openpitstop 1.5.0 → 1.5.1

package/README.md

@@ -50,6 +50,31 @@ your agent.
 
 ---
 
+## OpenPitStop vs Strix — why teams pick the referee
+
+Strix is a great *finder*. OpenPitStop is the *referee*. Both pen-test your app; the
+difference is what happens after a vulnerability is found:
+
+> **Strix finds. OpenPitStop proves.**
+
+| | [Strix](https://github.com/usestrix/strix) | **OpenPitStop** |
+|---|---|---|
+| What it produces | Findings + a PoC *report* | Findings + a **failing-first regression test** (`pitstop pen --fix`) |
+| Trust in the fix | One-click auto-fix PR | **Honesty Score (0–100)** + integrity gate that catches deleted tests, hardcoded passes, reverted baselines |
+| How it runs | Docker + LLM key, non-deterministic | **Zero infra, deterministic, no LLM bill** — runs in any CI |
+| Evidence | `strix_runs/` logs | **Tamper-evident, signed `.pitstop/` artifacts** you can audit |
+| Secret exfiltration | not emphasized | **Ledger mode** proves the app doesn't phone home with your keys |
+| DevSecOps | Cloud platform (paid tiers) | **Free SARIF → GitHub Security tab** + one-number `pitstop gate` |
+| Proof coverage | — | **`PITSTOP_PROOF` badge**: % of findings that ship a permanent repro test |
+| Bug classes covered | strong general set | **40+ classes** — race/TOCTOU, IDOR/BOLA, price-tampering, XXE, insecure deserialization, JWT alg-confusion/weak-secret, SSRF, SQL/NoSQLi, command-injection, path traversal, XSS, secrets, CORS, missing headers, rate-limit, and more |
+
+The honest pitch: a pen-test that only reports is a list of things to argue about. A
+pen-test that ships the regression test, signs the evidence, and scores the fix on a
+gate your CI can block on is something you can actually ship. That's the OpenPitStop
+loop — and it's the reason to choose the referee over the hacker.
+
+---
+
 ## Feature tour
 
 Every clip below is real opencode output, captured from a live agent session —

package/demo/web-app-broken/.pitstop/cache/jest/jest-transform-cache-09bbba084113da9182b28b169fd19719-79ef2876fae7ca75eedb2aa53dc48338/5e/config_5ea59c6b3000eadfbaecbc2e78a03802

