sdlc-agent-4-enterprise-server 1.0.0

package/extension/src/langgraph/providers/token-manager.ts

@@ -0,0 +1,180 @@
+/**
+ * TokenManager — KSA-231
+ * AWS SSO credential detection, in-memory storage, and auto-refresh.
+ * Security: Credentials exist ONLY in memory — never in settings, logs, or telemetry.
+ */
+
+import * as vscode from "vscode";
+import * as fs from "fs";
+import * as path from "path";
+import * as os from "os";
+import { refreshTokenWithRetry } from "./token-refresh";
+
+export type CredentialStatus = "active" | "refreshing" | "expired" | "no_credentials" | "unavailable";
+
+export interface KiroCredentials {
+  accessToken: string;
+  expiresAt: Date;
+  region: string;
+  refreshToken: string;
+  clientId: string;
+  clientSecret: string;
+  authMethod?: string;
+  status: CredentialStatus;
+  sourceFile: string;
+}
+
+class Mutex {
+  private locked = false;
+  private queue: (() => void)[] = [];
+  async acquire(): Promise<void> {
+    if (!this.locked) { this.locked = true; return; }
+    return new Promise<void>(resolve => this.queue.push(resolve));
+  }
+  release(): void {
+    if (this.queue.length > 0) this.queue.shift()!();
+    else this.locked = false;
+  }
+}
+
+export class TokenManager implements vscode.Disposable {
+  private credentials: KiroCredentials | null = null;
+  private refreshTimer: ReturnType<typeof setTimeout> | null = null;
+  private readonly refreshMutex = new Mutex();
+  private watcher: vscode.FileSystemWatcher | null = null;
+  private initialized = false;
+  private readonly _onStatusChange = new vscode.EventEmitter<CredentialStatus>();
+  readonly onStatusChange: vscode.Event<CredentialStatus> = this._onStatusChange.event;
+  private readonly outputChannel: vscode.OutputChannel;
+
+  constructor(outputChannel: vscode.OutputChannel) {
+    this.outputChannel = outputChannel;
+  }
+
+  async initialize(): Promise<void> {
+    if (this.initialized) return;
+    this.initialized = true;
+    const cacheDir = path.join(os.homedir(), ".aws", "sso", "cache");
+    if (!fs.existsSync(cacheDir)) { this.setStatus("unavailable"); return; }
+    await this.scanAndSelectCredentials(cacheDir);
+    this.startFileWatcher(cacheDir);
+  }
+
+  async getAccessToken(): Promise<string> {
+    if (!this.initialized) await this.initialize();
+    if (!this.credentials) throw new KiroCredentialError("No Kiro credentials available.");
+    if (this.credentials.expiresAt.getTime() - Date.now() < 60_000) await this.refreshToken();
+    if (!this.credentials || this.credentials.status === "expired") {
+      throw new KiroCredentialError("Kiro token expired. Please re-login.");
+    }
+    return this.credentials.accessToken;
+  }
+
+  getRegion(): string | undefined {
+    const override = vscode.workspace.getConfiguration("kiroSdlc").get<string>("kiroRegion", "");
+    return override || this.credentials?.region;
+  }
+
+  getStatus(): CredentialStatus { return this.credentials?.status ?? "no_credentials"; }
+
+  dispose(): void {
+    if (this.refreshTimer) { clearTimeout(this.refreshTimer); this.refreshTimer = null; }
+    if (this.watcher) { this.watcher.dispose(); this.watcher = null; }
+    if (this.credentials) {
+      this.credentials.accessToken = "";
+      this.credentials.refreshToken = "";
+      this.credentials.clientSecret = "";
+      this.credentials = null;
+    }
+    this._onStatusChange.dispose();
+  }
+
+  async refreshToken(): Promise<void> {
+    await this.refreshMutex.acquire();
+    try {
+      if (!this.credentials) return;
+      if (this.credentials.expiresAt.getTime() - Date.now() > 4 * 60_000) return;
+      const success = await refreshTokenWithRetry(this.credentials, {
+        setStatus: (s) => this.setStatus(s),
