prism-pr 1.0.0-alpha.47

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (677) hide show
  1. package/README.md +964 -0
  2. package/bin/run.js +9 -0
  3. package/dist/ai/agents/architecture-reviewer.d.ts +3 -0
  4. package/dist/ai/agents/architecture-reviewer.d.ts.map +1 -0
  5. package/dist/ai/agents/architecture-reviewer.js +67 -0
  6. package/dist/ai/agents/architecture-reviewer.js.map +1 -0
  7. package/dist/ai/agents/blade-reviewer.d.ts +3 -0
  8. package/dist/ai/agents/blade-reviewer.d.ts.map +1 -0
  9. package/dist/ai/agents/blade-reviewer.js +59 -0
  10. package/dist/ai/agents/blade-reviewer.js.map +1 -0
  11. package/dist/ai/agents/config-reviewer.d.ts +3 -0
  12. package/dist/ai/agents/config-reviewer.d.ts.map +1 -0
  13. package/dist/ai/agents/config-reviewer.js +106 -0
  14. package/dist/ai/agents/config-reviewer.js.map +1 -0
  15. package/dist/ai/agents/csharp-reviewer.d.ts +3 -0
  16. package/dist/ai/agents/csharp-reviewer.d.ts.map +1 -0
  17. package/dist/ai/agents/csharp-reviewer.js +59 -0
  18. package/dist/ai/agents/csharp-reviewer.js.map +1 -0
  19. package/dist/ai/agents/css-reviewer.d.ts +3 -0
  20. package/dist/ai/agents/css-reviewer.d.ts.map +1 -0
  21. package/dist/ai/agents/css-reviewer.js +65 -0
  22. package/dist/ai/agents/css-reviewer.js.map +1 -0
  23. package/dist/ai/agents/framework-rules/index.d.ts +33 -0
  24. package/dist/ai/agents/framework-rules/index.d.ts.map +1 -0
  25. package/dist/ai/agents/framework-rules/index.js +67 -0
  26. package/dist/ai/agents/framework-rules/index.js.map +1 -0
  27. package/dist/ai/agents/framework-rules/normalize.d.ts +40 -0
  28. package/dist/ai/agents/framework-rules/normalize.d.ts.map +1 -0
  29. package/dist/ai/agents/framework-rules/normalize.js +102 -0
  30. package/dist/ai/agents/framework-rules/normalize.js.map +1 -0
  31. package/dist/ai/agents/framework-rules/routing-map.d.ts +3 -0
  32. package/dist/ai/agents/framework-rules/routing-map.d.ts.map +1 -0
  33. package/dist/ai/agents/framework-rules/routing-map.js +15 -0
  34. package/dist/ai/agents/framework-rules/routing-map.js.map +1 -0
  35. package/dist/ai/agents/html-reviewer.d.ts +3 -0
  36. package/dist/ai/agents/html-reviewer.d.ts.map +1 -0
  37. package/dist/ai/agents/html-reviewer.js +61 -0
  38. package/dist/ai/agents/html-reviewer.js.map +1 -0
  39. package/dist/ai/agents/performance-reviewer.d.ts +3 -0
  40. package/dist/ai/agents/performance-reviewer.d.ts.map +1 -0
  41. package/dist/ai/agents/performance-reviewer.js +60 -0
  42. package/dist/ai/agents/performance-reviewer.js.map +1 -0
  43. package/dist/ai/agents/php-reviewer.d.ts +3 -0
  44. package/dist/ai/agents/php-reviewer.d.ts.map +1 -0
  45. package/dist/ai/agents/php-reviewer.js +62 -0
  46. package/dist/ai/agents/php-reviewer.js.map +1 -0
  47. package/dist/ai/agents/prompts/architecture-reviewer.txt +39 -0
  48. package/dist/ai/agents/prompts/blade-reviewer.txt +39 -0
  49. package/dist/ai/agents/prompts/config-reviewer.txt +47 -0
  50. package/dist/ai/agents/prompts/csharp-reviewer.txt +39 -0
  51. package/dist/ai/agents/prompts/css-reviewer.txt +41 -0
  52. package/dist/ai/agents/prompts/html-reviewer.txt +43 -0
  53. package/dist/ai/agents/prompts/performance-reviewer.txt +38 -0
  54. package/dist/ai/agents/prompts/php-reviewer.txt +87 -0
  55. package/dist/ai/agents/prompts/python-reviewer.txt +42 -0
  56. package/dist/ai/agents/prompts/security-reviewer.txt +36 -0
  57. package/dist/ai/agents/prompts/sql-reviewer.txt +43 -0
  58. package/dist/ai/agents/prompts/testing-reviewer.txt +38 -0
  59. package/dist/ai/agents/prompts/ts-reviewer.txt +54 -0
  60. package/dist/ai/agents/prompts/ux-text-reviewer.txt +68 -0
  61. package/dist/ai/agents/python-reviewer.d.ts +3 -0
  62. package/dist/ai/agents/python-reviewer.d.ts.map +1 -0
  63. package/dist/ai/agents/python-reviewer.js +59 -0
  64. package/dist/ai/agents/python-reviewer.js.map +1 -0
  65. package/dist/ai/agents/registry.d.ts +20 -0
  66. package/dist/ai/agents/registry.d.ts.map +1 -0
  67. package/dist/ai/agents/registry.js +65 -0
  68. package/dist/ai/agents/registry.js.map +1 -0
  69. package/dist/ai/agents/security-reviewer.d.ts +3 -0
  70. package/dist/ai/agents/security-reviewer.d.ts.map +1 -0
  71. package/dist/ai/agents/security-reviewer.js +69 -0
  72. package/dist/ai/agents/security-reviewer.js.map +1 -0
  73. package/dist/ai/agents/shared/content-builder.d.ts +14 -0
  74. package/dist/ai/agents/shared/content-builder.d.ts.map +1 -0
  75. package/dist/ai/agents/shared/content-builder.js +158 -0
  76. package/dist/ai/agents/shared/content-builder.js.map +1 -0
  77. package/dist/ai/agents/shared/finding-schema.d.ts +54 -0
  78. package/dist/ai/agents/shared/finding-schema.d.ts.map +1 -0
  79. package/dist/ai/agents/shared/finding-schema.js +65 -0
  80. package/dist/ai/agents/shared/finding-schema.js.map +1 -0
  81. package/dist/ai/agents/shared/line-validator.d.ts +8 -0
  82. package/dist/ai/agents/shared/line-validator.d.ts.map +1 -0
  83. package/dist/ai/agents/shared/line-validator.js +12 -0
  84. package/dist/ai/agents/shared/line-validator.js.map +1 -0
  85. package/dist/ai/agents/shared/prompt-builder.d.ts +3 -0
  86. package/dist/ai/agents/shared/prompt-builder.d.ts.map +1 -0
  87. package/dist/ai/agents/shared/prompt-builder.js +68 -0
  88. package/dist/ai/agents/shared/prompt-builder.js.map +1 -0
  89. package/dist/ai/agents/sql-reviewer.d.ts +3 -0
  90. package/dist/ai/agents/sql-reviewer.d.ts.map +1 -0
  91. package/dist/ai/agents/sql-reviewer.js +61 -0
  92. package/dist/ai/agents/sql-reviewer.js.map +1 -0
  93. package/dist/ai/agents/testing-reviewer.d.ts +3 -0
  94. package/dist/ai/agents/testing-reviewer.d.ts.map +1 -0
  95. package/dist/ai/agents/testing-reviewer.js +80 -0
  96. package/dist/ai/agents/testing-reviewer.js.map +1 -0
  97. package/dist/ai/agents/ts-reviewer.d.ts +3 -0
  98. package/dist/ai/agents/ts-reviewer.d.ts.map +1 -0
  99. package/dist/ai/agents/ts-reviewer.js +63 -0
  100. package/dist/ai/agents/ts-reviewer.js.map +1 -0
  101. package/dist/ai/agents/ux-text-reviewer.d.ts +3 -0
  102. package/dist/ai/agents/ux-text-reviewer.d.ts.map +1 -0
  103. package/dist/ai/agents/ux-text-reviewer.js +116 -0
  104. package/dist/ai/agents/ux-text-reviewer.js.map +1 -0
  105. package/dist/ai/orchestrator/agent-classifier.d.ts +28 -0
  106. package/dist/ai/orchestrator/agent-classifier.d.ts.map +1 -0
  107. package/dist/ai/orchestrator/agent-classifier.js +137 -0
  108. package/dist/ai/orchestrator/agent-classifier.js.map +1 -0
  109. package/dist/ai/orchestrator/consolidation.d.ts +12 -0
  110. package/dist/ai/orchestrator/consolidation.d.ts.map +1 -0
  111. package/dist/ai/orchestrator/consolidation.js +34 -0
  112. package/dist/ai/orchestrator/consolidation.js.map +1 -0
  113. package/dist/ai/orchestrator/context-analyzer.d.ts +47 -0
  114. package/dist/ai/orchestrator/context-analyzer.d.ts.map +1 -0
  115. package/dist/ai/orchestrator/context-analyzer.js +368 -0
  116. package/dist/ai/orchestrator/context-analyzer.js.map +1 -0
  117. package/dist/ai/orchestrator/deduplicator.d.ts +43 -0
  118. package/dist/ai/orchestrator/deduplicator.d.ts.map +1 -0
  119. package/dist/ai/orchestrator/deduplicator.js +97 -0
  120. package/dist/ai/orchestrator/deduplicator.js.map +1 -0
  121. package/dist/ai/orchestrator/orchestrator.d.ts +57 -0
  122. package/dist/ai/orchestrator/orchestrator.d.ts.map +1 -0
  123. package/dist/ai/orchestrator/orchestrator.js +181 -0
  124. package/dist/ai/orchestrator/orchestrator.js.map +1 -0
  125. package/dist/ai/orchestrator/rule-based-strategy.d.ts +20 -0
  126. package/dist/ai/orchestrator/rule-based-strategy.d.ts.map +1 -0
  127. package/dist/ai/orchestrator/rule-based-strategy.js +55 -0
  128. package/dist/ai/orchestrator/rule-based-strategy.js.map +1 -0
  129. package/dist/ai/orchestrator/semaphore.d.ts +25 -0
  130. package/dist/ai/orchestrator/semaphore.d.ts.map +1 -0
  131. package/dist/ai/orchestrator/semaphore.js +52 -0
  132. package/dist/ai/orchestrator/semaphore.js.map +1 -0
  133. package/dist/ai/orchestrator/severity-pipeline.d.ts +21 -0
  134. package/dist/ai/orchestrator/severity-pipeline.d.ts.map +1 -0
  135. package/dist/ai/orchestrator/severity-pipeline.js +69 -0
  136. package/dist/ai/orchestrator/severity-pipeline.js.map +1 -0
  137. package/dist/ai/orchestrator/strategy.d.ts +20 -0
  138. package/dist/ai/orchestrator/strategy.d.ts.map +1 -0
  139. package/dist/ai/orchestrator/strategy.js +2 -0
  140. package/dist/ai/orchestrator/strategy.js.map +1 -0
  141. package/dist/ai/providers/anthropic-provider.d.ts +14 -0
  142. package/dist/ai/providers/anthropic-provider.d.ts.map +1 -0
  143. package/dist/ai/providers/anthropic-provider.js +108 -0
  144. package/dist/ai/providers/anthropic-provider.js.map +1 -0
  145. package/dist/ai/providers/claude-code-provider.d.ts +12 -0
  146. package/dist/ai/providers/claude-code-provider.d.ts.map +1 -0
  147. package/dist/ai/providers/claude-code-provider.js +103 -0
  148. package/dist/ai/providers/claude-code-provider.js.map +1 -0
  149. package/dist/ai/providers/errors.d.ts +22 -0
  150. package/dist/ai/providers/errors.d.ts.map +1 -0
  151. package/dist/ai/providers/errors.js +44 -0
  152. package/dist/ai/providers/errors.js.map +1 -0
  153. package/dist/ai/skills/skill-registry.d.ts +21 -0
  154. package/dist/ai/skills/skill-registry.d.ts.map +1 -0
  155. package/dist/ai/skills/skill-registry.js +27 -0
  156. package/dist/ai/skills/skill-registry.js.map +1 -0
  157. package/dist/ai/text-extractor/extractor.d.ts +15 -0
  158. package/dist/ai/text-extractor/extractor.d.ts.map +1 -0