@@ -0,0 +1,113 @@
+b9e26b5a20d1b5508146e54c87fb8c88
+/* istanbul ignore next */
+function cov_e86xmt8qo() {
+  var path = "D:\\OpenPitStop cli\\demo\\web-app-broken\\src\\config.js";
+  var hash = "b8ce36803606bd246d8daa8c315e078307e95d46";
+  var global = new Function("return this")();
+  var gcv = "__coverage__";
+  var coverageData = {
+    path: "D:\\OpenPitStop cli\\demo\\web-app-broken\\src\\config.js",
+    statementMap: {
+      "0": {
+        start: {
+          line: 4,
+          column: 26
+        },
+        end: {
+          line: 4,
+          column: 62
+        }
+      },
+      "1": {
+        start: {
+          line: 5,
+          column: 26
+        },
+        end: {
+          line: 5,
+          column: 62
+        }
+      },
+      "2": {
+        start: {
+          line: 6,
+          column: 19
+        },
+        end: {
+          line: 6,
+          column: 48
+        }
+      },
+      "3": {
+        start: {
+          line: 7,
+          column: 20
+        },
+        end: {
+          line: 7,
+          column: 50
+        }
+      },
+      "4": {
+        start: {
+          line: 9,
+          column: 0
+        },
+        end: {
+          line: 9,
+          column: 83
+        }
+      }
+    },
+    fnMap: {},
+    branchMap: {},
+    s: {
+      "0": 0,
+      "1": 0,
+      "2": 0,
+      "3": 0,
+      "4": 0
+    },
+    f: {},
+    b: {},
+    _coverageSchema: "1a1c01bbd47fc00a2c39e90264f33305004495a9",
+    hash: "b8ce36803606bd246d8daa8c315e078307e95d46"
+  };
+  var coverage = global[gcv] || (global[gcv] = {});
+  if (!coverage[path] || coverage[path].hash !== hash) {
+    coverage[path] = coverageData;
+  }
+  var actualCoverage = coverage[path];
+  {
+    // @ts-ignore
+    cov_e86xmt8qo = function () {
+      return actualCoverage;
+    };
+  }
+  return actualCoverage;
+}
+cov_e86xmt8qo();
+// Hardcoded secrets in source — flagged by the secret analyzer even without .env.
+// NOTE: values are obvious FAKE placeholders (no real AKIA/sk_live prefixes) so the
+// repo passes GitHub push protection; OpenPitStop still flags them by variable name.
+const AWS_ACCESS_KEY_ID =
+/* istanbul ignore next */
+(cov_e86xmt8qo().s[0]++, "example-aws-access-key-id-not-real");
+const STRIPE_SECRET_KEY =
+/* istanbul ignore next */
+(cov_e86xmt8qo().s[1]++, "example-stripe-secret-key-not-real");
+const JWT_SECRET =
+/* istanbul ignore next */
+(cov_e86xmt8qo().s[2]++, "example-jwt-secret-not-real");
+const DB_PASSWORD =
+/* istanbul ignore next */
+(cov_e86xmt8qo().s[3]++, "example-db-password-not-real");
+/* istanbul ignore next */
+cov_e86xmt8qo().s[4]++;
+module.exports = {
+  AWS_ACCESS_KEY_ID,
+  STRIPE_SECRET_KEY,
+  JWT_SECRET,
+  DB_PASSWORD
+};
+//# sourceMappingURL=data:application/json;charset=utf-8;base64,eyJ2ZXJzaW9uIjozLCJuYW1lcyI6WyJjb3ZfZTg2eG10OHFvIiwiYWN0dWFsQ292ZXJhZ2UiLCJBV1NfQUNDRVNTX0tFWV9JRCIsInMiLCJTVFJJUEVfU0VDUkVUX0tFWSIsIkpXVF9TRUNSRVQiLCJEQl9QQVNTV09SRCIsIm1vZHVsZSIsImV4cG9ydHMiXSwic291cmNlcyI6WyJjb25maWcuanMiXSwic291cmNlc0NvbnRlbnQiOlsiLy8gSGFyZGNvZGVkIHNlY3JldHMgaW4gc291cmNlIOKAlCBmbGFnZ2VkIGJ5IHRoZSBzZWNyZXQgYW5hbHl6ZXIgZXZlbiB3aXRob3V0IC5lbnYuXG4vLyBOT1RFOiB2YWx1ZXMgYXJlIG9idmlvdXMgRkFLRSBwbGFjZWhvbGRlcnMgKG5vIHJlYWwgQUtJQS9za19saXZlIHByZWZpeGVzKSBzbyB0aGVcbi8vIHJlcG8gcGFzc2VzIEdpdEh1YiBwdXNoIHByb3RlY3Rpb247IE9wZW5QaXRTdG9wIHN0aWxsIGZsYWdzIHRoZW0gYnkgdmFyaWFibGUgbmFtZS5cbmNvbnN0IEFXU19BQ0NFU1NfS0VZX0lEID0gXCJleGFtcGxlLWF3cy1hY2Nlc3Mta2V5LWlkLW5vdC1yZWFsXCI7XG5jb25zdCBTVFJJUEVfU0VDUkVUX0tFWSA9IFwiZXhhbXBsZS1zdHJpcGUtc2VjcmV0LWtleS1ub3QtcmVhbFwiO1xuY29uc3QgSldUX1NFQ1JFVCA9IFwiZXhhbXBsZS1qd3Qtc2VjcmV0LW5vdC1yZWFsXCI7XG5jb25zdCBEQl9QQVNTV09SRCA9IFwiZXhhbXBsZS1kYi1wYXNzd29yZC1ub3QtcmVhbFwiO1xuXG5tb2R1bGUuZXhwb3J0cyA9IHsgQVdTX0FDQ0VTU19LRVlfSUQsIFNUUklQRV9TRUNSRVRfS0VZLCBKV1RfU0VDUkVULCBEQl9QQVNTV09SRCB9O1xuIl0sIm1hcHBpbmdzIjoiOzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7OztJQWVZO0lBQUFBLGFBQUEsWUFBQUEsQ0FBQTtNQUFBLE9BQUFDLGNBQUE7SUFBQTtFQUFBO0VBQUEsT0FBQUEsY0FBQTtBQUFBO0FBQUFELGFBQUE7QUFmWjtBQUNBO0FBQ0E7QUFDQSxNQUFNRSxpQkFBaUI7QUFBQTtBQUFBLENBQUFGLGFBQUEsR0FBQUcsQ0FBQSxPQUFHLG9DQUFvQztBQUM5RCxNQUFNQyxpQkFBaUI7QUFBQTtBQUFBLENBQUFKLGFBQUEsR0FBQUcsQ0FBQSxPQUFHLG9DQUFvQztBQUM5RCxNQUFNRSxVQUFVO0FBQUE7QUFBQSxDQUFBTCxhQUFBLEdBQUFHLENBQUEsT0FBRyw2QkFBNkI7QUFDaEQsTUFBTUcsV0FBVztBQUFBO0FBQUEsQ0FBQU4sYUFBQSxHQUFBRyxDQUFBLE9BQUcsOEJBQThCO0FBQUM7QUFBQUgsYUFBQSxHQUFBRyxDQUFBO0FBRW5ESSxNQUFNLENBQUNDLE9BQU8sR0FBRztFQUFFTixpQkFBaUI7RUFBRUUsaUJBQWlCO0VBQUVDLFVBQVU7RUFBRUM7QUFBWSxDQUFDIiwiaWdub3JlTGlzdCI6W119

package/demo/web-app-broken/.pitstop/cache/jest/jest-transform-cache-09bbba084113da9182b28b169fd19719-79ef2876fae7ca75eedb2aa53dc48338/5e/config_5ea59c6b3000eadfbaecbc2e78a03802.map