+        log: (l, m) => this.log(l, m),
+        scheduleRefresh: () => this.scheduleRefresh(),
+      });
+      if (!success) this.refreshTimer = setTimeout(() => this.refreshToken(), 30_000);
+    } finally {
+      this.refreshMutex.release();
+    }
+  }
+
+  private async scanAndSelectCredentials(cacheDir: string): Promise<void> {
+    try {
+      const files = fs.readdirSync(cacheDir).filter(f => f.endsWith(".json"));
+      const candidates: KiroCredentials[] = [];
+      for (const file of files) {
+        try {
+          const filePath = path.join(cacheDir, file);
+          const cred = this.parseCredentialFile(JSON.parse(fs.readFileSync(filePath, "utf-8")), filePath);
+          if (cred) candidates.push(cred);
+        } catch { /* skip */ }
+      }
+      if (candidates.length === 0) { this.setStatus("no_credentials"); return; }
+      const valid = candidates.filter(c => c.expiresAt.getTime() > Date.now());
+      if (valid.length === 0) { this.setStatus("expired"); return; }
+      valid.sort((a, b) => {
+        if (a.authMethod === "idc" && b.authMethod !== "idc") return -1;
+        if (a.authMethod !== "idc" && b.authMethod === "idc") return 1;
+        return b.expiresAt.getTime() - a.expiresAt.getTime();
+      });
+      this.credentials = valid[0];
+      this.credentials.status = "active";
+      this.setStatus("active");
+      this.scheduleRefresh();
+    } catch (err) {
+      this.log("ERROR", `Scan failed: ${(err as Error).message}`);
+      this.setStatus("unavailable");
+    }
+  }
+
+  private parseCredentialFile(data: any, filePath: string): KiroCredentials | null {
+    if (!data.accessToken || !data.expiresAt || !data.region || !data.refreshToken || !data.clientId || !data.clientSecret) return null;
+    const expiresAt = new Date(data.expiresAt);
+    if (isNaN(expiresAt.getTime())) return null;
+    if (!/^[a-z]{2}-[a-z]+-\d+$/.test(data.region)) return null;
+    return {
+      accessToken: data.accessToken, expiresAt, region: data.region,
+      refreshToken: data.refreshToken, clientId: data.clientId, clientSecret: data.clientSecret,
+      authMethod: data.authMethod, status: "active", sourceFile: filePath,
+    };
+  }
+
+  private scheduleRefresh(): void {
+    if (this.refreshTimer) clearTimeout(this.refreshTimer);
+    if (!this.credentials) return;
+    const delay = Math.max(this.credentials.expiresAt.getTime() - 5 * 60_000 - Date.now(), 10_000);
+    this.refreshTimer = setTimeout(() => this.refreshToken(), delay);
+  }
+
+  private startFileWatcher(cacheDir: string): void {
+    const pattern = new vscode.RelativePattern(vscode.Uri.file(cacheDir), "*.json");
+    this.watcher = vscode.workspace.createFileSystemWatcher(pattern);
+    const rescan = () => this.scanAndSelectCredentials(cacheDir);
+    this.watcher.onDidCreate(rescan);
+    this.watcher.onDidChange(rescan);
+  }
+
+  private setStatus(status: CredentialStatus): void {
+    if (this.credentials) this.credentials.status = status;
+    this._onStatusChange.fire(status);
+  }
+
+  private log(level: string, message: string): void {
+    this.outputChannel.appendLine(`[${level}] TokenManager: ${message}`);
+  }
+}
+
+export class KiroCredentialError extends Error {
+  constructor(message: string, options?: ErrorOptions) { super(message, options); this.name = "KiroCredentialError"; }
+}
+
+export class KiroRefreshError extends Error {
+  constructor(message: string, options?: ErrorOptions) { super(message, options); this.name = "KiroRefreshError"; }
+}

package/extension/src/langgraph/providers/token-refresh.ts

@@ -0,0 +1,94 @@
+/**
+ * Token Refresh Logic — extracted from TokenManager (KSA-231)
+ * SSO OIDC token refresh with retry logic.
