sdlc-agent-4-enterprise-server 1.0.0

package/extension/src/langgraph/workflow-parser.ts

@@ -0,0 +1,74 @@
+/**
+ * WorkflowParser --- KSA-243
+ * Parses .kiro/agents/{agent}.md workflow sections into executable step definitions.
+ */
+
+import { ActionType, StepAction, inferActions, extractCondition } from "./workflow-parser-actions";
+export { ActionType, StepAction } from "./workflow-parser-actions";
+
+export interface ParsedWorkflow {
+  agentName: string;
+  rolePrompt: string;
+  steps: WorkflowStep[];
+  skills: string[];
+}
+
+export interface WorkflowStep {
+  id: string;
+  title: string;
+  actions: StepAction[];
+  isConditional: boolean;
+  condition?: string;
+}
+
+/**
+ * Parse an agent markdown file into a structured workflow.
+ */
+export function parseAgentWorkflow(agentName: string, markdown: string): ParsedWorkflow {
+  const fmMatch = markdown.match(/^---\r?\n[\s\S]*?\r?\n---\r?\n([\s\S]*)$/);
+  const body = fmMatch ? fmMatch[1].trim() : markdown.trim();
+  const lines = body.split("\n");
+  const steps: WorkflowStep[] = [];
+  const roleLines: string[] = [];
+  const skills = new Set<string>();
+  let currentStep: WorkflowStep | null = null;
+  let inWorkflowSection = false;
+
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    const stepMatch = line.match(/^###\s*Step\s+([\d.]+):?\s*(.*)/i);
+    if (stepMatch) {
+      if (currentStep) steps.push(currentStep);
+      const title = stepMatch[2].trim();
+      currentStep = {
+        id: `step-${stepMatch[1]}`,
+        title,
+        actions: [],
+        isConditional: /\(if|only\s+for|when\s+/i.test(title),
+        condition: extractCondition(title),
+      };
+      inWorkflowSection = true;
+      continue;
+    }
+    if (/^##\s*Workflow/i.test(line)) { inWorkflowSection = true; continue; }
+    if (/^##\s+/.test(line) && !/^###/.test(line) && inWorkflowSection && currentStep) {
+      steps.push(currentStep);
+      currentStep = null;
+      inWorkflowSection = false;
+    }
+    if (currentStep && inWorkflowSection) {
+      const actions = inferActions(line);
+      for (const action of actions) { currentStep.actions.push(action); }
+      const skillMatch = line.match(/\.kiro\/steering\/([\w-]+\.md)/);
+      if (skillMatch) { skills.add(`.kiro/steering/${skillMatch[1]}`); }
+    } else if (!inWorkflowSection) {
+      roleLines.push(line);
+    }
+  }
+  if (currentStep) steps.push(currentStep);
+
+  const contextFilesMatches = body.matchAll(/contextFiles.*?path.*?["']([^"']+)["']/g);
+  for (const m of contextFilesMatches) { skills.add(m[1]); }
+
+  return { agentName, rolePrompt: roleLines.join("\n").trim(), steps, skills: [...skills] };
+}

package/extension/src/logger.ts

@@ -0,0 +1,34 @@
+/**
+ * Minimal structured logger interface.
+ * In production, replace with pino or winston.
+ */
+export interface Logger {
+  trace(msg: string, data?: Record<string, unknown>): void;
+  debug(msg: string, data?: Record<string, unknown>): void;
+  info(msg: string, data?: Record<string, unknown>): void;
+  warn(msg: string, data?: Record<string, unknown>): void;
+  error(msg: string, data?: Record<string, unknown>): void;
+}
+
+/**
+ * Default console-based logger with JSON structured output.
+ */
+export const logger: Logger = {
+  trace(msg: string, data?: Record<string, unknown>) {
+    if (process.env.LOG_LEVEL === 'trace') {
+      console.log(JSON.stringify({ level: 'trace', msg, ...data, timestamp: new Date().toISOString() }));
+    }
+  },
+  debug(msg: string, data?: Record<string, unknown>) {
+    console.debug(JSON.stringify({ level: 'debug', msg, ...data, timestamp: new Date().toISOString() }));
+  },
+  info(msg: string, data?: Record<string, unknown>) {
+    console.info(JSON.stringify({ level: 'info', msg, ...data, timestamp: new Date().toISOString() }));
+  },
+  warn(msg: string, data?: Record<string, unknown>) {
+    console.warn(JSON.stringify({ level: 'warn', msg, ...data, timestamp: new Date().toISOString() }));
+  },
+  error(msg: string, data?: Record<string, unknown>) {
+    console.error(JSON.stringify({ level: 'error', msg, ...data, timestamp: new Date().toISOString() }));
+  },
+};