@@ -0,0 +1 @@
+{"version":3,"names":["cov_e86xmt8qo","actualCoverage","AWS_ACCESS_KEY_ID","s","STRIPE_SECRET_KEY","JWT_SECRET","DB_PASSWORD","module","exports"],"sources":["config.js"],"sourcesContent":["// Hardcoded secrets in source — flagged by the secret analyzer even without .env.\n// NOTE: values are obvious FAKE placeholders (no real AKIA/sk_live prefixes) so the\n// repo passes GitHub push protection; OpenPitStop still flags them by variable name.\nconst AWS_ACCESS_KEY_ID = \"example-aws-access-key-id-not-real\";\nconst STRIPE_SECRET_KEY = \"example-stripe-secret-key-not-real\";\nconst JWT_SECRET = \"example-jwt-secret-not-real\";\nconst DB_PASSWORD = \"example-db-password-not-real\";\n\nmodule.exports = { AWS_ACCESS_KEY_ID, STRIPE_SECRET_KEY, JWT_SECRET, DB_PASSWORD };\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAeY;IAAAA,aAAA,YAAAA,CAAA;MAAA,OAAAC,cAAA;IAAA;EAAA;EAAA,OAAAA,cAAA;AAAA;AAAAD,aAAA;AAfZ;AACA;AACA;AACA,MAAME,iBAAiB;AAAA;AAAA,CAAAF,aAAA,GAAAG,CAAA,OAAG,oCAAoC;AAC9D,MAAMC,iBAAiB;AAAA;AAAA,CAAAJ,aAAA,GAAAG,CAAA,OAAG,oCAAoC;AAC9D,MAAME,UAAU;AAAA;AAAA,CAAAL,aAAA,GAAAG,CAAA,OAAG,6BAA6B;AAChD,MAAMG,WAAW;AAAA;AAAA,CAAAN,aAAA,GAAAG,CAAA,OAAG,8BAA8B;AAAC;AAAAH,aAAA,GAAAG,CAAA;AAEnDI,MAAM,CAACC,OAAO,GAAG;EAAEN,iBAAiB;EAAEE,iBAAiB;EAAEC,UAAU;EAAEC;AAAY,CAAC","ignoreList":[]}

package/demo/web-app-broken/.pitstop/cache/jest/perf-cache-09bbba084113da9182b28b169fd19719-da39a3ee5e6b4b0d3255bfef95601890

@@ -1 +1 @@
-{"D:\\OpenPitStop cli\\demo\\web-app-broken\\test\\app.test.js":[0,2024]}
+{"D:\\OpenPitStop cli\\demo\\web-app-broken\\test\\app.test.js":[0,1820]}

package/demo/web-app-broken/.pitstop/pen/run-2026-08-18T06-12-11-576Z/app.out.log

@@ -0,0 +1,22 @@
+node:internal/modules/cjs/loader:1252
+  throw err;
+  ^
+
+Error: Cannot find module 'D:\OpenPitStop'
+Require stack:
+- internal/preload
+    at Function._resolveFilename (node:internal/modules/cjs/loader:1249:15)
+    at Function._load (node:internal/modules/cjs/loader:1075:27)
+    at TracingChannel.traceSync (node:diagnostics_channel:322:14)
+    at wrapModuleLoad (node:internal/modules/cjs/loader:219:24)
+    at Module.require (node:internal/modules/cjs/loader:1340:12)
+    at node:internal/modules/cjs/loader:1843:12
+    at loadPreloadModules (node:internal/process/pre_execution:727:5)
+    at setupUserModules (node:internal/process/pre_execution:206:5)
+    at prepareExecution (node:internal/process/pre_execution:159:5)
+    at prepareMainThreadExecution (node:internal/process/pre_execution:54:10) {
+  code: 'MODULE_NOT_FOUND',
+  requireStack: [ 'internal/preload' ]
+}
+
+Node.js v22.12.0

