recon-generate 0.0.17 → 0.0.19

package/dist/cfg/types.d.ts

@@ -0,0 +1,270 @@
+export type SExpr = {
+    atom: string;
+} | {
+    list: SExpr[];
+} | {
+    comment: string;
+};
+export declare const atom: (s: string) => SExpr;
+export declare const list: (...args: SExpr[]) => SExpr;
+export declare const comment: (s: string) => SExpr;
+export type SymExpr = {
+    kind: 'var';
+    name: string;
+    type: string;
+} | {
+    kind: 'lit';
+    value: string;
+    type: string;
+} | {
+    kind: 'bool';
+    value: boolean;
+} | {
+    kind: 'binop';
+    op: BinOp;
+    left: SymExpr;
+    right: SymExpr;
+    checked: boolean;
+    signed: boolean;
+} | {
+    kind: 'unop';
+    op: UnOp;
+    arg: SymExpr;
+} | {
+    kind: 'select';
+    array: SymExpr;
+    index: SymExpr;
+} | {
+    kind: 'ite';
+    cond: SymExpr;
+    then: SymExpr;
+    else: SymExpr;
+} | {
+    kind: 'call';
+    target: string;
+    method: string;
+    args: SymExpr[];
+    callType: CallType;
+    contract?: string;
+} | {
+    kind: 'field';
+    base: SymExpr;
+    field: string;
+} | {
+    kind: 'cast';
+    toType: string;
+    arg: SymExpr;
+} | {
+    kind: 'keccak';
+    arg: SymExpr;
+} | {
+    kind: 'external_return';
+    target: string;
+    method: string;
+    args: SymExpr[];
+    ssaId: string;
+} | {
+    kind: 'loop';
+    var: string;
+    start: SymExpr;
+    bound: SymExpr;
+    body: string;
+};
+export type BinOp = 'add' | 'sub' | 'mul' | 'div' | 'mod' | 'exp' | 'eq' | 'ne' | 'lt' | 'le' | 'gt' | 'ge' | 'and' | 'or' | 'xor' | 'shl' | 'shr' | 'land' | 'lor';
+export type UnOp = 'not' | 'neg' | 'bnot';
+export type CallType = 'internal' | 'library' | 'external' | 'constructor';
+export interface BasicBlock {
+    id: string;
+    statements: CFGStatement[];
+    terminator: Terminator;
+    astIds: number[];
+}
+export type CFGStatement = {
+    kind: 'let';
+    name: string;
+    type: string;
+    expr: SymExpr;
+} | {
+    kind: 'store';
+    target: SymExpr;
+    index: SymExpr;
+    value: SymExpr;
+} | {
+    kind: 'assign';
+    target: string;
+    value: SymExpr;
+} | {
+    kind: 'call';
+    expr: SymExpr;
+} | {
+    kind: 'assume';
+    cond: SymExpr;
+    reason?: string;
+    revertEdge?: string;
+};
+export type Terminator = {
+    kind: 'branch';
+    cond: SymExpr;
+    trueBlock: string;
+    falseBlock: string;
+} | {
+    kind: 'jump';
+    target: string;
+} | {
+    kind: 'return';
+    values: SymExpr[];
+} | {
+    kind: 'revert';
+    reason?: string;
+} | {
+    kind: 'placeholder';
+};
+/**
+ * A CoverageEdge represents one branch outcome.
+ * Covering an edge means executing that branch direction.
+ */
+export interface CoverageEdge {
+    id: string;
+    from: string;
+    to: string;
+    condition: SymExpr;
+    functionName: string;
+    astId?: number;
+}
+/**
+ * A CompletePath is a sequence of edges from entry to exit.
+ * This is what we enumerate for "n paths total".
+ */
+export interface CompletePath {
+    id: string;
+    edges: string[];
+    entryBlock: string;
+    exitBlock: string;
+    pathCondition: SymExpr;
+    outcome: 'success' | 'revert';
+    solvable: boolean;
+}
+/**
+ * Snapshot of state at a block entry - for mid-point solving.
+ */
+export interface StateSnapshot {
+    atBlock: string;
+    variables: Map<string, SymExpr>;
+    pathCondition: SymExpr;
+    coveredBy: string[];
+}
+/**
+ * Observed return values from external calls (from tracing).
+ */
+export interface ExternalCallOracle {
+    target: string;
+    method: string;
+    argPatterns: string[];
+    observedReturns: string[];
+}
+/**
+ * Loop summary for symbolic reasoning
+ */
+export interface LoopInfo {
+    id: string;
+    headerBlock: string;
+    exitBlock: string;
+    condition: SymExpr;
+    inductionVar?: string;
+    bound?: SymExpr;
+    bodyBlocks: string[];
+}
+export interface FunctionCFG {
+    contract: string;
+    name: string;
+    selector: string;
+    visibility: 'public' | 'external' | 'internal' | 'private';
+    params: {
+        name: string;
+        type: string;
+    }[];
+    returns: {
+        name?: string;
+        type: string;
+    }[];
+    blocks: Map<string, BasicBlock>;
+    entryBlock: string;
+    edges: CoverageEdge[];
+    paths: CompletePath[];
+    externalCalls: {
+        target: string;
+        method: string;
+        ssaVar: string;
+    }[];
+    hasKeccak: boolean;
+    internalCalls: {
+        target: string;
+        contract: string;
+        callType: 'internal' | 'super' | 'library' | 'modifier' | 'constructor';
+        args: SymExpr[];
+    }[];
+    modifiers: string[];
+    ternaryEdges: CoverageEdge[];
+    loops: LoopInfo[];
+}
+/**
+ * Variable role classification for solver
+ */
+export type VarRole = 'input' | 'local' | 'state' | 'global' | 'external';
+/**
+ * Variable metadata for solver
+ */
+export interface VarInfo {
+    name: string;
+    baseName: string;
+    role: VarRole;
+    type: string;
+    slot?: number;
+    isMapping?: boolean;
+    keyTypes?: string[];
+}
+export interface ContractModule {
+    name: string;
+    solidityVersion: string;
+    stateVars: {
+        name: string;
+        type: string;
+        slot?: number;
+        contract?: string;
+    }[];
+    mappings: {
+        name: string;
+        keyType: string;
+        valueType: string;
+        slot?: number;
+        contract?: string;
+    }[];
+    constants?: {
+        name: string;
+        type: string;
+        value?: string;
+        contract?: string;
+    }[];
+    immutables?: {
+        name: string;
+        type: string;
+        contract?: string;
+    }[];
+    functions: FunctionCFG[];
+    totalPaths: number;
+    totalEdges: number;
+    oracle: ExternalCallOracle[];
+    varRoles?: Map<string, VarInfo>;
+}
+export interface SSAContext {
+    counter: Map<string, number>;
+    types: Map<string, string>;
+    blockCounter: number;
+    pathCounter: number;
+    edgeCounter: number;
+}
+export declare function freshSSA(ctx: SSAContext, base: string, type: string): string;
+export declare function currentSSA(ctx: SSAContext, base: string): string;
+export declare function newBlock(ctx: SSAContext): string;
+export declare function newPath(ctx: SSAContext): string;
+export declare function newEdge(ctx: SSAContext, funcName: string, from: string, dir: 'T' | 'F' | 'J'): string;