+ */
+
+import * as vscode from "vscode";
+import * as fs from "fs";
+import type { KiroCredentials, CredentialStatus } from "./token-manager";
+
+interface RefreshCallbacks {
+  setStatus: (status: CredentialStatus) => void;
+  log: (level: string, message: string) => void;
+  scheduleRefresh: () => void;
+}
+
+export async function refreshTokenWithRetry(
+  credentials: KiroCredentials, callbacks: RefreshCallbacks
+): Promise<boolean> {
+  credentials.status = "refreshing";
+  callbacks.setStatus("refreshing");
+  callbacks.log("INFO", "Refreshing token (attempt 1/3)");
+
+  let lastError: Error | null = null;
+  const delays = [1000, 2000, 4000];
+
+  for (let attempt = 0; attempt < 3; attempt++) {
+    try {
+      const result = await callSsoOidc(credentials);
+      if (result === "invalid_grant") {
+        credentials.status = "expired";
+        callbacks.setStatus("expired");
+        callbacks.log("WARN", "Refresh token expired. Re-login required.");
+        vscode.window.showWarningMessage("Kiro session expired. Please re-login.", "Open Kiro IDE");
+        return false;
+      }
+      if (result) {
+        credentials.accessToken = result.accessToken;
+        credentials.refreshToken = result.refreshToken;
+        credentials.expiresAt = new Date(Date.now() + result.expiresIn * 1000);
+        credentials.status = "active";
+        callbacks.setStatus("active");
+        callbacks.log("INFO", `Token refreshed. Expires at ${credentials.expiresAt.toISOString()}`);
+        writeBackToCache(credentials, callbacks.log);
+        callbacks.scheduleRefresh();
+        return true;
+      }
+    } catch (err) {
+      lastError = err as Error;
+      if (attempt < 2) {
+        callbacks.log("WARN", `Refresh attempt ${attempt + 1}/3 failed: ${lastError.message}`);
+        await new Promise(r => setTimeout(r, delays[attempt]));
+      }
+    }
+  }
+
+  callbacks.log("ERROR", `Token refresh failed after 3 attempts: ${lastError?.message}`);
+  credentials.status = "expired";
+  callbacks.setStatus("expired");
+  vscode.window.showWarningMessage("Cannot refresh Kiro token. Check network.", "Retry");
+  return false;
+}
+
+async function callSsoOidc(credentials: KiroCredentials): Promise<{ accessToken: string; refreshToken: string; expiresIn: number } | "invalid_grant"> {
+  const response = await fetch(`https://oidc.${credentials.region}.amazonaws.com/token`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      clientId: credentials.clientId, clientSecret: credentials.clientSecret,
+      grantType: "refresh_token", refreshToken: credentials.refreshToken,
+    }),
+    signal: AbortSignal.timeout(10_000),
+  });
+
+  if (response.status === 400) {
+    const body = await response.json().catch(() => ({})) as { error?: string };
+    if (body.error === "invalid_grant") return "invalid_grant";
+    throw new Error(`SSO OIDC 400: ${JSON.stringify(body)}`);
+  }
+  if (!response.ok) throw new Error(`SSO OIDC returned ${response.status}`);
+  return await response.json() as { accessToken: string; refreshToken: string; expiresIn: number };
+}
+
+function writeBackToCache(credentials: KiroCredentials, log: (l: string, m: string) => void): void {
+  try {
+    const content = fs.readFileSync(credentials.sourceFile, "utf-8");
+    const data = JSON.parse(content);
+    data.accessToken = credentials.accessToken;
+    data.refreshToken = credentials.refreshToken;
+    data.expiresAt = credentials.expiresAt.toISOString();
+    fs.writeFileSync(credentials.sourceFile, JSON.stringify(data, null, 2), "utf-8");
+  } catch (err) {
+    log("WARN", `Write-back failed: ${(err as Error).message}`);
+  }
+}

package/extension/src/langgraph/router/intent-classifier.ts

@@ -0,0 +1,131 @@
+/**
+ * Intent Classifier — Multi-Graph Architecture
+ * Classifies user input into a PipelineIntent using regex patterns (fast path)
+ * with LLM fallback for ambiguous inputs.