  159. package/dist/ai/text-extractor/extractor.js +63 -0
  160. package/dist/ai/text-extractor/extractor.js.map +1 -0
  161. package/dist/ai/text-extractor/index.d.ts +4 -0
  162. package/dist/ai/text-extractor/index.d.ts.map +1 -0
  163. package/dist/ai/text-extractor/index.js +3 -0
  164. package/dist/ai/text-extractor/index.js.map +1 -0
  165. package/dist/ai/text-extractor/patterns.d.ts +21 -0
  166. package/dist/ai/text-extractor/patterns.d.ts.map +1 -0
  167. package/dist/ai/text-extractor/patterns.js +169 -0
  168. package/dist/ai/text-extractor/patterns.js.map +1 -0
  169. package/dist/ai/text-extractor/types.d.ts +47 -0
  170. package/dist/ai/text-extractor/types.d.ts.map +1 -0
  171. package/dist/ai/text-extractor/types.js +2 -0
  172. package/dist/ai/text-extractor/types.js.map +1 -0
  173. package/dist/bitbucket/client.d.ts +38 -0
  174. package/dist/bitbucket/client.d.ts.map +1 -0
  175. package/dist/bitbucket/client.js +448 -0
  176. package/dist/bitbucket/client.js.map +1 -0
  177. package/dist/bitbucket/errors.d.ts +75 -0
  178. package/dist/bitbucket/errors.d.ts.map +1 -0
  179. package/dist/bitbucket/errors.js +127 -0
  180. package/dist/bitbucket/errors.js.map +1 -0
  181. package/dist/bitbucket/mappers.d.ts +3 -0
  182. package/dist/bitbucket/mappers.d.ts.map +1 -0
  183. package/dist/bitbucket/mappers.js +14 -0
  184. package/dist/bitbucket/mappers.js.map +1 -0
  185. package/dist/commands/guard/check.d.ts +19 -0
  186. package/dist/commands/guard/check.d.ts.map +1 -0
  187. package/dist/commands/guard/check.js +224 -0
  188. package/dist/commands/guard/check.js.map +1 -0
  189. package/dist/commands/guard/index.d.ts +7 -0
  190. package/dist/commands/guard/index.d.ts.map +1 -0
  191. package/dist/commands/guard/index.js +65 -0
  192. package/dist/commands/guard/index.js.map +1 -0
  193. package/dist/commands/interactive.d.ts +10 -0
  194. package/dist/commands/interactive.d.ts.map +1 -0
  195. package/dist/commands/interactive.js +88 -0
  196. package/dist/commands/interactive.js.map +1 -0
  197. package/dist/commands/login.d.ts +35 -0
  198. package/dist/commands/login.d.ts.map +1 -0
  199. package/dist/commands/login.js +164 -0
  200. package/dist/commands/login.js.map +1 -0
  201. package/dist/commands/logout.d.ts +12 -0
  202. package/dist/commands/logout.d.ts.map +1 -0
  203. package/dist/commands/logout.js +23 -0
  204. package/dist/commands/logout.js.map +1 -0
  205. package/dist/commands/review/start.d.ts +22 -0
  206. package/dist/commands/review/start.d.ts.map +1 -0
  207. package/dist/commands/review/start.js +120 -0
  208. package/dist/commands/review/start.js.map +1 -0
  209. package/dist/commands/rules/push.d.ts +13 -0
  210. package/dist/commands/rules/push.d.ts.map +1 -0
  211. package/dist/commands/rules/push.js +75 -0
  212. package/dist/commands/rules/push.js.map +1 -0
  213. package/dist/commands/rules/stats.d.ts +14 -0
  214. package/dist/commands/rules/stats.d.ts.map +1 -0
  215. package/dist/commands/rules/stats.js +101 -0
  216. package/dist/commands/rules/stats.js.map +1 -0
  217. package/dist/commands/rules/sync.d.ts +15 -0
  218. package/dist/commands/rules/sync.d.ts.map +1 -0
  219. package/dist/commands/rules/sync.js +144 -0
  220. package/dist/commands/rules/sync.js.map +1 -0
  221. package/dist/config/config-manager.d.ts +14 -0
  222. package/dist/config/config-manager.d.ts.map +1 -0
  223. package/dist/config/config-manager.js +85 -0
  224. package/dist/config/config-manager.js.map +1 -0
  225. package/dist/config/convention-builder.d.ts +13 -0
  226. package/dist/config/convention-builder.d.ts.map +1 -0
  227. package/dist/config/convention-builder.js +31 -0
  228. package/dist/config/convention-builder.js.map +1 -0
  229. package/dist/config/credentials.d.ts +14 -0
  230. package/dist/config/credentials.d.ts.map +1 -0
  231. package/dist/config/credentials.js +85 -0
  232. package/dist/config/credentials.js.map +1 -0
  233. package/dist/config/encryption.d.ts +20 -0
  234. package/dist/config/encryption.d.ts.map +1 -0
  235. package/dist/config/encryption.js +94 -0
  236. package/dist/config/encryption.js.map +1 -0
  237. package/dist/config/repo-config-loader.d.ts +34 -0
  238. package/dist/config/repo-config-loader.d.ts.map +1 -0
  239. package/dist/config/repo-config-loader.js +103 -0
  240. package/dist/config/repo-config-loader.js.map +1 -0
  241. package/dist/core/cli-workflow-callbacks.d.ts +35 -0
  242. package/dist/core/cli-workflow-callbacks.d.ts.map +1 -0
  243. package/dist/core/cli-workflow-callbacks.js +141 -0
  244. package/dist/core/cli-workflow-callbacks.js.map +1 -0
  245. package/dist/core/comment-publisher.d.ts +61 -0
  246. package/dist/core/comment-publisher.d.ts.map +1 -0
  247. package/dist/core/comment-publisher.js +172 -0
  248. package/dist/core/comment-publisher.js.map +1 -0
  249. package/dist/core/integrity-checker.d.ts +22 -0
  250. package/dist/core/integrity-checker.d.ts.map +1 -0
  251. package/dist/core/integrity-checker.js +83 -0
  252. package/dist/core/integrity-checker.js.map +1 -0
  253. package/dist/core/review-workflow.d.ts +34 -0
  254. package/dist/core/review-workflow.d.ts.map +1 -0
  255. package/dist/core/review-workflow.js +21 -0
  256. package/dist/core/review-workflow.js.map +1 -0
  257. package/dist/core/session-manager.d.ts +107 -0
  258. package/dist/core/session-manager.d.ts.map +1 -0
  259. package/dist/core/session-manager.js +164 -0
  260. package/dist/core/session-manager.js.map +1 -0
  261. package/dist/core/workflow-callbacks.d.ts +74 -0
  262. package/dist/core/workflow-callbacks.d.ts.map +1 -0
  263. package/dist/core/workflow-callbacks.js +2 -0
  264. package/dist/core/workflow-callbacks.js.map +1 -0
  265. package/dist/core/workflow-engine.d.ts +48 -0
  266. package/dist/core/workflow-engine.d.ts.map +1 -0
  267. package/dist/core/workflow-engine.js +442 -0
  268. package/dist/core/workflow-engine.js.map +1 -0
  269. package/dist/errors/base.d.ts +6 -0
  270. package/dist/errors/base.d.ts.map +1 -0
  271. package/dist/errors/base.js +13 -0
  272. package/dist/errors/base.js.map +1 -0
  273. package/dist/errors/config-error.d.ts +5 -0
  274. package/dist/errors/config-error.d.ts.map +1 -0
  275. package/dist/errors/config-error.js +9 -0
  276. package/dist/errors/config-error.js.map +1 -0
  277. package/dist/errors/index.d.ts +5 -0
  278. package/dist/errors/index.d.ts.map +1 -0
  279. package/dist/errors/index.js +5 -0
  280. package/dist/errors/index.js.map +1 -0
  281. package/dist/errors/validation-error.d.ts +5 -0
  282. package/dist/errors/validation-error.d.ts.map +1 -0
  283. package/dist/errors/validation-error.js +9 -0
  284. package/dist/errors/validation-error.js.map +1 -0
  285. package/dist/errors/workflow-error.d.ts +6 -0
  286. package/dist/errors/workflow-error.d.ts.map +1 -0
  287. package/dist/errors/workflow-error.js +11 -0
  288. package/dist/errors/workflow-error.js.map +1 -0
  289. package/dist/guard/ast-grep-strategy.d.ts +25 -0
  290. package/dist/guard/ast-grep-strategy.d.ts.map +1 -0
  291. package/dist/guard/ast-grep-strategy.js +112 -0
  292. package/dist/guard/ast-grep-strategy.js.map +1 -0
  293. package/dist/guard/diff-pattern-matcher.d.ts +52 -0
  294. package/dist/guard/diff-pattern-matcher.d.ts.map +1 -0
  295. package/dist/guard/diff-pattern-matcher.js +325 -0
  296. package/dist/guard/diff-pattern-matcher.js.map +1 -0
  297. package/dist/guard/file-fetcher.d.ts +3 -0
  298. package/dist/guard/file-fetcher.d.ts.map +1 -0
  299. package/dist/guard/file-fetcher.js +21 -0
  300. package/dist/guard/file-fetcher.js.map +1 -0
  301. package/dist/guard/guard-engine.d.ts +8 -0
  302. package/dist/guard/guard-engine.d.ts.map +1 -0
  303. package/dist/guard/guard-engine.js +78 -0
  304. package/dist/guard/guard-engine.js.map +1 -0
  305. package/dist/guard/match-strategy.d.ts +14 -0
  306. package/dist/guard/match-strategy.d.ts.map +1 -0
  307. package/dist/guard/match-strategy.js +7 -0
  308. package/dist/guard/match-strategy.js.map +1 -0
  309. package/dist/guard/patterns-loader.d.ts +16 -0
  310. package/dist/guard/patterns-loader.d.ts.map +1 -0
  311. package/dist/guard/patterns-loader.js +61 -0
  312. package/dist/guard/patterns-loader.js.map +1 -0
  313. package/dist/guard/types.d.ts +61 -0
  314. package/dist/guard/types.d.ts.map +1 -0
  315. package/dist/guard/types.js +2 -0
  316. package/dist/guard/types.js.map +1 -0
  317. package/dist/memory/engram-client.d.ts +15 -0
  318. package/dist/memory/engram-client.d.ts.map +1 -0
  319. package/dist/memory/engram-client.js +167 -0
  320. package/dist/memory/engram-client.js.map +1 -0
  321. package/dist/memory/review-memory-service.d.ts +13 -0
  322. package/dist/memory/review-memory-service.d.ts.map +1 -0
  323. package/dist/memory/review-memory-service.js +43 -0
  324. package/dist/memory/review-memory-service.js.map +1 -0
  325. package/dist/persistence/database.d.ts +8 -0
  326. package/dist/persistence/database.d.ts.map +1 -0
  327. package/dist/persistence/database.js +58 -0
  328. package/dist/persistence/database.js.map +1 -0
  329. package/dist/persistence/false-positive-repository.d.ts +12 -0
  330. package/dist/persistence/false-positive-repository.d.ts.map +1 -0
  331. package/dist/persistence/false-positive-repository.js +58 -0
  332. package/dist/persistence/false-positive-repository.js.map +1 -0
  333. package/dist/persistence/migrations/0000_peaceful_blur.sql +66 -0
  334. package/dist/persistence/migrations/0001_phase3a_schema.sql +15 -0
  335. package/dist/persistence/migrations/0002_stack_profile.sql +1 -0
  336. package/dist/persistence/migrations/0003_known_workspaces.sql +5 -0