package/dist/cfg/types.js

@@ -0,0 +1,41 @@
+"use strict";
+// ============================================================================
+// S-Expression AST (for output)
+// ============================================================================
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.comment = exports.list = exports.atom = void 0;
+exports.freshSSA = freshSSA;
+exports.currentSSA = currentSSA;
+exports.newBlock = newBlock;
+exports.newPath = newPath;
+exports.newEdge = newEdge;
+// Helper constructors
+const atom = (s) => ({ atom: s });
+exports.atom = atom;
+const list = (...args) => ({ list: args });
+exports.list = list;
+const comment = (s) => ({ comment: s });
+exports.comment = comment;
+function freshSSA(ctx, base, type) {
+    const count = (ctx.counter.get(base) || 0) + 1;
+    ctx.counter.set(base, count);
+    const name = `${base}_${count}`;
+    ctx.types.set(name, type);
+    return name;
+}
+function currentSSA(ctx, base) {
+    var _a;
+    // If variable hasn't been assigned yet, return _0 (initial/undefined state)
+    // This ensures the first freshSSA returns _1, which will be different
+    const count = (_a = ctx.counter.get(base)) !== null && _a !== void 0 ? _a : 0;
+    return `${base}_${count}`;
+}
+function newBlock(ctx) {
+    return `B${ctx.blockCounter++}`;
+}
+function newPath(ctx) {
+    return `P${ctx.pathCounter++}`;
+}
+function newEdge(ctx, funcName, from, dir) {
+    return `${funcName}_${from}_${dir}`;
+}

