openpitstop 1.0.0

package/dist/sandbox/proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy.js","sourceRoot":"","sources":["../../src/sandbox/proxy.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,MAAM,SAAS,CAAC;AA6CzB,MAAM,SAAS,GACb,4FAA4F,CAAC;AAE/F,SAAS,SAAS,CAAC,OAAiC,EAAE,IAAY;IAChE,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAClC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM;YAAE,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,SAAS,CAAC,MAAc,EAAE,IAAY,EAAE,OAAiC,EAAE,IAAa;IAC/F,KAAK,MAAM,IAAI,IAAI;QACjB,iBAAiB;QACjB,mBAAmB;QACnB,aAAa;QACb,eAAe;QACf,wBAAwB;KACzB,EAAE,CAAC;QACF,MAAM,CAAC,GAAG,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE;YAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC;IACD,MAAM,CAAC,GAAG,IAAsC,CAAC;IACjD,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC;IAC7D,IAAI,GAAG,IAAI,IAAI;QAAE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,6DAA6D,CAAC,CAAC;IAC5F,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IACnB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,QAAQ,CAAC,MAAc,EAAE,IAAY;IAC5C,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;IACvC,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACjE,OAAO,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;AACtC,CAAC;AAED,IAAI,GAAG,GAAG,CAAC,CAAC;AACZ,SAAS,MAAM,CAAC,MAAc;IAC5B,GAAG,IAAI,CAAC,CAAC;IACT,OAAO,CAAC,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,GAAG,GAAG,GAAG,GAAG,CAAC;AACvE,CAAC;AAED,SAAS,QAAQ,CAAC,GAAY;IAC5B,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACrD,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,GAAG,EAAE,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,MAAc,EAAE,IAAY,EAAE,IAAa,EAAE,SAAiB;IAClG,MAAM,CAAC,GAAG,IAAsC,CAAC;IACjD,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IACvD,MAAM,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC;IAC5C,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IAErC,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3B,OAAO;YACL,EAAE,EAAE,MAAM,GAAG,SAAS;YACtB,MAAM,EAAE,SAAS;YACjB,MAAM;YACN,QAAQ;YACR,MAAM,EAAE,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY;YAChE,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,IAAI;YACnC,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,IAAI;YACT,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI;SAC9B,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,OAAO;YACL,EAAE,EAAE,KAAK,GAAG,SAAS;YACrB,MAAM,EAAE,QAAQ;YAChB,MAAM;YACN,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE;YACxC,MAAM,EAAE,WAAW;YACnB,IAAI,EAAE,IAAI;YACV,QAAQ,EAAE,IAAI;YACd,SAAS;YACT,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI;SAC3B,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5B,OAAO;YACL,EAAE,EAAE,SAAS;YACb,MAAM,EAAE,aAAa;YACrB,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC;YAC3C,eAAe,EAAE,QAAQ;YACzB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;IACJ,CAAC;IACD,OAAO;QACL,EAAE,EAAE,SAAS;QACb,MAAM,EAAE,SAAS;QACjB,MAAM,EAAE,WAAW;QACnB,MAAM;QACN,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAkB;IACpD,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,GAAY,EAAQ,EAAE;QAClD,IAAI,CAAC;YACH,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;QACtD,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB;QACnB,CAAC;IACH,CAAC,CAAC;IACF,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,KAA8B,EAAQ,EAAE;QACtE,MAAM,IAAI,CAAC,CAAC;QACZ,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE;YACnB,IAAI;YACJ,CAAC,EAAE,MAAM;YACT,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC5B,GAAG,KAAK;SACT,CAAC,CAAC;IACL,CAAC,CAAC;IACF,MAAM,OAAO,GAAG,CAAC,KAA8B,EAAQ,EAAE;QACvD,IAAI,IAAI,CAAC,WAAW;YAAE,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;IAC7F,CAAC,CAAC;IAEF,MAAM,SAAS,GAAG,CAAC,IAAY,EAAW,EAAE,CAC1C,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QAC3B,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