+ */
+
+import type { PipelineIntent } from "../state";
+import type { LlmProvider } from "../llm-provider";
+import { IntentClassification, CONFIDENCE_THRESHOLD } from "./router-state";
+
+// === Regex Pattern Rules (fast path) ===
+
+interface PatternRule {
+  pattern: RegExp;
+  intent: PipelineIntent;
+  confidence: number;
+}
+
+const PATTERN_RULES: PatternRule[] = [
+  // SDLC pipeline commands (ticket-based)
+  { pattern: /^[A-Z]+-\d+\s+(full|tao\s+brd|tao\s+fsd|tao\s+tdd|tao\s+stp|tao\s+stc|implement|deploy|test|tao\s+ug)/i, intent: "sdlc", confidence: 1.0 },
+  { pattern: /^[A-Z]+-\d+$/i, intent: "sdlc", confidence: 0.95 },
+  { pattern: /^[A-Z]+-\d+\s+/i, intent: "sdlc", confidence: 0.9 },
+
+  // Hotfix / bug fix
+  { pattern: /\b(fix\s+bug|hotfix|patch|bug\s+fix|urgent\s+fix|critical\s+bug)\b/i, intent: "hotfix", confidence: 0.95 },
+  { pattern: /\b(fix\s+lỗi|sửa\s+bug|sửa\s+lỗi|lỗi\s+gấp)\b/i, intent: "hotfix", confidence: 0.9 },
+
+  // Code review
+  { pattern: /\b(review\s+pr|code\s+review|review\s+#\d+|review\s+code|pr\s+review)\b/i, intent: "code_review", confidence: 0.95 },
+  { pattern: /\b(review\s+pull\s+request|merge\s+request\s+review)\b/i, intent: "code_review", confidence: 0.9 },
+
+  // Documentation
+  { pattern: /\b(tao\s+ug|tao\s+dpg|create\s+guide|write\s+docs|viết\s+user\s+guide)\b/i, intent: "docs", confidence: 0.95 },
+  { pattern: /\b(generate\s+documentation|update\s+readme)\b/i, intent: "docs", confidence: 0.85 },
+
+  // Security audit
+  { pattern: /\b(security\s+audit|scan\s+vulnerability|vulnerability\s+scan|owasp\s+scan|security\s+scan)\b/i, intent: "security_audit", confidence: 0.95 },
+  { pattern: /\b(audit\s+bảo\s+mật|scan\s+bảo\s+mật)\b/i, intent: "security_audit", confidence: 0.9 },
+];
+
+/**
+ * Classify user input into a PipelineIntent.
+ * Fast regex match first; LLM fallback if confidence is below threshold.
+ */
+export async function classifyIntent(
+  userInput: string,
+  llmProvider?: LlmProvider
+): Promise<IntentClassification> {
+  // Fast path: regex matching
+  const regexResult = classifyByRegex(userInput);
+  if (regexResult.confidence >= CONFIDENCE_THRESHOLD) {
+    return regexResult;
+  }
+
+  // LLM fallback for ambiguous inputs
+  if (llmProvider) {
+    try {
+      const available = await llmProvider.isAvailable();
+      if (available) {
+        return await classifyByLlm(userInput, llmProvider);
+      }
+    } catch {
+      // Fall through to regex result
+    }
+  }
+
+  // Return best regex match or default to chat
+  return regexResult;
+}
+
+/**
+ * Fast regex classification — O(n) scan through pattern rules.