package/dist/cfg/unified-coverage.d.ts

@@ -0,0 +1,87 @@
+/**
+ * Unified Coverage Map Generator
+ *
+ * Creates a single coverage-map.json that combines:
+ * - branches.json (PC → AST mapping, line numbers)
+ * - edge-mappings.json (PC → Edge ID mapping from CFG)
+ *
+ * This eliminates the need for two separate JSON files and ensures
+ * the Rust fuzzer has all coverage information in one place.
+ */
+/** Unified branch info combining branches.json and edge-mappings.json data */
+export interface UnifiedBranch {
+    /** PC of the JUMPI instruction */
+    pc: number;
+    /** AST node ID */
+    astId: number | null;
+    /** All AST IDs at this source location */
+    allAstIds: number[];
+    /** Source byte offset */
+    offset: number;
+    /** Source byte length */
+    length: number;
+    /** Source file index */
+    fileIndex: number;
+    /** Line number of the branch condition (1-based) */
+    conditionLine?: number;
+    /** Edge ID when branch is taken (true) */
+    trueEdge?: string;
+    /** Edge ID when branch is not taken (false) */
+    falseEdge?: string;
+    /** Function name containing this branch */
+    function?: string;
+    /** Block ID in CFG */
+    block?: string;
+    /** Line number of the first statement in true branch */
+    trueBodyLine?: number;
+    /** Line number of the first statement in false branch */
+    falseBodyLine?: number;
+    /** First PC of the true branch body */
+    trueBodyPc?: number;
+    /** First PC of the false branch body */
+    falseBodyPc?: number;
+    /** Whether this is an assertion (require/assert) - FALSE branch is the bug-finding path */
+    isAssertion?: boolean;
+}
+/** Per-contract unified coverage data */
+export interface UnifiedContractCoverage {
+    /** Contract name */
+    name: string;
+    /** Source file path */
+    sourceFile: string;
+    /** Total edges (2 per branch: true + false) */
+    totalEdges: number;
+    /** All branches with unified info */
+    branches: UnifiedBranch[];
+}
+/** Unified coverage manifest */
+export interface UnifiedCoverageManifest {
+    /** Generation timestamp */
+    generated: string;
+    /** Schema version for forward compatibility */
+    version: string;
+    /** Total contracts */
+    totalContracts: number;
+    /** Total branch points */
+    totalBranches: number;
+    /** Total edges (branch directions) */
+    totalEdges: number;
+    /** Per-contract coverage data */
+    contracts: {
+        [name: string]: UnifiedContractCoverage;
+    };
+}
+/**
+ * Generate unified coverage map by merging branches.json and edge-mappings.json
+ * Can be called after both files exist, or during the "all" command
+ */
+export declare function generateUnifiedCoverageMap(reconDir: string, branchesData?: any, edgeMappingsData?: any): Promise<UnifiedCoverageManifest>;
+/**
+ * Write unified coverage map to file
+ */
+export declare function writeUnifiedCoverageMap(reconDir: string, manifest: UnifiedCoverageManifest): void;
+/**
+ * Generate unified coverage map directly from branch and edge data
+ * Called during the "all" command to avoid re-reading JSON files
+ */
+export declare function createUnifiedFromMemory(branchManifest: any, edgeMappings: any | null): UnifiedCoverageManifest;

