);
+    if (fs.existsSync(cachePath)) {
+        try {
+            const cached = JSON.parse(fs.readFileSync(cachePath, "utf8"));
+            if (cached &&
+                typeof cached.stdout === "string" &&
+                typeof cached.at === "string" &&
+                Date.now() - Date.parse(cached.at) < AUDIT_TTL_MS) {
+                return parseOsvScanner(cached.stdout);
+            }
+        }
+        catch {
+            /* stale or corrupt — re-scan */
+        }
+    }
+    const r = await safeExecAsync("osv-scanner", ["scan", "--format", "json", repo], repo, 180000);
+    if (r.stdout) {
+        try {
+            fs.writeFileSync(cachePath, JSON.stringify({ at: new Date().toISOString(), stdout: r.stdout }));
+        }
+        catch {
+            /* cache write is best-effort */
+        }
+        return parseOsvScanner(r.stdout);
+    }
+    return [];
+}
+function parseOsvScanner(stdout) {
+    const issues = [];
+    let json;
+    try {
+        json = JSON.parse(stdout);
+    }
+    catch {
+        return issues;
+    }
+    for (const res of json?.results ?? []) {
+        for (const pkg of res?.packages ?? []) {
+            const name = pkg?.package?.name ?? "unknown";
+            const version = pkg?.package?.version ?? "";
+            for (const v of pkg?.vulnerabilities ?? []) {
+                // OSV advisories carry CVSS scores; map to the 4-level severity scale
+                // the rest of the report uses.
+                const sev = v?.severity?.[0];
+                let severity = "medium";
+                if (typeof sev?.score === "string" || typeof sev?.score === "number") {
+                    const score = parseFloat(String(sev.score));
+                    if (!Number.isNaN(score)) {
+                        severity =
+                            score >= 9 ? "critical" : score >= 7 ? "high" : score >= 4 ? "medium" : "low";
+                    }
+                }
+                const summary = (v?.summary ?? "").trim();
+                const desc = `${name}${version ? `@${version}` : ""} ${v?.id ?? ""}`.trim();
+                issues.push({
+                    type: "dependency",
+                    severity,
+                    description: summary ? `${desc} — ${summary}` : desc,
+                });
+            }
+        }
+    }
+    return issues;
+}
+function parseNpmAudit(stdout) {
+    const issues = [];
+    let json;
+    try {
+        json = JSON.parse(stdout);
+    }
+    catch {
+        return issues;
+    }
+    const vuls = json?.vulnerabilities ?? {};
+    for (const [name, v] of Object.entries(vuls)) {
+        let desc = name;
+        const via = v?.via;
+        if (Array.isArray(via)) {
+            const firstObj = via.find((x) => typeof x === "object" && x.title);
+            if (firstObj?.title)
+                desc = `${name}: ${firstObj.title}`;
+            else if (typeof via[0] === "string")
+                desc = `${name} (via ${via[0]})`;
+        }
+        issues.push({
+            type: "dependency",
+            severity: v?.severity ?? "unknown",
+            description: desc,
+        });
+    }
+    return issues;
+}
+function parsePipAudit(stdout) {
+    const issues = [];
+    let arr;
+    try {
+        arr = JSON.parse(stdout);
+    }
+    catch {
+        return issues;
+    }
+    for (const v of arr) {
+        issues.push({
+            type: "dependency",
+            severity: v.severity ?? "unknown",
+            description: `${v.name} ${v.id ?? ""}`.trim(),
+        });
+    }
+    return issues;
+}
+function parseGitleaks(stdout) {
+    const issues = [];
+    let arr;
+    try {
+        arr = JSON.parse(stdout);
+    }
+    catch {
+        return issues;
+    }
+    for (const f of arr) {
+        issues.push({
+            type: "secret",
+            severity: f.Severity ?? "high",
+            file: f.File,
+            line: f.StartLine,
+            description: f.Description ?? f.RuleID ?? "secret detected",
+        });