package/demo/web-app-broken/.pitstop/pen-2026-08-18T06-12-11-787Z.json

@@ -0,0 +1,162 @@
+{
+  "timestamp": "2026-08-18T06:12:11.785Z",
+  "repo": "D:\\OpenPitStop cli\\demo\\web-app-broken",
+  "mode": "pen",
+  "staticEnabled": true,
+  "dynamicEnabled": true,
+  "dynamic": {
+    "status": "aborted",
+    "note": "app did not come up within 25s (start: \"node src/server.js\")",
+    "routesProbed": 0,
+    "attacks": 0,
+    "bootMs": 198,
+    "durationMs": 209,
+    "outboundEvents": 0
+  },
+  "staticProof": {
+    "proven": 0,
+    "indicated": 0,
+    "unproven": 0,
+    "notTested": 8
+  },
+  "packages": [
+    "express",
+    "lodash",
+    "jsonwebtoken",
+    "mysql2",
+    "cors",
+    "jest"
+  ],
+  "findings": [
+    {
+      "id": "pen-62be9b7b",
+      "source": "pen-static",
+      "type": "sql-injection",
+      "severity": "critical",
+      "confidence": "indicated",
+      "title": "SQL built by string interpolation",
+      "description": "A query string is assembled by concatenating or interpolating variables into SQL. Any route feeding these variables becomes a live injection point. (src/server.js:24)",
+      "file": "D:\\OpenPitStop cli\\demo\\web-app-broken\\src\\server.js",
+      "line": 24,
+      "repro": "open src/server.js:24",
+      "fix": "Use parameterized queries (?, $1 placeholders) or an ORM. Never interpolate values into SQL text.",
+      "runtimeProof": "not-tested",
+      "runtimeNote": "no runtime verification: the dynamic phase did not run (app did not come up within 25s (start: \"node src/server.js\"))"
+    },
+    {
+      "id": "pen-654abdce",
+      "source": "pen-static",
+      "type": "sql-injection",
+      "severity": "critical",
+      "confidence": "indicated",
+      "title": "SQL built by string interpolation",
+      "description": "A query string is assembled by concatenating or interpolating variables into SQL. Any route feeding these variables becomes a live injection point. (src/users.js:16)",
+      "file": "D:\\OpenPitStop cli\\demo\\web-app-broken\\src\\users.js",
+      "line": 16,
+      "repro": "open src/users.js:16",
+      "fix": "Use parameterized queries (?, $1 placeholders) or an ORM. Never interpolate values into SQL text.",
+      "runtimeProof": "not-tested",
+      "runtimeNote": "no runtime verification: the dynamic phase did not run (app did not come up within 25s (start: \"node src/server.js\"))"
+    },
+    {
+      "id": "pen-81855543",
+      "source": "pen-static",
+      "type": "command-injection",
+      "severity": "critical",
+      "confidence": "indicated",
+      "title": "child_process called with request-derived input",
+      "description": "exec/spawn/execFile is called with a value that can trace back to request data (query, params, body). If the shell interprets it, that is remote code execution. (src/server.js:24)",
+      "file": "D:\\OpenPitStop cli\\demo\\web-app-broken\\src\\server.js",
+      "line": 24,
+      "repro": "open src/server.js:24",
+      "fix": "Do not shell out with user input. If unavoidable: execFile with a fixed command, no shell, and validate input against a strict allowlist (e.g. /^[a-z0-9-]{1,64}$/).",
+      "runtimeProof": "not-tested",
+      "runtimeNote": "no runtime verification: the dynamic phase did not run (app did not come up within 25s (start: \"node src/server.js\"))"
+    },
+    {
+      "id": "pen-6d14fd91",
+      "source": "pen-static",
+      "type": "arbitrary-code-execution",
+      "severity": "high",
+      "confidence": "heuristic",
+      "title": "eval / new Function in application code",
+      "description": "`eval` or `new Function` turns attacker-influenced strings into executable code. It is never needed for this; replace with a lookup table or JSON.parse. (src/server.js:59)",
+      "file": "D:\\OpenPitStop cli\\demo\\web-app-broken\\src\\server.js",
+      "line": 59,
+      "repro": "open src/server.js:59",
+      "fix": "Remove eval/new Function. If a template engine is genuinely required, use a sandboxed one (e.g. a compiled template with no global access).",
