tryassay 0.31.0 → 0.33.0

package/dist/hunt/__tests__/e2e.test.js

@@ -0,0 +1,261 @@
+import { describe, it, expect, vi } from 'vitest';
+import { HuntOrchestrator } from '../orchestrator.js';
+import { mkdtempSync, writeFileSync, mkdirSync } from 'fs';
+import { join } from 'path';
+import { tmpdir } from 'os';
+function makeTempRepo(files) {
+    const dir = mkdtempSync(join(tmpdir(), 'hunt-e2e-'));
+    for (const [path, content] of Object.entries(files)) {
+        const full = join(dir, path);
+        mkdirSync(join(full, '..'), { recursive: true });
+        writeFileSync(full, content);
+    }
+    return dir;
+}
+describe('Hunt E2E', () => {
+    it('full pipeline: discover → match → triage → deep dive', async () => {
+        const dir = makeTempRepo({
+            'src/csrf-protection.ts': `
+        // CSRF protection for origin validation
+        // Wildcards like *.com should be rejected
+        export function matchWildcardDomain(origin: string, pattern: string): boolean {
+          if (!pattern.startsWith('*.')) return origin === pattern;
+          const suffix = pattern.slice(1); // e.g., '.example.com'
+          return origin.endsWith(suffix);
+        }
+
+        export function validateOrigin(origin: string, allowlist: string[]): boolean {
+          return allowlist.some(pattern => matchWildcardDomain(origin, pattern));
+        }
+      `,
+        });
+        let triageCallCount = 0;
+        let deepDiveCallCount = 0;
+        const mockProvider = {
+            type: 'api',
+            complete: vi.fn().mockImplementation(async (params) => {
+                // Detect phase by looking at the prompt
+                const prompt = params.userPrompt || '';
+                const isDeepDive = prompt.includes('HYPOTHESIS:');
+                if (isDeepDive) {
+                    deepDiveCallCount++;
+                    return {
+                        content: JSON.stringify({
+                            confirmed: true,
+                            title: 'CSRF Bypass via TLD Wildcard',
+                            severity: 'high',
+                            cwe: 'CWE-352',
+                            attack_scenario: '1. Register evil.com\n2. *.com pattern matches evil.com',
+                            reproduction_steps: 'matchWildcardDomain("evil.com", "*.com") returns true',
+                            evidence: 'Line 4: origin.endsWith(suffix) — for *.com, suffix is .com, and evil.com ends with .com',
+                            recommendation: 'Reject wildcards with fewer than 3 labels',
+                            false_positive_reason: null,
+                        }),
+                        inputTokens: 500,
+                        outputTokens: 200,
+                        provider: 'api',
+                        durationMs: 1000,
+                    };
+                }
+                else {
+                    triageCallCount++;
+                    return {
+                        content: JSON.stringify({
+                            vulnerable: true,
+                            confidence: 'high',
+                            summary: 'matchWildcardDomain accepts TLD wildcards like *.com',
+                            attacker_control: 'Origin header',
+                            impact: 'CSRF bypass for any .com domain',
+                            line: 4,
+                        }),
+                        inputTokens: 200,
+                        outputTokens: 80,
+                        provider: 'api',
+                        durationMs: 600,
+                    };
+                }
+            }),
+        };
+        const orch = new HuntOrchestrator({
+            targetPath: dir,
+            provider: mockProvider,
+            concurrency: 1,
+        });
+        // Triage phase
+        const triageResult = await orch.triage();
+        expect(triageResult.filesScanned).toBe(1);
+        expect(triageResult.hypotheses.length).toBeGreaterThanOrEqual(1);
+        expect(triageCallCount).toBeGreaterThanOrEqual(1);
+        // Verify triage result structure
+        const hypothesis = triageResult.hypotheses[0];
+        expect(hypothesis).toBeDefined();
+        expect(hypothesis.id).toBeDefined();
+        expect(hypothesis.templateId).toBeDefined();
+        expect(hypothesis.file).toContain('csrf-protection.ts');
+        expect(hypothesis.confidence).toBe('high');
+        expect(hypothesis.summary).toContain('TLD wildcards');
+        // Deep dive phase: only HIGH confidence hypotheses
+        const high = triageResult.hypotheses.filter(h => h.confidence === 'high');