package/extension/src/mcp-config-builder.ts

@@ -0,0 +1,118 @@
+/**
+ * MCP config file operations — resolve, write, and manage MCP server configurations.
+ * Extracted from mcp-injector.ts.
+ */
+import * as fs from "fs";
+import * as path from "path";
+import * as os from "os";
+import * as vscode from "vscode";
+import { MCP_SERVERS_DIR, GITHUB_RELEASE_REPO, McpVariant } from "./config";
+import { debugError } from "./debug-logger";
+
+export function resolveConfig(variant: McpVariant, root: string): Record<string, unknown> {
+  const serversDir = getMcpServersDir(root);
+  const config: Record<string, unknown> = { ...variant.config };
+  const args = (variant.config.args || []).map((arg: string) =>
+    arg.replace("${mcpServersDir}", serversDir).replace("${workspaceFolder}", root)
+  );
+  config.args = args;
+  if (variant.config.cwd) {
+    config.cwd = variant.config.cwd.replace("${mcpServersDir}", serversDir).replace("${workspaceFolder}", root);
+  }
+  config.env = { CODE_INTEL_WORKSPACE: root, CODE_INTEL_VIEWER_PORT: "3200", FORCE_RESTART: "15" };
+  return config;
+}
+
+export function writeDefaultOrchestrationConfig(root: string): void {
+  const orchPath = path.join(root, ".code-intel", "orchestration.json");
+  if (fs.existsSync(orchPath)) { return; }
+  const defaultConfig = {
+    mcpServers: {},
+    settings: {
+      autoLog: { enabled: true, excludeTools: ["mem_audit", "mem_status"], maxArgLength: 200 },
+      healthCheckIntervalMs: 30000, maxRestartRetries: 3,
+      similarityThreshold: 0.7, maxRecursionDepth: 3,
+      discoveryTimeoutMs: 10000, kbSearchTimeoutMs: 2000
+    }
+  };
+  fs.mkdirSync(path.dirname(orchPath), { recursive: true });
+  fs.writeFileSync(orchPath, JSON.stringify(defaultConfig, null, 2));
+}
+
+export function writeMcpConfig(root: string, serverConfig: Record<string, unknown>): void {
+  const mcpConfigPath = path.join(root, ".kiro", "settings", "mcp.json");
+  let config: Record<string, unknown> = { mcpServers: {} };
+  if (fs.existsSync(mcpConfigPath)) {
+    try {
+      config = JSON.parse(fs.readFileSync(mcpConfigPath, "utf-8"));
+      config.mcpServers = config.mcpServers || {};
+    } catch (err) {
+      debugError("[McpInjector] Failed to parse existing mcp.json, resetting", err as Error);
+      config = { mcpServers: {} };
+    }
+  }
+  const servers = config.mcpServers as Record<string, unknown>;
+  const existing = (servers["code-intelligence"] as Record<string, unknown>) || {};
+  servers["code-intelligence"] = { ...existing, ...serverConfig };
+  fs.mkdirSync(path.dirname(mcpConfigPath), { recursive: true });
+  fs.writeFileSync(mcpConfigPath, JSON.stringify(config, null, 2));
+}
+
+export async function downloadVariant(variant: McpVariant, root: string): Promise<boolean> {
+  if (!variant.downloadAsset) { return false; }
+  const destDir = getMcpServersDir(root);
+  const assetPath = path.join(destDir, variant.downloadAsset);
+  if (fs.existsSync(assetPath.replace(".zip", "").replace(".jar", ".jar"))) {
+    const reuse = await vscode.window.showInformationMessage(
+      `MCP server "${variant.id}" already downloaded. Re-download?`, "Use Existing", "Re-download"
+    );
+    if (reuse === "Use Existing") { return true; }
+  }
+  const url = `https://github.com/${GITHUB_RELEASE_REPO}/releases/latest/download/${variant.downloadAsset}`;
+  return vscode.window.withProgress(
+    { location: vscode.ProgressLocation.Notification, title: `Downloading ${variant.id} MCP server...` },
+    async () => {
+      try {
+        fs.mkdirSync(destDir, { recursive: true });
+        await downloadFile(url, assetPath);
+        if (assetPath.endsWith(".zip")) {
+          await extractZip(assetPath, path.join(destDir, variant.id));
+          fs.unlinkSync(assetPath);
+        }
+        vscode.window.showInformationMessage(`✅ Downloaded ${variant.id} MCP server`);
+        return true;
+      } catch (err) { vscode.window.showErrorMessage(`Failed to download: ${err}`); return false; }
+    }
+  );
+}
+
+export function getMcpServersDir(root?: string): string {
+  if (root) return path.join(root, MCP_SERVERS_DIR);
+  const folders = vscode.workspace.workspaceFolders;
+  if (folders && folders.length > 0) return path.join(folders[0].uri.fsPath, MCP_SERVERS_DIR);
+  return path.join(os.homedir(), MCP_SERVERS_DIR);
+}
+
+async function downloadFile(url: string, dest: string): Promise<void> {
+  const response = await fetch(url, { redirect: "follow" });
+  if (!response.ok) { throw new Error(`HTTP ${response.status}: ${url}`); }
+  const buffer = Buffer.from(await response.arrayBuffer());
+  fs.writeFileSync(dest, buffer);
+}
+
+async function extractZip(zipPath: string, destDir: string): Promise<void> {
+  fs.mkdirSync(destDir, { recursive: true });
+  const resolvedZip = path.resolve(zipPath);
+  const resolvedDest = path.resolve(destDir);
+  if (process.platform === "win32") {
+    const scriptPath = path.join(os.tmpdir(), `extract-${Date.now()}-${path.basename(resolvedZip, ".zip")}.ps1`);
+    fs.writeFileSync(scriptPath, `Expand-Archive -LiteralPath '${resolvedZip.replace(/'/g, "''")}' -DestinationPath '${resolvedDest.replace(/'/g, "''")}' -Force`, "utf-8");
+    try {
+      const { execFileSync } = await import("child_process");
+      execFileSync("powershell", ["-NoProfile", "-ExecutionPolicy", "Bypass", "-File", scriptPath], { stdio: "ignore" });
+    } finally { try { fs.unlinkSync(scriptPath); } catch { } }
+  } else {
+    const { execFileSync } = await import("child_process");
+    execFileSync("unzip", ["-o", resolvedZip, "-d", resolvedDest], { stdio: "ignore" });
+  }
+}

