prism-pr 1.0.0-alpha.47

package/dist/ai/agents/framework-rules/normalize.js

@@ -0,0 +1,102 @@
+/**
+ * Framework name normalization utilities.
+ *
+ * Provides a canonical alias map and helpers to normalize raw framework names
+ * (as they appear in package manifests or stack detectors) into stable
+ * canonical identifiers used by the framework-rules system.
+ */
+export const FRAMEWORK_ALIASES = new Map([
+    // Angular
+    ['angular', 'angular'],
+    ['@angular/core', 'angular'],
+    // React
+    ['react', 'react'],
+    ['react-dom', 'react'],
+    // Next.js
+    ['next', 'nextjs'],
+    ['next.js', 'nextjs'],
+    ['nextjs', 'nextjs'],
+    // NestJS
+    ['nest', 'nestjs'],
+    ['nest.js', 'nestjs'],
+    ['nestjs', 'nestjs'],
+    ['@nestjs/core', 'nestjs'],
+    // Vue
+    ['vue', 'vue'],
+    ['vue.js', 'vue'],
+    ['vuejs', 'vue'],
+    // Nuxt
+    ['nuxt', 'nuxt'],
+    ['nuxt.js', 'nuxt'],
+    ['nuxtjs', 'nuxt'],
+    // Laravel
+    ['laravel', 'laravel'],
+    ['laravel/framework', 'laravel'],
+    // .NET (modern / Core)
+    ['dotnet', 'dotnet'],
+    ['.net', 'dotnet'],
+    ['.net core', 'dotnet'],
+    ['asp.net', 'dotnet'],
+    ['aspnet', 'dotnet'],
+    ['asp.net core', 'dotnet'],
+    // .NET Framework (legacy)
+    ['dotnet-framework', 'dotnet-framework'],
+    ['.net framework', 'dotnet-framework'],
+    ['aspnet-framework', 'dotnet-framework'],
+    // Django
+    ['django', 'django'],
+    // Express
+    ['express', 'express'],
+    // Fastify
+    ['fastify', 'fastify'],
+    // Spring
+    ['spring-boot', 'spring-boot'],
+    ['spring', 'spring-boot'],
+]);
+/**
+ * Normalize a raw framework name to its canonical identifier.
+ *
+ * Comparison is case-insensitive. Returns `undefined` for unknown frameworks.
+ *
+ * @example
+ * normalizeFrameworkName('Angular')    // → 'angular'
+ * normalizeFrameworkName('next.js')    // → 'nextjs'
+ * normalizeFrameworkName('.net core')  // → 'dotnet'
+ * normalizeFrameworkName('unknown')    // → undefined
+ */
+export function normalizeFrameworkName(raw) {
+    return FRAMEWORK_ALIASES.get(raw.toLowerCase());
+}
+/**
+ * Extract the major version component from a semver-like version string.
+ *
+ * Strips leading non-digit characters (`^`, `~`, `>=`, `v`, etc.) before
+ * parsing. Returns `undefined` for null, empty, or non-numeric strings such
+ * as `"latest"` or `"*"`.
+ *
+ * When `dotnetFw` is `true`, returns the first two numeric components
+ * (`major.minor`) — matching the .NET Framework versioning convention where
+ * `4.7` and `4.8` are distinct major releases.
+ *
+ * @example
+ * extractMajorVersion('^14.2.1')        // → '14'
+ * extractMajorVersion('v10.2.1')        // → '10'
+ * extractMajorVersion('4.7.2', true)    // → '4.7'
+ * extractMajorVersion(null)             // → undefined
+ * extractMajorVersion('latest')         // → undefined
+ */
+export function extractMajorVersion(version, dotnetFw) {
+    if (version === null || version.length === 0)
+        return undefined;
+    // Strip leading non-digit characters (^, ~, >=, v, etc.)
+    const stripped = version.replace(/^[^\d]+/, '');
+    if (stripped.length === 0)
+        return undefined;
+    if (dotnetFw === true) {
+        const match = stripped.match(/^(\d+\.\d+)/);
+        return match?.[1];
+    }
+    const match = stripped.match(/^(\d+)/);
+    return match?.[1];
+}
+//# sourceMappingURL=normalize.js.map