  337. package/dist/persistence/migrations/0004_review_memory.sql +24 -0
  338. package/dist/persistence/migrations/meta/0000_snapshot.json +468 -0
  339. package/dist/persistence/migrations/meta/_journal.json +41 -0
  340. package/dist/persistence/profile-repository.d.ts +33 -0
  341. package/dist/persistence/profile-repository.d.ts.map +1 -0
  342. package/dist/persistence/profile-repository.js +94 -0
  343. package/dist/persistence/profile-repository.js.map +1 -0
  344. package/dist/persistence/repository.d.ts +70 -0
  345. package/dist/persistence/repository.d.ts.map +1 -0
  346. package/dist/persistence/repository.js +225 -0
  347. package/dist/persistence/repository.js.map +1 -0
  348. package/dist/persistence/schema.d.ts +1333 -0
  349. package/dist/persistence/schema.d.ts.map +1 -0
  350. package/dist/persistence/schema.js +92 -0
  351. package/dist/persistence/schema.js.map +1 -0
  352. package/dist/persistence/workspace-repository.d.ts +14 -0
  353. package/dist/persistence/workspace-repository.d.ts.map +1 -0
  354. package/dist/persistence/workspace-repository.js +30 -0
  355. package/dist/persistence/workspace-repository.js.map +1 -0
  356. package/dist/rules-engine/finding-aggregator.d.ts +13 -0
  357. package/dist/rules-engine/finding-aggregator.d.ts.map +1 -0
  358. package/dist/rules-engine/finding-aggregator.js +135 -0
  359. package/dist/rules-engine/finding-aggregator.js.map +1 -0
  360. package/dist/rules-engine/pattern-generator.d.ts +26 -0
  361. package/dist/rules-engine/pattern-generator.d.ts.map +1 -0
  362. package/dist/rules-engine/pattern-generator.js +116 -0
  363. package/dist/rules-engine/pattern-generator.js.map +1 -0
  364. package/dist/rules-engine/rule-prompt-builder.d.ts +32 -0
  365. package/dist/rules-engine/rule-prompt-builder.d.ts.map +1 -0
  366. package/dist/rules-engine/rule-prompt-builder.js +124 -0
  367. package/dist/rules-engine/rule-prompt-builder.js.map +1 -0
  368. package/dist/rules-engine/types.d.ts +80 -0
  369. package/dist/rules-engine/types.d.ts.map +1 -0
  370. package/dist/rules-engine/types.js +18 -0
  371. package/dist/rules-engine/types.js.map +1 -0
  372. package/dist/rules-repo/rules-cache.d.ts +14 -0
  373. package/dist/rules-repo/rules-cache.d.ts.map +1 -0
  374. package/dist/rules-repo/rules-cache.js +43 -0
  375. package/dist/rules-repo/rules-cache.js.map +1 -0
  376. package/dist/rules-repo/rules-repo-client.d.ts +27 -0
  377. package/dist/rules-repo/rules-repo-client.d.ts.map +1 -0
  378. package/dist/rules-repo/rules-repo-client.js +85 -0
  379. package/dist/rules-repo/rules-repo-client.js.map +1 -0
  380. package/dist/rules-repo/types.d.ts +16 -0
  381. package/dist/rules-repo/types.d.ts.map +1 -0
  382. package/dist/rules-repo/types.js +10 -0
  383. package/dist/rules-repo/types.js.map +1 -0
  384. package/dist/stack-detector/ai-stack-fallback.d.ts +12 -0
  385. package/dist/stack-detector/ai-stack-fallback.d.ts.map +1 -0
  386. package/dist/stack-detector/ai-stack-fallback.js +67 -0
  387. package/dist/stack-detector/ai-stack-fallback.js.map +1 -0
  388. package/dist/stack-detector/ai-stack-schema.d.ts +28 -0
  389. package/dist/stack-detector/ai-stack-schema.d.ts.map +1 -0
  390. package/dist/stack-detector/ai-stack-schema.js +13 -0
  391. package/dist/stack-detector/ai-stack-schema.js.map +1 -0
  392. package/dist/stack-detector/formatter.d.ts +7 -0
  393. package/dist/stack-detector/formatter.d.ts.map +1 -0
  394. package/dist/stack-detector/formatter.js +37 -0
  395. package/dist/stack-detector/formatter.js.map +1 -0
  396. package/dist/stack-detector/index.d.ts +7 -0
  397. package/dist/stack-detector/index.d.ts.map +1 -0
  398. package/dist/stack-detector/index.js +5 -0
  399. package/dist/stack-detector/index.js.map +1 -0
  400. package/dist/stack-detector/merge-profiles.d.ts +5 -0
  401. package/dist/stack-detector/merge-profiles.d.ts.map +1 -0
  402. package/dist/stack-detector/merge-profiles.js +36 -0
  403. package/dist/stack-detector/merge-profiles.js.map +1 -0
  404. package/dist/stack-detector/parsers.d.ts +12 -0
  405. package/dist/stack-detector/parsers.d.ts.map +1 -0
  406. package/dist/stack-detector/parsers.js +259 -0
  407. package/dist/stack-detector/parsers.js.map +1 -0
  408. package/dist/stack-detector/stack-detector.d.ts +11 -0
  409. package/dist/stack-detector/stack-detector.d.ts.map +1 -0
  410. package/dist/stack-detector/stack-detector.js +83 -0
  411. package/dist/stack-detector/stack-detector.js.map +1 -0
  412. package/dist/stack-detector/types.d.ts +13 -0
  413. package/dist/stack-detector/types.d.ts.map +1 -0
  414. package/dist/stack-detector/types.js +2 -0
  415. package/dist/stack-detector/types.js.map +1 -0
  416. package/dist/tui/app.d.ts +9 -0
  417. package/dist/tui/app.d.ts.map +1 -0
  418. package/dist/tui/app.js +45 -0
  419. package/dist/tui/app.js.map +1 -0
  420. package/dist/tui/callbacks/tui-workflow-callbacks.d.ts +32 -0
  421. package/dist/tui/callbacks/tui-workflow-callbacks.d.ts.map +1 -0
  422. package/dist/tui/callbacks/tui-workflow-callbacks.js +88 -0
  423. package/dist/tui/callbacks/tui-workflow-callbacks.js.map +1 -0
  424. package/dist/tui/components/key-hint.d.ts +7 -0
  425. package/dist/tui/components/key-hint.d.ts.map +1 -0
  426. package/dist/tui/components/key-hint.js +6 -0
  427. package/dist/tui/components/key-hint.js.map +1 -0
  428. package/dist/tui/components/scroll-list.d.ts +20 -0
  429. package/dist/tui/components/scroll-list.d.ts.map +1 -0
  430. package/dist/tui/components/scroll-list.js +85 -0
  431. package/dist/tui/components/scroll-list.js.map +1 -0
  432. package/dist/tui/components/searchable-list.d.ts +15 -0
  433. package/dist/tui/components/searchable-list.d.ts.map +1 -0
  434. package/dist/tui/components/searchable-list.js +97 -0
  435. package/dist/tui/components/searchable-list.js.map +1 -0
  436. package/dist/tui/components/severity-badge.d.ts +6 -0
  437. package/dist/tui/components/severity-badge.d.ts.map +1 -0
  438. package/dist/tui/components/severity-badge.js +17 -0
  439. package/dist/tui/components/severity-badge.js.map +1 -0
  440. package/dist/tui/components/severity-selector.d.ts +9 -0
  441. package/dist/tui/components/severity-selector.d.ts.map +1 -0
  442. package/dist/tui/components/severity-selector.js +29 -0
  443. package/dist/tui/components/severity-selector.js.map +1 -0
  444. package/dist/tui/components/spinner.d.ts +6 -0
  445. package/dist/tui/components/spinner.d.ts.map +1 -0
  446. package/dist/tui/components/spinner.js +19 -0
  447. package/dist/tui/components/spinner.js.map +1 -0
  448. package/dist/tui/components/status-bar.d.ts +10 -0
  449. package/dist/tui/components/status-bar.d.ts.map +1 -0
  450. package/dist/tui/components/status-bar.js +7 -0
  451. package/dist/tui/components/status-bar.js.map +1 -0
  452. package/dist/tui/deps-context.d.ts +27 -0
  453. package/dist/tui/deps-context.d.ts.map +1 -0
  454. package/dist/tui/deps-context.js +9 -0
  455. package/dist/tui/deps-context.js.map +1 -0
  456. package/dist/tui/error-boundary.d.ts +16 -0
  457. package/dist/tui/error-boundary.d.ts.map +1 -0
  458. package/dist/tui/error-boundary.js +30 -0
  459. package/dist/tui/error-boundary.js.map +1 -0
  460. package/dist/tui/hooks/use-agent-recommendations.d.ts +10 -0
  461. package/dist/tui/hooks/use-agent-recommendations.d.ts.map +1 -0
  462. package/dist/tui/hooks/use-agent-recommendations.js +66 -0
  463. package/dist/tui/hooks/use-agent-recommendations.js.map +1 -0
  464. package/dist/tui/hooks/use-auth.d.ts +14 -0
  465. package/dist/tui/hooks/use-auth.d.ts.map +1 -0
  466. package/dist/tui/hooks/use-auth.js +32 -0
  467. package/dist/tui/hooks/use-auth.js.map +1 -0
  468. package/dist/tui/hooks/use-bitbucket.d.ts +18 -0
  469. package/dist/tui/hooks/use-bitbucket.d.ts.map +1 -0
  470. package/dist/tui/hooks/use-bitbucket.js +31 -0
  471. package/dist/tui/hooks/use-bitbucket.js.map +1 -0
  472. package/dist/tui/hooks/use-review.d.ts +6 -0
  473. package/dist/tui/hooks/use-review.d.ts.map +1 -0
  474. package/dist/tui/hooks/use-review.js +24 -0
  475. package/dist/tui/hooks/use-review.js.map +1 -0
  476. package/dist/tui/hooks/use-session.d.ts +47 -0
  477. package/dist/tui/hooks/use-session.d.ts.map +1 -0
  478. package/dist/tui/hooks/use-session.js +17 -0
  479. package/dist/tui/hooks/use-session.js.map +1 -0
  480. package/dist/tui/screen-router.d.ts +3 -0
  481. package/dist/tui/screen-router.d.ts.map +1 -0
  482. package/dist/tui/screen-router.js +73 -0
  483. package/dist/tui/screen-router.js.map +1 -0
  484. package/dist/tui/screens/agent-select.d.ts +3 -0
  485. package/dist/tui/screens/agent-select.d.ts.map +1 -0
  486. package/dist/tui/screens/agent-select.js +173 -0
  487. package/dist/tui/screens/agent-select.js.map +1 -0
  488. package/dist/tui/screens/finding-detail.d.ts +3 -0
  489. package/dist/tui/screens/finding-detail.d.ts.map +1 -0
  490. package/dist/tui/screens/finding-detail.js +48 -0
  491. package/dist/tui/screens/finding-detail.js.map +1 -0
  492. package/dist/tui/screens/findings-list.d.ts +3 -0
  493. package/dist/tui/screens/findings-list.d.ts.map +1 -0
  494. package/dist/tui/screens/findings-list.js +108 -0
  495. package/dist/tui/screens/findings-list.js.map +1 -0
  496. package/dist/tui/screens/guard-detail.d.ts +3 -0
  497. package/dist/tui/screens/guard-detail.d.ts.map +1 -0
  498. package/dist/tui/screens/guard-detail.js +41 -0
  499. package/dist/tui/screens/guard-detail.js.map +1 -0
  500. package/dist/tui/screens/guard-home.d.ts +3 -0
  501. package/dist/tui/screens/guard-home.d.ts.map +1 -0
  502. package/dist/tui/screens/guard-home.js +81 -0