package/dist/cfg/unified-coverage.js

@@ -0,0 +1,248 @@
+"use strict";
+/**
+ * Unified Coverage Map Generator
+ *
+ * Creates a single coverage-map.json that combines:
+ * - branches.json (PC → AST mapping, line numbers)
+ * - edge-mappings.json (PC → Edge ID mapping from CFG)
+ *
+ * This eliminates the need for two separate JSON files and ensures
+ * the Rust fuzzer has all coverage information in one place.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.generateUnifiedCoverageMap = generateUnifiedCoverageMap;
+exports.writeUnifiedCoverageMap = writeUnifiedCoverageMap;
+exports.createUnifiedFromMemory = createUnifiedFromMemory;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+// ============================================================================
+// Generation
+// ============================================================================
+/**
+ * Generate unified coverage map by merging branches.json and edge-mappings.json
+ * Can be called after both files exist, or during the "all" command
+ */
+async function generateUnifiedCoverageMap(reconDir, branchesData, edgeMappingsData) {
+    var _a, _b, _c, _d, _e, _f, _g;
+    // Load branches.json if not provided
+    if (!branchesData) {
+        const branchesPath = path.join(reconDir, 'branches.json');
+        if (!fs.existsSync(branchesPath)) {
+            throw new Error(`branches.json not found in ${reconDir}`);
+        }
+        branchesData = JSON.parse(fs.readFileSync(branchesPath, 'utf-8'));
+    }
+    // Load edge-mappings.json if not provided (optional - might not exist)
+    if (!edgeMappingsData) {
+        const edgeMappingsPath = path.join(reconDir, 'edge-mappings.json');
+        if (fs.existsSync(edgeMappingsPath)) {
+            edgeMappingsData = JSON.parse(fs.readFileSync(edgeMappingsPath, 'utf-8'));
+        }
+    }
+    // Build lookup maps from edge-mappings
+    // Primary: PC → edge info
+    // Fallback: AST ID → edge info (handles PC mismatches between branches.json and edge-mappings.json)
+    const pcToEdgeInfo = new Map(); // key: "contractName:pc"
+    const astIdToEdgeInfo = new Map(); // key: "contractName:astId"
+    if (edgeMappingsData === null || edgeMappingsData === void 0 ? void 0 : edgeMappingsData.contracts) {
+        for (const [contractName, contractData] of Object.entries(edgeMappingsData.contracts)) {
+            const branches = contractData.branches || [];
+            for (const branch of branches) {
+                const pcKey = `${contractName}:${branch.pc}`;
+                pcToEdgeInfo.set(pcKey, branch);
+                // Also index by AST ID for fallback lookup
+                if (branch.astId !== undefined && branch.astId !== null) {
+                    const astKey = `${contractName}:${branch.astId}`;
+                    astIdToEdgeInfo.set(astKey, branch);
+                }
+            }
+        }
+    }
+    // Merge data
+    const unifiedContracts = {};
+    let totalBranches = 0;
+    let totalEdges = 0;
+    for (const contract of branchesData.contracts || []) {
+        const contractName = contract.contract;
+        const unifiedBranches = [];
+        for (const branch of contract.branches || []) {
+            // Look up edge info - try PC first, then fallback to AST ID
+            const pcKey = `${contractName}:${branch.pc}`;
+            let edgeInfo = pcToEdgeInfo.get(pcKey);
+            // If PC lookup fails, try AST ID lookup (handles PC mismatches)
+            if (!edgeInfo && branch.astId !== undefined && branch.astId !== null) {
+                const astKey = `${contractName}:${branch.astId}`;
+                edgeInfo = astIdToEdgeInfo.get(astKey);
+            }
+            // Also try allAstIds if primary astId didn't match
+            if (!edgeInfo && ((_a = branch.allAstIds) === null || _a === void 0 ? void 0 : _a.length) > 0) {
+                for (const astId of branch.allAstIds) {
+                    const astKey = `${contractName}:${astId}`;
+                    edgeInfo = astIdToEdgeInfo.get(astKey);
+                    if (edgeInfo)
+                        break;
+                }
+            }
+            // Determine if this is an assertion branch
+            // Assertions have edge IDs containing "assert" - the FALSE branch is the bug path
+            const isAssertion = ((_b = edgeInfo === null || edgeInfo === void 0 ? void 0 : edgeInfo.trueEdge) === null || _b === void 0 ? void 0 : _b.includes('assert')) ||
+                ((_c = edgeInfo === null || edgeInfo === void 0 ? void 0 : edgeInfo.falseEdge) === null || _c === void 0 ? void 0 : _c.includes('assert')) ||
+                false;
+            const unified = {
+                pc: branch.pc,
+                astId: branch.astId,
+                allAstIds: branch.allAstIds || [],
+                offset: branch.offset,
+                length: branch.length,
+                fileIndex: branch.fileIndex,
+                conditionLine: branch.conditionLine,
+                // Edge info (from edge-mappings.json)
+                trueEdge: edgeInfo === null || edgeInfo === void 0 ? void 0 : edgeInfo.trueEdge,
+                falseEdge: edgeInfo === null || edgeInfo === void 0 ? void 0 : edgeInfo.falseEdge,
+                function: edgeInfo === null || edgeInfo === void 0 ? void 0 : edgeInfo.function,
+                block: edgeInfo === null || edgeInfo === void 0 ? void 0 : edgeInfo.block,
+                // Body info (can come from either source)
+                trueBodyLine: (_d = branch.trueBodyLine) !== null && _d !== void 0 ? _d : edgeInfo === null || edgeInfo === void 0 ? void 0 : edgeInfo.trueBodyLine,