package/dist/ai/agents/framework-rules/normalize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"normalize.js","sourceRoot":"","sources":["../../../../src/ai/agents/framework-rules/normalize.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAgC,IAAI,GAAG,CAAC;IACpE,UAAU;IACV,CAAC,SAAS,EAAE,SAAS,CAAC;IACtB,CAAC,eAAe,EAAE,SAAS,CAAC;IAC5B,QAAQ;IACR,CAAC,OAAO,EAAE,OAAO,CAAC;IAClB,CAAC,WAAW,EAAE,OAAO,CAAC;IACtB,UAAU;IACV,CAAC,MAAM,EAAE,QAAQ,CAAC;IAClB,CAAC,SAAS,EAAE,QAAQ,CAAC;IACrB,CAAC,QAAQ,EAAE,QAAQ,CAAC;IACpB,SAAS;IACT,CAAC,MAAM,EAAE,QAAQ,CAAC;IAClB,CAAC,SAAS,EAAE,QAAQ,CAAC;IACrB,CAAC,QAAQ,EAAE,QAAQ,CAAC;IACpB,CAAC,cAAc,EAAE,QAAQ,CAAC;IAC1B,MAAM;IACN,CAAC,KAAK,EAAE,KAAK,CAAC;IACd,CAAC,QAAQ,EAAE,KAAK,CAAC;IACjB,CAAC,OAAO,EAAE,KAAK,CAAC;IAChB,OAAO;IACP,CAAC,MAAM,EAAE,MAAM,CAAC;IAChB,CAAC,SAAS,EAAE,MAAM,CAAC;IACnB,CAAC,QAAQ,EAAE,MAAM,CAAC;IAClB,UAAU;IACV,CAAC,SAAS,EAAE,SAAS,CAAC;IACtB,CAAC,mBAAmB,EAAE,SAAS,CAAC;IAChC,uBAAuB;IACvB,CAAC,QAAQ,EAAE,QAAQ,CAAC;IACpB,CAAC,MAAM,EAAE,QAAQ,CAAC;IAClB,CAAC,WAAW,EAAE,QAAQ,CAAC;IACvB,CAAC,SAAS,EAAE,QAAQ,CAAC;IACrB,CAAC,QAAQ,EAAE,QAAQ,CAAC;IACpB,CAAC,cAAc,EAAE,QAAQ,CAAC;IAC1B,0BAA0B;IAC1B,CAAC,kBAAkB,EAAE,kBAAkB,CAAC;IACxC,CAAC,gBAAgB,EAAE,kBAAkB,CAAC;IACtC,CAAC,kBAAkB,EAAE,kBAAkB,CAAC;IACxC,SAAS;IACT,CAAC,QAAQ,EAAE,QAAQ,CAAC;IACpB,UAAU;IACV,CAAC,SAAS,EAAE,SAAS,CAAC;IACtB,UAAU;IACV,CAAC,SAAS,EAAE,SAAS,CAAC;IACtB,SAAS;IACT,CAAC,aAAa,EAAE,aAAa,CAAC;IAC9B,CAAC,QAAQ,EAAE,aAAa,CAAC;CAC1B,CAAC,CAAC;AAEH;;;;;;;;;;GAUG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAW;IAChD,OAAO,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAsB,EAAE,QAAkB;IAC5E,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAE/D,yDAAyD;IACzD,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAEhD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAE5C,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAC5C,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IAED,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACvC,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC"}

package/dist/ai/agents/framework-rules/routing-map.d.ts

@@ -0,0 +1,3 @@
+export type FrameworkAgentMap = ReadonlyMap<string, ReadonlySet<string>>;
+export declare const FRAMEWORK_AGENT_MAP: FrameworkAgentMap;
+//# sourceMappingURL=routing-map.d.ts.map

package/dist/ai/agents/framework-rules/routing-map.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routing-map.d.ts","sourceRoot":"","sources":["../../../../src/ai/agents/framework-rules/routing-map.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,iBAAiB,GAAG,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;AAEzE,eAAO,MAAM,mBAAmB,EAAE,iBAahC,CAAC"}

package/dist/ai/agents/framework-rules/routing-map.js

@@ -0,0 +1,15 @@
+export const FRAMEWORK_AGENT_MAP = new Map([
+    ['angular', new Set(['ts-reviewer', 'html-reviewer', 'css-reviewer', 'testing-reviewer', 'architecture-reviewer'])],
+    ['react', new Set(['ts-reviewer', 'css-reviewer', 'testing-reviewer', 'architecture-reviewer', 'performance-reviewer'])],
+    ['nextjs', new Set(['ts-reviewer', 'css-reviewer', 'security-reviewer', 'config-reviewer'])],
+    ['nestjs', new Set(['ts-reviewer', 'security-reviewer', 'testing-reviewer', 'architecture-reviewer'])],
+    ['laravel', new Set(['php-reviewer', 'blade-reviewer', 'security-reviewer', 'architecture-reviewer', 'testing-reviewer', 'config-reviewer', 'performance-reviewer'])],
+    ['django', new Set(['python-reviewer', 'security-reviewer', 'architecture-reviewer', 'testing-reviewer', 'config-reviewer'])],
+    ['fastapi', new Set(['python-reviewer', 'security-reviewer', 'testing-reviewer', 'performance-reviewer'])],
+    ['dotnet', new Set(['csharp-reviewer', 'security-reviewer', 'architecture-reviewer', 'testing-reviewer', 'performance-reviewer'])],
+    ['dotnet-framework', new Set(['csharp-reviewer', 'security-reviewer', 'architecture-reviewer', 'config-reviewer'])],
+    ['ionic', new Set(['ts-reviewer', 'html-reviewer', 'css-reviewer', 'testing-reviewer', 'performance-reviewer'])],
+    ['vue', new Set(['ts-reviewer', 'html-reviewer', 'css-reviewer', 'architecture-reviewer'])],
+    ['nuxt', new Set(['ts-reviewer', 'html-reviewer', 'css-reviewer', 'security-reviewer', 'config-reviewer'])],
+]);
+//# sourceMappingURL=routing-map.js.map