+ */
+function classifyByRegex(input: string): IntentClassification {
+  const trimmed = input.trim();
+
+  for (const rule of PATTERN_RULES) {
+    if (rule.pattern.test(trimmed)) {
+      return {
+        intent: rule.intent,
+        confidence: rule.confidence,
+        source: "regex",
+      };
+    }
+  }
+
+  // Default: chat (free-form conversation)
+  return {
+    intent: "chat",
+    confidence: 0.6,
+    source: "regex",
+  };
+}
+
+/**
+ * LLM-based classification — one-shot prompt for ambiguous inputs.
+ */
+async function classifyByLlm(
+  input: string,
+  llmProvider: LlmProvider
+): Promise<IntentClassification> {
+  const systemPrompt = `You are an intent classifier for an SDLC pipeline system.
+Classify the user's message into exactly ONE of these intents:
+- "sdlc": SDLC pipeline tasks (create BRD/FSD/TDD, implement feature, deploy, test — usually with a ticket key like KSA-123)
+- "hotfix": Bug fixes, urgent patches, error resolution
+- "code_review": PR review, code quality review, merge request review
+- "docs": Documentation generation (user guides, deployment guides, README)
+- "security_audit": Security scanning, vulnerability analysis, OWASP checks
+- "chat": General questions, help, conversation, explanations
+
+Respond with ONLY the intent string, nothing else.`;
+
+  const response = await llmProvider.chat(
+    [
+      { role: "system", content: systemPrompt },
+      { role: "user", content: input },
+    ],
+    { temperature: 0, maxTokens: 20 }
+  );
+
+  const normalized = response.trim().toLowerCase().replace(/['"]/g, "") as PipelineIntent;
+  const validIntents: PipelineIntent[] = ["sdlc", "hotfix", "code_review", "docs", "security_audit", "chat"];
+
+  if (validIntents.includes(normalized)) {
+    return { intent: normalized, confidence: 0.85, source: "llm" };
+  }
+
+  // LLM returned invalid — fallback to chat
+  return { intent: "chat", confidence: 0.5, source: "llm" };
+}

package/extension/src/langgraph/router/router-graph.ts

@@ -0,0 +1,187 @@
+// Router Graph --- Multi-Graph Architecture --- classifies intent and routes to subgraphs
+import { StateGraph, END } from "@langchain/langgraph";
+import { PipelineAnnotation, PipelineState, PipelineIntent } from "../state";
+import { McpBridge } from "../mcp-bridge";
+import { StreamHandler } from "../stream-handler";
+import { WorkspaceCheckpointer } from "../checkpointer";
+import type { LlmProvider } from "../llm-provider";
+import type { HookEngine } from "../hook-engine";
+import { classifyIntent } from "./intent-classifier";
+
+export async function buildRouterGraph(
+  mcpBridge: McpBridge,
+  streamHandler: StreamHandler,
+  checkpointer: WorkspaceCheckpointer,
+  llmProvider?: LlmProvider,
+  hookEngine?: HookEngine
+) {
+  // Lazy-load subgraph invokers (only imported when needed)
+  const subgraphCache = new Map<PipelineIntent, (state: PipelineState) => Promise<Partial<PipelineState>>>();
+
+  async function getSubgraphInvoker(intent: PipelineIntent): Promise<(state: PipelineState) => Promise<Partial<PipelineState>>> {
+    if (subgraphCache.has(intent)) {
+      return subgraphCache.get(intent)!;
+    }
+
+    let invoker: (state: PipelineState) => Promise<Partial<PipelineState>>;
+
+    switch (intent) {
+      case "sdlc": {
+        const { buildSdlcSubgraph } = await import("../graphs/sdlc-graph");
+        const graph = await buildSdlcSubgraph(mcpBridge, streamHandler, checkpointer, llmProvider);
+        invoker = async (state) => {
+          const result = await graph.invoke(state, { configurable: { thread_id: state.threadId } });
+          return result as Partial<PipelineState>;
+        };
+        break;
+      }
+      case "hotfix": {
+        const { buildHotfixSubgraph } = await import("../graphs/hotfix-graph");
+        const graph = await buildHotfixSubgraph(mcpBridge, streamHandler, llmProvider);