+    }
+    return issues;
+}
+function parseSemgrep(stdout) {
+    const issues = [];
+    let json;
+    try {
+        json = JSON.parse(stdout);
+    }
+    catch {
+        return issues;
+    }
+    for (const r of json?.results ?? []) {
+        issues.push({
+            type: "code",
+            severity: r.extra?.severity ?? "medium",
+            file: r.path,
+            line: r.start?.line,
+            description: r.extra?.message ?? r.check_id ?? "finding",
+        });
+    }
+    return issues;
+}
+//# sourceMappingURL=security.js.map

package/dist/analyzers/security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.js","sourceRoot":"","sources":["../../src/analyzers/security.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAGzE,mFAAmF;AACnF,MAAM,YAAY,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEzC,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAY;IAChD,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,MAAM,GAAgB,EAAE,CAAC;IAC/B,IAAI,OAA2B,CAAC;IAEhC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,yEAAyE;QACzE,0EAA0E;QAC1E,0EAA0E;QAC1E,oEAAoE;QACpE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,gBAAgB,CAAC,CAAC;YAChE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3D,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YACpC,MAAM,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;SAAM,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,IAAI,aAAa,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/B,MAAM,CAAC,GAAG,MAAM,aAAa,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;YACzE,IAAI,CAAC,CAAC,MAAM;gBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QACxD,CAAC;aAAM,CAAC;YACN,wEAAwE;YACxE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;SAAM,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,IAAI,aAAa,CAAC,aAAa,CAAC,EAAE,CAAC;YACjC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACxC,CAAC;aAAM,CAAC;YACN,OAAO,GAAG,iGAAiG,IAAI,eAAe,CAAC;QACjI,CAAC;IACH,CAAC;IAED,IAAI,aAAa,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,YAAY,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACvE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACrD,MAAM,CAAC,GAAG,MAAM,aAAa,CAC3B,UAAU,EACV,CAAC,QAAQ,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,IAAI,CAAC,EAC7E,IAAI,EACJ,MAAM,CACP,CAAC;QACF,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,IAAI,CAAC;gBACH,MAAM,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;YAC9D,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY;YACd,CAAC;YACD,IAAI,CAAC;gBACH,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjB,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY;YACd,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,aAAa,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,MAAM,aAAa,CAAC,SAAS,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QACvF,IAAI,CAAC,CAAC,MAAM;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACvD,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9C,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,IAAI,EAAE,4CAA4C;YAClD,MAAM,EAAE,EAAE;SACX,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;QACnC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAC1D,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAClC,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAY;IAClC,MAAM,aAAa,GAAG,CAAC,mBAAmB,EAAE,qBAAqB,EAAE,cAAc,CAAC,CAAC,IAAI,CACrF,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CACzC,CAAC;IACF,IAAI,CAAC,aAAa;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,IAAI,GAAG,MAAM;SAChB,UAAU,CAAC,MAAM,CAAC;SAClB,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;SACvD,MAAM,CAAC,KAAK,CAAC;SACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAEhB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;IACtD,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,aAAa,IAAI,OAAO,CAAC,CAAC;IAChE,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAG3D,CAAC;YACF,IACE,MAAM;gBACN,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;gBACjC,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ;gBAC7B,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,YAAY,EACjD,CAAC;gBACD,OAAO,MAAM,CAAC,MAAM,CAAC;YACvB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,iCAAiC;QACnC,CAAC;IACH,CAAC;IAED,MAAM,CAAC,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IACxE,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;QACb,IAAI,CAAC;YACH,EAAE,CAAC,aAAa,CACd,SAAS,EACT,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CACnE,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,gCAAgC;QAClC,CAAC;IACH,CAAC;IACD,OAAO,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC;AAC1B,CAAC;AAED,oFAAoF;AACpF,MAAM,kBAAkB,GAAG;IACzB,QAAQ;IACR,QAAQ;IACR,YAAY;IACZ,YAAY;IACZ,cAAc;IACd,cAAc;IACd,SAAS;IACT,cAAc;IACd,kBAAkB;IAClB,oBAAoB;IACpB,kBAAkB;IAClB,gBAAgB;IAChB,aAAa;CACd,CAAC;AAEF;;;;;GAKG;AACH,KAAK,UAAU,OAAO,CAAC,IAAY;IACjC,MAAM,OAAO,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;SAChF,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACT,IAAI,CAAC;YACH,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC;QACX,CAAC;IACH,CAAC,CAAC;SACD,IAAI,CAAC,GAAG,CAAC,CAAC;IACb,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,IAAI,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAE3F,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;IACtD,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,IAAI,OAAO,CAAC,CAAC;IAC1D,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAG3D,CAAC;YACF,IACE,MAAM;gBACN,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;gBACjC,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ;gBAC7B,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,YAAY,EACjD,CAAC;gBACD,OAAO,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACxC,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,gCAAgC;QAClC,CAAC;IACH,CAAC;IAED,MAAM,CAAC,GAAG,MAAM,aAAa,CAAC,aAAa,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IAC/F,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;QACb,IAAI,CAAC;YACH,EAAE,CAAC,aAAa,CACd,SAAS,EACT,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CACnE,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,gCAAgC;QAClC,CAAC;QACD,OAAO,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,eAAe,CAAC,MAAc;IACrC,MAAM,MAAM,GAAgB,EAAE,CAAC;IAC/B,IAAI,IAAS,CAAC;IACd,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,OAAO,IAAI,EAAE,EAAE,CAAC;QACtC,KAAK,MAAM,GAAG,IAAI,GAAG,EAAE,QAAQ,IAAI,EAAE,EAAE,CAAC;YACtC,MAAM,IAAI,GAAW,GAAG,EAAE,OAAO,EAAE,IAAI,IAAI,SAAS,CAAC;YACrD,MAAM,OAAO,GAAW,GAAG,EAAE,OAAO,EAAE,OAAO,IAAI,EAAE,CAAC;YACpD,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,eAAe,IAAI,EAAE,EAAE,CAAC;gBAC3C,sEAAsE;gBACtE,+BAA+B;gBAC/B,MAAM,GAAG,GAAG,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;gBAC7B,IAAI,QAAQ,GAAG,QAAQ,CAAC;gBACxB,IAAI,OAAO,GAAG,EAAE,KAAK,KAAK,QAAQ,IAAI,OAAO,GAAG,EAAE,KAAK,KAAK,QAAQ,EAAE,CAAC;oBACrE,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;oBAC5C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;wBACzB,QAAQ;4BACN,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC;oBAClF,CAAC;gBACH,CAAC;gBACD,MAAM,OAAO,GAAG,CAAC,CAAC,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC1C,MAAM,IAAI,GAAG,GAAG,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;gBAC5E,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,YAAY;oBAClB,QAAQ;oBACR,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,MAAM,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI;iBACrD,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,aAAa,CAAC,MAAc;IACnC,MAAM,MAAM,GAAgB,EAAE,CAAC;IAC/B,IAAI,IAAS,CAAC;IACd,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,EAAE,eAAe,IAAI,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAM,IAAI,CAAC,EAAE,CAAC;QAClD,IAAI,IAAI,GAAG,IAAI,CAAC;QAChB,MAAM,GAAG,GAAG,CAAC,EAAE,GAAG,CAAC;QACnB,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC;YACxE,IAAI,QAAQ,EAAE,KAAK;gBAAE,IAAI,GAAG,GAAG,IAAI,KAAK,QAAQ,CAAC,KAAK,EAAE,CAAC;iBACpD,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC,KAAK,QAAQ;gBAAE,IAAI,GAAG,GAAG,IAAI,SAAS,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACxE,CAAC;QACD,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,YAAY;YAClB,QAAQ,EAAE,CAAC,EAAE,QAAQ,IAAI,SAAS;YAClC,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,aAAa,CAAC,MAAc;IACnC,MAAM,MAAM,GAAgB,EAAE,CAAC;IAC/B,IAAI,GAAU,CAAC;IACf,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;QACpB,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,YAAY;YAClB,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,SAAS;YACjC,WAAW,EAAE,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE;SAC9C,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,aAAa,CAAC,MAAc;IACnC,MAAM,MAAM,GAAgB,EAAE,CAAC;IAC/B,IAAI,GAAU,CAAC;IACf,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;QACpB,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,MAAM;YAC9B,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,SAAS;YACjB,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,MAAM,IAAI,iBAAiB;SAC5D,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,YAAY,CAAC,MAAc;IAClC,MAAM,MAAM,GAAgB,EAAE,CAAC;IAC/B,IAAI,IAAS,CAAC;IACd,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,OAAO,IAAI,EAAE,EAAE,CAAC;QACpC,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,MAAM;YACZ,QAAQ,EAAE,CAAC,CAAC,KAAK,EAAE,QAAQ,IAAI,QAAQ;YACvC,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI;YACnB,WAAW,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,IAAI,CAAC,CAAC,QAAQ,IAAI,SAAS;SACzD,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/analyzers/suiteRunner.d.ts

@@ -0,0 +1,64 @@
+/**
+ * suiteRunner.ts — run a repo's test suite for non-JS/TS stacks and report
+ * per-test outcomes (or a whole-suite pseudo-test when the runner only exposes
+ * aggregates). Shared by the tests analyzer (one run) and the reliability
+ * analyzer (N sequential runs for flakiness detection).
+ *
+ * Honest contract: a runner that cannot produce parseable outcomes returns
+ * `unparseable` instead of inventing pass counts; a repo with no tests at all
+ * returns null so callers report "no tests", not a fabricated clean run.
+ */
+export interface SuiteRun {
+    framework: string;
+    tests: {
+        name: string;
+        file?: string;
+        status: "passed" | "failed";
+    }[];
+    total: number;
+    passed: number;
+    failed: number;
+    durationMs: number;
+    /** Set when the toolchain ran but produced no parseable results. */
+    unparseable?: string;
+}
+/** Run the suite for Go/Rust/Flutter/.NET/Java repos; null if no toolchain or no tests. */
+export declare function runNonJsSuite(repo: string): Promise<SuiteRun | null>;
+/** True when the language's test toolchain is available (PATH or repo wrapper). */
+export declare function nonJsToolchainPresent(lang: string, repo: string): boolean;
+/** Pure parser for `go test -json` stream. Exported for unit tests. */
+export declare function parseGoTestOutput(stdout: string): {
+    tests: SuiteRun["tests"];
+    passed: number;
+    failed: number;
+};
+/** Pure parser for cargo's libtest JSON stream. Exported for unit tests. */
+export declare function parseCargoTestOutput(stdout: string): {
+    tests: SuiteRun["tests"];
+    passed: number;
+    failed: number;
+};
+/** Pure parser for flutter --machine stream. Exported for unit tests. */
+export declare function parseFlutterMachineOutput(stdout: string): {
+    tests: SuiteRun["tests"];
+    passed: number;
+    failed: number;
+};
+/** Pure parser for the dotnet test summary line. Exported for unit tests. */
+export declare function parseDotnetSummary(output: string): {
+    passed: number;
+    failed: number;
+    total: number;
+} | null;
+/** Pure parser for maven surefire "Tests run:" summaries. Exported for unit tests. */
+export declare function parseMavenSummary(output: string): {
+    passed: number;
+    failed: number;
+    total: number;
+};
+/** Pure parser for gradle's build/test-results XML. Exported for unit tests. */
+export declare function parseGradleXml(xml: string): {
+    passed: number;
+    failed: number;
+    total: number;
+};