package/extension/src/mcp-injector.ts

@@ -0,0 +1,68 @@
+/**
+ * MCP server config injection — handles migration from legacy scripts,
+ * downloads MCP servers from GitHub Release, and injects config.
+ */
+import * as vscode from "vscode";
+import * as fs from "fs";
+import * as path from "path";
+import { MCP_VARIANTS } from "./config";
+import { debugError } from "./debug-logger";
+import { resolveConfig, writeDefaultOrchestrationConfig, writeMcpConfig, downloadVariant } from "./mcp-config-builder";
+
+/** Migrate legacy scripts folder and report what was cleaned up. */
+export function migrateLegacyScripts(root: string): { removed: boolean } {
+  let removed = false;
+  const scriptsDir = path.join(root, ".analysis", "code-intelligence", "scripts");
+  if (fs.existsSync(scriptsDir)) { fs.rmSync(scriptsDir, { recursive: true, force: true }); removed = true; }
+  return { removed };
+}
+
+/** Show picker for MCP variant and inject config into .kiro/settings/mcp.json. */
+export async function injectMcpConfig(root: string): Promise<string | null> {
+  const variantPicks = MCP_VARIANTS.map(v => ({ label: v.label, description: v.description, variant: v }));
+  const selected = await vscode.window.showQuickPick(variantPicks, {
+    placeHolder: "Choose Code Intelligence MCP server variant"
+  });
+  if (!selected) { return null; }
+  const variant = selected.variant;
+  if (variant.delivery === "download") {
+    const ok = await downloadVariant(variant, root);
+    if (!ok) { return null; }
+  }
+  const resolvedConfig = resolveConfig(variant, root);
+  writeMcpConfig(root, resolvedConfig);
+  writeDefaultOrchestrationConfig(root);
+  return variant.id;
+}
+
+/** Check if MCP code-intelligence config exists in workspace. */
+export function hasMcpConfig(workspaceRoot: string): boolean {
+  const mcpConfigPath = path.join(workspaceRoot, ".kiro", "settings", "mcp.json");
+  if (!fs.existsSync(mcpConfigPath)) { return false; }
+  try {
+    const config = JSON.parse(fs.readFileSync(mcpConfigPath, "utf-8"));
+    return !!config?.mcpServers?.["code-intelligence"];
+  } catch { return false; }
+}
+
+/** Write HTTP Streamable MCP config for the remote backend. */
+export function writeBundledMcpConfig(workspaceRoot: string, port: number): void {
+  const serverConfig = { url: `http://127.0.0.1:${port}/mcp`, transportType: "httpStream", disabled: false };
+  writeMcpConfig(workspaceRoot, serverConfig);
+}
+
+/** Remove the bundled code-intelligence entry from .kiro/settings/mcp.json. */
+export function removeBundledMcpConfig(workspaceRoot: string): void {
+  const mcpConfigPath = path.join(workspaceRoot, ".kiro", "settings", "mcp.json");
+  if (!fs.existsSync(mcpConfigPath)) { return; }
+  try {
+    const config = JSON.parse(fs.readFileSync(mcpConfigPath, "utf-8"));
+    if (config?.mcpServers?.["code-intelligence"]) {
+      delete config.mcpServers["code-intelligence"];
+      if (Object.keys(config.mcpServers).length === 0) { delete config.mcpServers; }
+      fs.writeFileSync(mcpConfigPath, JSON.stringify(config, null, 2));
+    }
+  } catch (err) { debugError("[McpInjector] Failed to remove bundled mcp config", err as Error); }
+}
+
+