QACxD,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAC7B,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IACL,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAW,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC,CAAC;IACzG,MAAM,UAAU,GAAG,CAAC,IAAY,EAAW,EAAE,CAC3C,kDAAkD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEhE,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC5C,IAAI,MAAW,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACnB,GAAG,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;YAC9C,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC;QAC1F,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC;QAC7C,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;QAEzD,yEAAyE;QACzE,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CACxB;gBACE,IAAI,EAAE,MAAM,CAAC,QAAQ;gBACrB,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9D,MAAM;gBACN,IAAI,EAAE,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM;gBACrC,OAAO,EAAE,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE;aAC/C,EACD,CAAC,QAAQ,EAAE,EAAE;gBACX,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,IAAI,GAAG,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;gBAC5D,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACrB,CAAC,CACF,CAAC;YACF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBACrB,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,CAAC,wCAAwC,CAAC,CAAC;YACpD,CAAC,CAAC,CAAC;YACH,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAChB,OAAO;QACT,CAAC;QAED,IAAI,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACnB,QAAQ,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YACzC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;YACrD,GAAG,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;YAC9B,OAAO;QACT,CAAC;QAED,IAAI,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;YACpB,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9C,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC9D,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;gBAChC,MAAM,MAAM,GAAG;oBACb,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;oBAC5B,IAAI;oBACJ,MAAM;oBACN,IAAI;oBACJ,GAAG,EAAE,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC;oBAC/C,OAAO,EAAG,IAAuC,EAAE,QAAQ,IAAI,IAAI;oBACnE,SAAS;oBACT,cAAc,EAAE,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE;oBAClC,WAAW,EAAE,IAAI;oBACjB,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;oBAC9B,cAAc,EAAE,GAAG;oBACnB,YAAY,EAAE,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC;iBAClE,CAAC;gBACF,IAAI,IAAI,CAAC,cAAc;oBAAE,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;gBAC7D,OAAO,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;gBACjF,QAAQ,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;gBACzC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;YAC/C,CAAC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,8DAA8D;QAC9D,QAAQ,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5C,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,uBAAuB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,2EAA2E;IAC3E,oDAAoD;IACpD,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE;QACnC,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC;QAC9D,QAAQ,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC,CAAC;QACtE,MAAM,CAAC,KAAK,CAAC,6DAA6D,CAAC,CAAC;QAC5E,MAAM,CAAC,OAAO,EAAE,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YACjC,MAAM,IAAI,GAAI,MAAM,CAAC,OAAO,EAAsB,CAAC,IAAI,CAAC;YACxD,OAAO,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACjD,OAAO,CAAC;gBACN,IAAI;gBACJ,KAAK,EAAE,GAAG,EAAE,CACV,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE;oBACtB,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;oBACxB,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;gBAC9B,CAAC,CAAC;aACL,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/sandbox/startCmd.d.ts