package/dist/ai/agents/framework-rules/routing-map.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routing-map.js","sourceRoot":"","sources":["../../../../src/ai/agents/framework-rules/routing-map.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,mBAAmB,GAAsB,IAAI,GAAG,CAAC;IAC5D,CAAC,SAAS,EAAE,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,eAAe,EAAE,cAAc,EAAE,kBAAkB,EAAE,uBAAuB,CAAC,CAAC,CAAC;IACnH,CAAC,OAAO,EAAE,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,cAAc,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,sBAAsB,CAAC,CAAC,CAAC;IACxH,CAAC,QAAQ,EAAE,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,cAAc,EAAE,mBAAmB,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAC5F,CAAC,QAAQ,EAAE,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,uBAAuB,CAAC,CAAC,CAAC;IACtG,CAAC,SAAS,EAAE,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,sBAAsB,CAAC,CAAC,CAAC;IACrK,CAAC,QAAQ,EAAE,IAAI,GAAG,CAAC,CAAC,iBAAiB,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAC7H,CAAC,SAAS,EAAE,IAAI,GAAG,CAAC,CAAC,iBAAiB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,sBAAsB,CAAC,CAAC,CAAC;IAC1G,CAAC,QAAQ,EAAE,IAAI,GAAG,CAAC,CAAC,iBAAiB,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,sBAAsB,CAAC,CAAC,CAAC;IAClI,CAAC,kBAAkB,EAAE,IAAI,GAAG,CAAC,CAAC,iBAAiB,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,iBAAiB,CAAC,CAAC,CAAC;IACnH,CAAC,OAAO,EAAE,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,eAAe,EAAE,cAAc,EAAE,kBAAkB,EAAE,sBAAsB,CAAC,CAAC,CAAC;IAChH,CAAC,KAAK,EAAE,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,eAAe,EAAE,cAAc,EAAE,uBAAuB,CAAC,CAAC,CAAC;IAC3F,CAAC,MAAM,EAAE,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,eAAe,EAAE,cAAc,EAAE,mBAAmB,EAAE,iBAAiB,CAAC,CAAC,CAAC;CAC5G,CAAC,CAAC"}

package/dist/ai/agents/html-reviewer.d.ts

@@ -0,0 +1,3 @@
+import type { Agent } from '../../types/index.js';
+export declare const htmlReviewerAgent: Agent;
+//# sourceMappingURL=html-reviewer.d.ts.map

package/dist/ai/agents/html-reviewer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"html-reviewer.d.ts","sourceRoot":"","sources":["../../../src/ai/agents/html-reviewer.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,KAAK,EAAgE,MAAM,sBAAsB,CAAC;AAchH,eAAO,MAAM,iBAAiB,EAAE,KAqD/B,CAAC"}

package/dist/ai/agents/html-reviewer.js

@@ -0,0 +1,61 @@
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import path from 'node:path';
+import { Logger, LogLevel } from '../../utils/logger.js';
+import { FINDING_TOOL_SCHEMA, normalizeFinding } from './shared/finding-schema.js';
+import { buildSystemPrompt } from './shared/prompt-builder.js';
+import { buildUserContent } from './shared/content-builder.js';
+import { isValidLineNumber } from './shared/line-validator.js';
+const HTML_EXTENSIONS = new Set(['.html', '.htm']);
+// Load the system prompt at module load time (relative to this source file)
+const __filename = fileURLToPath(import.meta.url);
+const __dir = path.dirname(__filename);
+const BASE_SYSTEM_PROMPT = readFileSync(path.resolve(__dir, 'prompts', 'html-reviewer.txt'), 'utf-8');
+export const htmlReviewerAgent = {
+    id: 'html-reviewer',
+    displayName: 'HTML',
+    description: 'Markup semantics, accessibility, and structure',
+    domain: 'language',
+    contextTags: ['conventions', 'frameworkRules'],
+    fileFilter(filePath) {
+        const ext = path.extname(filePath).toLowerCase();
+        return HTML_EXTENSIONS.has(ext);
+    },
+    async analyze(input, provider) {
+        const logger = new Logger(LogLevel.warn);
+        const relevantFiles = input.files.filter((f) => this.fileFilter(f.newPath));
+        if (relevantFiles.length === 0) {
+            return {
+                agentId: this.id,
+                findings: [],
+                usage: { inputTokens: 0, outputTokens: 0 },
+            };
+        }
+        const legacyProjectContext = input.projectContext;
+        const systemPrompt = buildSystemPrompt(BASE_SYSTEM_PROMPT, input.context, legacyProjectContext);
+        const userContent = buildUserContent(relevantFiles, input.prMetadata, input.context?.contentMode ?? 'full');
+        const result = await provider.analyze({
+            systemPrompt,
+            userContent,
+            toolName: 'report_findings',
+            toolSchema: FINDING_TOOL_SCHEMA,
+        });
+        const findings = [];
+        for (const raw of result.findings) {
+            const finding = normalizeFinding(raw, this.id);
+            if (finding === null) {
+                logger.warn(`[html-reviewer] Dropping invalid finding — failed schema validation`);
+                continue;
+            }
+            if (isValidLineNumber(finding.lineNumber, finding.filePath, relevantFiles)) {
+                findings.push(finding);
+            }
+            else {
+                logger.warn(`[html-reviewer] Dropping finding at ${finding.filePath}:${finding.lineNumber} — not an addition line`);
+            }
+        }
+        const usage = result.usage;
+        return { agentId: this.id, findings, usage };
+    },
+};
+//# sourceMappingURL=html-reviewer.js.map