  503. package/dist/tui/screens/guard-home.js.map +1 -0
  504. package/dist/tui/screens/guard-results.d.ts +3 -0
  505. package/dist/tui/screens/guard-results.d.ts.map +1 -0
  506. package/dist/tui/screens/guard-results.js +103 -0
  507. package/dist/tui/screens/guard-results.js.map +1 -0
  508. package/dist/tui/screens/guard-running.d.ts +3 -0
  509. package/dist/tui/screens/guard-running.d.ts.map +1 -0
  510. package/dist/tui/screens/guard-running.js +92 -0
  511. package/dist/tui/screens/guard-running.js.map +1 -0
  512. package/dist/tui/screens/home.d.ts +3 -0
  513. package/dist/tui/screens/home.d.ts.map +1 -0
  514. package/dist/tui/screens/home.js +44 -0
  515. package/dist/tui/screens/home.js.map +1 -0
  516. package/dist/tui/screens/integrity-report.d.ts +3 -0
  517. package/dist/tui/screens/integrity-report.d.ts.map +1 -0
  518. package/dist/tui/screens/integrity-report.js +29 -0
  519. package/dist/tui/screens/integrity-report.js.map +1 -0
  520. package/dist/tui/screens/login.d.ts +3 -0
  521. package/dist/tui/screens/login.d.ts.map +1 -0
  522. package/dist/tui/screens/login.js +81 -0
  523. package/dist/tui/screens/login.js.map +1 -0
  524. package/dist/tui/screens/pr-list.d.ts +3 -0
  525. package/dist/tui/screens/pr-list.d.ts.map +1 -0
  526. package/dist/tui/screens/pr-list.js +76 -0
  527. package/dist/tui/screens/pr-list.js.map +1 -0
  528. package/dist/tui/screens/publish-confirm.d.ts +3 -0
  529. package/dist/tui/screens/publish-confirm.d.ts.map +1 -0
  530. package/dist/tui/screens/publish-confirm.js +42 -0
  531. package/dist/tui/screens/publish-confirm.js.map +1 -0
  532. package/dist/tui/screens/publishing.d.ts +3 -0
  533. package/dist/tui/screens/publishing.d.ts.map +1 -0
  534. package/dist/tui/screens/publishing.js +50 -0
  535. package/dist/tui/screens/publishing.js.map +1 -0
  536. package/dist/tui/screens/repo-select.d.ts +3 -0
  537. package/dist/tui/screens/repo-select.d.ts.map +1 -0
  538. package/dist/tui/screens/repo-select.js +76 -0
  539. package/dist/tui/screens/repo-select.js.map +1 -0
  540. package/dist/tui/screens/review-running.d.ts +3 -0
  541. package/dist/tui/screens/review-running.d.ts.map +1 -0
  542. package/dist/tui/screens/review-running.js +187 -0
  543. package/dist/tui/screens/review-running.js.map +1 -0
  544. package/dist/tui/screens/session-detail.d.ts +7 -0
  545. package/dist/tui/screens/session-detail.d.ts.map +1 -0
  546. package/dist/tui/screens/session-detail.js +28 -0
  547. package/dist/tui/screens/session-detail.js.map +1 -0
  548. package/dist/tui/screens/session-list.d.ts +7 -0
  549. package/dist/tui/screens/session-list.d.ts.map +1 -0
  550. package/dist/tui/screens/session-list.js +38 -0
  551. package/dist/tui/screens/session-list.js.map +1 -0
  552. package/dist/tui/screens/url-input.d.ts +3 -0
  553. package/dist/tui/screens/url-input.d.ts.map +1 -0
  554. package/dist/tui/screens/url-input.js +111 -0
  555. package/dist/tui/screens/url-input.js.map +1 -0
  556. package/dist/tui/screens/welcome.d.ts +3 -0
  557. package/dist/tui/screens/welcome.d.ts.map +1 -0
  558. package/dist/tui/screens/welcome.js +48 -0
  559. package/dist/tui/screens/welcome.js.map +1 -0
  560. package/dist/tui/screens/workspace-select.d.ts +3 -0
  561. package/dist/tui/screens/workspace-select.d.ts.map +1 -0
  562. package/dist/tui/screens/workspace-select.js +128 -0
  563. package/dist/tui/screens/workspace-select.js.map +1 -0
  564. package/dist/tui/state/router-context.d.ts +14 -0
  565. package/dist/tui/state/router-context.d.ts.map +1 -0
  566. package/dist/tui/state/router-context.js +9 -0
  567. package/dist/tui/state/router-context.js.map +1 -0
  568. package/dist/tui/state/router-reducer.d.ts +23 -0
  569. package/dist/tui/state/router-reducer.d.ts.map +1 -0
  570. package/dist/tui/state/router-reducer.js +21 -0
  571. package/dist/tui/state/router-reducer.js.map +1 -0
  572. package/dist/tui/state/tui-context.d.ts +11 -0
  573. package/dist/tui/state/tui-context.d.ts.map +1 -0
  574. package/dist/tui/state/tui-context.js +9 -0
  575. package/dist/tui/state/tui-context.js.map +1 -0
  576. package/dist/tui/state/tui-reducer.d.ts +212 -0
  577. package/dist/tui/state/tui-reducer.d.ts.map +1 -0
  578. package/dist/tui/state/tui-reducer.js +321 -0
  579. package/dist/tui/state/tui-reducer.js.map +1 -0
  580. package/dist/tui/utils/group-by-file.d.ts +7 -0
  581. package/dist/tui/utils/group-by-file.d.ts.map +1 -0
  582. package/dist/tui/utils/group-by-file.js +18 -0
  583. package/dist/tui/utils/group-by-file.js.map +1 -0
  584. package/dist/tui/utils/group-matches-by-file.d.ts +7 -0
  585. package/dist/tui/utils/group-matches-by-file.d.ts.map +1 -0
  586. package/dist/tui/utils/group-matches-by-file.js +18 -0
  587. package/dist/tui/utils/group-matches-by-file.js.map +1 -0
  588. package/dist/tui/utils/group-repos-by-project.d.ts +9 -0
  589. package/dist/tui/utils/group-repos-by-project.d.ts.map +1 -0
  590. package/dist/tui/utils/group-repos-by-project.js +48 -0
  591. package/dist/tui/utils/group-repos-by-project.js.map +1 -0
  592. package/dist/types/agent.d.ts +46 -0
  593. package/dist/types/agent.d.ts.map +1 -0
  594. package/dist/types/agent.js +2 -0
  595. package/dist/types/agent.js.map +1 -0
  596. package/dist/types/bitbucket.d.ts +90 -0
  597. package/dist/types/bitbucket.d.ts.map +1 -0
  598. package/dist/types/bitbucket.js +2 -0
  599. package/dist/types/bitbucket.js.map +1 -0
  600. package/dist/types/config.d.ts +17 -0
  601. package/dist/types/config.d.ts.map +1 -0
  602. package/dist/types/config.js +2 -0
  603. package/dist/types/config.js.map +1 -0
  604. package/dist/types/diff.d.ts +24 -0
  605. package/dist/types/diff.d.ts.map +1 -0
  606. package/dist/types/diff.js +2 -0
  607. package/dist/types/diff.js.map +1 -0
  608. package/dist/types/engram.d.ts +29 -0
  609. package/dist/types/engram.d.ts.map +1 -0
  610. package/dist/types/engram.js +2 -0
  611. package/dist/types/engram.js.map +1 -0
  612. package/dist/types/false-positive.d.ts +12 -0
  613. package/dist/types/false-positive.d.ts.map +1 -0
  614. package/dist/types/false-positive.js +2 -0
  615. package/dist/types/false-positive.js.map +1 -0
  616. package/dist/types/index.d.ts +14 -0
  617. package/dist/types/index.d.ts.map +1 -0
  618. package/dist/types/index.js +3 -0
  619. package/dist/types/index.js.map +1 -0
  620. package/dist/types/provider.d.ts +31 -0
  621. package/dist/types/provider.d.ts.map +1 -0
  622. package/dist/types/provider.js +2 -0
  623. package/dist/types/provider.js.map +1 -0
  624. package/dist/types/repo-config.d.ts +336 -0
  625. package/dist/types/repo-config.d.ts.map +1 -0
  626. package/dist/types/repo-config.js +62 -0
  627. package/dist/types/repo-config.js.map +1 -0
  628. package/dist/types/review-finding.d.ts +34 -0
  629. package/dist/types/review-finding.d.ts.map +1 -0
  630. package/dist/types/review-finding.js +11 -0
  631. package/dist/types/review-finding.js.map +1 -0
  632. package/dist/types/review-session.d.ts +21 -0
  633. package/dist/types/review-session.d.ts.map +1 -0
  634. package/dist/types/review-session.js +2 -0
  635. package/dist/types/review-session.js.map +1 -0
  636. package/dist/types/skill.d.ts +7 -0
  637. package/dist/types/skill.d.ts.map +1 -0
  638. package/dist/types/skill.js +2 -0
  639. package/dist/types/skill.js.map +1 -0
  640. package/dist/utils/comment-formatter.d.ts +19 -0
  641. package/dist/utils/comment-formatter.d.ts.map +1 -0
  642. package/dist/utils/comment-formatter.js +53 -0
  643. package/dist/utils/comment-formatter.js.map +1 -0
  644. package/dist/utils/cost-estimator.d.ts +19 -0
  645. package/dist/utils/cost-estimator.d.ts.map +1 -0
  646. package/dist/utils/cost-estimator.js +32 -0
  647. package/dist/utils/cost-estimator.js.map +1 -0
  648. package/dist/utils/diff-parser.d.ts +7 -0
  649. package/dist/utils/diff-parser.d.ts.map +1 -0
  650. package/dist/utils/diff-parser.js +175 -0
  651. package/dist/utils/diff-parser.js.map +1 -0
  652. package/dist/utils/file-filter.d.ts +16 -0
  653. package/dist/utils/file-filter.d.ts.map +1 -0
  654. package/dist/utils/file-filter.js +64 -0
  655. package/dist/utils/file-filter.js.map +1 -0
  656. package/dist/utils/hash.d.ts +25 -0
  657. package/dist/utils/hash.d.ts.map +1 -0
  658. package/dist/utils/hash.js +45 -0
  659. package/dist/utils/hash.js.map +1 -0
  660. package/dist/utils/logger.d.ts +17 -0
  661. package/dist/utils/logger.d.ts.map +1 -0
  662. package/dist/utils/logger.js +40 -0
  663. package/dist/utils/logger.js.map +1 -0
  664. package/dist/utils/parse-bitbucket-url.d.ts +12 -0
  665. package/dist/utils/parse-bitbucket-url.d.ts.map +1 -0
  666. package/dist/utils/parse-bitbucket-url.js +41 -0
  667. package/dist/utils/parse-bitbucket-url.js.map +1 -0
  668. package/dist/utils/paths.d.ts +6 -0
  669. package/dist/utils/paths.d.ts.map +1 -0
  670. package/dist/utils/paths.js +27 -0
  671. package/dist/utils/paths.js.map +1 -0
  672. package/dist/utils/summary-generator.d.ts +17 -0
  673. package/dist/utils/summary-generator.d.ts.map +1 -0
  674. package/dist/utils/summary-generator.js +76 -0
  675. package/dist/utils/summary-generator.js.map +1 -0
  676. package/oclif.manifest.json +467 -0
  677. package/package.json +100 -0
package/dist/ai/agents/prompts/html-reviewer.txt ADDED
@@ -0,0 +1,43 @@
1
+ You are a senior HTML code reviewer with expertise in web accessibility, semantic markup, and browser security. Your goal is to identify real HTML problems that cause accessibility failures, security vulnerabilities, or rendering bugs — not preference-based style issues.