+                falseBodyLine: (_e = branch.falseBodyLine) !== null && _e !== void 0 ? _e : edgeInfo === null || edgeInfo === void 0 ? void 0 : edgeInfo.falseBodyLine,
+                trueBodyPc: (_f = branch.trueBodyPc) !== null && _f !== void 0 ? _f : edgeInfo === null || edgeInfo === void 0 ? void 0 : edgeInfo.trueBodyPc,
+                falseBodyPc: (_g = branch.falseBodyPc) !== null && _g !== void 0 ? _g : edgeInfo === null || edgeInfo === void 0 ? void 0 : edgeInfo.falseBodyPc,
+                // Metadata
+                isAssertion,
+            };
+            unifiedBranches.push(unified);
+        }
+        // Count edges: each branch with edge info has 2 edges, others have 2 potential directions
+        const edgesForContract = unifiedBranches.length * 2;
+        unifiedContracts[contractName] = {
+            name: contractName,
+            sourceFile: contract.sourceFile,
+            totalEdges: edgesForContract,
+            branches: unifiedBranches,
+        };
+        totalBranches += unifiedBranches.length;
+        totalEdges += edgesForContract;
+    }
+    const manifest = {
+        generated: new Date().toISOString(),
+        version: '1.0',
+        totalContracts: Object.keys(unifiedContracts).length,
+        totalBranches,
+        totalEdges,
+        contracts: unifiedContracts,
+    };
+    return manifest;
+}
+/**
+ * Write unified coverage map to file
+ */
+function writeUnifiedCoverageMap(reconDir, manifest) {
+    const outputPath = path.join(reconDir, 'coverage-map.json');
+    fs.writeFileSync(outputPath, JSON.stringify(manifest, null, 2));
+    console.log(`   ✅ Unified coverage map written to ${outputPath}`);
+}
+/**
+ * Generate unified coverage map directly from branch and edge data
+ * Called during the "all" command to avoid re-reading JSON files
+ */
+function createUnifiedFromMemory(branchManifest, edgeMappings) {
+    return generateUnifiedCoverageMapSync(branchManifest, edgeMappings);
+}
+/** Synchronous version for in-memory data */
+function generateUnifiedCoverageMapSync(branchesData, edgeMappingsData) {
+    var _a, _b, _c, _d, _e, _f;
+    // Build PC → edge info lookup
+    const pcToEdgeInfo = new Map();
+    if (edgeMappingsData === null || edgeMappingsData === void 0 ? void 0 : edgeMappingsData.contracts) {
+        for (const [contractName, contractData] of Object.entries(edgeMappingsData.contracts)) {
+            const branches = contractData.branches || [];
+            for (const branch of branches) {
+                const key = `${contractName}:${branch.pc}`;
+                pcToEdgeInfo.set(key, branch);
+            }
+        }
+    }
+    // Merge data
+    const unifiedContracts = {};
+    let totalBranches = 0;
+    let totalEdges = 0;
+    for (const contract of branchesData.contracts || []) {
+        const contractName = contract.contract;
+        const unifiedBranches = [];
+        for (const branch of contract.branches || []) {
+            const edgeKey = `${contractName}:${branch.pc}`;
+            const edgeInfo = pcToEdgeInfo.get(edgeKey);
+            const isAssertion = ((_a = edgeInfo === null || edgeInfo === void 0 ? void 0 : edgeInfo.trueEdge) === null || _a === void 0 ? void 0 : _a.includes('assert')) ||
+                ((_b = edgeInfo === null || edgeInfo === void 0 ? void 0 : edgeInfo.falseEdge) === null || _b === void 0 ? void 0 : _b.includes('assert')) ||
+                false;
+            const unified = {
+                pc: branch.pc,
+                astId: branch.astId,
+                allAstIds: branch.allAstIds || [],
+                offset: branch.offset,
+                length: branch.length,
+                fileIndex: branch.fileIndex,
+                conditionLine: branch.conditionLine,
+                trueEdge: edgeInfo === null || edgeInfo === void 0 ? void 0 : edgeInfo.trueEdge,
+                falseEdge: edgeInfo === null || edgeInfo === void 0 ? void 0 : edgeInfo.falseEdge,
+                function: edgeInfo === null || edgeInfo === void 0 ? void 0 : edgeInfo.function,
+                block: edgeInfo === null || edgeInfo === void 0 ? void 0 : edgeInfo.block,
+                trueBodyLine: (_c = branch.trueBodyLine) !== null && _c !== void 0 ? _c : edgeInfo === null || edgeInfo === void 0 ? void 0 : edgeInfo.trueBodyLine,
+                falseBodyLine: (_d = branch.falseBodyLine) !== null && _d !== void 0 ? _d : edgeInfo === null || edgeInfo === void 0 ? void 0 : edgeInfo.falseBodyLine,
+                trueBodyPc: (_e = branch.trueBodyPc) !== null && _e !== void 0 ? _e : edgeInfo === null || edgeInfo === void 0 ? void 0 : edgeInfo.trueBodyPc,
+                falseBodyPc: (_f = branch.falseBodyPc) !== null && _f !== void 0 ? _f : edgeInfo === null || edgeInfo === void 0 ? void 0 : edgeInfo.falseBodyPc,
+                isAssertion,
+            };
+            unifiedBranches.push(unified);
+        }
+        const edgesForContract = unifiedBranches.length * 2;
+        unifiedContracts[contractName] = {
+            name: contractName,
+            sourceFile: contract.sourceFile,
+            totalEdges: edgesForContract,
+            branches: unifiedBranches,
+        };
+        totalBranches += unifiedBranches.length;
+        totalEdges += edgesForContract;
+    }
+    return {
+        generated: new Date().toISOString(),
+        version: '1.0',
+        totalContracts: Object.keys(unifiedContracts).length,
+        totalBranches,
+        totalEdges,
+        contracts: unifiedContracts,
+    };
+}