package/dist/ai/agents/html-reviewer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"html-reviewer.js","sourceRoot":"","sources":["../../../src/ai/agents/html-reviewer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACnF,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAE/D,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;AAEnD,4EAA4E;AAC5E,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;AACvC,MAAM,kBAAkB,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,mBAAmB,CAAC,EAAE,OAAO,CAAC,CAAC;AAEtG,MAAM,CAAC,MAAM,iBAAiB,GAAU;IACtC,EAAE,EAAE,eAAe;IACnB,WAAW,EAAE,MAAM;IACnB,WAAW,EAAE,gDAAgD;IAC7D,MAAM,EAAE,UAAU;IAClB,WAAW,EAAE,CAAC,aAAa,EAAE,gBAAgB,CAAC;IAE9C,UAAU,CAAC,QAAgB;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;QACjD,OAAO,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,KAAiB,EAAE,QAAuB;QACtD,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,aAAa,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QAE5E,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO;gBACL,OAAO,EAAE,IAAI,CAAC,EAAE;gBAChB,QAAQ,EAAE,EAAE;gBACZ,KAAK,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE;aAC3C,CAAC;QACJ,CAAC;QAED,MAAM,oBAAoB,GAAG,KAAK,CAAC,cAAc,CAAC;QAClD,MAAM,YAAY,GAAG,iBAAiB,CAAC,kBAAkB,EAAE,KAAK,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;QAChG,MAAM,WAAW,GAAG,gBAAgB,CAAC,aAAa,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,OAAO,EAAE,WAAW,IAAI,MAAM,CAAC,CAAC;QAE5G,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC;YACpC,YAAY;YACZ,WAAW;YACX,QAAQ,EAAE,iBAAiB;YAC3B,UAAU,EAAE,mBAAmB;SAChC,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,EAAE,CAAC;QACpB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YAClC,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;YAC/C,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,MAAM,CAAC,IAAI,CAAC,qEAAqE,CAAC,CAAC;gBACnF,SAAS;YACX,CAAC;YACD,IAAI,iBAAiB,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE,CAAC;gBAC3E,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACzB,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CAAC,uCAAuC,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,UAAU,yBAAyB,CAAC,CAAC;YACtH,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAAe,MAAM,CAAC,KAAK,CAAC;QAEvC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC/C,CAAC;CACF,CAAC"}

package/dist/ai/agents/performance-reviewer.d.ts

@@ -0,0 +1,3 @@
+import type { Agent } from '../../types/index.js';
+export declare const performanceReviewerAgent: Agent;
+//# sourceMappingURL=performance-reviewer.d.ts.map

package/dist/ai/agents/performance-reviewer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"performance-reviewer.d.ts","sourceRoot":"","sources":["../../../src/ai/agents/performance-reviewer.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,KAAK,EAAsD,MAAM,sBAAsB,CAAC;AAYtG,eAAO,MAAM,wBAAwB,EAAE,KAuDtC,CAAC"}

package/dist/ai/agents/performance-reviewer.js

@@ -0,0 +1,60 @@
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import path from 'node:path';
+import { Logger, LogLevel } from '../../utils/logger.js';
+import { FINDING_TOOL_SCHEMA, normalizeFinding } from './shared/finding-schema.js';
+import { buildSystemPrompt } from './shared/prompt-builder.js';
+import { buildUserContent } from './shared/content-builder.js';
+import { isValidLineNumber } from './shared/line-validator.js';
+// Load the system prompt at module load time (relative to this source file)
+const __filename = fileURLToPath(import.meta.url);
+const __dir = path.dirname(__filename);
+const BASE_SYSTEM_PROMPT = readFileSync(path.resolve(__dir, 'prompts', 'performance-reviewer.txt'), 'utf-8');
+export const performanceReviewerAgent = {
+    id: 'performance-reviewer',
+    displayName: 'Performance',
+    description: 'Bottlenecks, complexity, and optimization',
+    domain: 'infra',
+    contextTags: ['conventions'],
+    // Performance reviewer checks ALL files — perf issues can appear anywhere
+    fileFilter(_filePath) {
+        return true;
+    },
+    async analyze(input, provider) {
+        const logger = new Logger(LogLevel.warn);
+        // Performance reviewer reviews all files — no filtering by extension
+        const files = input.files;
+        if (files.length === 0) {
+            return {
+                agentId: this.id,
+                findings: [],
+                usage: { inputTokens: 0, outputTokens: 0 },
+            };
+        }
+        const legacyProjectContext = input.projectContext;
+        const systemPrompt = buildSystemPrompt(BASE_SYSTEM_PROMPT, input.context, legacyProjectContext);
+        const userContent = buildUserContent(files, input.prMetadata, input.context?.contentMode ?? 'full');
+        const result = await provider.analyze({
+            systemPrompt,
+            userContent,
+            toolName: 'report_findings',
+            toolSchema: FINDING_TOOL_SCHEMA,
+        });
+        const findings = [];
+        for (const raw of result.findings) {
+            const finding = normalizeFinding(raw, this.id);
+            if (finding === null) {
+                logger.warn(`[performance-reviewer] Dropping invalid finding — failed schema validation`);
+                continue;
+            }
+            if (!isValidLineNumber(finding.lineNumber, finding.filePath, files)) {
+                logger.warn(`[performance-reviewer] Dropping finding at ${finding.filePath}:${finding.lineNumber} — not an addition line`);
+                continue;
+            }
+            findings.push(finding);
+        }
+        const usage = result.usage;
+        return { agentId: this.id, findings, usage };
+    },
+};
+//# sourceMappingURL=performance-reviewer.js.map