@@ -0,0 +1,24 @@
+import type { Language } from "../analyzers/util.js";
+/**
+ * sandbox/startCmd.ts — resolve the app-under-test's start command.
+ *
+ * JS repos use the package.json `start` script (as before). Non-JS stacks have
+ * no universal convention, so in order we try:
+ *   1. the PITSTOP_START env var (explicit, e.g. "uvicorn app.main:app"),
+ *   2. the repo's own conventions (manage.py / app.py / main.py / server.py,
+ *      `go run .`, `cargo run`, `dotnet run`, spring-boot:run / bootRun),
+ *   3. null — the caller aborts honestly with a hint instead of guessing.
+ */
+export interface StartCommand {
+    cmd: string;
+    args: string[];
+}
+export declare function isNodeCommand(cmd: string): boolean;
+/** The start command for a Node/JS repo (package.json `start` script). */
+export declare function resolveNodeStart(repo: string): StartCommand;
+/**
+ * Best-effort start command for a non-JS repo. `port` is templated into the
+ * args where the framework needs it (e.g. Django's runserver). Returns null
+ * when nothing can be guessed — callers must abort with an honest hint.
+ */
+export declare function resolveNativeStart(repo: string, lang: Language, port: number): StartCommand | null;

package/dist/sandbox/startCmd.js

@@ -0,0 +1,71 @@
+import fs from "node:fs";
+import path from "node:path";
+const NODE_BASED = new Set([
+    "node", "node.exe", "nodejs", "npm", "npm.cmd", "npx", "npx.cmd",
+    "yarn", "yarn.cmd", "pnpm", "pnpm.cmd", "tsx", "ts-node", "babel-node",
+    "ojs", "vitest", "jest",
+]);
+export function isNodeCommand(cmd) {
+    return NODE_BASED.has(cmd);
+}
+/** The start command for a Node/JS repo (package.json `start` script). */
+export function resolveNodeStart(repo) {
+    const pkgPath = path.join(repo, "package.json");
+    if (!fs.existsSync(pkgPath))
+        throw new Error("no package.json — a start script is required");
+    const start = JSON.parse(fs.readFileSync(pkgPath, "utf8").replace(/^\uFEFF/, ""))?.scripts?.start || "";
+    if (!start)
+        throw new Error("no `start` script in package.json — a start script is required");
+    const tokens = start.trim().split(/\s+/);
+    return { cmd: tokens[0] || "", args: tokens.slice(1) };
+}
+function gradleWrapper(repo) {
+    const name = process.platform === "win32" ? "gradlew.bat" : "gradlew";
+    const wrapper = path.join(repo, name);
+    return fs.existsSync(wrapper) ? wrapper : null;
+}
+/**
+ * Best-effort start command for a non-JS repo. `port` is templated into the
+ * args where the framework needs it (e.g. Django's runserver). Returns null
+ * when nothing can be guessed — callers must abort with an honest hint.
+ */
+export function resolveNativeStart(repo, lang, port) {
+    const fromEnv = process.env.PITSTOP_START?.trim();
+    if (fromEnv) {
+        const tokens = fromEnv.split(/\s+/);
+        return { cmd: tokens[0] || "", args: tokens.slice(1) };
+    }
+    switch (lang) {
+        case "python": {
+            if (fs.existsSync(path.join(repo, "manage.py"))) {
+                return { cmd: "python", args: ["manage.py", "runserver", "--noreload", `0.0.0.0:${port}`] };
+            }
+            for (const f of ["app.py", "main.py", "server.py", "wsgi.py", "asgi.py"]) {
+                if (fs.existsSync(path.join(repo, f)))
+                    return { cmd: "python", args: [f] };
+            }
+            return null;
+        }
+        case "go":
+            return fs.existsSync(path.join(repo, "go.mod")) ? { cmd: "go", args: ["run", "."] } : null;
+        case "rust":
+            return fs.existsSync(path.join(repo, "Cargo.toml"))
+                ? { cmd: "cargo", args: ["run"] }
+                : null;
+        case "dotnet":
+            return { cmd: "dotnet", args: ["run"] };
+        case "java": {
+            if (fs.existsSync(path.join(repo, "pom.xml"))) {
+                return { cmd: "mvn", args: ["spring-boot:run"] };
+            }
+            const gradle = gradleWrapper(repo);
+            if (gradle || fs.existsSync(path.join(repo, "build.gradle"))) {
+                return { cmd: gradle ?? "gradle", args: ["bootRun"] };
+            }
+            return null;
+        }
+        default:
+            return null;
+    }
+}
+//# sourceMappingURL=startCmd.js.map

package/dist/sandbox/startCmd.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"startCmd.js","sourceRoot":"","sources":["../../src/sandbox/startCmd.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAmB7B,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC;IACzB,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS;IAChE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY;IACtE,KAAK,EAAE,QAAQ,EAAE,MAAM;CACxB,CAAC,CAAC;AAEH,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,OAAO,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAC7B,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAChD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAC7F,MAAM,KAAK,GACT,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC;IAC5F,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IAC9F,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACzC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AACzD,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;IACtE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACtC,OAAO,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AACjD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,IAAc,EAAE,IAAY;IAC3E,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC;IAClD,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACpC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IACzD,CAAC;IAED,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC;gBAChD,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,IAAI,EAAE,CAAC,EAAE,CAAC;YAC9F,CAAC;YACD,KAAK,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC;gBACzE,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;oBAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7E,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,KAAK,IAAI;YACP,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC7F,KAAK,MAAM;YACT,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;gBACjD,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE;gBACjC,CAAC,CAAC,IAAI,CAAC;QACX,KAAK,QAAQ;YACX,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1C,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC;gBAC9C,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,iBAAiB,CAAC,EAAE,CAAC;YACnD,CAAC;YACD,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;YACnC,IAAI,MAAM,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC;gBAC7D,OAAO,EAAE,GAAG,EAAE,MAAM,IAAI,QAAQ,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC;YACxD,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC"}