+      "runtimeProof": "not-tested",
+      "runtimeNote": "no runtime verification: the dynamic phase did not run (app did not come up within 25s (start: \"node src/server.js\"))"
+    },
+    {
+      "id": "pen-e02320ba",
+      "source": "pen-static",
+      "type": "cookie-without-httponly",
+      "severity": "medium",
+      "confidence": "indicated",
+      "title": "cookie set without httpOnly",
+      "description": "A session/security cookie is being set without `httpOnly` (and likely without `secure`), so an XSS in any page can steal it via document.cookie.",
+      "file": "D:\\OpenPitStop cli\\demo\\web-app-broken\\src\\auth.js",
+      "line": 31,
+      "fix": "Set `{ httpOnly: true, secure: true, sameSite: \"strict\" }` on every session/auth cookie.",
+      "runtimeProof": "not-tested",
+      "runtimeNote": "no runtime verification: the dynamic phase did not run (app did not come up within 25s (start: \"node src/server.js\"))"
+    },
+    {
+      "id": "pen-c3f2b7cf",
+      "source": "pen-static",
+      "type": "insecure-cors",
+      "severity": "high",
+      "confidence": "indicated",
+      "title": "CORS allows any origin",
+      "description": "CORS is wide open — either a bare `cors()` (defaults to origin: * with credentials off) or an explicit `origin: \"*\"`. Any website can read the responses of this endpoint from a victim's browser.",
+      "file": "D:\\OpenPitStop cli\\demo\\web-app-broken\\src\\server.js",
+      "line": 13,
+      "fix": "Restrict origins to an explicit allowlist: `cors({ origin: [/^https?:\\/\\/(localhost|127\\.0\\.0\\.1)(:\\d+)?$/, ...] })` — or better, list only your real production origins and never combine `origin: *` with credentials.",
+      "runtimeProof": "not-tested",
+      "runtimeNote": "no runtime verification: the dynamic phase did not run (app did not come up within 25s (start: \"node src/server.js\"))"
+    },
+    {
+      "id": "pen-c55906fe",
+      "source": "pen-static",
+      "type": "missing-security-headers",
+      "severity": "medium",
+      "confidence": "indicated",
+      "title": "no helmet / security headers middleware",
+      "description": "An Express app without helmet() (or manual CSP / X-Frame-Options / X-Content-Type-Options headers). Clickjacking, MIME sniffing and mixed-content protections are all off.",
+      "file": "D:\\OpenPitStop cli\\demo\\web-app-broken\\src\\server.js",
+      "line": 10,
+      "fix": "Install helmet and `app.use(helmet());` after app creation (deterministic patch generated by `pitstop pen --fix` when helmet is already installed).",
+      "runtimeProof": "not-tested",
+      "runtimeNote": "no runtime verification: the dynamic phase did not run (app did not come up within 25s (start: \"node src/server.js\"))"
+    },
+    {
+      "id": "pen-295619f9",
+      "source": "pen-static",
+      "type": "no-rate-limit",
+      "severity": "medium",
+      "confidence": "heuristic",
+      "title": "no rate limiting on authentication paths",
+      "description": "express-rate-limit is not installed and login-ish routes exist — credential stuffing / brute force is unthrottled. The dynamic phase verifies this live. Login-ish routes: POST /login.",
+      "fix": "Add express-rate-limit and apply a strict limiter to /login /verify /otp /token routes (e.g. 5 requests / 15 min per IP).",
+      "runtimeProof": "not-tested",
+      "runtimeNote": "no runtime verification: the dynamic phase did not run (app did not come up within 25s (start: \"node src/server.js\"))"
+    }
+  ],
+  "summary": {
+    "critical": 3,
+    "high": 2,
+    "medium": 3,
+    "low": 0,
+    "info": 0,
+    "proven": 0,
+    "indicated": 6,
+    "heuristic": 2
+  },
+  "evidence": {
+    "scheme": "pitstop-canonical-sha256-v1",
+    "digest": "e4ce8e1e6534ee152c199374a4de6ca6c2dec036c3a487554c215a9c0fedf2bd",
+    "of": "pitstop pen result for D:\\OpenPitStop cli\\demo\\web-app-broken",
+    "signedAt": "2026-08-18T06:12:11.786Z"
+  }
+}

package/demo/web-app-broken/.pitstop/pen-latest.json

@@ -0,0 +1,162 @@
+{
+  "timestamp": "2026-08-18T06:12:11.785Z",
+  "repo": "D:\\OpenPitStop cli\\demo\\web-app-broken",
+  "mode": "pen",
+  "staticEnabled": true,
+  "dynamicEnabled": true,
+  "dynamic": {
+    "status": "aborted",
+    "note": "app did not come up within 25s (start: \"node src/server.js\")",
+    "routesProbed": 0,
+    "attacks": 0,
+    "bootMs": 198,
+    "durationMs": 209,
+    "outboundEvents": 0
+  },
+  "staticProof": {
+    "proven": 0,
+    "indicated": 0,
+    "unproven": 0,
+    "notTested": 8
+  },
+  "packages": [
+    "express",
+    "lodash",
+    "jsonwebtoken",
+    "mysql2",
+    "cors",
+    "jest"
+  ],
+  "findings": [
+    {
+      "id": "pen-62be9b7b",
+      "source": "pen-static",
+      "type": "sql-injection",
+      "severity": "critical",
+      "confidence": "indicated",
+      "title": "SQL built by string interpolation",
+      "description": "A query string is assembled by concatenating or interpolating variables into SQL. Any route feeding these variables becomes a live injection point. (src/server.js:24)",
+      "file": "D:\\OpenPitStop cli\\demo\\web-app-broken\\src\\server.js",
+      "line": 24,
+      "repro": "open src/server.js:24",
+      "fix": "Use parameterized queries (?, $1 placeholders) or an ORM. Never interpolate values into SQL text.",
+      "runtimeProof": "not-tested",
+      "runtimeNote": "no runtime verification: the dynamic phase did not run (app did not come up within 25s (start: \"node src/server.js\"))"
+    },
+    {
+      "id": "pen-654abdce",
+      "source": "pen-static",
+      "type": "sql-injection",
+      "severity": "critical",
+      "confidence": "indicated",
+      "title": "SQL built by string interpolation",
+      "description": "A query string is assembled by concatenating or interpolating variables into SQL. Any route feeding these variables becomes a live injection point. (src/users.js:16)",
+      "file": "D:\\OpenPitStop cli\\demo\\web-app-broken\\src\\users.js",
+      "line": 16,
+      "repro": "open src/users.js:16",
+      "fix": "Use parameterized queries (?, $1 placeholders) or an ORM. Never interpolate values into SQL text.",
+      "runtimeProof": "not-tested",
+      "runtimeNote": "no runtime verification: the dynamic phase did not run (app did not come up within 25s (start: \"node src/server.js\"))"
+    },
+    {
+      "id": "pen-81855543",
+      "source": "pen-static",
+      "type": "command-injection",
+      "severity": "critical",
+      "confidence": "indicated",
+      "title": "child_process called with request-derived input",
+      "description": "exec/spawn/execFile is called with a value that can trace back to request data (query, params, body). If the shell interprets it, that is remote code execution. (src/server.js:24)",
+      "file": "D:\\OpenPitStop cli\\demo\\web-app-broken\\src\\server.js",
+      "line": 24,
+      "repro": "open src/server.js:24",
+      "fix": "Do not shell out with user input. If unavoidable: execFile with a fixed command, no shell, and validate input against a strict allowlist (e.g. /^[a-z0-9-]{1,64}$/).",
+      "runtimeProof": "not-tested",
+      "runtimeNote": "no runtime verification: the dynamic phase did not run (app did not come up within 25s (start: \"node src/server.js\"))"
+    },
+    {
+      "id": "pen-6d14fd91",
+      "source": "pen-static",
+      "type": "arbitrary-code-execution",
+      "severity": "high",
+      "confidence": "heuristic",
+      "title": "eval / new Function in application code",
+      "description": "`eval` or `new Function` turns attacker-influenced strings into executable code. It is never needed for this; replace with a lookup table or JSON.parse. (src/server.js:59)",
+      "file": "D:\\OpenPitStop cli\\demo\\web-app-broken\\src\\server.js",
+      "line": 59,
+      "repro": "open src/server.js:59",
+      "fix": "Remove eval/new Function. If a template engine is genuinely required, use a sandboxed one (e.g. a compiled template with no global access).",
+      "runtimeProof": "not-tested",
+      "runtimeNote": "no runtime verification: the dynamic phase did not run (app did not come up within 25s (start: \"node src/server.js\"))"
+    },
+    {
+      "id": "pen-e02320ba",
+      "source": "pen-static",
+      "type": "cookie-without-httponly",
+      "severity": "medium",
+      "confidence": "indicated",
+      "title": "cookie set without httpOnly",
+      "description": "A session/security cookie is being set without `httpOnly` (and likely without `secure`), so an XSS in any page can steal it via document.cookie.",
+      "file": "D:\\OpenPitStop cli\\demo\\web-app-broken\\src\\auth.js",
+      "line": 31,
+      "fix": "Set `{ httpOnly: true, secure: true, sameSite: \"strict\" }` on every session/auth cookie.",
+      "runtimeProof": "not-tested",
+      "runtimeNote": "no runtime verification: the dynamic phase did not run (app did not come up within 25s (start: \"node src/server.js\"))"
+    },
+    {
+      "id": "pen-c3f2b7cf",
+      "source": "pen-static",
+      "type": "insecure-cors",
+      "severity": "high",
+      "confidence": "indicated",
+      "title": "CORS allows any origin",
+      "description": "CORS is wide open — either a bare `cors()` (defaults to origin: * with credentials off) or an explicit `origin: \"*\"`. Any website can read the responses of this endpoint from a victim's browser.",
+      "file": "D:\\OpenPitStop cli\\demo\\web-app-broken\\src\\server.js",
+      "line": 13,
+      "fix": "Restrict origins to an explicit allowlist: `cors({ origin: [/^https?:\\/\\/(localhost|127\\.0\\.0\\.1)(:\\d+)?$/, ...] })` — or better, list only your real production origins and never combine `origin: *` with credentials.",
+      "runtimeProof": "not-tested",
+      "runtimeNote": "no runtime verification: the dynamic phase did not run (app did not come up within 25s (start: \"node src/server.js\"))"
+    },
+    {
+      "id": "pen-c55906fe",
+      "source": "pen-static",
+      "type": "missing-security-headers",
+      "severity": "medium",
+      "confidence": "indicated",
+      "title": "no helmet / security headers middleware",
+      "description": "An Express app without helmet() (or manual CSP / X-Frame-Options / X-Content-Type-Options headers). Clickjacking, MIME sniffing and mixed-content protections are all off.",
+      "file": "D:\\OpenPitStop cli\\demo\\web-app-broken\\src\\server.js",
+      "line": 10,
+      "fix": "Install helmet and `app.use(helmet());` after app creation (deterministic patch generated by `pitstop pen --fix` when helmet is already installed).",
+      "runtimeProof": "not-tested",
+      "runtimeNote": "no runtime verification: the dynamic phase did not run (app did not come up within 25s (start: \"node src/server.js\"))"
+    },
+    {
+      "id": "pen-295619f9",
+      "source": "pen-static",
+      "type": "no-rate-limit",
+      "severity": "medium",
+      "confidence": "heuristic",
+      "title": "no rate limiting on authentication paths",
+      "description": "express-rate-limit is not installed and login-ish routes exist — credential stuffing / brute force is unthrottled. The dynamic phase verifies this live. Login-ish routes: POST /login.",
+      "fix": "Add express-rate-limit and apply a strict limiter to /login /verify /otp /token routes (e.g. 5 requests / 15 min per IP).",
+      "runtimeProof": "not-tested",
+      "runtimeNote": "no runtime verification: the dynamic phase did not run (app did not come up within 25s (start: \"node src/server.js\"))"
+    }
+  ],
+  "summary": {
+    "critical": 3,
+    "high": 2,
+    "medium": 3,
+    "low": 0,
+    "info": 0,
+    "proven": 0,
+    "indicated": 6,
+    "heuristic": 2
+  },
+  "evidence": {
+    "scheme": "pitstop-canonical-sha256-v1",
+    "digest": "e4ce8e1e6534ee152c199374a4de6ca6c2dec036c3a487554c215a9c0fedf2bd",
+    "of": "pitstop pen result for D:\\OpenPitStop cli\\demo\\web-app-broken",
+    "signedAt": "2026-08-18T06:12:11.786Z"
+  }
+}