+        invoker = async (state) => {
+          const result = await graph.invoke(state);
+          return result as Partial<PipelineState>;
+        };
+        break;
+      }
+      case "code_review": {
+        const { buildCodeReviewSubgraph } = await import("../graphs/code-review-graph");
+        const graph = await buildCodeReviewSubgraph(mcpBridge, streamHandler, llmProvider);
+        invoker = async (state) => {
+          const result = await graph.invoke(state);
+          return result as Partial<PipelineState>;
+        };
+        break;
+      }
+      case "docs": {
+        const { buildDocsSubgraph } = await import("../graphs/docs-graph");
+        const graph = await buildDocsSubgraph(mcpBridge, streamHandler, llmProvider);
+        invoker = async (state) => {
+          const result = await graph.invoke(state);
+          return result as Partial<PipelineState>;
+        };
+        break;
+      }
+      case "security_audit": {
+        const { buildSecurityAuditSubgraph } = await import("../graphs/security-audit-graph");
+        const graph = await buildSecurityAuditSubgraph(mcpBridge, streamHandler, llmProvider);
+        invoker = async (state) => {
+          const result = await graph.invoke(state);
+          return result as Partial<PipelineState>;
+        };
+        break;
+      }
+      case "chat":
+      default: {
+        const { buildChatSubgraph } = await import("../graphs/chat-graph");
+        const wsRoot = require("vscode").workspace.workspaceFolders?.[0]?.uri.fsPath || "";
+        const graph = await buildChatSubgraph(streamHandler, llmProvider, mcpBridge, wsRoot, hookEngine);
+        invoker = async (state) => {
+          const result = await graph.invoke(state);
+          return result as Partial<PipelineState>;
+        };
+        break;
+      }
+    }
+
+    subgraphCache.set(intent, invoker);
+    return invoker;
+  }
+
+  // === Build the router graph ===
+
+  const graph = new StateGraph(PipelineAnnotation)
+    // Node: classify user intent
+    .addNode("classify_intent", async (state: PipelineState) => {
+      const lastMessage = state.chatHistory?.[state.chatHistory.length - 1];
+      const userInput = lastMessage?.content || state.ticketKey || "";
+
+      // If intent is already set (pre-classified by engine), skip classification
+      if (state.intent) {
+        return { lastUpdatedAt: new Date().toISOString() };
+      }
+
+      const classification = await classifyIntent(userInput, llmProvider);
+      return {
+        intent: classification.intent,
+        lastUpdatedAt: new Date().toISOString(),
+      };
+    })
+
+    // Node: SDLC subgraph
+    .addNode("sdlc_subgraph", async (state: PipelineState) => {
+      const invoker = await getSubgraphInvoker("sdlc");
+      return invoker(state);
+    })
+
+    // Node: Hotfix subgraph
+    .addNode("hotfix_subgraph", async (state: PipelineState) => {
+      const invoker = await getSubgraphInvoker("hotfix");
+      return invoker(state);
+    })
+
+    // Node: Code review subgraph
+    .addNode("code_review_subgraph", async (state: PipelineState) => {
+      const invoker = await getSubgraphInvoker("code_review");
+      return invoker(state);
+    })
+
+    // Node: Docs subgraph
+    .addNode("docs_subgraph", async (state: PipelineState) => {
+      const invoker = await getSubgraphInvoker("docs");
+      return invoker(state);
+    })
+
+    // Node: Security audit subgraph
+    .addNode("security_audit_subgraph", async (state: PipelineState) => {
+      const invoker = await getSubgraphInvoker("security_audit");
+      return invoker(state);
+    })
+
+    // Node: Chat subgraph
+    .addNode("chat_subgraph", async (state: PipelineState) => {
+      const invoker = await getSubgraphInvoker("chat");
+      return invoker(state);