package/dist/ui/spinner.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Spinner wrapper with two modes:
+ *
+ * - TTY               → ora spinner rendered on STDOUT. Overriding the default
+ *                       stderr stream avoids PowerShell 5.1 painting every
+ *                       spinner frame as a red "RemoteException" error record,
+ *                       which made the very first `pitstop scan` look broken.
+ * - non-TTY (CI/pipe) → ora is a no-op there; instead we print a plain "text…"
+ *                       line at start and a plain ✓/✗ line at the end, so CI
+ *                       logs still read as a coherent step instead of a terse
+ *                       spinner glyph that never clears.
+ */
+export interface Spinner {
+    succeed(text?: string): void;
+    warn(text?: string): void;
+    fail(text?: string): void;
+}
+export declare function createSpinner(text: string): Spinner;

package/dist/ui/spinner.js

@@ -0,0 +1,26 @@
+import ora from "ora";
+import chalk from "chalk";
+export function createSpinner(text) {
+    if (!process.stderr.isTTY) {
+        console.log(chalk.dim(`${text}…`));
+        return {
+            succeed: (t) => {
+                if (t)
+                    console.log(chalk.green(`✓ ${t}`));
+            },
+            warn: (t) => {
+                console.log(chalk.yellow(`⚠ ${t ?? text}`));
+            },
+            fail: (t) => {
+                console.log(chalk.red(`✗ ${t ?? text}`));
+            },
+        };
+    }
+    const spin = ora({ text, stream: process.stdout }).start();
+    return {
+        succeed: (t) => spin.succeed(t),
+        warn: (t) => spin.warn(t),
+        fail: (t) => spin.fail(t),
+    };
+}
+//# sourceMappingURL=spinner.js.map

package/dist/ui/spinner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"spinner.js","sourceRoot":"","sources":["../../src/ui/spinner.ts"],"names":[],"mappings":"AAAA,OAAO,GAAG,MAAM,KAAK,CAAC;AACtB,OAAO,KAAK,MAAM,OAAO,CAAC;AAqB1B,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC;QACnC,OAAO;YACL,OAAO,EAAE,CAAC,CAAU,EAAE,EAAE;gBACtB,IAAI,CAAC;oBAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;YAC5C,CAAC;YACD,IAAI,EAAE,CAAC,CAAU,EAAE,EAAE;gBACnB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;YAC9C,CAAC;YACD,IAAI,EAAE,CAAC,CAAU,EAAE,EAAE;gBACnB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;YAC3C,CAAC;SACF,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;IAC3D,OAAO;QACL,OAAO,EAAE,CAAC,CAAU,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QACxC,IAAI,EAAE,CAAC,CAAU,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAClC,IAAI,EAAE,CAAC,CAAU,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;KACnC,CAAC;AACJ,CAAC"}

package/dist/verify/metrics.d.ts

@@ -0,0 +1,13 @@
+import type { ScanResult } from "../analyzers/types.js";
+import type { VerifyMetrics, VerifyReport } from "../report/format.js";
+export type Delta = VerifyReport["deltas"];
+/** Collapse a ScanResult into the compact metric shape used for diffs. */
+export declare function metricsOf(r: ScanResult): VerifyMetrics;
+export declare function deltasOf(base: VerifyMetrics, current: VerifyMetrics): Delta;
+/**
+ * Bundle size is stable across runs, so a >10% relative change is meaningful.
+ * Build time is noisy at small absolute values; only treat as a regression when
+ * the baseline is large enough for a relative % to be trustworthy.
+ */
+export declare function perfRegressed(base: VerifyMetrics["perf"], current: VerifyMetrics["perf"]): boolean;
+export declare function classifyRisk(base: VerifyMetrics, current: VerifyMetrics, d: Delta): VerifyReport["risk"];