package/dist/ai/agents/performance-reviewer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"performance-reviewer.js","sourceRoot":"","sources":["../../../src/ai/agents/performance-reviewer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACnF,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAE/D,4EAA4E;AAC5E,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;AACvC,MAAM,kBAAkB,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,0BAA0B,CAAC,EAAE,OAAO,CAAC,CAAC;AAE7G,MAAM,CAAC,MAAM,wBAAwB,GAAU;IAC7C,EAAE,EAAE,sBAAsB;IAC1B,WAAW,EAAE,aAAa;IAC1B,WAAW,EAAE,2CAA2C;IACxD,MAAM,EAAE,OAAO;IACf,WAAW,EAAE,CAAC,aAAa,CAAC;IAE5B,0EAA0E;IAC1E,UAAU,CAAC,SAAiB;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,KAAiB,EAAE,QAAuB;QACtD,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAEzC,qEAAqE;QACrE,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;QAE1B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO;gBACL,OAAO,EAAE,IAAI,CAAC,EAAE;gBAChB,QAAQ,EAAE,EAAE;gBACZ,KAAK,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE;aAC3C,CAAC;QACJ,CAAC;QAED,MAAM,oBAAoB,GAAG,KAAK,CAAC,cAAc,CAAC;QAClD,MAAM,YAAY,GAAG,iBAAiB,CAAC,kBAAkB,EAAE,KAAK,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;QAChG,MAAM,WAAW,GAAG,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,OAAO,EAAE,WAAW,IAAI,MAAM,CAAC,CAAC;QAEpG,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC;YACpC,YAAY;YACZ,WAAW;YACX,QAAQ,EAAE,iBAAiB;YAC3B,UAAU,EAAE,mBAAmB;SAChC,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,EAAE,CAAC;QACpB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YAClC,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;YAC/C,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,MAAM,CAAC,IAAI,CAAC,4EAA4E,CAAC,CAAC;gBAC1F,SAAS;YACX,CAAC;YACD,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC;gBACpE,MAAM,CAAC,IAAI,CAAC,8CAA8C,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,UAAU,yBAAyB,CAAC,CAAC;gBAC3H,SAAS;YACX,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzB,CAAC;QAED,MAAM,KAAK,GAAe,MAAM,CAAC,KAAK,CAAC;QAEvC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC/C,CAAC;CACF,CAAC"}

package/dist/ai/agents/php-reviewer.d.ts

@@ -0,0 +1,3 @@
+import type { Agent } from '../../types/index.js';
+export declare const phpReviewerAgent: Agent;
+//# sourceMappingURL=php-reviewer.d.ts.map

package/dist/ai/agents/php-reviewer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"php-reviewer.d.ts","sourceRoot":"","sources":["../../../src/ai/agents/php-reviewer.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,KAAK,EAAsD,MAAM,sBAAsB,CAAC;AAYtG,eAAO,MAAM,gBAAgB,EAAE,KAsD9B,CAAC"}

package/dist/ai/agents/php-reviewer.js

@@ -0,0 +1,62 @@
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import path from 'node:path';
+import { Logger, LogLevel } from '../../utils/logger.js';
+import { FINDING_TOOL_SCHEMA, normalizeFinding } from './shared/finding-schema.js';
+import { buildSystemPrompt } from './shared/prompt-builder.js';
+import { buildUserContent } from './shared/content-builder.js';
+import { isValidLineNumber } from './shared/line-validator.js';
+// Load the system prompt at module load time (relative to this source file)
+const __filename = fileURLToPath(import.meta.url);
+const __dir = path.dirname(__filename);
+const BASE_SYSTEM_PROMPT = readFileSync(path.resolve(__dir, 'prompts', 'php-reviewer.txt'), 'utf-8');
+export const phpReviewerAgent = {
+    id: 'php-reviewer',
+    displayName: 'PHP',
+    description: 'PHP code quality, type safety, and Laravel conventions',
+    domain: 'language',
+    contextTags: ['conventions', 'frameworkRules'],
+    fileFilter(filePath) {
+        const lower = filePath.toLowerCase();
+        if (lower.endsWith('.blade.php'))
+            return false;
+        return path.extname(lower) === '.php';
+    },
+    async analyze(input, provider) {
+        const logger = new Logger(LogLevel.warn);
+        const relevantFiles = input.files.filter((f) => this.fileFilter(f.newPath));
+        if (relevantFiles.length === 0) {
+            return {
+                agentId: this.id,
+                findings: [],
+                usage: { inputTokens: 0, outputTokens: 0 },
+            };
+        }
+        const legacyProjectContext = input.projectContext;
+        const systemPrompt = buildSystemPrompt(BASE_SYSTEM_PROMPT, input.context, legacyProjectContext);
+        const userContent = buildUserContent(relevantFiles, input.prMetadata, input.context?.contentMode ?? 'full');
+        const result = await provider.analyze({
+            systemPrompt,
+            userContent,
+            toolName: 'report_findings',
+            toolSchema: FINDING_TOOL_SCHEMA,
+        });
+        const findings = [];
+        for (const raw of result.findings) {
+            const finding = normalizeFinding(raw, this.id);
+            if (finding === null) {
+                logger.warn(`[php-reviewer] Dropping invalid finding — failed schema validation`);
+                continue;
+            }
+            if (isValidLineNumber(finding.lineNumber, finding.filePath, relevantFiles)) {
+                findings.push(finding);
+            }
+            else {
+                logger.warn(`[php-reviewer] Dropping finding at ${finding.filePath}:${finding.lineNumber} — not an addition line`);
+            }
+        }
+        const usage = result.usage;
+        return { agentId: this.id, findings, usage };
+    },
+};
+//# sourceMappingURL=php-reviewer.js.map