package/dist/generator.js

@@ -298,7 +298,7 @@ class ReconGenerator {
                                     this.logDebug('Skipping artifact from non-source directory', { contractName, sourcePath });
                                     continue;
                                 }
-                                if (isAbstract && !isExplicitlyIncluded && !isExplicitlyMocked) {
+                                if (isAbstract) {
                                     this.logDebug('Skipping abstract contract', { contractName, sourcePath });
                                     continue;
                                 }

package/dist/index.js

@@ -44,6 +44,7 @@ const pathsGenerator_1 = require("./pathsGenerator");
 const info_1 = require("./info");
 const utils_1 = require("./utils");
 const link_1 = require("./link");
+const sourcemap_1 = require("./sourcemap");
 function parseFilter(input) {
     if (!input)
         return undefined;
@@ -193,6 +194,24 @@ async function main() {
             : path.join(foundryRoot, medusaConfigOpt);
         await (0, link_1.runLink)(foundryRoot, echidnaConfigPath, medusaConfigPath, !!opts.verbose);
     });
+    program
+        .command('sourcemap')
+        .description('Generate CFGs and coverage-map.json for coverage-directed fuzzing')
+        .option('-o, --output <path>', 'Custom output directory for coverage artifacts (defaults to .recon)')
+        .option('--verbose', 'Enable verbose output for debugging')
+        .option('--foundry-config <path>', 'Path to foundry.toml (defaults to ./foundry.toml)')
+        .action(async (opts, cmd) => {
+        const workspaceRoot = process.cwd();
+        const foundryConfig = (0, utils_1.getFoundryConfigPath)(workspaceRoot, opts.foundryConfig);
+        const foundryRoot = path.dirname(foundryConfig);
+        const outputDir = opts.output
+            ? (path.isAbsolute(opts.output) ? opts.output : path.join(foundryRoot, opts.output))
+            : undefined;
+        await (0, sourcemap_1.runSourcemap)(foundryRoot, {
+            outputDir,
+            verbose: !!opts.verbose,
+        });
+    });
     program
         .command('info <contractName>')
         .description('Generate contract info JSON (payable, constants, function relations, etc.)')