package/dist/verify/metrics.js

@@ -0,0 +1,72 @@
+/** Collapse a ScanResult into the compact metric shape used for diffs. */
+export function metricsOf(r) {
+    return {
+        tests: {
+            total: r.tests.total,
+            passed: r.tests.passed,
+            failed: r.tests.failed,
+            durationMs: r.tests.durationMs,
+            coverage: r.tests.coverage,
+        },
+        perf: {
+            buildTimeMs: r.perf.buildTimeMs,
+            bundleSizeBytes: r.perf.bundleSizeBytes,
+        },
+        securityCount: r.security.issues.length,
+        duplicationCount: r.duplication.cloneCount,
+    };
+}
+export function deltasOf(base, current) {
+    return {
+        passed: current.tests.passed - base.tests.passed,
+        failed: current.tests.failed - base.tests.failed,
+        durationMs: current.tests.durationMs - base.tests.durationMs,
+        coverage: (current.tests.coverage ?? 0) - (base.tests.coverage ?? 0),
+        buildTimeMs: (current.perf.buildTimeMs ?? 0) - (base.perf.buildTimeMs ?? 0),
+        bundleSizeBytes: (current.perf.bundleSizeBytes ?? 0) - (base.perf.bundleSizeBytes ?? 0),
+        security: current.securityCount - base.securityCount,
+        duplication: current.duplicationCount - base.duplicationCount,
+    };
+}
+/**
+ * Bundle size is stable across runs, so a >10% relative change is meaningful.
+ * Build time is noisy at small absolute values; only treat as a regression when
+ * the baseline is large enough for a relative % to be trustworthy.
+ */
+export function perfRegressed(base, current) {
+    const bb = base.bundleSizeBytes ?? 0;
+    const cb = current.bundleSizeBytes ?? 0;
+    const bt = base.buildTimeMs ?? 0;
+    const ct = current.buildTimeMs ?? 0;
+    if (bb > 0 && (cb - bb) / bb > 0.1)
+        return true;
+    if (bt >= 500 && (ct - bt) / bt > 0.1)
+        return true;
+    return false;
+}
+export function classifyRisk(base, current, d) {
+    const testsNewlyFail = current.tests.failed > base.tests.failed && current.tests.failed > 0;
+    if (testsNewlyFail || perfRegressed(base.perf, current.perf))
+        return "High";
+    // Build time is noisy at small absolute values; ignore sub-50ms deltas
+    // when classifying risk so a re-run doesn't look like a regression.
+    const buildDelta = Math.abs(d.buildTimeMs) > 50 ? d.buildTimeMs : 0;
+    const changed = d.passed !== 0 ||
+        d.failed !== 0 ||
+        d.durationMs !== 0 ||
+        d.coverage !== 0 ||
+        buildDelta !== 0 ||
+        d.bundleSizeBytes !== 0 ||
+        d.security !== 0 ||
+        d.duplication !== 0;
+    const improved = d.failed < 0 ||
+        d.passed > 0 ||
+        d.durationMs < 0 ||
+        d.coverage > 0 ||
+        buildDelta < 0 ||
+        d.bundleSizeBytes < 0 ||
+        d.security < 0 ||
+        d.duplication < 0;
+    return !changed || improved ? "Low" : "Medium";
+}
+//# sourceMappingURL=metrics.js.map

package/dist/verify/metrics.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"metrics.js","sourceRoot":"","sources":["../../src/verify/metrics.ts"],"names":[],"mappings":"AAKA,0EAA0E;AAC1E,MAAM,UAAU,SAAS,CAAC,CAAa;IACrC,OAAO;QACL,KAAK,EAAE;YACL,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK;YACpB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM;YACtB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM;YACtB,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU;YAC9B,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ;SAC3B;QACD,IAAI,EAAE;YACJ,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW;YAC/B,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe;SACxC;QACD,aAAa,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM;QACvC,gBAAgB,EAAE,CAAC,CAAC,WAAW,CAAC,UAAU;KAC3C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,IAAmB,EAAE,OAAsB;IAClE,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM;QAChD,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM;QAChD,UAAU,EAAE,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU;QAC5D,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,CAAC;QACpE,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC;QAC3E,eAAe,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,CAAC;QACvF,QAAQ,EAAE,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa;QACpD,WAAW,EAAE,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,gBAAgB;KAC9D,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAC3B,IAA2B,EAC3B,OAA8B;IAE9B,MAAM,EAAE,GAAG,IAAI,CAAC,eAAe,IAAI,CAAC,CAAC;IACrC,MAAM,EAAE,GAAG,OAAO,CAAC,eAAe,IAAI,CAAC,CAAC;IACxC,MAAM,EAAE,GAAG,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC;IACjC,MAAM,EAAE,GAAG,OAAO,CAAC,WAAW,IAAI,CAAC,CAAC;IACpC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,EAAE,GAAG,GAAG;QAAE,OAAO,IAAI,CAAC;IAChD,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,EAAE,GAAG,GAAG;QAAE,OAAO,IAAI,CAAC;IACnD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,YAAY,CAC1B,IAAmB,EACnB,OAAsB,EACtB,CAAQ;IAER,MAAM,cAAc,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IAC5F,IAAI,cAAc,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC;IAC5E,uEAAuE;IACvE,oEAAoE;IACpE,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;IACpE,MAAM,OAAO,GACX,CAAC,CAAC,MAAM,KAAK,CAAC;QACd,CAAC,CAAC,MAAM,KAAK,CAAC;QACd,CAAC,CAAC,UAAU,KAAK,CAAC;QAClB,CAAC,CAAC,QAAQ,KAAK,CAAC;QAChB,UAAU,KAAK,CAAC;QAChB,CAAC,CAAC,eAAe,KAAK,CAAC;QACvB,CAAC,CAAC,QAAQ,KAAK,CAAC;QAChB,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC;IACtB,MAAM,QAAQ,GACZ,CAAC,CAAC,MAAM,GAAG,CAAC;QACZ,CAAC,CAAC,MAAM,GAAG,CAAC;QACZ,CAAC,CAAC,UAAU,GAAG,CAAC;QAChB,CAAC,CAAC,QAAQ,GAAG,CAAC;QACd,UAAU,GAAG,CAAC;QACd,CAAC,CAAC,eAAe,GAAG,CAAC;QACrB,CAAC,CAAC,QAAQ,GAAG,CAAC;QACd,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC;IACpB,OAAO,CAAC,OAAO,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;AACjD,CAAC"}