+        expect(high.length).toBeGreaterThanOrEqual(1);
+        const findings = await orch.deepDive(high);
+        expect(deepDiveCallCount).toBeGreaterThanOrEqual(1);
+        expect(findings.length).toBeGreaterThanOrEqual(1);
+        // Verify finding structure
+        const finding = findings[0];
+        expect(finding.title).toContain('CSRF');
+        expect(finding.severity).toBe('high');
+        expect(finding.confirmed).toBe(true);
+        expect(finding.cwe).toBe('CWE-352');
+        expect(finding.attackScenario).toContain('evil.com');
+        expect(finding.reproductionSteps).toContain('matchWildcardDomain');
+        expect(finding.recommendation).toContain('Reject wildcards');
+    });
+    it('handles false positives during deep dive', async () => {
+        const dir = makeTempRepo({
+            'src/query-validator.ts': `
+        // Query validation - injection pattern match
+        export function validateQuery(query: string): boolean {
+          // Basic validation but appears to handle SQL queries
+          return query.length > 0;
+        }
+      `,
+        });
+        const mockProvider = {
+            type: 'api',
+            complete: vi.fn().mockImplementation(async (params) => {
+                // Detect phase by looking at the prompt
+                const prompt = params.userPrompt || '';
+                const isDeepDive = prompt.includes('HYPOTHESIS:');
+                if (isDeepDive) {
+                    // Deep dive rejects it as false positive
+                    return {
+                        content: JSON.stringify({
+                            confirmed: false,
+                            title: null,
+                            severity: null,
+                            cwe: null,
+                            attack_scenario: null,
+                            reproduction_steps: null,
+                            evidence: 'Query validation is basic but not actually executing queries, so not a real injection risk',
+                            recommendation: null,
+                            false_positive_reason: 'No actual SQL execution, just length check',
+                        }),
+                        inputTokens: 300,
+                        outputTokens: 80,
+                        provider: 'api',
+                        durationMs: 500,
+                    };
+                }
+                else {
+                    // Triage returns confidence medium
+                    return {
+                        content: JSON.stringify({
+                            vulnerable: true,
+                            confidence: 'medium',
+                            summary: 'Query validation might miss SQL injection vectors',
+                            attacker_control: 'Query parameter',
+                            impact: 'Potential injection if not properly sanitized',
+                            line: 3,
+                        }),
+                        inputTokens: 200,
+                        outputTokens: 60,
+                        provider: 'api',
+                        durationMs: 400,
+                    };
+                }
+            }),
+        };
+        const orch = new HuntOrchestrator({
+            targetPath: dir,
+            provider: mockProvider,
+            concurrency: 1,
+        });
+        const triageResult = await orch.triage();
+        expect(triageResult.hypotheses.length).toBeGreaterThanOrEqual(1);
+        const findings = await orch.deepDive(triageResult.hypotheses);
+        // False positives are filtered out (confirmed: false)
+        expect(findings.filter(f => f.confirmed).length).toBe(0);
+    });
+    it('respects confidence filters during triage', async () => {
+        const dir = makeTempRepo({
+            'src/token-generator.ts': `
+        // Token generation - security relevant
+        export function generateToken() {
+          return Math.random().toString();
+        }
+      `,
+        });
+        const mockProvider = {
+            type: 'api',
+            complete: vi.fn().mockResolvedValue({
+                content: JSON.stringify({
+                    vulnerable: true,
+                    confidence: 'low',
+                    summary: 'Weak random might be used for tokens',
+                    attacker_control: 'None',
+                    impact: 'Potential predictability',
+                    line: 3,
+                }),
+                inputTokens: 150,
+                outputTokens: 40,
+                provider: 'api',
+                durationMs: 300,
+            }),
+        };
+        const orch = new HuntOrchestrator({