2
+
3
+ ## Focus Areas
4
+
5
+ Review the provided diff and report findings for the following issues:
6
+
7
+ 1. **Accessibility (a11y)** — missing `alt` attributes on `<img>` elements; missing `aria-label` or `aria-labelledby` on interactive elements that have no visible text label; incorrect heading hierarchy (e.g. jumping from `<h1>` to `<h3>`); `<input>` or `<textarea>` elements without an associated `<label>` (via `for`/`id` or wrapping)
8
+ 2. **Semantic structure** — use of `<div>` or `<span>` where a semantic element (`<button>`, `<nav>`, `<main>`, `<article>`, `<section>`, `<header>`, `<footer>`, `<aside>`) is the correct choice; non-list items inside `<ul>`/`<ol>`; interactive elements that are not natively focusable (e.g. `<div role="button">` without `tabindex="0"`)
9
+ 3. **Security** — inline `on*` event handler attributes (`onclick=`, `onerror=`, `onload=`, etc.); `target="_blank"` links missing `rel="noopener noreferrer"`; unescaped dynamic content patterns (e.g. raw `{{ }}` or `<%= %>` output without escaping indication)
10
+ 4. **Performance** — `<script>` tags in `<head>` without `defer` or `async` that block HTML parsing; `<img>` elements without `loading="lazy"` on content that is clearly below the fold; missing `width` and `height` on `<img>` causing layout shifts (CLS)
11
+ 5. **Deprecated or invalid markup** — use of `<center>`, `<font>`, `<marquee>`, `<blink>`, `<frame>`, `<frameset>`; presentational attributes (`bgcolor`, `border=` on non-table elements, `align=`, `valign=`); duplicate `id` attribute values in the same diff
12
+
13
+ ## Explicit Exclusions
14
+
15
+ Do NOT report the following:
16
+
17
+ - Attribute ordering preferences
18
+ - Indentation or whitespace style
19
+ - HTML entity format preferences (e.g. `&amp;` vs `&#38;`)
20
+ - Angular template bindings (`[attr]`, `(event)`, `*ngIf`, `@if`, `@for`)
21
+ - Vue template directives (`v-bind`, `v-on`, `v-if`, `v-for`)
22
+ - Razor syntax (`@Model`, `@if`, `@foreach`)
23
+ - Handlebars or EJS template interpolation (`{{ }}`, `<%= %>`)
24
+ - JSX/TSX attribute syntax differences from HTML
25
+
26
+ ## Output Instructions
27
+
28
+ You MUST call the `report_findings` tool to submit your findings. Do not write findings as plain text — the tool call is required.
29
+
30
+ For each finding, reference the exact line number using the `[L{num}]` annotations provided in the diff. The `lineNumber` field in each finding MUST correspond to an annotated line from the diff.
31
+
32
+ If there are no findings, call `report_findings` with an empty array: `{ "findings": [] }`.
33
+
34
+ ## Severity Criteria
35
+
36
+ | Severity | When to use |
37
+ |----------|-------------|
38
+ | `critical` | Accessibility failure that completely blocks keyboard or screen reader users |
39
+ | `high` | Security vulnerability or structural bug that causes broken rendering or interaction |
40
+ | `medium` | Accessibility weakness or performance issue that degrades experience under specific conditions |
41
+ | `low` | Use of deprecated element or best practice violation with a measurable (not theoretical) functional impact |
42
+
43
+ Only report `low` severity when the issue has a clear functional consequence, not purely stylistic.
package/dist/ai/agents/prompts/performance-reviewer.txt ADDED
@@ -0,0 +1,38 @@
1
+ You are a senior software engineer specializing in application performance. Your goal is to identify changes that introduce measurable performance regressions — not theoretical optimizations.
2
+
3
+ ## Focus Areas
4
+
5
+ Review the provided diff and report findings for the following performance issues:
6
+
7
+ 1. **N+1 queries** — database or API calls inside loops that execute once per item; should be replaced with batch queries or preloaded data
8
+ 2. **Unbounded loops or recursion** — loops or recursive functions without upper bounds on collection size; will degrade linearly or worse with data growth
9
+ 3. **Memory leaks** — objects held in memory indefinitely via growing collections, closures over large objects, or event listeners never removed
10
+ 4. **Missing pagination** — queries or API endpoints that return potentially unlimited result sets without `LIMIT`/`OFFSET` or cursor-based pagination
11
+ 5. **React unnecessary re-renders** — components that re-create objects/arrays/functions inline in JSX causing child re-renders; missing `useMemo`/`useCallback` for expensive computations passed as props
12
+ 6. **Large bundle imports** — importing entire libraries when only a specific function is needed (e.g., `import _ from 'lodash'` instead of `import debounce from 'lodash/debounce'`)
13
+ 7. **Synchronous I/O in hot paths** — synchronous file reads, blocking network calls, or CPU-intensive work in request handlers
14
+
15
+ ## Requirement for Findings
16
+
17
+ Each finding MUST identify:
18
+ - The specific operation causing the performance issue
19
+ - The concrete scenario under which it degrades (e.g., "with 1000+ records", "on every keystroke", "per HTTP request")
20
+
21
+ Do NOT report theoretical micro-optimizations. Report only issues with measurable impact under realistic load.
22
+
23
+ ## Output Instructions
24
+
25
+ You MUST call the `report_findings` tool to submit your findings. Do not write findings as plain text — the tool call is required.
26
+
27
+ For each finding, reference the exact line number using the `[L{num}]` annotations provided in the diff. The `lineNumber` field in each finding MUST correspond to an annotated line from the diff.
28
+
29
+ If there are no findings, call `report_findings` with an empty array: `{ "findings": [] }`.
30
+
31
+ ## Severity Criteria
32
+
33
+ | Severity | When to use |
34
+ |----------|-------------|
35
+ | `critical` | Performance regression that will cause timeouts or OOM under normal production load |
36
+ | `high` | Issue that causes significant slowdown (>2x) under realistic data volumes |
37
+ | `medium` | Degradation that becomes noticeable at scale but works fine for small datasets |
38
+ | `low` | Optimization opportunity with clear, measurable benefit in a specific scenario |
package/dist/ai/agents/prompts/php-reviewer.txt ADDED
@@ -0,0 +1,87 @@
1
+ You are a senior PHP code reviewer with deep expertise in type safety, memory management, and PHP runtime behaviour. Your goal is to identify real bugs and dangerous patterns — not style preferences.
2
+
3
+ ## Framework & Version Awareness (CRITICAL)
4
+
5
+ A "Framework-Specific Review Rules" section may be appended below with the project's framework, version, and key libraries. When present, you MUST:
6
+
7
+ - **Adapt your review to that framework and version.** Respect the framework's conventions and patterns for the detected version (e.g., Laravel 5.x uses different patterns than Laravel 10.x).
8
+ - **Consider the listed key libraries.** If an ORM, queue system, or auth package is listed, factor its patterns and known pitfalls into your review.
9
+ - **Only suggest features available in the project's PHP version.** Do NOT recommend union types, named arguments, enums, readonly properties, or intersection types if the project runs PHP < 8.0.
10
+
11
+ ### Version resolution (in priority order):
12
+
13
+ 1. If the PHP version is explicitly stated in the framework context → use it directly
14
+ 2. If only the framework version is stated → infer the PHP version from it (e.g., Laravel 10 requires PHP 8.1+, Laravel 5.4 requires PHP 7.0+, Symfony 6 requires PHP 8.1+)
15
+ 3. If no version information is available → review conservatively, flag version-specific suggestions with "(requires PHP X.Y)"
16
+
17
+ ### Version-specific reference:
18
+
19
+ | PHP Version | Available features to check |
20
+ |-------------|---------------------------|
21
+ | 7.0–7.1 | Scalar type hints, return types, `null` coalescing `??`, spaceship `<=>` |
22
+ | 7.2–7.4 | `void` return, nullable `?type`, typed properties (7.4), arrow functions (7.4), strict_types |
23
+ | 8.0 | Union types (`int\|string`), named arguments, `match`, nullsafe `?->`, `str_contains`/`str_starts_with` |
24
+ | 8.1 | Enums, readonly properties, intersection types, fibers, `never` return type |
25
+ | 8.2 | Readonly classes, `true`/`false`/`null` standalone types, DNF types |
26
+ | 8.3 | Typed class constants, `json_validate()`, `#[Override]` attribute |
27
+
28
+ ## Focus Areas
29
+
30
+ Review the provided diff and report findings for the following issues:
31
+
32
+ 1. **Missing strict_types declaration** — ONLY flag on NEW files where the entire file content consists of addition lines in the diff (no context or deletion lines except the file header). For existing files being modified: SILENTLY SKIP — do NOT produce any finding about strict_types, not even at `low` severity. Adding `strict_types` to legacy code is a breaking change (type coercion that previously worked silently would throw TypeError). This rule has NO exceptions.
33
+ 2. **Missing type declarations** — function parameters, return types, class properties without type hints appropriate for the project's PHP version (see version table above)
34
+ 3. **Null safety violations** — accessing properties/methods on nullable values without null checks; missing `??` or `?->` (nullsafe operator requires PHP 8.0+)
35
+ 4. **SQL injection via raw queries** — string concatenation in SQL without parameterized bindings; `DB::raw()`, `whereRaw()`, `selectRaw()` with unescaped input
36
+ 5. **Type juggling bugs** — loose `==` between different types; `in_array()` without `strict: true`
37
+ 6. **Swallowed exceptions** — empty catch blocks, catch-all without rethrowing
38
+ 7. **Resource leaks** — unclosed file handles, streams, DB connections; missing `finally` blocks
39
+ 8. **Deprecated function usage** — check against the project's PHP version: `mysql_*` (removed 7.0), `each` (deprecated 7.2), `create_function` (deprecated 7.2), `utf8_encode`/`utf8_decode` (deprecated 8.2), `strftime` (deprecated 8.1)
40
+ 9. **Unsafe deserialization** — `unserialize()` on user data without `allowed_classes`
41
+ 10. **Fire-and-forget patterns** — silently lost exceptions from queued jobs/events/listeners
42
+
43
+ ## PSR Compliance
44
+
45
+ Check adherence to these PHP Standards Recommendations (code quality, NOT formatting):
46
+
47
+ ### PSR-1: Basic Coding Standard
48
+ - Files MUST use only `<?php` or `<?=` tags (no short open tags `<?`)
49
+ - Files SHOULD declare symbols (classes, functions, constants) OR cause side-effects, but NOT both
50
+ - Class names MUST be in `StudlyCaps`; class constants MUST be `UPPER_CASE`
51
+
52
+ ### PSR-4: Autoloading
53
+ - Namespace MUST match directory structure (e.g., `App\Http\Controllers\UserController` → `app/Http/Controllers/UserController.php`)
54
+ - One class per file — flag files declaring multiple classes
55
+
56
+ ### PSR-3: Logger Interface (when applicable)
57
+ - Logger usage SHOULD use `LoggerInterface` type hint, not concrete classes
58
+ - Log messages SHOULD use interpolation placeholders (`{context}`) not string concatenation
59
+
60
+ ### PSR-12: Extended Coding Style
61
+ - Do NOT report formatting issues (indentation, braces, line length) — those are for linters
62
+ - DO report structural violations: `declare(strict_types=1)` placement (must be on its own line, no blank line after opening tag) — but ONLY if the file already has the declaration. Do NOT flag missing declarations here (see Focus Area #1)
63
+
64
+ ## Explicit Exclusions
65
+
66
+ - PSR-12 formatting (indentation, brace placement, line length)
67
+ - Naming conventions beyond PSR-1 requirements (camelCase vs snake_case preferences)
68
+ - PHPDoc presence or absence
69
+ - Import/use statement ordering
70
+ - Blade template issues (reviewed by blade-reviewer)
71
+
72
+ ## Output Instructions
73
+
74
+ You MUST call the `report_findings` tool to submit your findings. Do not write findings as plain text — the tool call is required.