package/extension/src/mcp-server-manager.ts

@@ -0,0 +1,24 @@
+/**
+ * McpServerManager — Proxy class for RemoteBackendClient (KSA-293).
+ *
+ * Preserves the old McpServerManager class name to minimize refactoring across UI panels,
+ * but implements the new Light Client architecture connecting to the remote backend.
+ *
+ * NOTE: McpServerManager is an alias for RemoteBackendClient. New code should import
+ * RemoteBackendClient directly for clarity.
+ */
+
+export { RemoteBackendClient as McpServerManager, RemoteBackendClient } from "./remote-backend-client";
+
+// Re-export getNonce utility that some panels import from this module
+import * as crypto from "crypto";
+
+/**
+ * Generate a cryptographic nonce for CSP script authorization.
+ */
+export function getNonce(): string {
+  const array = crypto.randomBytes(16);
+  return Array.from(array)
+    .map((b) => b.toString(16).padStart(2, "0"))
+    .join("");
+}

package/extension/src/models/LlmProviderConfig.ts

@@ -0,0 +1,25 @@
+/**
+ * Per-provider configuration interfaces for LLM settings.
+ */
+
+/** Secret storage keys for each provider */
+export const SECRET_KEYS: Record<string, string> = {
+  anthropic: "kiroSdlc.anthropicApiKey",
+  openai: "kiroSdlc.openaiApiKey",
+  openrouter: "kiroSdlc.openaiApiKey",
+  lmstudio: "kiroSdlc.openaiApiKey",
+};
+
+/** Provider-specific base URL defaults */
+export const PROVIDER_BASE_URL_DEFAULTS: Record<string, string> = {
+  lmstudio: "http://localhost:1234/v1",
+  openrouter: "https://openrouter.ai/api/v1",
+};
+
+/** Config keys for per-provider base URLs */
+export const PROVIDER_BASE_URL_KEYS: Record<string, string> = {
+  anthropic: "anthropicBaseUrl",
+  openai: "openaiBaseUrl",
+  lmstudio: "lmstudioBaseUrl",
+  openrouter: "openrouterBaseUrl",
+};

package/extension/src/models/LlmTestResult.ts

@@ -0,0 +1,9 @@
+/**
+ * LLM connection test result interfaces.
+ */
+
+export interface LlmTestResult {
+  success: boolean;
+  message?: string;
+  error?: string;
+}