+    })
+
+    // Entry: start → classify
+    .addEdge("__start__", "classify_intent")
+
+    // Conditional routing from classifier to subgraphs
+    .addConditionalEdges("classify_intent", routeByIntent, {
+      sdlc_subgraph: "sdlc_subgraph",
+      hotfix_subgraph: "hotfix_subgraph",
+      code_review_subgraph: "code_review_subgraph",
+      docs_subgraph: "docs_subgraph",
+      security_audit_subgraph: "security_audit_subgraph",
+      chat_subgraph: "chat_subgraph",
+    })
+
+    // All subgraphs terminate to END
+    .addEdge("sdlc_subgraph", END)
+    .addEdge("hotfix_subgraph", END)
+    .addEdge("code_review_subgraph", END)
+    .addEdge("docs_subgraph", END)
+    .addEdge("security_audit_subgraph", END)
+    .addEdge("chat_subgraph", END);
+
+  return graph.compile({ checkpointer });
+}
+
+function routeByIntent(state: PipelineState): string {
+  switch (state.intent) {
+    case "sdlc":
+      return "sdlc_subgraph";
+    case "hotfix":
+      return "hotfix_subgraph";
+    case "code_review":
+      return "code_review_subgraph";
+    case "docs":
+      return "docs_subgraph";
+    case "security_audit":
+      return "security_audit_subgraph";
+    case "chat":
+    default:
+      return "chat_subgraph";
+  }
+}

package/extension/src/langgraph/router/router-state.ts

@@ -0,0 +1,19 @@
+/**
+ * Router State — Multi-Graph Architecture
+ * Router-specific state extensions for intent classification and subgraph routing.
+ */
+
+export type { PipelineIntent } from "../state";
+
+/**
+ * Confidence score from intent classification.
+ * Used to decide whether regex match is sufficient or LLM fallback is needed.
+ */
+export interface IntentClassification {
+  intent: import("../state").PipelineIntent;
+  confidence: number; // 0.0–1.0
+  source: "regex" | "llm";
+}
+
+/** Threshold below which we fall back to LLM classification */
+export const CONFIDENCE_THRESHOLD = 0.8;

package/extension/src/langgraph/state-types.ts

@@ -0,0 +1,21 @@
+/**
+ * Pipeline state type definitions --- KSA-210
+ */
+
+import type { LlmToolCall } from "./llm-provider";
+
+export type SDLCPhase = "requirements" | "specification" | "design" | "test_planning" | "implementation" | "user_guide" | "testing" | "deployment" | "all";
+export type PipelineIntent = "sdlc" | "hotfix" | "code_review" | "docs" | "security_audit" | "chat";
+export type PipelineStatus = "idle" | "running" | "paused" | "completed" | "failed" | "cancelled";
+export type ApprovalDecision = "approve" | "reject" | "revise";
+export type StreamEventType = "token" | "status" | "progress" | "complete" | "error" | "retry" | "verify" | "strategy_switch" | "human_intervention_required";
+
+export interface StrategyEvent { nodeId: string; strategy: string; timestamp: string; reason: string; }
+export interface DocumentState { status: "pending" | "in_progress" | "done" | "failed"; version: number; path: string | null; completedAt: string | null; }
+export interface AgentOutput { nodeId: string; content: string; timestamp: string; metadata?: Record<string, unknown>; }
+export interface QualityGateCheckpoint { gateId: string; phase: SDLCPhase; nodeId: string; summary: string; criteria: string[]; timestamp: string; }
+export interface QualityGateResult { passed: boolean; issues: string[]; }
+export interface ChatMessage { id: string; role: "user" | "assistant" | "system"; content: string; nodeId?: string; timestamp: string; }
+export interface PipelineError { nodeId: string; code: string; message: string; timestamp: string; recoverable: boolean; }
+export interface PipelineGraphNode { id: string; label: string; status: "idle" | "active" | "completed" | "failed" | "skipped"; phase: SDLCPhase; }
+export interface PersistedPipelineInfo { threadId: string; ticketKey: string; phase: SDLCPhase; status: PipelineStatus; lastUpdatedAt: string; }