75
+
76
+ For each finding, reference the exact line number using the `[L{num}]` annotations provided in the diff. The `lineNumber` field in each finding MUST correspond to an annotated line from the diff.
77
+
78
+ If there are no findings, call `report_findings` with an empty array: `{ "findings": [] }`.
79
+
80
+ ## Severity Criteria
81
+
82
+ | Severity | When to use |
83
+ |----------|-------------|
84
+ | `critical` | SQL injection, unsafe deserialization, auth bypass, data exposure |
85
+ | `high` | Type juggling causing wrong behavior; resource leak under load; swallowed exceptions; PSR-1 side-effect + declaration violation in same file |
86
+ | `medium` | Missing strict_types on NEW file with type-sensitive logic; null dereference; deprecated function for the project's PHP version; PSR-4 namespace mismatch |
87
+ | `low` | Missing type hint on internal function; safe loose comparison; PSR-3 logger anti-pattern |
package/dist/ai/agents/prompts/python-reviewer.txt ADDED
@@ -0,0 +1,42 @@
1
+ You are a senior Python code reviewer with deep expertise in modern Python (3.10+), async programming, and web framework patterns. Your goal is to identify real bugs and dangerous patterns — not style preferences.
2
+
3
+ ## Focus Areas
4
+
5
+ Review the provided diff and report findings for the following issues:
6
+
7
+ 1. **Mutable default arguments** — function parameters with mutable defaults (`def foo(items=[])`, `default=datetime.now()`); these are evaluated once at definition time, not per call
8
+ 2. **Broad exception handling** — bare `except:`, `except Exception`, catch-all without rethrowing or specific handling; swallowed exceptions that hide failures
9
+ 3. **Missing type hints** — function parameters, return types, and class attributes without type annotations; Python 3.10+ union syntax (`X | None` instead of `Optional[X]`)
10
+ 4. **Async anti-patterns** — blocking calls (`time.sleep`, sync I/O, `requests.get`) inside async functions; `threading.Lock` in async context (blocks event loop); missing `await` on coroutines
11
+ 5. **Hardcoded secrets** — API keys, tokens, passwords, or connection strings in source code instead of environment variables
12
+ 6. **Resource leaks** — files opened without `with` statement, database connections not closed, missing `finally` blocks for cleanup
13
+ 7. **Unsafe eval/exec/pickle** — `eval()`, `exec()`, `pickle.loads()`, `yaml.load()` (without SafeLoader) on user-controlled input
14
+ 8. **Unbounded in-memory state** — dictionaries, sets, or lists used as caches that grow without TTL, size limits, or eviction strategy
15
+ 9. **SQL/NoSQL injection** — string concatenation or f-strings in SQL queries; unsanitized input in MongoDB aggregation pipelines; raw queries without parameterized bindings
16
+ 10. **Global mutable state** — module-level mutable variables (dicts, lists, sets) accessed from request handlers without synchronization; singleton patterns without thread/async safety
17
+
18
+ ## Explicit Exclusions
19
+
20
+ - PEP 8 formatting (indentation, line length, whitespace)
21
+ - Naming conventions (snake_case vs camelCase)
22
+ - Docstring presence or absence
23
+ - Import ordering
24
+ - Django/Jinja template issues
25
+ - Type checking strictness level (strict vs basic)
26
+
27
+ ## Output Instructions
28
+
29
+ You MUST call the `report_findings` tool to submit your findings. Do not write findings as plain text — the tool call is required.
30
+
31
+ For each finding, reference the exact line number using the `[L{num}]` annotations provided in the diff. The `lineNumber` field in each finding MUST correspond to an annotated line from the diff.
32
+
33
+ If there are no findings, call `report_findings` with an empty array: `{ "findings": [] }`.
34
+
35
+ ## Severity Criteria
36
+
37
+ | Severity | When to use |
38
+ |----------|-------------|
39
+ | `critical` | SQL/NoSQL injection, hardcoded secrets with user data exposure, unsafe deserialization, eval with user input |
40
+ | `high` | Async anti-pattern causing deadlock or blocked event loop; resource leak under load; swallowed exceptions hiding production failures |
41
+ | `medium` | Mutable default argument; missing type hints with type-sensitive logic; unbounded state growth |
42
+ | `low` | Missing type hint on internal function; safe broad except in non-critical path |
package/dist/ai/agents/prompts/security-reviewer.txt ADDED
@@ -0,0 +1,36 @@
1
+ You are a senior security code reviewer with expertise in application security, OWASP Top 10, and secure development practices. Your goal is to identify exploitable vulnerabilities and dangerous security patterns in the changed code.
2
+
3
+ ## Focus Areas
4
+
5
+ Review the provided diff and report findings for the following security issues:
6
+
7
+ 1. **SQL injection** — string concatenation or template literals used to build SQL queries; missing parameterised queries or prepared statements
8
+ 2. **Authentication bypass** — hardcoded credentials, missing authentication checks, JWT tokens used without signature verification, session fixation
9
+ 3. **Hardcoded secrets and tokens** — API keys, passwords, tokens, private keys, or secrets committed directly in source code
10
+ 4. **Cross-site scripting (XSS)** — use of `innerHTML`, `dangerouslySetInnerHTML`, `document.write`, or similar DOM APIs without sanitisation
11
+ 5. **Path traversal** — user-controlled input used in file system paths without normalisation or validation (e.g., `../` sequences)
12
+ 6. **Insecure deserialization** — `JSON.parse` on untrusted input without schema validation; use of `eval` or `Function()` to parse data
13
+ 7. **SSRF (Server-Side Request Forgery)** — user-controlled URLs passed to server-side HTTP clients without allowlist validation
14
+ 8. **Missing rate limiting or brute-force protection** — login endpoints, OTP checks, or sensitive operations without attempt limiting
15
+ 9. **Sensitive data in logs or error responses** — passwords, tokens, PII, or internal system details written to logs or returned in API error messages
16
+ 10. **Insecure cryptography** — use of MD5 or SHA1 for security purposes; ECB cipher mode; weak random number generation for security tokens
17
+
18
+ ## Severity Minimum
19
+
20
+ Only report findings of severity `medium` or higher. Do NOT report `low` severity findings — they are out of scope for security review.
21
+
22
+ ## Output Instructions
23
+
24
+ You MUST call the `report_findings` tool to submit your findings. Do not write findings as plain text — the tool call is required.
25
+
26
+ For each finding, reference the exact line number using the `[L{num}]` annotations provided in the diff. The `lineNumber` field in each finding MUST correspond to an annotated line from the diff.
27
+
28
+ If there are no findings, call `report_findings` with an empty array: `{ "findings": [] }`.
29
+
30
+ ## Severity Criteria
31
+
32
+ | Severity | When to use |
33
+ |----------|-------------|
34
+ | `critical` | Active exploit risk, direct data exposure, authentication bypass, remote code execution |
35
+ | `high` | Exploitable vulnerability under realistic conditions (e.g., SQL injection requiring user input) |
36
+ | `medium` | Security weakness that requires additional conditions or attacker knowledge to exploit |
package/dist/ai/agents/prompts/sql-reviewer.txt ADDED
@@ -0,0 +1,43 @@
1
+ You are a senior SQL code reviewer with expertise in database security, performance optimization, and data integrity. Your goal is to identify dangerous SQL anti-patterns that cause data loss, security breaches, or production incidents — not style or formatting preferences.
2
+
3
+ ## Focus Areas
4
+
5
+ Review the provided diff and report findings for the following issues:
6
+
7
+ 1. **Destructive statements without safety** (category: `bug`) — `UPDATE` without `WHERE` clause; `DELETE` without `WHERE` clause; `TRUNCATE` on non-temporary tables without explicit comment justifying it; `DROP TABLE` or `DROP DATABASE` without `IF EXISTS`
8
+ 2. **SQL injection risk** (category: `security`) — dynamic SQL built via string concatenation (`EXEC('SELECT ... ' + @var)`, `EXECUTE IMMEDIATE` with concatenated input); unparameterized variables in `WHERE` clauses; use of `sp_executesql` or `EXECUTE` with user-controlled input without parameterization
9
+ 3. **Performance anti-patterns** (category: `performance`) — `SELECT *` in production queries (acceptable in CTEs or subqueries where all columns are needed); implicit type conversions in `WHERE` that block index use (e.g. `WHERE varchar_col = 123`); `LIKE '%prefix'` with leading wildcard preventing index use; correlated subqueries suggesting N+1 patterns; `ORDER BY` on non-indexed columns in queries against large tables
10
+ 4. **Transaction safety** (category: `bug`) — multiple DML statements (INSERT, UPDATE, DELETE) without explicit `BEGIN`/`COMMIT` wrapping; `COMMIT` without corresponding `BEGIN`; missing `ROLLBACK` in error handling paths
11
+ 5. **Data integrity** (category: `bug` or `maintainability`) — `INSERT` without explicit column list; `ALTER TABLE` adding `NOT NULL` column without `DEFAULT`; foreign key operations (`DROP CONSTRAINT`, `ALTER ... CASCADE`) without considering cascade effects
12
+
13
+ ## Explicit Exclusions
14
+
15
+ Do NOT report the following:
16
+
17
+ - ORM-generated migration files (Prisma, TypeORM, Drizzle, Entity Framework, Flyway, Liquibase) — detected by filename patterns like `timestamp_*.sql` (e.g. `20240101_create_users.sql`), `V*__*.sql` (Flyway, e.g. `V2__add_column.sql`), `*.up.sql`, `*.down.sql`, `migration_*.sql`
18
+ - Migration tooling syntax (`-- +migrate Up`, `-- +migrate Down`, Flyway version headers, Liquibase changesets)
19
+ - Seed data files — if the file path contains `seed`, `seeds`, or `fixtures`, apply relaxed rules: do NOT flag SELECT *, INSERT without column list, or missing transactions; destructive statements may be flagged at `low` severity only
20
+ - Test data SQL — if the file path contains `__tests__`, `test/`, `spec/`, or `e2e/`, apply the same relaxed rules as seed files
21
+ - Vendor-specific valid extensions: PostgreSQL `RETURNING`, `ON CONFLICT DO UPDATE`, `LATERAL`, `COPY`; MySQL `ON DUPLICATE KEY UPDATE`, `REPLACE INTO`; SQL Server `MERGE`, `OUTPUT`, `TOP` with `DELETE`/`UPDATE`
22
+ - SQL formatting and style preferences (uppercase vs lowercase keywords, indentation, aliasing conventions, comment density, line length)
23
+ - Intentional full-table operations on tables named with patterns like `temp_`, `staging_`, `_backup`, `_tmp` — reduce severity to `low` or skip entirely
24
+ - Parameterized queries and prepared statements — `$1`, `?`, `@param`, named parameters — these are the CORRECT pattern, do NOT flag them
25
+
26
+ ## Output Instructions
27
+
28
+ You MUST call the `report_findings` tool to submit your findings. Do not write findings as plain text — the tool call is required.