package/dist/ai/agents/php-reviewer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"php-reviewer.js","sourceRoot":"","sources":["../../../src/ai/agents/php-reviewer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACnF,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAE/D,4EAA4E;AAC5E,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;AACvC,MAAM,kBAAkB,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,kBAAkB,CAAC,EAAE,OAAO,CAAC,CAAC;AAErG,MAAM,CAAC,MAAM,gBAAgB,GAAU;IACrC,EAAE,EAAE,cAAc;IAClB,WAAW,EAAE,KAAK;IAClB,WAAW,EAAE,wDAAwD;IACrE,MAAM,EAAE,UAAU;IAClB,WAAW,EAAE,CAAC,aAAa,EAAE,gBAAgB,CAAC;IAE9C,UAAU,CAAC,QAAgB;QACzB,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;QACrC,IAAI,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC;YAAE,OAAO,KAAK,CAAC;QAC/C,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC;IACxC,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,KAAiB,EAAE,QAAuB;QACtD,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,aAAa,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QAE5E,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO;gBACL,OAAO,EAAE,IAAI,CAAC,EAAE;gBAChB,QAAQ,EAAE,EAAE;gBACZ,KAAK,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE;aAC3C,CAAC;QACJ,CAAC;QAED,MAAM,oBAAoB,GAAG,KAAK,CAAC,cAAc,CAAC;QAClD,MAAM,YAAY,GAAG,iBAAiB,CAAC,kBAAkB,EAAE,KAAK,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;QAChG,MAAM,WAAW,GAAG,gBAAgB,CAAC,aAAa,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,OAAO,EAAE,WAAW,IAAI,MAAM,CAAC,CAAC;QAE5G,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC;YACpC,YAAY;YACZ,WAAW;YACX,QAAQ,EAAE,iBAAiB;YAC3B,UAAU,EAAE,mBAAmB;SAChC,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,EAAE,CAAC;QACpB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YAClC,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;YAC/C,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,MAAM,CAAC,IAAI,CAAC,oEAAoE,CAAC,CAAC;gBAClF,SAAS;YACX,CAAC;YACD,IAAI,iBAAiB,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE,CAAC;gBAC3E,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACzB,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CAAC,sCAAsC,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,UAAU,yBAAyB,CAAC,CAAC;YACrH,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAAe,MAAM,CAAC,KAAK,CAAC;QAEvC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC/C,CAAC;CACF,CAAC"}

package/dist/ai/agents/prompts/architecture-reviewer.txt

@@ -0,0 +1,39 @@
+You are a senior software architect reviewing a pull request for structural and design issues. Your goal is to identify high-signal architectural problems — NOT file-level code style issues or implementation details.
+
+## Focus Areas
+
+Review the entire diff holistically and report findings for:
+
+1. **Circular dependencies** — modules or packages that import each other directly or transitively, creating tight coupling that prevents independent testing or deployment
+2. **Single Responsibility Principle violations** — classes, modules, or functions that are clearly doing multiple unrelated things (e.g., a data model that also handles HTTP calls; a service that mixes business logic with persistence)
+3. **Layer boundary crossings** — higher-level layers being imported by lower-level layers (e.g., UI components importing directly from database models; infrastructure code importing domain entities incorrectly)
+4. **Inappropriate coupling** — components that know too much about each other's internals; tight coupling that makes changes in one place require changes in many others
+5. **Leaked abstractions** — implementation details of one layer leaking into another (e.g., SQL-specific types in business logic; HTTP status codes in domain services)
+
+## Critical Output Constraint
+
+Produce between 0 and 3 findings MAXIMUM. This is a hard limit.
+
+Focus only on `critical` or `high` severity architectural issues. Do NOT report:
+- `medium`, `low`, or `info` severity findings
+- File-level implementation details
+- Naming conventions or code style
+- Issues that affect a single file without cross-component impact
+- Theoretical violations without clear evidence in the diff
+
+If no high-signal architectural issues exist, return an empty findings array. Do NOT manufacture findings to appear thorough.
+
+## Output Instructions
+
+You MUST call the `report_findings` tool to submit your findings. Do not write findings as plain text — the tool call is required.
+
+For each finding, reference the exact line number using the `[L{num}]` annotations provided in the diff. The `lineNumber` field in each finding MUST correspond to an annotated line from the diff.
+
+If there are no findings, call `report_findings` with an empty array: `{ "findings": [] }`.
+
+## Severity Criteria
+
+| Severity | When to use |
+|----------|-------------|
+| `critical` | Circular dependency or layer violation that will break builds or prevent testability |
+| `high` | SRP violation or coupling issue that will cause cascading changes and increase defect rate |

package/dist/ai/agents/prompts/blade-reviewer.txt

@@ -0,0 +1,39 @@
+You are a senior Laravel Blade template reviewer with deep expertise in template security, component architecture, and Laravel rendering behaviour. Your goal is to identify real security risks, accessibility issues, and anti-patterns — not style preferences.
+
+## Focus Areas
+
+Review the provided diff and report findings for the following issues:
+
+1. **Unescaped output (XSS)** — `{!! $variable !!}` without sanitization; ALL user-controlled data MUST use `{{ }}` (auto-escaped)
+2. **Missing CSRF protection** — forms without `@csrf`; every POST/PUT/PATCH/DELETE form MUST include `@csrf`
+3. **Missing method spoofing** — PUT/PATCH/DELETE forms without `@method('...')` directive
+4. **Business logic in templates** — `@php` blocks with business logic, DB queries, complex computations
+5. **@inject misuse** — `@inject('var', 'App\Services\...')` pulling services into views
+6. **Raw HTML attribute injection** — dynamic values in attributes without escaping, `javascript:` protocol
+7. **Accessibility violations** — missing `alt`, form inputs without labels, invalid ARIA
+8. **Component anti-patterns** — inline HTML for extraction, 3+ nested levels, missing slots
+
+## Explicit Exclusions
+
+- Blade formatting and whitespace
+- Directive ordering preferences
+- CSS class naming (Tailwind, BEM)
+- Alpine.js / Livewire directives
+- PHP code quality in @php blocks (handled by php-reviewer)
+
+## Output Instructions
+
+You MUST call the `report_findings` tool to submit your findings. Do not write findings as plain text — the tool call is required.
+
+For each finding, reference the exact line number using the `[L{num}]` annotations provided in the diff. The `lineNumber` field in each finding MUST correspond to an annotated line from the diff.
+
+If there are no findings, call `report_findings` with an empty array: `{ "findings": [] }`.
+
+## Severity Criteria
+
+| Severity | When to use |
+|----------|-------------|
+| `critical` | XSS via `{!! !!}` with user data; missing `@csrf` on state-mutating forms; raw attribute injection |
+| `high` | `@inject` of services; `@php` with DB queries; missing method spoofing |
+| `medium` | Accessibility violations; deeply nested control structures |
+| `low` | Component extraction opportunity; slot usage; minor structure improvement |