package/demo/web-app-broken/.pitstop/verify-2026-08-18T06-11-59-327Z.json

@@ -0,0 +1,73 @@
+{
+  "timestamp": "2026-08-18T06:11:59.328Z",
+  "repo": "D:\\OpenPitStop cli\\demo\\web-app-broken",
+  "baselineTimestamp": "2026-08-18T04:07:42.300Z",
+  "risk": "Low",
+  "blocked": false,
+  "stale": true,
+  "staleNote": "baseline is STALE — .env changed 2026-08-18T05:21:00.275Z, after the baseline scan (2026-08-18T04:07:42.300Z). Score delta vs baseline is approximate; re-run `pitstop scan` for a fresh baseline.",
+  "evidence": {
+    "scheme": "pitstop-canonical-sha256-v1",
+    "digest": "297e93ba61700be8a7614c9abb32a888cc07a59008a57e60cc729efd444feb29",
+    "of": "pitstop verify result for D:\\OpenPitStop cli\\demo\\web-app-broken",
+    "signedAt": "2026-08-18T06:11:59.328Z"
+  },
+  "status": "OK",
+  "exitCode": 0,
+  "integrity": {
+    "verdict": "CLEAN",
+    "findings": [],
+    "summary": {
+      "confirmed": 0,
+      "suspicious": 0,
+      "total": 0
+    }
+  },
+  "deltas": {
+    "passed": 0,
+    "failed": 0,
+    "durationMs": -2912,
+    "coverage": 0,
+    "buildTimeMs": 0,
+    "bundleSizeBytes": 0,
+    "security": -2,
+    "duplication": 0
+  },
+  "baseline": {
+    "tests": {
+      "total": 5,
+      "passed": 0,
+      "failed": 5,
+      "durationMs": 6283,
+      "coverage": 62.02
+    },
+    "perf": {},
+    "securityCount": 45,
+    "duplicationCount": 0
+  },
+  "current": {
+    "tests": {
+      "total": 5,
+      "passed": 0,
+      "failed": 5,
+      "durationMs": 3371,
+      "coverage": 62.02
+    },
+    "perf": {},
+    "securityCount": 43,
+    "duplicationCount": 0
+  },
+  "score": {
+    "baseline": 35,
+    "current": 35,
+    "delta": 0,
+    "grade": "F"
+  },
+  "honesty": {
+    "score": 90,
+    "rating": "TRUSTWORTHY",
+    "reasons": [
+      "baseline is stale — the score delta is approximate, not exact"
+    ]
+  }
+}

package/demo/web-app-broken/PITSTOP_BADGE.svg

@@ -0,0 +1,12 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="139" height="20" role="img" aria-label="OpenPitStop score 35/100 (F)">
+  <linearGradient id="g" x1="0" y1="0" x2="1" y2="0">
+    <stop offset="0%" stop-color="#5c5c5c" stop-opacity="0.95"/>
+    <stop offset="100%" stop-color="#3a3a3a" stop-opacity="0.95"/>
+  </linearGradient>
+  <rect width="139" height="20" rx="3" fill="url(#g)"/>
+  <rect x="66" width="73" height="20" fill="#E53935"/>
+  <g fill="#fff" font-family="Verdana,DejaVu Sans,sans-serif" font-size="11" text-anchor="middle">
+    <text x="33" y="14">PITSTOP</text>
+    <text x="102.5" y="14">35/100 F</text>
+  </g>
+</svg>

package/dist/commands/report.js

@@ -2,12 +2,14 @@ import { Command } from "commander";
 import path from "node:path";
 import fs from "node:fs";
 import chalk from "chalk";
-import { buildModel, renderTerminal, renderMarkdown, renderHtml } from "../report/format.js";
+import { buildModel, renderTerminal, renderMarkdown, renderHtml, renderProofBadgeSvg } from "../report/format.js";
 import { computeScore, renderBadgeSvg } from "../report/score.js";
+import { buildSarif } from "../report/sarif.js";
 export const report = new Command("report")
     .description("Generate a repository analysis report from scan/verify history")
     .argument("[repo]", "path to the repo to report on", ".")
     .option("--html", "also write a self-contained PITSTOP_REPORT.html (zero external assets)")
+    .option("--sarif", "also write PITSTOP_REPORT.sarif — upload to GitHub code scanning (Security tab)")
     .option("--badge-json", "also write PITSTOP_BADGE.json — a shields.io `endpoint`-schema badge you can host " +
     "(https://img.shields.io/endpoint?url=<hosted.json>)")
     .action(async (repoArg, options) => {
@@ -38,7 +40,21 @@ export const report = new Command("report")
                 chalk.dim(`   host it and use: https://img.shields.io/endpoint?url=<url>/PITSTOP_BADGE.json\n`));
         }
     }
+    // Proof-coverage badge — the "we prove, not just report" signal for README/CI.
+    if (model.proofCoverage?.hasPen) {
+        const proofBadge = path.join(repo, "PITSTOP_PROOF.svg");
+        fs.writeFileSync(proofBadge, renderProofBadgeSvg(model.proofCoverage.pct));
+        console.log(chalk.dim(`Proof-coverage badge written to ${proofBadge}`) +
+            chalk.dim(` — embed: ![OpenPitStop proof](PITSTOP_PROOF.svg)\n`));
+    }
     console.log(chalk.dim(`\nReport written to ${mdPath}\n`));
+    if (options.sarif) {
+        const sarif = buildSarif(repo, model);
+        const sarifPath = path.join(repo, "PITSTOP_REPORT.sarif");
+        fs.writeFileSync(sarifPath, JSON.stringify(sarif, null, 2));
+        console.log(chalk.dim(`SARIF written to ${sarifPath}`) +
+            chalk.dim(` — upload to GitHub: gh api /repos/<owner>/<repo>/code-scanning/sarifs\n`));
+    }
     if (options.html) {
         const htmlPath = path.join(repo, "PITSTOP_REPORT.html");
         fs.writeFileSync(htmlPath, renderHtml(model));