package/extension/src/models/SettingsState.ts

@@ -0,0 +1,16 @@
+/**
+ * State shape sent from extension to the Settings webview.
+ */
+
+export interface SettingsState {
+  type: "state";
+  provider: string;
+  model: string;
+  ollamaUrl: string;
+  baseUrl: string;
+  hasAnthropicKey: boolean;
+  hasOpenaiKey: boolean;
+  backendUrl: string;
+  mcpServerPort: number;
+  enableMcpServer: boolean;
+}

package/extension/src/models/index.ts

@@ -0,0 +1,3 @@
+export { SECRET_KEYS, PROVIDER_BASE_URL_DEFAULTS, PROVIDER_BASE_URL_KEYS } from "./LlmProviderConfig";
+export type { LlmTestResult } from "./LlmTestResult";
+export type { SettingsState } from "./SettingsState";

package/extension/src/native-addon-manager.ts

@@ -0,0 +1,194 @@
+import * as vscode from "vscode";
+import * as fs from "fs";
+import * as path from "path";
+import { execSync } from "child_process";
+import { downloadFile, computeSha256, getProxyUrl } from "./addon-download-helpers";
+
+interface NativeAddonManifestEntry { url: string; size: number; sha256: string; }
+interface NativeAddonManifest { "better-sqlite3": { version: string; releaseUrl: string; binaries: Record<string, NativeAddonManifestEntry> } }
+
+export interface PlatformInfo {
+  platform: string; arch: string; napiVersion: string; nodeMajorVersion: string;
+  electronVersion: string; supported: boolean; cacheKey: string; cacheDir: string;
+}
+
+export class NativeAddonManager {
+  private readonly globalStoragePath: string;
+  private readonly extensionPath: string;
+  private readonly outputChannel: vscode.OutputChannel;
+  private readonly manifest: NativeAddonManifest;
+
+  constructor(context: vscode.ExtensionContext, outputChannel: vscode.OutputChannel) {
+    this.globalStoragePath = context.globalStorageUri.fsPath;
+    this.extensionPath = context.extensionPath;
+    this.outputChannel = outputChannel;
+    this.manifest = this.loadManifest();
+  }
+
+  public async ensure(): Promise<string | null> {
+    const info = this.getPlatformInfo();
+    if (!info.supported) { this.showUnsupportedError(info); return null; }
+    const bindingPath = path.join(info.cacheDir, "better_sqlite3.node");
+    if (fs.existsSync(bindingPath)) {
+      const stat = fs.statSync(bindingPath);
+      if (stat.size > 0) {
+        this.outputChannel.appendLine(`[NativeAddon] Cache hit: ${bindingPath} (${(stat.size / 1024 / 1024).toFixed(1)} MB)`);
+        return bindingPath;
+      }
+      fs.unlinkSync(bindingPath);
+    }
+    return this.downloadWithProgress(info);
+  }
+
+  public getCachedPath(): string | null {
+    const info = this.getPlatformInfo();
+    const bindingPath = path.join(info.cacheDir, "better_sqlite3.node");
+    if (fs.existsSync(bindingPath) && fs.statSync(bindingPath).size > 0) { return bindingPath; }
+    return null;
+  }
+
+  public async redownload(): Promise<string | null> {
+    const info = this.getPlatformInfo();
+    const bindingPath = path.join(info.cacheDir, "better_sqlite3.node");
+    if (fs.existsSync(bindingPath)) { fs.unlinkSync(bindingPath); }
+    return this.downloadWithProgress(info);
+  }
+
+  public getPlatformInfo(): PlatformInfo {
+    const platform = process.platform;
+    const arch = process.arch;
+    const napiVersion = process.versions.napi || "9";
+    const nodeMajorVersion = this.getSystemNodeMajorVersion();
+    const electronVersion = process.versions.electron || "unknown";
+    const version = this.manifest["better-sqlite3"].version;
+    const binaries = this.manifest["better-sqlite3"].binaries;
+    let cacheKey = `node-v${nodeMajorVersion}-${platform}-${arch}`;
+    let supported = cacheKey in binaries;
+    if (!supported) { supported = this.tryNodeFallback(binaries, platform, arch, nodeMajorVersion, (k) => { cacheKey = k; }); }
+    if (!supported) { supported = this.tryNapiFallback(binaries, platform, arch, napiVersion, (k) => { cacheKey = k; }); }