package/dist/ai/agents/prompts/config-reviewer.txt

@@ -0,0 +1,47 @@
+You are a senior configuration and infrastructure reviewer with expertise in application security, DevOps best practices, and cloud-native configuration patterns. Your goal is to identify dangerous misconfigurations that cause security breaches, environment-bleed issues, or production incidents — not style or formatting preferences.
+
+## Focus Areas
+
+Review the provided diff and report findings for the following issues:
+
+1. **Accidental secrets / credentials** (category: `security`) — Key names matching `password`, `secret`, `api_key`, `apikey`, `token`, `private_key`, `connection_string`, `database_url`, `auth_token` with non-placeholder, non-empty values. Real-looking values: 32+ char hex/base64 strings, `sk_live_*`, `ghp_*`, `AKIA*` (AWS), `xoxb-*` (Slack). Exception: `pk_test_*`, `sk_test_*` (Stripe test keys) → `low` severity only.
+
+2. **Hardcoded environment-specific values** (category: `maintainability`) — Literal `localhost`, `127.0.0.1`, `0.0.0.0`, IP addresses, absolute paths (starting with `/` or a Windows drive letter) in non-Docker-internal config files. Database names containing `prod`, `production`, or `staging` without an environment variable reference.
+
+3. **Docker Compose security** (category: `security`) — `privileged: true` without a justification comment; ports bound to `0.0.0.0` exposing internal-only services; bind mounts to sensitive host paths (`/`, `/etc`, `/root`, `/var/run/docker.sock`); `network_mode: host` without justification; missing `healthcheck` on database or queue services; `latest` tag on images (non-deterministic builds, severity: `medium`).
+
+4. **Duplicate keys and structural errors** (category: `bug`) — JSON or YAML files with the same key appearing more than once at the same level (last-wins silently); TOML table redefinition.
+
+5. **Dangerously permissive CORS / security defaults** (category: `security`) — `cors: "*"` or `allow_origins: ["*"]`; `debug: true` or `DEBUG=true` in non-dev-named config files; `ssl: false`, `verify: false`, `tls: false`, `secure: false` in non-dev contexts.
+
+6. **Missing required fields in known schemas** (category: `maintainability`) — `package.json` without an `engines` field; `tsconfig.json` without `strict: true` under `compilerOptions`; Docker Compose services without a `restart` policy.
+
+## Explicit Exclusions
+
+Do NOT report the following:
+
+- **Lockfiles**: package-lock.json, yarn.lock, pnpm-lock.yaml, composer.lock, Gemfile.lock, Cargo.lock, go.sum, poetry.lock — NEVER review these; skip the entire file if it appears
+- **Auto-generated configs**: Files under `.angular/`, `.next/`, `.nuxt/`, `node_modules/`, `dist/`, `coverage/`, `.cache/`, `vendor/`; files ending with `.tsbuildinfo` or `.eslintcache`
+- **IDE / editor settings**: `.vscode/settings.json`, `.vscode/extensions.json`, `.idea/` files, `.editorconfig` — these are team-preference files, not security-relevant
+- **Placeholder values in `.env.example` files**: Values matching `YOUR_*`, `<placeholder>`, `TODO`, `CHANGEME`, `xxx`, `your-key-here`, `example`, `REPLACE_ME`, `__CHANGE_ME__`, or empty string — these are CORRECT patterns and must NOT be flagged
+- **Test fixture configs**: Files under `__tests__/`, `test/`, `spec/`, `fixtures/`, `__mocks__/` — apply relaxed rules; only flag `critical` issues
+- **Config formatting and style preferences**: Key ordering, quote style (single vs double in YAML), comment density, whitespace, indentation style (tabs vs spaces), line length
+
+## Output Instructions
+
+You MUST call the `report_findings` tool to submit your findings. Do not write findings as plain text — the tool call is required.
+
+For each finding, reference the exact line number using the `[L{num}]` annotations provided in the diff. The `lineNumber` field MUST correspond to an annotated line from the diff.
+
+If there are no findings, call `report_findings` with an empty array: `{ "findings": [] }`.
+
+## Severity Criteria
+
+| Severity | When to use |
+|----------|-------------|
+| `critical` | Actual secret committed (real API key, password, token — not a placeholder); `privileged: true` in Docker Compose without justification; credentials embedded in a connection string |
+| `high` | `cors: "*"` in production config; bind mount to `/` or `/etc`; `ssl: false` in a production-facing config; hardcoded production database credentials (even if partially masked) |
+| `medium` | Hardcoded `localhost` or IP addresses in non-dev config; duplicate JSON/YAML keys; `latest` Docker image tag; `debug: true` in ambiguous context; missing healthcheck on database service |
+| `low` | Missing `engines` in `package.json`; `.env.example` completeness suggestions; `ssl: false` in an explicit dev config; missing `restart` policy; advisory recommendations with clear functional consequence |
+
+Only report `low` severity when the issue has a clear functional consequence, not purely theoretical.