+            targetPath: dir,
+            provider: mockProvider,
+            concurrency: 1,
+            minConfidence: 'high', // Filter to HIGH only
+        });
+        const triageResult = await orch.triage();
+        // LOW confidence should be filtered out by minConfidence
+        expect(triageResult.hypotheses.filter(h => h.confidence === 'low').length).toBe(0);
+    });
+    it('handles multiple files with multiple matches', async () => {
+        const dir = makeTempRepo({
+            'src/auth.ts': `
+        export function checkPassword(pwd: string, hash: string) {
+          return pwd === hash; // Insecure
+        }
+      `,
+            'src/crypto.ts': `
+        export function generateToken() {
+          return Math.random().toString(); // Weak random
+        }
+      `,
+        });
+        let fileNum = 0;
+        const mockProvider = {
+            type: 'api',
+            complete: vi.fn().mockImplementation(async () => {
+                fileNum++;
+                return {
+                    content: JSON.stringify({
+                        vulnerable: true,
+                        confidence: fileNum === 1 ? 'high' : 'medium',
+                        summary: `Issue in file ${fileNum}`,
+                        attacker_control: 'Test attacker',
+                        impact: 'Test impact',
+                        line: 2,
+                    }),
+                    inputTokens: 100,
+                    outputTokens: 50,
+                    provider: 'api',
+                    durationMs: 400,
+                };
+            }),
+        };
+        const orch = new HuntOrchestrator({
+            targetPath: dir,
+            provider: mockProvider,
+            concurrency: 1,
+        });
+        const triageResult = await orch.triage();
+        expect(triageResult.filesScanned).toBe(2);
+        // At least 2 pairs (2 files × at least 1 template match each)
+        expect(triageResult.templateMatchCount).toBeGreaterThanOrEqual(2);
+        expect(triageResult.hypotheses.length).toBeGreaterThanOrEqual(1);
+    });
+});
+//# sourceMappingURL=e2e.test.js.map

package/dist/hunt/__tests__/e2e.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"e2e.test.js","sourceRoot":"","sources":["../../../src/hunt/__tests__/e2e.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAC3D,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC;AAE5B,SAAS,YAAY,CAAC,KAA6B;IACjD,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,WAAW,CAAC,CAAC,CAAC;IACrD,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC7B,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE;IACxB,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,GAAG,GAAG,YAAY,CAAC;YACvB,wBAAwB,EAAE;;;;;;;;;;;;OAYzB;SACF,CAAC,CAAC;QAEH,IAAI,eAAe,GAAG,CAAC,CAAC;QACxB,IAAI,iBAAiB,GAAG,CAAC,CAAC;QAC1B,MAAM,YAAY,GAAG;YACnB,IAAI,EAAE,KAAc;YACpB,QAAQ,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,KAAK,EAAE,MAAW,EAAE,EAAE;gBACzD,wCAAwC;gBACxC,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;gBACvC,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;gBAElD,IAAI,UAAU,EAAE,CAAC;oBACf,iBAAiB,EAAE,CAAC;oBACpB,OAAO;wBACL,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC;4BACtB,SAAS,EAAE,IAAI;4BACf,KAAK,EAAE,8BAA8B;4BACrC,QAAQ,EAAE,MAAM;4BAChB,GAAG,EAAE,SAAS;4BACd,eAAe,EAAE,yDAAyD;4BAC1E,kBAAkB,EAAE,uDAAuD;4BAC3E,QAAQ,EAAE,0FAA0F;4BACpG,cAAc,EAAE,2CAA2C;4BAC3D,qBAAqB,EAAE,IAAI;yBAC5B,CAAC;wBACF,WAAW,EAAE,GAAG;wBAChB,YAAY,EAAE,GAAG;wBACjB,QAAQ,EAAE,KAAc;wBACxB,UAAU,EAAE,IAAI;qBACjB,CAAC;gBACJ,CAAC;qBAAM,CAAC;oBACN,eAAe,EAAE,CAAC;oBAClB,OAAO;wBACL,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC;4BACtB,UAAU,EAAE,IAAI;4BAChB,UAAU,EAAE,MAAM;4BAClB,OAAO,EAAE,sDAAsD;4BAC/D,gBAAgB,EAAE,eAAe;4BACjC,MAAM,EAAE,iCAAiC;4BACzC,IAAI,EAAE,CAAC;yBACR,CAAC;wBACF,WAAW,EAAE,GAAG;wBAChB,YAAY,EAAE,EAAE;wBAChB,QAAQ,EAAE,KAAc;wBACxB,UAAU,EAAE,GAAG;qBAChB,CAAC;gBACJ,CAAC;YACH,CAAC,CAAC;SACH,CAAC;QAEF,MAAM,IAAI,GAAG,IAAI,gBAAgB,CAAC;YAChC,UAAU,EAAE,GAAG;YACf,QAAQ,EAAE,YAAmB;YAC7B,WAAW,EAAE,CAAC;SACf,CAAC,CAAC;QAEH,eAAe;QACf,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACzC,MAAM,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1C,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;QACjE,MAAM,CAAC,eAAe,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;QAElD,iCAAiC;QACjC,MAAM,UAAU,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAC9C,MAAM,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;QACjC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QACpC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;QAC5C,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;QACxD,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC3C,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QAEtD,mDAAmD;QACnD,MAAM,IAAI,GAAG,YAAY,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,MAAM,CAAC,CAAC;QAC1E,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;QAE9C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,CAAC,iBAAiB,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;QACpD,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;QAElD,2BAA2B;QAC3B,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACpC,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACrD,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;QACnE,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;QACxD,MAAM,GAAG,GAAG,YAAY,CAAC;YACvB,wBAAwB,EAAE;;;;;;OAMzB;SACF,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG;YACnB,IAAI,EAAE,KAAc;YACpB,QAAQ,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,KAAK,EAAE,MAAW,EAAE,EAAE;gBACzD,wCAAwC;gBACxC,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;gBACvC,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;gBAElD,IAAI,UAAU,EAAE,CAAC;oBACf,yCAAyC;oBACzC,OAAO;wBACL,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC;4BACtB,SAAS,EAAE,KAAK;4BAChB,KAAK,EAAE,IAAI;4BACX,QAAQ,EAAE,IAAI;4BACd,GAAG,EAAE,IAAI;4BACT,eAAe,EAAE,IAAI;4BACrB,kBAAkB,EAAE,IAAI;4BACxB,QAAQ,EAAE,4FAA4F;4BACtG,cAAc,EAAE,IAAI;4BACpB,qBAAqB,EAAE,4CAA4C;yBACpE,CAAC;wBACF,WAAW,EAAE,GAAG;wBAChB,YAAY,EAAE,EAAE;wBAChB,QAAQ,EAAE,KAAc;wBACxB,UAAU,EAAE,GAAG;qBAChB,CAAC;gBACJ,CAAC;qBAAM,CAAC;oBACN,mCAAmC;oBACnC,OAAO;wBACL,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC;4BACtB,UAAU,EAAE,IAAI;4BAChB,UAAU,EAAE,QAAQ;4BACpB,OAAO,EAAE,mDAAmD;4BAC5D,gBAAgB,EAAE,iBAAiB;4BACnC,MAAM,EAAE,+CAA+C;4BACvD,IAAI,EAAE,CAAC;yBACR,CAAC;wBACF,WAAW,EAAE,GAAG;wBAChB,YAAY,EAAE,EAAE;wBAChB,QAAQ,EAAE,KAAc;wBACxB,UAAU,EAAE,GAAG;qBAChB,CAAC;gBACJ,CAAC;YACH,CAAC,CAAC;SACH,CAAC;QAEF,MAAM,IAAI,GAAG,IAAI,gBAAgB,CAAC;YAChC,UAAU,EAAE,GAAG;YACf,QAAQ,EAAE,YAAmB;YAC7B,WAAW,EAAE,CAAC;SACf,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACzC,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;QAEjE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;QAC9D,sDAAsD;QACtD,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,GAAG,GAAG,YAAY,CAAC;YACvB,wBAAwB,EAAE;;;;;OAKzB;SACF,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG;YACnB,IAAI,EAAE,KAAc;YACpB,QAAQ,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC;gBAClC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC;oBACtB,UAAU,EAAE,IAAI;oBAChB,UAAU,EAAE,KAAK;oBACjB,OAAO,EAAE,sCAAsC;oBAC/C,gBAAgB,EAAE,MAAM;oBACxB,MAAM,EAAE,0BAA0B;oBAClC,IAAI,EAAE,CAAC;iBACR,CAAC;gBACF,WAAW,EAAE,GAAG;gBAChB,YAAY,EAAE,EAAE;gBAChB,QAAQ,EAAE,KAAc;gBACxB,UAAU,EAAE,GAAG;aAChB,CAAC;SACH,CAAC;QAEF,MAAM,IAAI,GAAG,IAAI,gBAAgB,CAAC;YAChC,UAAU,EAAE,GAAG;YACf,QAAQ,EAAE,YAAmB;YAC7B,WAAW,EAAE,CAAC;YACd,aAAa,EAAE,MAAM,EAAE,sBAAsB;SAC9C,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACzC,yDAAyD;QACzD,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,GAAG,GAAG,YAAY,CAAC;YACvB,aAAa,EAAE;;;;OAId;YACD,eAAe,EAAE;;;;OAIhB;SACF,CAAC,CAAC;QAEH,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,MAAM,YAAY,GAAG;YACnB,IAAI,EAAE,KAAc;YACpB,QAAQ,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,KAAK,IAAI,EAAE;gBAC9C,OAAO,EAAE,CAAC;gBACV,OAAO;oBACL,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC;wBACtB,UAAU,EAAE,IAAI;wBAChB,UAAU,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;wBAC7C,OAAO,EAAE,iBAAiB,OAAO,EAAE;wBACnC,gBAAgB,EAAE,eAAe;wBACjC,MAAM,EAAE,aAAa;wBACrB,IAAI,EAAE,CAAC;qBACR,CAAC;oBACF,WAAW,EAAE,GAAG;oBAChB,YAAY,EAAE,EAAE;oBAChB,QAAQ,EAAE,KAAc;oBACxB,UAAU,EAAE,GAAG;iBAChB,CAAC;YACJ,CAAC,CAAC;SACH,CAAC;QAEF,MAAM,IAAI,GAAG,IAAI,gBAAgB,CAAC;YAChC,UAAU,EAAE,GAAG;YACf,QAAQ,EAAE,YAAmB;YAC7B,WAAW,EAAE,CAAC;SACf,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACzC,MAAM,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1C,8DAA8D;QAC9D,MAAM,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;QAClE,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/hunt/__tests__/matcher.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/hunt/__tests__/matcher.test.js

@@ -0,0 +1,63 @@
+import { describe, it, expect } from 'vitest';
+import { matchTemplates } from '../matcher.js';
+const makeFile = (path, content) => ({
+    relativePath: path,
+    absolutePath: `/tmp/${path}`,
+    content,
+    imports: [],
+    exports: [],
+    functions: [],
+    contentHash: 'abc123',
+    isLowPriority: false,
+});
+const makeTemplate = (overrides) => ({
+    id: 'test',
+    name: 'Test',
+    cwe: 'CWE-000',
+    filePatterns: ['auth', 'token'],