package/dist/commands/report.js.map

@@ -1 +1 @@
-{"version":3,"file":"report.js","sourceRoot":"","sources":["../../src/commands/report.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAC7F,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAElE,MAAM,CAAC,MAAM,MAAM,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC;KACxC,WAAW,CAAC,gEAAgE,CAAC;KAC7E,QAAQ,CAAC,QAAQ,EAAE,+BAA+B,EAAE,GAAG,CAAC;KACxD,MAAM,CAAC,QAAQ,EAAE,wEAAwE,CAAC;KAC1F,MAAM,CACL,cAAc,EACd,oFAAoF;IAClF,qDAAqD,CACxD;KACA,MAAM,CAAC,KAAK,EAAE,OAAe,EAAE,OAAgD,EAAE,EAAE;IAClF,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACnC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,2BAA2B,IAAI,QAAQ,CAAC,CAAC,CAAC;IAEjE,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAC/B,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;IAEnC,MAAM,EAAE,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;IACpD,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAE7B,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QACrB,MAAM,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;QACvD,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC;QAChD,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,GAAG,CAAC,qCAAqC,SAAS,IAAI,CAAC;YAC3D,KAAK,CAAC,GAAG,CAAC,0DAA0D,CAAC,CACxE,CAAC;QACF,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;YACtB,MAAM,OAAO,GAAG;gBACd,aAAa,EAAE,CAAC;gBAChB,KAAK,EAAE,SAAS;gBAChB,OAAO,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC,KAAK,EAAE;gBACtC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK;gBACnH,YAAY,EAAE,IAAI;aACnB,CAAC;YACF,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC;YACvD,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YACpE,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,GAAG,CAAC,gCAAgC,QAAQ,IAAI,CAAC;gBACrD,KAAK,CAAC,GAAG,CAAC,oFAAoF,CAAC,CAClG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,uBAAuB,MAAM,IAAI,CAAC,CAAC,CAAC;IAE1D,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC;QACxD,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;QAC9C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,0BAA0B,QAAQ,IAAI,CAAC,CAAC,CAAC;IACjE,CAAC;AACH,CAAC,CAAC,CAAC"}
+{"version":3,"file":"report.js","sourceRoot":"","sources":["../../src/commands/report.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,cAAc,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAClH,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD,MAAM,CAAC,MAAM,MAAM,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC;KACxC,WAAW,CAAC,gEAAgE,CAAC;KAC7E,QAAQ,CAAC,QAAQ,EAAE,+BAA+B,EAAE,GAAG,CAAC;KACxD,MAAM,CAAC,QAAQ,EAAE,wEAAwE,CAAC;KAC1F,MAAM,CAAC,SAAS,EAAE,iFAAiF,CAAC;KACpG,MAAM,CACL,cAAc,EACd,oFAAoF;IAClF,qDAAqD,CACxD;KACA,MAAM,CAAC,KAAK,EAAE,OAAe,EAAE,OAAiE,EAAE,EAAE;IACnG,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACnC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,2BAA2B,IAAI,QAAQ,CAAC,CAAC,CAAC;IAEjE,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAC/B,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;IAEnC,MAAM,EAAE,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;IACpD,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAE7B,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QACrB,MAAM,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;QACvD,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC;QAChD,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,GAAG,CAAC,qCAAqC,SAAS,IAAI,CAAC;YAC3D,KAAK,CAAC,GAAG,CAAC,0DAA0D,CAAC,CACxE,CAAC;QACF,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;YACtB,MAAM,OAAO,GAAG;gBACd,aAAa,EAAE,CAAC;gBAChB,KAAK,EAAE,SAAS;gBAChB,OAAO,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC,KAAK,EAAE;gBACtC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK;gBACnH,YAAY,EAAE,IAAI;aACnB,CAAC;YACF,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC;YACvD,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YACpE,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,GAAG,CAAC,gCAAgC,QAAQ,IAAI,CAAC;gBACrD,KAAK,CAAC,GAAG,CAAC,oFAAoF,CAAC,CAClG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,+EAA+E;IAC/E,IAAI,KAAK,CAAC,aAAa,EAAE,MAAM,EAAE,CAAC;QAChC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;QACxD,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,mBAAmB,CAAC,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3E,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,GAAG,CAAC,mCAAmC,UAAU,EAAE,CAAC;YACxD,KAAK,CAAC,GAAG,CAAC,qDAAqD,CAAC,CACnE,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,uBAAuB,MAAM,IAAI,CAAC,CAAC,CAAC;IAE1D,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACtC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC;QAC1D,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC5D,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,GAAG,CAAC,oBAAoB,SAAS,EAAE,CAAC;YACxC,KAAK,CAAC,GAAG,CAAC,0EAA0E,CAAC,CACxF,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC;QACxD,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;QAC9C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,0BAA0B,QAAQ,IAAI,CAAC,CAAC,CAAC;IACjE,CAAC;AACH,CAAC,CAAC,CAAC"}