+    const cacheDir = path.join(this.globalStoragePath, "native-addons", "better-sqlite3", `v${version}`, cacheKey);
+    return { platform, arch, napiVersion, nodeMajorVersion, electronVersion, supported, cacheKey, cacheDir };
+  }
+
+  private tryNodeFallback(binaries: Record<string, any>, platform: string, arch: string, nodeMajor: string, setCacheKey: (k: string) => void): boolean {
+    const runtimeMajor = parseInt(nodeMajor, 10);
+    const candidates = Object.keys(binaries)
+      .filter(k => k.startsWith("node-v") && k.endsWith(`-${platform}-${arch}`))
+      .map(k => ({ key: k, major: parseInt(k.match(/node-v(\d+)/)?.[1] || "0", 10) }))
+      .filter(c => c.major <= runtimeMajor)
+      .sort((a, b) => b.major - a.major);
+    if (candidates.length > 0) {
+      setCacheKey(candidates[0].key);
+      this.outputChannel.appendLine(`[NativeAddon] Node v${nodeMajor}, using compatible binary: ${candidates[0].key}`);
+      return true;
+    }
+    return false;
+  }
+
+  private tryNapiFallback(binaries: Record<string, any>, platform: string, arch: string, napiVersion: string, setCacheKey: (k: string) => void): boolean {
+    const runtimeNapi = parseInt(napiVersion, 10);
+    const candidates = Object.keys(binaries)
+      .filter(k => k.startsWith("napi-v") && k.endsWith(`-${platform}-${arch}`))
+      .map(k => ({ key: k, napi: parseInt(k.match(/napi-v(\d+)/)?.[1] || "0", 10) }))
+      .filter(c => c.napi <= runtimeNapi)
+      .sort((a, b) => b.napi - a.napi);
+    if (candidates.length > 0) {
+      setCacheKey(candidates[0].key);
+      this.outputChannel.appendLine(`[NativeAddon] Legacy fallback — N-API v${napiVersion}, using: ${candidates[0].key}`);
+      return true;
+    }
+    return false;
+  }
+
+  private loadManifest(): NativeAddonManifest {
+    const manifestPath = path.join(this.extensionPath, "resources", "release-manifest.json");
+    if (!fs.existsSync(manifestPath)) { throw new Error(`Release manifest not found: ${manifestPath}`); }
+    return JSON.parse(fs.readFileSync(manifestPath, "utf-8"));
+  }
+
+  private getSystemNodeMajorVersion(): string {
+    try {
+      try {
+        const mv = execSync(`"${process.execPath}" -p "process.versions.modules"`, { encoding: "utf-8", timeout: 5000 }).trim();
+        const major = this.moduleVersionToNodeMajor(mv);
+        if (major) { this.outputChannel.appendLine(`[NativeAddon] Runtime MODULE_VERSION=${mv} → Node v${major}`); return major; }
+      } catch { /* fallback */ }
+      const output = execSync(`"${process.execPath}" --version`, { encoding: "utf-8", timeout: 5000 }).trim();
+      const major = output.replace("v", "").split(".")[0];
+      this.outputChannel.appendLine(`[NativeAddon] System Node: ${output} (major: ${major})`);
+      return major;
+    } catch {
+      const fallback = process.versions.node.split(".")[0];
+      this.outputChannel.appendLine(`[NativeAddon] Cannot detect system Node, using host: v${fallback}`);
+      return fallback;
+    }
+  }
+
+  private moduleVersionToNodeMajor(moduleVersion: string): string | null {
+    const map: Record<string, string> = { "83": "14", "93": "16", "108": "18", "115": "20", "127": "22", "131": "22", "132": "23", "135": "24", "137": "24", "139": "24", "141": "25" };
+    return map[moduleVersion] || null;
+  }
+
+  private async downloadWithProgress(info: PlatformInfo): Promise<string | null> {
+    const entry = this.manifest["better-sqlite3"].binaries[info.cacheKey];
+    if (!entry) { this.showUnsupportedError(info); return null; }
+    if (!fs.existsSync(info.cacheDir)) { fs.mkdirSync(info.cacheDir, { recursive: true }); }
+    const bindingPath = path.join(info.cacheDir, "better_sqlite3.node");
+    this.outputChannel.appendLine(`[NativeAddon] Downloading: ${entry.url}`);
+    this.outputChannel.appendLine(`[NativeAddon] Target: ${bindingPath}`);
+    return vscode.window.withProgress(