+    triagePrompt: 'test prompt',
+    deepDivePrompt: 'test prompt',
+    knownBypasses: ['bypass1'],
+    specReferences: ['RFC 0000'],
+    severityRange: ['low', 'high'],
+    ...overrides,
+});
+describe('matchTemplates', () => {
+    it('matches file with 2+ keyword hits', () => {
+        const file = makeFile('src/auth.ts', 'function validateToken(token) { return auth(token); }');
+        const template = makeTemplate({ filePatterns: ['auth', 'token', 'validate'] });
+        const matches = matchTemplates(file, [template]);
+        expect(matches).toHaveLength(1);
+        expect(matches[0].score).toBeGreaterThanOrEqual(2);
+    });
+    it('rejects file with only 1 keyword hit', () => {
+        const file = makeFile('src/utils.ts', 'function add(a, b) { return a + b; }');
+        const template = makeTemplate({ filePatterns: ['auth', 'token'] });
+        const matches = matchTemplates(file, [template]);
+        expect(matches).toHaveLength(0);
+    });
+    it('respects negativePatterns', () => {
+        const file = makeFile('src/query.ts', 'import { prisma } from "./db";\nconst result = prisma.query.findMany();');
+        const template = makeTemplate({
+            id: 'injection',
+            filePatterns: ['query', 'exec', 'sql'],
+            negativePatterns: ['prisma', 'drizzle'],
+        });
+        const matches = matchTemplates(file, [template]);
+        expect(matches).toHaveLength(0);
+    });
+    it('respects custom minMatchScore', () => {
+        const file = makeFile('src/auth.ts', 'auth token');
+        const template = makeTemplate({ minMatchScore: 3, filePatterns: ['auth', 'token', 'session'] });
+        const matches = matchTemplates(file, [template]);
+        expect(matches).toHaveLength(0);
+    });
+    it('returns multiple template matches for one file', () => {
+        const file = makeFile('src/cors-auth.ts', 'function corsAuth(origin, token) { validateOrigin(origin); }');
+        const t1 = makeTemplate({ id: 'cors', filePatterns: ['cors', 'origin', 'access-control'] });
+        const t2 = makeTemplate({ id: 'auth', filePatterns: ['auth', 'token', 'validate'] });
+        const matches = matchTemplates(file, [t1, t2]);
+        expect(matches.length).toBe(2);
+    });
+});
+//# sourceMappingURL=matcher.test.js.map

package/dist/hunt/__tests__/matcher.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"matcher.test.js","sourceRoot":"","sources":["../../../src/hunt/__tests__/matcher.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAI/C,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,OAAe,EAAkB,EAAE,CAAC,CAAC;IACnE,YAAY,EAAE,IAAI;IAClB,YAAY,EAAE,QAAQ,IAAI,EAAE;IAC5B,OAAO;IACP,OAAO,EAAE,EAAE;IACX,OAAO,EAAE,EAAE;IACX,SAAS,EAAE,EAAE;IACb,WAAW,EAAE,QAAQ;IACrB,aAAa,EAAE,KAAK;CACrB,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,CAAC,SAAyC,EAAyB,EAAE,CAAC,CAAC;IAC1F,EAAE,EAAE,MAAM;IACV,IAAI,EAAE,MAAM;IACZ,GAAG,EAAE,SAAS;IACd,YAAY,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;IAC/B,YAAY,EAAE,aAAa;IAC3B,cAAc,EAAE,aAAa;IAC7B,aAAa,EAAE,CAAC,SAAS,CAAC;IAC1B,cAAc,EAAE,CAAC,UAAU,CAAC;IAC5B,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC;IAC9B,GAAG,SAAS;CACb,CAAC,CAAC;AAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,IAAI,GAAG,QAAQ,CAAC,aAAa,EAAE,uDAAuD,CAAC,CAAC;QAC9F,MAAM,QAAQ,GAAG,YAAY,CAAC,EAAE,YAAY,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC;QAC/E,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QACjD,MAAM,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAChC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,IAAI,GAAG,QAAQ,CAAC,cAAc,EAAE,sCAAsC,CAAC,CAAC;QAC9E,MAAM,QAAQ,GAAG,YAAY,CAAC,EAAE,YAAY,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QACnE,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QACjD,MAAM,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACnC,MAAM,IAAI,GAAG,QAAQ,CAAC,cAAc,EAAE,yEAAyE,CAAC,CAAC;QACjH,MAAM,QAAQ,GAAG,YAAY,CAAC;YAC5B,EAAE,EAAE,WAAW;YACf,YAAY,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC;YACtC,gBAAgB,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC;SACxC,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QACjD,MAAM,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,IAAI,GAAG,QAAQ,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;QACnD,MAAM,QAAQ,GAAG,YAAY,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;QAChG,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QACjD,MAAM,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,IAAI,GAAG,QAAQ,CAAC,kBAAkB,EAAE,8DAA8D,CAAC,CAAC;QAC1G,MAAM,EAAE,GAAG,YAAY,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,gBAAgB,CAAC,EAAE,CAAC,CAAC;QAC5F,MAAM,EAAE,GAAG,YAAY,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC;QACrF,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QAC/C,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/hunt/__tests__/orchestrator.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/hunt/__tests__/orchestrator.test.js