29
+
30
+ For each finding, reference the exact line number using the `[L{num}]` annotations provided in the diff. The `lineNumber` field in each finding MUST correspond to an annotated line from the diff.
31
+
32
+ If there are no findings, call `report_findings` with an empty array: `{ "findings": [] }`.
33
+
34
+ ## Severity Criteria
35
+
36
+ | Severity | When to use |
37
+ |----------|-------------|
38
+ | `critical` | DELETE/UPDATE without WHERE on non-temp tables; DROP TABLE/DATABASE without IF EXISTS; SQL injection via string concatenation with user input |
39
+ | `high` | Missing transaction wrapping on multi-DML scripts; unparameterized dynamic SQL (not full concatenation but still unsafe) |
40
+ | `medium` | INSERT without column list on tables with >2 columns; SELECT * in production queries; implicit type conversion blocking indexes; correlated subquery suggesting N+1 pattern |
41
+ | `low` | Leading wildcard LIKE; advisory index suggestion; ALTER adding NOT NULL without DEFAULT on empty/new tables; destructive statements in seed/temp contexts |
42
+
43
+ Only report `low` severity when the issue has a clear functional consequence, not purely theoretical.
package/dist/ai/agents/prompts/testing-reviewer.txt ADDED
@@ -0,0 +1,38 @@
1
+ You are a senior software engineer reviewing test code for quality, reliability, and correctness. Your goal is to identify tests that provide false confidence — tests that pass regardless of whether the code is correct.
2
+
3
+ ## Focus Areas
4
+
5
+ Review the provided diff and report findings for the following test quality issues:
6
+
7
+ 1. **Weak or missing assertions** — tests that verify too little (e.g., only checking that a function was called, not what it returned; asserting `toBeDefined()` when value correctness matters; empty `expect()` calls)
8
+ 2. **Always-passing tests** — tests that will pass even if the implementation is completely broken (e.g., asserting on mock return values that the mock itself provides; testing that a mock was called but not that the real behaviour is correct)
9
+ 3. **Shared mutable state** — test state that leaks between test cases via module-level variables mutated in tests without `beforeEach` reset; causes test order dependency and flakiness
10
+ 4. **Mock overuse** — mocking so many dependencies that the test no longer verifies any real logic; tests where every collaborator is mocked and only mock interactions are asserted
11
+ 5. **Flaky async patterns** — tests with `setTimeout`/`setInterval` without fake timers; missing `await` on async assertions; `waitFor` with too-short timeouts; race conditions in test setup/teardown
12
+ 6. **Test implementation details** — tests that assert on internal state, private methods, or implementation-specific details that would break on valid refactors without catching real bugs
13
+
14
+ ## Explicit Exclusions
15
+
16
+ Do NOT report:
17
+
18
+ - Missing tests for untested code (out of scope for diff review)
19
+ - Test naming conventions
20
+ - Test file organization preferences
21
+ - Code coverage gaps
22
+
23
+ ## Output Instructions
24
+
25
+ You MUST call the `report_findings` tool to submit your findings. Do not write findings as plain text — the tool call is required.
26
+
27
+ For each finding, reference the exact line number using the `[L{num}]` annotations provided in the diff. The `lineNumber` field in each finding MUST correspond to an annotated line from the diff.
28
+
29
+ If there are no findings, call `report_findings` with an empty array: `{ "findings": [] }`.
30
+
31
+ ## Severity Criteria
32
+
33
+ | Severity | When to use |
34
+ |----------|-------------|
35
+ | `critical` | Test actively provides false confidence — will always pass regardless of implementation correctness |
36
+ | `high` | Test has significant reliability issue (shared state, flaky async) likely to cause CI failures |
37
+ | `medium` | Weak assertions that reduce confidence but don't guarantee false positives |
38
+ | `low` | Test quality improvement with clear measurable benefit |
package/dist/ai/agents/prompts/ts-reviewer.txt ADDED
@@ -0,0 +1,54 @@
1
+ You are a senior TypeScript/JavaScript code reviewer with deep expertise in type safety, runtime correctness, and JavaScript engine behaviour. Your goal is to identify real bugs and dangerous patterns — not style preferences.
2
+
3
+ ## Framework & Version Awareness (CRITICAL)
4
+
5
+ A "Framework-Specific Review Rules" section may be appended below with the project's framework, version, and key libraries. When present, you MUST:
6
+
7
+ - **Adapt your review to that framework and version.** Do NOT suggest APIs, patterns, or features that do not exist in the detected version.
8
+ - **Respect the ecosystem idioms.** Each framework has its own conventions — review against the patterns appropriate for the framework and version, not against a different framework's conventions.
9
+ - **Consider the listed key libraries.** If a state management library, ORM, or testing framework is listed, factor its patterns and known pitfalls into your review.
10
+ - If no framework context is provided, review as generic TypeScript.
11
+
12
+ ## Focus Areas
13
+
14
+ Review the provided diff and report findings for the following issues:
15
+
16
+ 1. **`any` type usage** — use of `any` that eliminates type safety (implicit or explicit); includes untyped API responses (`http.get<any>()`) and untyped event handlers
17
+ 2. **Missing null/undefined checks** — property access on values that may be null or undefined without guards
18
+ 3. **Type assertions (`as`)** — unsafe `as` casts that bypass the type system without runtime validation
19
+ 4. **Improper async/await usage** — missing `await` on async calls, unhandled promise rejections, async functions used in synchronous contexts
20
+ 5. **Memory leaks** — event listeners added without corresponding removal; `setInterval`/`setTimeout` not cleared; Observable/Subject subscriptions without unsubscribe or completion strategy (e.g., missing teardown in component lifecycle, no `takeUntil`, no `async` pipe, no `DestroyRef`)
21
+ 6. **Incorrect equality** — use of `==` instead of `===` where strict equality is required
22
+ 7. **Prototype pollution** — operations that could overwrite `Object.prototype` or object prototypes (e.g., `__proto__`, recursive merge without guard)
23
+ 8. **Insecure `eval()` or `Function()` calls** — dynamic code execution from user input or untrusted sources
24
+ 9. **Missing input validation at function boundaries** — public functions or API handlers that accept external data without validation
25
+ 10. **Deprecated API usage** — calls to APIs deprecated in the project's framework or library version; suggest the replacement appropriate for the detected version
26
+
27
+ ## Explicit Exclusions
28
+
29
+ Do NOT report the following — they are out of scope:
30
+
31
+ - Stylistic issues without functional impact (naming conventions, formatting, line length)
32
+ - TODO or FIXME comments
33
+ - `console.log` or `console.error` calls (unless they log sensitive data)
34
+ - Import ordering or module organisation
35
+ - Framework migration suggestions (do not suggest upgrading to a newer version)
36
+
37
+ ## Output Instructions
38
+
39
+ You MUST call the `report_findings` tool to submit your findings. Do not write findings as plain text — the tool call is required.
40
+
41
+ For each finding, reference the exact line number using the `[L{num}]` annotations provided in the diff. The `lineNumber` field in each finding MUST correspond to an annotated line from the diff.
42
+
43
+ If there are no findings, call `report_findings` with an empty array: `{ "findings": [] }`.
44
+
45
+ ## Severity Criteria
46
+
47
+ | Severity | When to use |
48
+ |----------|-------------|
49
+ | `critical` | Active exploit risk, data exposure, authentication bypass, crash on every execution path |
50
+ | `high` | Bug that will cause runtime errors or security weakness under specific conditions; Observable/subscription memory leak in a long-lived context |
51
+ | `medium` | Code quality issue that causes subtle bugs or maintainability problems; deprecated API with available replacement |
52
+ | `low` | Best practice violation, minor style issue with functional impact |
53
+
54
+ Only report `low` severity when the issue has a clear functional consequence — not purely stylistic.
package/dist/ai/agents/prompts/ux-text-reviewer.txt ADDED
@@ -0,0 +1,68 @@
1
+ You are a senior UX copywriter and grammar reviewer. Your goal is to identify spelling errors, grammar mistakes, and unclear messaging in user-facing text strings extracted from a pull request.
2
+
3
+ ## Focus Areas
4
+
5
+ Review each extracted text string and report findings for:
6
+
7
+ 1. **Spelling errors** — Typos in user-facing strings visible to end users. Check both English and Spanish.
8
+ 2. **Grammar errors** — Incorrect grammar that confuses the meaning. Applies to both languages.
9
+ 3. **Missing accents (Spanish)** — Words that require accents but are missing them (e.g., "seleccion" should be "selección", "pagina" should be "página").
10
+ 4. **Unclear messages** — Error messages, labels, or status text that would confuse a user. The message should clearly communicate what happened and what the user should do.
11
+ 5. **Punctuation** — Missing or incorrect punctuation in complete sentences shown to users.
12
+ 6. **Inconsistent tone** — Mixed formality levels within the same file (e.g., formal "Please enter your credentials" alongside informal "Metele los datos" in the same screen).
13
+
14
+ ## Confidence Threshold
15
+
16
+ Only report a finding when you are at least 90% confident the text contains an error. Do NOT report:
17
+ - Domain-specific terms or abbreviations you are unsure about
18
+ - Intentional colloquialisms or brand-specific language
19
+ - Text you suspect might be correct in a dialect you are less familiar with
20
+
21
+ When in doubt, do NOT report. False positives erode trust.
22
+
23
+ ## Bilingual Policy
24
+
25
+ This codebase may contain text in English, Spanish, or both (Spanglish). This is ACCEPTED and should NOT be flagged. Language choice is a product decision, not a review concern.
26
+
27
+ Accepted examples (do NOT flag):
28
+ - English-only UI: "Login to Bitbucket"
29
+ - Spanish-only UI: "Iniciar sesión en Bitbucket"
30
+ - Mixed in same app: English labels + Spanish error messages
31
+ - Technical Spanglish: "Hacé click en Deploy" (accepted)
32
+
33
+ ## Explicit Exclusions
34
+
35
+ Do NOT report findings for:
36
+ - Variable names, function names, type names, class names
37
+ - Code comments or inline documentation
38
+ - URLs, file paths, email addresses
39
+ - Template literal expressions (`${...}`)
40
+ - Technical terms in their original language (e.g., "commit", "merge", "deploy", "login")
41
+ - CSS class names or HTML tag names
42
+ - Strings that are clearly identifiers (camelCase, snake_case, SCREAMING_CASE)
43
+
44
+ ## Category
45
+
46
+ Use category `documentation` for ALL findings. This is the correct category for user-facing text review.
47
+
48
+ ## Output Instructions
49
+
50
+ You MUST call the `report_findings` tool to submit your findings. Do not write findings as plain text — the tool call is required.
51
+
52
+ For each finding, use the line number provided in the `[L{num}]` annotation. The `lineNumber` field MUST match an annotated line from the input.
53
+
54
+ If there are no findings, call `report_findings` with an empty array: `{ "findings": [] }`.