package/package.json

@@ -0,0 +1,68 @@
+{
+  "name": "openpitstop",
+  "version": "1.0.0",
+  "description": "Deterministic scans + your coding agent's own reasoning, in one autonomous quality loop. Adds a /pitstop slash-command to any AI coding tool.",
+  "license": "MIT",
+  "author": "Krish-1507",
+  "keywords": [
+    "cli",
+    "pitstop",
+    "code-quality",
+    "code-review",
+    "ai",
+    "autonomous",
+    "agent",
+    "scan",
+    "verify"
+  ],
+  "type": "module",
+  "bin": {
+    "openpitstop": "dist/cli.js",
+    "pitstop": "dist/cli.js"
+  },
+  "files": [
+    "dist",
+    "scripts",
+    "templates",
+    "demo-repo",
+    "demo-repo-integrity",
+    "demo-repo-fintech",
+    "demo-repo-generators",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=22"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Krish-1507/OpenPitStop.git"
+  },
+  "homepage": "https://github.com/Krish-1507/OpenPitStop#readme",
+  "bugs": {
+    "url": "https://github.com/Krish-1507/OpenPitStop/issues"
+  },
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsx watch src/cli.ts",
+    "smoke": "node dist/cli.js scan demo-repo",
+    "test": "node --import tsx --test \"test/*.test.ts\"",
+    "typecheck": "tsc --noEmit && tsc --noEmit -p tsconfig.test.json",
+    "prepublishOnly": "npm run build"
+  },
+  "dependencies": {
+    "@babel/parser": "^7.25.0",
+    "boxen": "^7.1.1",
+    "chalk": "^5.3.0",
+    "cli-table3": "^0.6.5",
+    "commander": "^12.1.0",
+    "execa": "^10.0.1",
+    "nock": "^14.0.17",
+    "ora": "^8.1.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "tsx": "^4.19.0",
+    "typescript": "^5.6.0"
+  }
+}