@@ -0,0 +1,73 @@
+import { describe, it, expect, vi } from 'vitest';
+import { HuntOrchestrator } from '../orchestrator.js';
+import { mkdtempSync, writeFileSync, mkdirSync } from 'fs';
+import { join } from 'path';
+import { tmpdir } from 'os';
+function makeTempRepo(files) {
+    const dir = mkdtempSync(join(tmpdir(), 'hunt-orch-'));
+    for (const [path, content] of Object.entries(files)) {
+        const full = join(dir, path);
+        mkdirSync(join(full, '..'), { recursive: true });
+        writeFileSync(full, content);
+    }
+    return dir;
+}
+describe('HuntOrchestrator', () => {
+    it('runs triage and returns hypotheses', async () => {
+        const dir = makeTempRepo({
+            'src/csrf.ts': `
+        import { verify } from './utils.js';
+        export function checkOrigin(origin: string, allowedOrigins: string[]) {
+          for (const pattern of allowedOrigins) {
+            if (origin.endsWith(pattern.replace('*', ''))) return true;
+          }
+          return false;
+        }
+      `,
+        });
+        const mockProvider = {
+            type: 'api',
+            complete: vi.fn().mockResolvedValue({
+                content: JSON.stringify({
+                    vulnerable: true,
+                    confidence: 'high',
+                    summary: 'Origin endsWith check is bypassable',
+                    attacker_control: 'Origin header',
+                    impact: 'CSRF bypass',
+                    line: 4,
+                }),
+                inputTokens: 100,
+                outputTokens: 50,
+                provider: 'api',
+                durationMs: 500,
+            }),
+        };
+        const orch = new HuntOrchestrator({
+            targetPath: dir,
+            provider: mockProvider,
+            concurrency: 1,
+        });
+        const result = await orch.triage();
+        expect(result.filesScanned).toBeGreaterThanOrEqual(0);
+        expect(mockProvider.complete).toHaveBeenCalled();
+    });
+    it('loadFiles populates file cache for dive mode', () => {
+        const orch = new HuntOrchestrator({
+            targetPath: '/tmp/test',
+            provider: { type: 'api', complete: vi.fn() },
+        });
+        orch.loadFiles([{
+                relativePath: 'src/auth.ts',
+                absolutePath: '/tmp/src/auth.ts',
+                content: 'code',
+                imports: [],
+                exports: [],
+                functions: [],
+                contentHash: 'abc',
+                isLowPriority: false,
+            }]);
+        // File cache is populated (tested indirectly via deepDive)
+        expect(true).toBe(true); // loadFiles doesn't throw
+    });
+});
+//# sourceMappingURL=orchestrator.test.js.map

package/dist/hunt/__tests__/orchestrator.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"orchestrator.test.js","sourceRoot":"","sources":["../../../src/hunt/__tests__/orchestrator.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAC3D,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC;AAE5B,SAAS,YAAY,CAAC,KAA6B;IACjD,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,YAAY,CAAC,CAAC,CAAC;IACtD,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC7B,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;QAClD,MAAM,GAAG,GAAG,YAAY,CAAC;YACvB,aAAa,EAAE;;;;;;;;OAQd;SACF,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG;YACnB,IAAI,EAAE,KAAc;YACpB,QAAQ,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC;gBAClC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC;oBACtB,UAAU,EAAE,IAAI;oBAChB,UAAU,EAAE,MAAM;oBAClB,OAAO,EAAE,qCAAqC;oBAC9C,gBAAgB,EAAE,eAAe;oBACjC,MAAM,EAAE,aAAa;oBACrB,IAAI,EAAE,CAAC;iBACR,CAAC;gBACF,WAAW,EAAE,GAAG;gBAChB,YAAY,EAAE,EAAE;gBAChB,QAAQ,EAAE,KAAc;gBACxB,UAAU,EAAE,GAAG;aAChB,CAAC;SACH,CAAC;QAEF,MAAM,IAAI,GAAG,IAAI,gBAAgB,CAAC;YAChC,UAAU,EAAE,GAAG;YACf,QAAQ,EAAE,YAAmB;YAC7B,WAAW,EAAE,CAAC;SACf,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACnC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;QACtD,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,gBAAgB,EAAE,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,IAAI,GAAG,IAAI,gBAAgB,CAAC;YAChC,UAAU,EAAE,WAAW;YACvB,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAc,EAAE,QAAQ,EAAE,EAAE,CAAC,EAAE,EAAE,EAAS;SAC7D,CAAC,CAAC;QAEH,IAAI,CAAC,SAAS,CAAC,CAAC;gBACd,YAAY,EAAE,aAAa;gBAC3B,YAAY,EAAE,kBAAkB;gBAChC,OAAO,EAAE,MAAM;gBACf,OAAO,EAAE,EAAE;gBACX,OAAO,EAAE,EAAE;gBACX,SAAS,EAAE,EAAE;gBACb,WAAW,EAAE,KAAK;gBAClB,aAAa,EAAE,KAAK;aACrB,CAAC,CAAC,CAAC;QAEJ,2DAA2D;QAC3D,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,0BAA0B;IACrD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/hunt/__tests__/parse-utils.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/hunt/__tests__/parse-utils.test.js