+      { location: vscode.ProgressLocation.Notification, title: "Kiro SDLC: Downloading native module...", cancellable: true },
+      (progress, token) => this.attemptDownload(entry, bindingPath, info, progress, token)
+    );
+  }
+
+  private async attemptDownload(
+    entry: NativeAddonManifestEntry, bindingPath: string, info: PlatformInfo,
+    progress: vscode.Progress<{ message?: string; increment?: number }>, token: vscode.CancellationToken
+  ): Promise<string | null> {
+    const backoffs = [0, 2000, 4000];
+    for (let attempt = 0; attempt < 3; attempt++) {
+      if (token.isCancellationRequested) { vscode.window.showInformationMessage("Download cancelled."); return null; }
+      if (attempt > 0) {
+        this.outputChannel.appendLine(`[NativeAddon] Retry ${attempt + 1}/3...`);
+        progress.report({ message: `Retrying (${attempt + 1}/3)...` });
+        await this.sleep(backoffs[attempt]);
+      }
+      try {
+        await downloadFile(entry.url, bindingPath, entry.size, progress, token, getProxyUrl(), this.outputChannel);
+        progress.report({ message: "Verifying integrity..." });
+        const hash = await computeSha256(bindingPath);
+        if (hash !== entry.sha256) {
+          this.outputChannel.appendLine(`[NativeAddon] Checksum mismatch`);
+          if (fs.existsSync(bindingPath)) { fs.unlinkSync(bindingPath); }
+          continue;
+        }
+        this.outputChannel.appendLine(`[NativeAddon] ✅ Downloaded and verified: ${bindingPath}`);
+        return bindingPath;
+      } catch (err: any) {
+        this.outputChannel.appendLine(`[NativeAddon] Attempt ${attempt + 1} failed: ${err.message}`);
+        if (fs.existsSync(bindingPath)) { try { fs.unlinkSync(bindingPath); } catch { } }
+      }
+    }
+    this.showDownloadError(info);
+    return null;
+  }
+
+  private showUnsupportedError(info: PlatformInfo): void {
+    const msg = `Platform ${info.platform}-${info.arch} (Node v${info.nodeMajorVersion}) is not supported.`;
+    this.outputChannel.appendLine(`[NativeAddon] ❌ ${msg}`);
+    vscode.window.showErrorMessage(msg, "View Documentation").then((action) => {
+      if (action === "View Documentation") { vscode.env.openExternal(vscode.Uri.parse(this.manifest["better-sqlite3"].releaseUrl)); }
+    });
+  }
+
+  private showDownloadError(info: PlatformInfo): void {
+    this.outputChannel.appendLine(`[NativeAddon] ❌ All download attempts failed for ${info.cacheKey}`);
+    vscode.window.showErrorMessage("Failed to download native module after 3 attempts.", "Retry", "Manual Download").then((action) => {
+      if (action === "Retry") { this.redownload(); }
+      else if (action === "Manual Download") { vscode.env.openExternal(vscode.Uri.parse(this.manifest["better-sqlite3"].releaseUrl)); }
+    });
+  }
+
+  private sleep(ms: number): Promise<void> { return new Promise((resolve) => setTimeout(resolve, ms)); }
+}

package/extension/src/panels/analytics-panel.ts

@@ -0,0 +1,31 @@
+/**
+ * AnalyticsPanel — Search volume, popular queries, gaps, recommendations.
+ * Real-time updates via KbEventBus SSE subscription + polling fallback.
+ */
+
+import * as vscode from "vscode";
+import { WebviewToExtMessage, SERVER_CONSTANTS } from "../types";
+import { McpServerManager } from "../mcp-server-manager";
+import { BasePanel } from "./base-panel";
+import { KbEventBus } from "../kb-event-bus";
+
+export class AnalyticsPanel extends BasePanel {
+  private refreshTimer: NodeJS.Timeout | undefined;
+  private eventSubscription: vscode.Disposable | undefined;
+
+  constructor(mcpManager: McpServerManager, extensionUri: vscode.Uri, eventBus?: KbEventBus) {
+    super("analytics", mcpManager, extensionUri);
+  }
+
+  getHtml(webview: vscode.Webview): string {
+    return this.getIframeHtml();
+  }
+
+  async loadData(): Promise<void> {
+    // No-op
+  }
+
+  async handleMessage(msg: WebviewToExtMessage): Promise<void> {
+    // No-op
+  }
+}