package/dist/ai/agents/prompts/csharp-reviewer.txt

@@ -0,0 +1,39 @@
+You are a senior C# code reviewer with deep expertise in async programming, memory management, and .NET runtime behaviour. Your goal is to identify real bugs and dangerous patterns — not style preferences.
+
+## Focus Areas
+
+Review the provided diff and report findings for the following issues:
+
+1. **Blocking async calls** — use of `.Result`, `.Wait()`, `.GetAwaiter().GetResult()` on Tasks in async contexts; these cause deadlocks in ASP.NET and UI contexts and are CRITICAL issues
+2. **IDisposable not disposed** — objects implementing `IDisposable` (DbConnection, HttpClient, Stream, SqlCommand) created without `using` statements or explicit `Dispose()` calls; causes resource leaks
+3. **Swallowed exceptions** — `catch {}` or `catch (Exception) {}` blocks that do nothing or only log without rethrowing; hides failures and makes debugging impossible
+4. **LINQ N+1 queries** — LINQ queries inside loops that execute against a database or IQueryable without materializing first; each iteration triggers a separate query
+5. **Null safety violations** — accessing properties or methods on values that may be null without null checks; missing null-conditional operators (`?.`) or null-coalescing operators (`??`)
+6. **async void methods** — methods declared `async void` outside of event handlers; exceptions from async void cannot be caught and crash the process
+7. **Thread safety issues** — shared mutable state accessed from multiple threads without synchronization; static fields modified without locks
+
+## Explicit Exclusions
+
+Do NOT report the following:
+
+- Naming conventions (PascalCase vs camelCase preferences)
+- Using directives ordering
+- Code formatting or whitespace
+- XML documentation presence or absence
+
+## Output Instructions
+
+You MUST call the `report_findings` tool to submit your findings. Do not write findings as plain text — the tool call is required.
+
+For each finding, reference the exact line number using the `[L{num}]` annotations provided in the diff. The `lineNumber` field in each finding MUST correspond to an annotated line from the diff.
+
+If there are no findings, call `report_findings` with an empty array: `{ "findings": [] }`.
+
+## Severity Criteria
+
+| Severity | When to use |
+|----------|-------------|
+| `critical` | `.Result`/`.Wait()` that will deadlock; unhandled exception that crashes the process |
+| `high` | Resource leak that accumulates under load; exception swallowing that hides production failures |
+| `medium` | N+1 query that degrades performance under realistic data volumes; null dereference under specific conditions |
+| `low` | Code pattern that may cause issues but requires unusual circumstances |

package/dist/ai/agents/prompts/css-reviewer.txt

@@ -0,0 +1,41 @@
+You are a senior CSS/styling code reviewer with expertise in scalable CSS architecture, accessibility, and performance. Your goal is to identify real CSS problems that cause bugs, accessibility failures, or performance regressions — not preference-based style issues.
+
+## Focus Areas
+
+Review the provided diff and report findings for the following issues:
+
+1. **Specificity problems** — overly specific selectors (ID selectors in component styles, `!important` abuse) that create maintenance nightmares or override failures
+2. **Missing focus/focus-visible styles** — interactive elements (buttons, links, inputs) that lack visible `:focus` or `:focus-visible` states, breaking keyboard navigation
+3. **Fixed pixel values for text and spacing** — use of `px` units for `font-size`, `line-height`, or layout spacing where `rem`/`em` would scale correctly with user preferences
+4. **Performance-impacting properties** — use of `top`/`left` for animation instead of `transform`; `width`/`height` transitions that trigger layout; `box-shadow` on frequently repainted elements
+5. **Accessibility color contrast** — hardcoded color combinations that likely fail WCAG AA contrast ratio (4.5:1 for normal text, 3:1 for large text or UI components)
+6. **Missing responsive breakpoints** — layouts using fixed widths without corresponding responsive adjustments that would break on mobile viewports
+7. **CSS custom property misuse** — referencing CSS variables that may be undefined without fallback values
+
+## Explicit Exclusions
+
+Do NOT report the following:
+
+- Vendor prefix presence or absence (tooling handles this)
+- Property ordering or alphabetical sorting preferences
+- Comments or documentation style
+- Color format preferences (hex vs rgb vs hsl) without contrast issues
+
+## Output Instructions
+
+You MUST call the `report_findings` tool to submit your findings. Do not write findings as plain text — the tool call is required.
+
+For each finding, reference the exact line number using the `[L{num}]` annotations provided in the diff. The `lineNumber` field in each finding MUST correspond to an annotated line from the diff.
+
+If there are no findings, call `report_findings` with an empty array: `{ "findings": [] }`.
+
+## Severity Criteria
+
+| Severity | When to use |
+|----------|-------------|
+| `critical` | Accessibility failure that blocks keyboard or screen reader users completely |
+| `high` | Bug causing visible breakage across common screen sizes or interaction states |
+| `medium` | Performance issue or accessibility weakness under specific conditions |
+| `low` | Best practice violation with measurable (not theoretical) functional impact |
+
+Only report `low` severity when the issue has a clear functional consequence, not purely stylistic.