@@ -0,0 +1,28 @@
+import { describe, it, expect } from 'vitest';
+import { stripCodeFences, safeParseJSON } from '../parse-utils.js';
+describe('stripCodeFences', () => {
+    it('strips markdown code fences', () => {
+        expect(stripCodeFences('```json\n{"a":1}\n```')).toBe('{"a":1}');
+    });
+    it('handles no fences', () => {
+        expect(stripCodeFences('{"a":1}')).toBe('{"a":1}');
+    });
+    it('strips fences with language tag', () => {
+        expect(stripCodeFences('```typescript\ncode\n```')).toBe('code');
+    });
+});
+describe('safeParseJSON', () => {
+    it('parses valid JSON', () => {
+        expect(safeParseJSON('{"a":1}')).toEqual({ a: 1 });
+    });
+    it('parses JSON inside code fences', () => {
+        expect(safeParseJSON('```json\n{"a":1}\n```')).toEqual({ a: 1 });
+    });
+    it('returns null for invalid JSON', () => {
+        expect(safeParseJSON('not json')).toBeNull();
+    });
+    it('returns null for empty string', () => {
+        expect(safeParseJSON('')).toBeNull();
+    });
+});
+//# sourceMappingURL=parse-utils.test.js.map

package/dist/hunt/__tests__/parse-utils.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse-utils.test.js","sourceRoot":"","sources":["../../../src/hunt/__tests__/parse-utils.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEnE,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;QACrC,MAAM,CAAC,eAAe,CAAC,uBAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mBAAmB,EAAE,GAAG,EAAE;QAC3B,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,CAAC,eAAe,CAAC,0BAA0B,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,EAAE,CAAC,mBAAmB,EAAE,GAAG,EAAE;QAC3B,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,MAAM,CAAC,aAAa,CAAC,uBAAuB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACvC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/hunt/__tests__/state.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/hunt/__tests__/state.test.js

@@ -0,0 +1,49 @@
+import { describe, it, expect } from 'vitest';
+import { saveState, loadState, checkStaleness, getStateDir } from '../state.js';
+import { mkdtempSync } from 'fs';
+import { join } from 'path';
+import { tmpdir } from 'os';
+describe('Hunt state', () => {
+    it('saves and loads state', () => {
+        const stateDir = mkdtempSync(join(tmpdir(), 'hunt-state-'));
+        const state = {
+            scannedAt: new Date().toISOString(),
+            path: '/tmp/repo',
+            fileHashes: { 'src/auth.ts': 'abc123' },
+            filesScanned: 1,
+            hypotheses: [],
+            findings: [],
+        };
+        saveState(stateDir, state);
+        const loaded = loadState(stateDir);
+        expect(loaded).not.toBeNull();
+        expect(loaded.path).toBe('/tmp/repo');
+        expect(loaded.fileHashes['src/auth.ts']).toBe('abc123');
+    });
+    it('returns null for missing state', () => {
+        const stateDir = mkdtempSync(join(tmpdir(), 'hunt-empty-'));
+        expect(loadState(stateDir)).toBeNull();
+    });
+    it('detects stale files', () => {
+        const state = {
+            scannedAt: new Date().toISOString(),
+            path: '/tmp/repo',
+            fileHashes: { 'src/auth.ts': 'abc123' },
+            filesScanned: 1,
+            hypotheses: [{ id: 1, templateId: 'test', file: 'src/auth.ts', confidence: 'high', summary: 'test', attackerControl: 'x', impact: 'x' }],
+            findings: [],
+        };
+        const staleFiles = checkStaleness(state, { 'src/auth.ts': 'different_hash' });
+        expect(staleFiles).toContain('src/auth.ts');
+        const freshFiles = checkStaleness(state, { 'src/auth.ts': 'abc123' });
+        expect(freshFiles).toHaveLength(0);
+    });
+    it('generates deterministic state dir from path', () => {
+        const dir1 = getStateDir('/tmp/repo-a');
+        const dir2 = getStateDir('/tmp/repo-a');
+        const dir3 = getStateDir('/tmp/repo-b');
+        expect(dir1).toBe(dir2);
+        expect(dir1).not.toBe(dir3);
+    });
+});
+//# sourceMappingURL=state.test.js.map