package/scripts/cheat-demo.cjs

@@ -0,0 +1,102 @@
+#!/usr/bin/env node
+/**
+ * cheat-demo.cjs — the 90-second "agent tried to cheat, OpenPitStop caught it"
+ * demo, fully scripted and deterministic. Use it in a video, or live in front
+ * of judges: it produces the SUSPICIOUS -> CONFIRMED_CHEAT arc on cue.
+ *
+ * Story: demo-repo-integrity has a real float-rounding bug and a test that
+ * proves it. A lazy "agent" tries to make the failing suite green WITHOUT
+ * fixing the root cause, twice:
+ *
+ *   1. focuses the suite on the passing tests  -> SUSPICIOUS
+ *   2. deletes the failing test file entirely  -> CONFIRMED_CHEAT
+ *
+ * `pitstop gate` catches both, escalates to exit code 2, and blocks the
+ * commit. That is the product: the agent finally has a referee.
+ *
+ * Usage:   node scripts/cheat-demo.cjs
+ *          (set PITSTOP_CLI to point at a build, e.g.
+ *           PITSTOP_CLI="node D:/OpenPitStop-cli/dist/cli.js")
+ */
+
+const fs = require("fs");
+const os = require("os");
+const path = require("path");
+const { execSync } = require("child_process");
+
+const ROOT = path.resolve(__dirname, "..");
+const CLI = process.env.PITSTOP_CLI || "npx openpitstop";
+
+const run = (cmd, cwd) => {
+  console.log(`\n$ ${cmd}`);
+  try {
+    const out = execSync(cmd, { cwd, encoding: "utf8", stdio: ["pipe", "inherit", "inherit"] });
+    return { code: 0, out };
+  } catch (e) {
+    return { code: e.status ?? 1, out: String(e.stdout ?? "") };
+  }
+};
+
+const say = (t) => console.log("\n" + "─".repeat(72) + "\n" + t + "\n" + "─".repeat(72));
+
+function main() {
+  const src = path.join(ROOT, "demo-repo-integrity");
+  if (!fs.existsSync(path.join(src, "package.json"))) {
+    console.error(`demo-repo-integrity not found at ${src}`);
+    process.exit(1);
+  }
+
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "pitstop-cheat-demo-"));
+  fs.cpSync(src, tmp, { recursive: true, filter: (p) => !/node_modules$/.test(p) });
+
+  say("PITSTOP CHEAT-CATCH DEMO — the agent finally has a referee");
+  console.log(`demo repo: ${tmp}`);
+
+  say("ACT 1 — baseline: a real bug, a failing test, an honest scan");
+  run("npm install --no-audit --no-fund", tmp);
+  run("git init -q && git config user.email pitstop@demo.local && git config user.name \"OpenPitStop Demo\" && git add -A && git commit -q -m baseline", tmp);
+  const scan = run(`${CLI} scan`, tmp);
+  if (!/1 failed|failed 1|Tests\s*:.*fail/i.test(scan.out)) {
+    console.log(scan.out);
+    console.log("\n(scan output above; the test suite should show 1 failed — the float bug)");
+  }
+
+  say("ACT 2 — a lazy 'fix': focus the suite on the passing tests (SUSPICIOUS)");
+  const testFile = path.join(tmp, "test", "money.test.js");
+  let testCode = fs.readFileSync(testFile, "utf8");
+  testCode = testCode.replace(
+    'it("quotes base + 7.5% markup to the cent"',
+    'fit("quotes base + 7.5% markup to the cent"',
+  );
+  testCode = testCode.replace(
+    'it("splits a bill evenly to the cent"',
+    'fit("splits a bill evenly to the cent"',
+  );
+  fs.writeFileSync(testFile, testCode, "utf8");
+  const act2 = run(`${CLI} gate`, tmp);
+  console.log("\nOpenPitStop's verdict: jest now runs ONLY the focused tests — the failing one is");
+  console.log("hidden, the suite is 'green', the bug is still there. SUSPICIOUS, needs a human.");
+  if (act2.code !== 1) {
+    console.log(`\nWARNING: expected gate exit 1 (SUSPICIOUS), got ${act2.code}`);
+    process.exitCode = 1;
+  }
+
+  say("ACT 3 — the desperate 'fix': delete the failing test (CONFIRMED_CHEAT)");
+  run("git rm -q -f test/money.test.js", tmp);
+  const gate = run(`${CLI} gate`, tmp);
+  console.log(`\ngate exit code: ${gate.code} — ` + (gate.code === 2 ? "CONFIRMED_CHEAT. The commit is blocked." : `expected 2, got ${gate.code}`));
+  if (gate.code !== 2) process.exitCode = 1;
+
+  say("THE PITCH");
+  console.log(
+    "Agents fix code; they don't know when to stop, and they'll tell you they're done regardless.\n" +
+      "OpenPitStop is the referee it can't cheat: deterministic scans, tamper-evident baselines,\n" +
+      "runtime penetration tests with failing-first repro contracts, and a verification gate\n" +
+      "that catches the agent lying — SUSPICIOUS needs a human, CONFIRMED_CHEAT is blocked.\n" +
+      "\nNow run the same arc against a repo that matters: npx openpitstop pen --fix, then\n" +
+      "npx openpitstop drive <finding-id> — your agent fixes it, and OpenPitStop verifies the\n" +
+      "repro flips FAIL -> PASS. The numbers can't be talked into looking better.",
+  );
+}
+
+main();