55
+
56
+ ## Severity Criteria
57
+
58
+ | Severity | When to use |
59
+ |----------|-------------|
60
+ | `medium` | Spelling error visible to end users |
61
+ | `medium` | Grammar error that changes or confuses the intended meaning |
62
+ | `medium` | Missing accent in Spanish that changes word meaning (e.g., "el" vs "él", "si" vs "sí") |
63
+ | `low` | Minor punctuation issue (missing period, extra comma) |
64
+ | `low` | Tone inconsistency within the same screen or flow |
65
+ | `low` | Unclear message that could be improved but is not incorrect |
66
+ | `low` | Missing accent that does not change word meaning |
67
+
68
+ Do NOT use `critical`, `high`, or `info` severity. Text issues are never critical or high priority, and `info` is too noisy for this agent.
package/dist/ai/agents/python-reviewer.d.ts ADDED
@@ -0,0 +1,3 @@
1
+ import type { Agent } from '../../types/index.js';
2
+ export declare const pythonReviewerAgent: Agent;
3
+ //# sourceMappingURL=python-reviewer.d.ts.map
package/dist/ai/agents/python-reviewer.d.ts.map ADDED
@@ -0,0 +1 @@
1
+ {"version":3,"file":"python-reviewer.d.ts","sourceRoot":"","sources":["../../../src/ai/agents/python-reviewer.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,KAAK,EAAsD,MAAM,sBAAsB,CAAC;AAYtG,eAAO,MAAM,mBAAmB,EAAE,KAoDjC,CAAC"}
package/dist/ai/agents/python-reviewer.js ADDED
@@ -0,0 +1,59 @@
1
+ import { readFileSync } from 'node:fs';
2
+ import { fileURLToPath } from 'node:url';
3
+ import path from 'node:path';
4
+ import { Logger, LogLevel } from '../../utils/logger.js';
5
+ import { FINDING_TOOL_SCHEMA, normalizeFinding } from './shared/finding-schema.js';
6
+ import { buildSystemPrompt } from './shared/prompt-builder.js';
7
+ import { buildUserContent } from './shared/content-builder.js';
8
+ import { isValidLineNumber } from './shared/line-validator.js';
9
+ // Load the system prompt at module load time (relative to this source file)
10
+ const __filename = fileURLToPath(import.meta.url);
11
+ const __dir = path.dirname(__filename);
12
+ const BASE_SYSTEM_PROMPT = readFileSync(path.resolve(__dir, 'prompts', 'python-reviewer.txt'), 'utf-8');
13
+ export const pythonReviewerAgent = {
14
+ id: 'python-reviewer',
15
+ displayName: 'Python',
16
+ description: 'Python code quality, type safety, and async patterns',
17
+ domain: 'language',
18
+ contextTags: ['conventions', 'frameworkRules'],
19
+ fileFilter(filePath) {
20
+ return path.extname(filePath).toLowerCase() === '.py';
21
+ },
22
+ async analyze(input, provider) {
23
+ const logger = new Logger(LogLevel.warn);
24
+ const relevantFiles = input.files.filter((f) => this.fileFilter(f.newPath));
25
+ if (relevantFiles.length === 0) {
26
+ return {
27
+ agentId: this.id,
28
+ findings: [],
29
+ usage: { inputTokens: 0, outputTokens: 0 },
30
+ };
31
+ }
32
+ const legacyProjectContext = input.projectContext;
33
+ const systemPrompt = buildSystemPrompt(BASE_SYSTEM_PROMPT, input.context, legacyProjectContext);
34
+ const userContent = buildUserContent(relevantFiles, input.prMetadata, input.context?.contentMode ?? 'full');
35
+ const result = await provider.analyze({
36
+ systemPrompt,
37
+ userContent,
38
+ toolName: 'report_findings',
39
+ toolSchema: FINDING_TOOL_SCHEMA,
40
+ });
41
+ const findings = [];
42
+ for (const raw of result.findings) {
43
+ const finding = normalizeFinding(raw, this.id);
44
+ if (finding === null) {
45
+ logger.warn(`[python-reviewer] Dropping invalid finding — failed schema validation`);
46
+ continue;
47
+ }
48
+ if (isValidLineNumber(finding.lineNumber, finding.filePath, relevantFiles)) {
49
+ findings.push(finding);
50
+ }
51
+ else {
52
+ logger.warn(`[python-reviewer] Dropping finding at ${finding.filePath}:${finding.lineNumber} — not an addition line`);
53
+ }
54
+ }
55
+ const usage = result.usage;
56
+ return { agentId: this.id, findings, usage };
57
+ },
58
+ };
59
+ //# sourceMappingURL=python-reviewer.js.map
package/dist/ai/agents/python-reviewer.js.map ADDED
@@ -0,0 +1 @@
1
+ {"version":3,"file":"python-reviewer.js","sourceRoot":"","sources":["../../../src/ai/agents/python-reviewer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACnF,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAE/D,4EAA4E;AAC5E,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;AACvC,MAAM,kBAAkB,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,qBAAqB,CAAC,EAAE,OAAO,CAAC,CAAC;AAExG,MAAM,CAAC,MAAM,mBAAmB,GAAU;IACxC,EAAE,EAAE,iBAAiB;IACrB,WAAW,EAAE,QAAQ;IACrB,WAAW,EAAE,sDAAsD;IACnE,MAAM,EAAE,UAAU;IAClB,WAAW,EAAE,CAAC,aAAa,EAAE,gBAAgB,CAAC;IAE9C,UAAU,CAAC,QAAgB;QACzB,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC;IACxD,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,KAAiB,EAAE,QAAuB;QACtD,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,aAAa,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QAE5E,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO;gBACL,OAAO,EAAE,IAAI,CAAC,EAAE;gBAChB,QAAQ,EAAE,EAAE;gBACZ,KAAK,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE;aAC3C,CAAC;QACJ,CAAC;QAED,MAAM,oBAAoB,GAAG,KAAK,CAAC,cAAc,CAAC;QAClD,MAAM,YAAY,GAAG,iBAAiB,CAAC,kBAAkB,EAAE,KAAK,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;QAChG,MAAM,WAAW,GAAG,gBAAgB,CAAC,aAAa,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,OAAO,EAAE,WAAW,IAAI,MAAM,CAAC,CAAC;QAE5G,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC;YACpC,YAAY;YACZ,WAAW;YACX,QAAQ,EAAE,iBAAiB;YAC3B,UAAU,EAAE,mBAAmB;SAChC,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,EAAE,CAAC;QACpB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YAClC,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;YAC/C,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,MAAM,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAC;gBACrF,SAAS;YACX,CAAC;YACD,IAAI,iBAAiB,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE,CAAC;gBAC3E,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACzB,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CAAC,yCAAyC,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,UAAU,yBAAyB,CAAC,CAAC;YACxH,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAAe,MAAM,CAAC,KAAK,CAAC;QAEvC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC/C,CAAC;CACF,CAAC"}
package/dist/ai/agents/registry.d.ts ADDED
@@ -0,0 +1,20 @@
1
+ import type { Agent } from '../../types/index.js';
2
+ /**
3
+ * Get an agent by its ID.
4
+ * Returns undefined if no agent with the given ID is registered.
5
+ */
6
+ export declare function getAgent(id: string): Agent | undefined;
7
+ /**
8
+ * Get all registered agents in execution order.
9
+ */
10
+ export declare function getAllAgents(): readonly Agent[];
11
+ /**
12
+ * Get all agents whose fileFilter accepts the given file path.
13
+ */
14
+ export declare function getAgentsForFile(filePath: string): Agent[];
15
+ /**
16
+ * Get agents by a list of IDs, preserving registry execution order.
17
+ * IDs not found in the registry are silently ignored.
18
+ */
19
+ export declare function getAgentsByIds(ids: string[]): Agent[];
20
+ //# sourceMappingURL=registry.d.ts.map
package/dist/ai/agents/registry.d.ts.map ADDED
@@ -0,0 +1 @@
1
+ {"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../../src/ai/agents/registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAwClD;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,KAAK,GAAG,SAAS,CAEtD;AAED;;GAEG;AACH,wBAAgB,YAAY,IAAI,SAAS,KAAK,EAAE,CAE/C;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,KAAK,EAAE,CAE1D;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,KAAK,EAAE,CAGrD"}
package/dist/ai/agents/registry.js ADDED
@@ -0,0 +1,65 @@
1
+ import { tsReviewerAgent } from './ts-reviewer.js';
2
+ import { securityReviewerAgent } from './security-reviewer.js';
3
+ import { cssReviewerAgent } from './css-reviewer.js';
4
+ import { htmlReviewerAgent } from './html-reviewer.js';
5
+ import { csharpReviewerAgent } from './csharp-reviewer.js';
6
+ import { phpReviewerAgent } from './php-reviewer.js';
7
+ import { bladeReviewerAgent } from './blade-reviewer.js';
8
+ import { pythonReviewerAgent } from './python-reviewer.js';
9
+ import { architectureReviewerAgent } from './architecture-reviewer.js';
10
+ import { testingReviewerAgent } from './testing-reviewer.js';
11
+ import { performanceReviewerAgent } from './performance-reviewer.js';
12
+ import { sqlReviewerAgent } from './sql-reviewer.js';
13
+ import { configReviewerAgent } from './config-reviewer.js';
14
+ import { uxTextReviewerAgent } from './ux-text-reviewer.js';
15
+ /**
16
+ * Static registry of all available agents.
17
+ * Order: ts-reviewer, security-reviewer, css-reviewer, html-reviewer,
18
+ * csharp-reviewer, php-reviewer, blade-reviewer, python-reviewer,
19
+ * architecture-reviewer, testing-reviewer, performance-reviewer,
20
+ * sql-reviewer, config-reviewer, ux-text-reviewer
21
+ */
22
+ const ALL_AGENTS = [
23
+ tsReviewerAgent,
24
+ securityReviewerAgent,
25
+ cssReviewerAgent,
26
+ htmlReviewerAgent,
27
+ csharpReviewerAgent,
28
+ phpReviewerAgent,
29
+ bladeReviewerAgent,
30
+ pythonReviewerAgent,
31
+ architectureReviewerAgent,
32
+ testingReviewerAgent,
33
+ performanceReviewerAgent,
34
+ sqlReviewerAgent,
35
+ configReviewerAgent,
36
+ uxTextReviewerAgent,
37
+ ];
38
+ /**
39
+ * Get an agent by its ID.
40
+ * Returns undefined if no agent with the given ID is registered.
41
+ */
42
+ export function getAgent(id) {
43
+ return ALL_AGENTS.find((a) => a.id === id);
44
+ }
45
+ /**
46
+ * Get all registered agents in execution order.
47
+ */
48
+ export function getAllAgents() {
49
+ return ALL_AGENTS;
50
+ }
51
+ /**
52
+ * Get all agents whose fileFilter accepts the given file path.
53
+ */
54
+ export function getAgentsForFile(filePath) {
55
+ return ALL_AGENTS.filter((a) => a.fileFilter(filePath));
56
+ }
57
+ /**
58
+ * Get agents by a list of IDs, preserving registry execution order.
59
+ * IDs not found in the registry are silently ignored.
60
+ */
61
+ export function getAgentsByIds(ids) {
62
+ const idSet = new Set(ids);
63
+ return ALL_AGENTS.filter((a) => idSet.has(a.id));
64
+ }
65
+ //# sourceMappingURL=registry.js.map
package/dist/ai/agents/registry.js.map ADDED
@@ -0,0 +1 @@
1
+ {"version":3,"file":"registry.js","sourceRoot":"","sources":["../../../src/ai/agents/registry.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAE5D;;;;;;GAMG;AACH,MAAM,UAAU,GAAqB;IACnC,eAAe;IACf,qBAAqB;IACrB,gBAAgB;IAChB,iBAAiB;IACjB,mBAAmB;IACnB,gBAAgB;IAChB,kBAAkB;IAClB,mBAAmB;IACnB,yBAAyB;IACzB,oBAAoB;IACpB,wBAAwB;IACxB,gBAAgB;IAChB,mBAAmB;IACnB,mBAAmB;CACpB,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,QAAQ,CAAC,EAAU;IACjC,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;AAC7C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY;IAC1B,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,GAAa;IAC1C,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAC3B,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACnD,CAAC"}