package/dist/hunt/__tests__/state.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"state.test.js","sourceRoot":"","sources":["../../../src/hunt/__tests__/state.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAChF,OAAO,EAAE,WAAW,EAA0C,MAAM,IAAI,CAAC;AACzE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC;AAG5B,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE;IAC1B,EAAE,CAAC,uBAAuB,EAAE,GAAG,EAAE;QAC/B,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,aAAa,CAAC,CAAC,CAAC;QAC5D,MAAM,KAAK,GAAc;YACvB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,IAAI,EAAE,WAAW;YACjB,UAAU,EAAE,EAAE,aAAa,EAAE,QAAQ,EAAE;YACvC,YAAY,EAAE,CAAC;YACf,UAAU,EAAE,EAAE;YACd,QAAQ,EAAE,EAAE;SACb,CAAC;QAEF,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC3B,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;QACnC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC9B,MAAM,CAAC,MAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACvC,MAAM,CAAC,MAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,aAAa,CAAC,CAAC,CAAC;QAC5D,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qBAAqB,EAAE,GAAG,EAAE;QAC7B,MAAM,KAAK,GAAc;YACvB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,IAAI,EAAE,WAAW;YACjB,UAAU,EAAE,EAAE,aAAa,EAAE,QAAQ,EAAE;YACvC,YAAY,EAAE,CAAC;YACf,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;YACxI,QAAQ,EAAE,EAAE;SACb,CAAC;QAEF,MAAM,UAAU,GAAG,cAAc,CAAC,KAAK,EAAE,EAAE,aAAa,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC9E,MAAM,CAAC,UAAU,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QAE5C,MAAM,UAAU,GAAG,cAAc,CAAC,KAAK,EAAE,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC,CAAC;QACtE,MAAM,CAAC,UAAU,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,IAAI,GAAG,WAAW,CAAC,aAAa,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,WAAW,CAAC,aAAa,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,WAAW,CAAC,aAAa,CAAC,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxB,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/hunt/__tests__/templates.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/hunt/__tests__/templates.test.js

@@ -0,0 +1,32 @@
+import { describe, it, expect } from 'vitest';
+import { getAllTemplates, getTemplateById } from '../templates/index.js';
+describe('Template registry', () => {
+    it('loads all templates', () => {
+        const templates = getAllTemplates();
+        expect(templates.length).toBeGreaterThanOrEqual(1);
+        for (const t of templates) {
+            expect(t.id).toBeTruthy();
+            expect(t.cwe).toMatch(/^CWE-\d+$/);
+            expect(t.filePatterns.length).toBeGreaterThan(0);
+            expect(t.triagePrompt.length).toBeGreaterThan(50);
+            expect(t.deepDivePrompt.length).toBeGreaterThan(50);
+            expect(t.knownBypasses.length).toBeGreaterThan(0);
+        }
+    });
+    it('finds template by id', () => {
+        const t = getTemplateById('csrf-bypass');
+        expect(t).toBeDefined();
+        expect(t.cwe).toBe('CWE-352');
+    });
+    it('returns undefined for unknown id', () => {
+        expect(getTemplateById('nonexistent')).toBeUndefined();
+    });
+    it('has exactly 10 templates', () => {
+        expect(getAllTemplates()).toHaveLength(10);
+    });
+    it('each template has unique id', () => {
+        const ids = getAllTemplates().map(t => t.id);
+        expect(new Set(ids).size).toBe(ids.length);
+    });
+});
+//# sourceMappingURL=templates.test.js.map

package/dist/hunt/__tests__/templates.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"templates.test.js","sourceRoot":"","sources":["../../../src/hunt/__tests__/templates.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAEzE,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,qBAAqB,EAAE,GAAG,EAAE;QAC7B,MAAM,SAAS,GAAG,eAAe,EAAE,CAAC;QACpC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;QACnD,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;YAC1B,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC;YAC1B,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;YACnC,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;YACjD,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;YAClD,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;YACpD,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QACpD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sBAAsB,EAAE,GAAG,EAAE;QAC9B,MAAM,CAAC,GAAG,eAAe,CAAC,aAAa,CAAC,CAAC;QACzC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QACxB,MAAM,CAAC,CAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC1C,MAAM,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0BAA0B,EAAE,GAAG,EAAE;QAClC,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;QACrC,MAAM,GAAG,GAAG,eAAe,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC7C,MAAM,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/hunt/__tests__/triage.test.d.ts

@@ -0,0 +1 @@
+export {};