tryassay 0.33.1 → 0.34.0

package/dist/realtime/__tests__/streaming-verifier.test.js

@@ -0,0 +1,157 @@
+import { describe, it, expect, vi } from 'vitest';
+import { StreamingVerifier } from '../streaming-verifier.js';
+// ── Helpers ─────────────────────────────────────────────────────
+/** Push a string one character at a time to simulate real token streaming. */
+function pushCharByChar(verifier, code) {
+    const allEvents = [];
+    for (const ch of code) {
+        allEvents.push(...verifier.push(ch));
+    }
+    return allEvents;
+}
+// ── End-to-end: SQL injection caught ────────────────────────────
+describe('StreamingVerifier', () => {
+    it('catches SQL injection via string concatenation', () => {
+        const verifier = new StreamingVerifier({ language: 'typescript' });
+        const code = 'const q = "SELECT * FROM users WHERE id = " + userId;\n';
+        const events = pushCharByChar(verifier, code);
+        const findings = events.filter(e => e.verdict === 'FAIL');
+        expect(findings.length).toBeGreaterThanOrEqual(1);
+        const sqlFinding = findings.find(e => e.checkId.includes('sql'));
+        expect(sqlFinding).toBeDefined();
+        expect(sqlFinding.severity).toBe('critical');
+    });
+    // ── End-to-end: Clean code passes ───────────────────────────
+    it('produces no findings for clean code', () => {
+        const verifier = new StreamingVerifier({ language: 'typescript' });
+        const code = 'const x = 1;\n';
+        const events = pushCharByChar(verifier, code);
+        const findings = events.filter(e => e.verdict === 'FAIL');
+        expect(findings.length).toBe(0);
+    });
+    // ── Multi-unit stream ───────────────────────────────────────
+    it('handles multi-unit stream with mixed good and bad code', () => {
+        const verifier = new StreamingVerifier({ language: 'typescript' });
+        const code = [
+            'const x = 1;',
+            'const q = "SELECT * FROM users WHERE id = " + userId;',
+            'const y = 2;',
+            '',
+        ].join('\n');
+        const events = pushCharByChar(verifier, code);
+        const findings = events.filter(e => e.verdict === 'FAIL');
+        // Only the SQL injection line should produce a finding
+        expect(findings.length).toBeGreaterThanOrEqual(1);
+        for (const f of findings) {
+            expect(f.codeUnit.text).toContain('SELECT');
+        }
+    });
+    // ── Flush catches trailing code ─────────────────────────────
+    it('flush catches trailing code without a terminator', () => {
+        const verifier = new StreamingVerifier({ language: 'typescript' });
+        // No semicolon, no newline — the buffer won't emit a code unit
+        const code = 'const secret = "sk-abc123secret456"';
+        verifier.push(code);
+        // No events from push since no code unit boundary was reached
+        const pushFindings = verifier.getFindings();
+        // Flush should create a trailing unit and check it
+        const flushEvents = verifier.flush();
+        const flushFindings = flushEvents.filter(e => e.verdict === 'FAIL');
+        expect(flushFindings.length).toBeGreaterThanOrEqual(1);
+        const secretFinding = flushFindings.find(e => e.checkId.includes('secret'));
+        expect(secretFinding).toBeDefined();
+    });
+    // ── Stats tracking ──────────────────────────────────────────
+    it('tracks stats correctly across multiple pushes', () => {
+        const verifier = new StreamingVerifier({ language: 'typescript' });
+        verifier.push('const a = 1;\n');
+        verifier.push('const b = 2;\n');
+        verifier.push('const q = "SELECT * FROM t WHERE id = " + x;\n');
+        const stats = verifier.getStats();
+        expect(stats.unitsProcessed).toBeGreaterThanOrEqual(3);
+        expect(stats.checksRun).toBeGreaterThan(0);
+        expect(stats.findings).toBeGreaterThanOrEqual(1);
+        expect(stats.totalTimeMs).toBeGreaterThanOrEqual(0);
+        expect(stats.avgLatencyMs).toBeGreaterThanOrEqual(0);
+    });
+    // ── onEvent callback fires ──────────────────────────────────
+    it('fires onEvent callback for findings', () => {
+        const callback = vi.fn();
+        const verifier = new StreamingVerifier({
+            language: 'typescript',
+            onEvent: callback,
+        });
+        verifier.push('const q = "SELECT * FROM users WHERE id = " + userId;\n');
+        expect(callback).toHaveBeenCalled();
+        const callArg = callback.mock.calls[0][0];
+        expect(callArg.verdict).toBe('FAIL');
+        expect(callArg.checkId).toContain('sql');
+    });
+    // ── getFindings filters correctly ───────────────────────────
+    it('getFindings returns only FAIL events', () => {
+        const verifier = new StreamingVerifier({ language: 'typescript' });
+        // Push clean code and bad code
+        verifier.push('const x = 1;\n');
+        verifier.push('const q = "SELECT * FROM users WHERE id = " + userId;\n');
+        verifier.push('const y = 2;\n');
+        const findings = verifier.getFindings();
+        // Every item in findings must be FAIL
+        for (const f of findings) {
+            expect(f.verdict).toBe('FAIL');
+        }
+        expect(findings.length).toBeGreaterThanOrEqual(1);
+    });
+    // ── Reset clears state ──────────────────────────────────────
+    it('reset clears all state', () => {
+        const verifier = new StreamingVerifier({ language: 'typescript' });
+        verifier.push('const q = "SELECT * FROM users WHERE id = " + userId;\n');
+        expect(verifier.getStats().unitsProcessed).toBeGreaterThan(0);
+        expect(verifier.getFindings().length).toBeGreaterThan(0);
+        expect(verifier.getGeneratedCode().length).toBeGreaterThan(0);
+        verifier.reset();
+        const stats = verifier.getStats();
+        expect(stats.unitsProcessed).toBe(0);
+        expect(stats.checksRun).toBe(0);
+        expect(stats.findings).toBe(0);
+        expect(stats.totalTimeMs).toBe(0);
+        expect(stats.maxLatencyMs).toBe(0);
+        expect(verifier.getFindings().length).toBe(0);
+        expect(verifier.getGeneratedCode()).toBe('');
+    });
+    // ── Function block verification ─────────────────────────────
+    it('catches SQL injection inside a complete function block', () => {
+        const verifier = new StreamingVerifier({ language: 'typescript' });
+        const code = 'function getUser() { const q = "SELECT * FROM users WHERE id = " + id; return db.query(q); }\n';
+        const events = pushCharByChar(verifier, code);
+        const findings = events.filter(e => e.verdict === 'FAIL');
+        expect(findings.length).toBeGreaterThanOrEqual(1);
+        const sqlFinding = findings.find(e => e.checkId.includes('sql'));
+        expect(sqlFinding).toBeDefined();
+    });
+    // ── Performance ─────────────────────────────────────────────
+    it('processes 20 statements in under 100ms', () => {
+        const verifier = new StreamingVerifier({ language: 'typescript' });
+        const start = performance.now();
+        for (let i = 0; i < 20; i++) {
+            verifier.push(`const x${i} = ${i};\n`);
+        }
+        const elapsed = performance.now() - start;
+        expect(elapsed).toBeLessThan(100);
+        expect(verifier.getStats().unitsProcessed).toBeGreaterThanOrEqual(20);
+    });
+    // ── getGeneratedCode returns full buffer ────────────────────
+    it('getGeneratedCode returns accumulated code', () => {
+        const verifier = new StreamingVerifier({ language: 'typescript' });
+        verifier.push('const a = 1;');
+        verifier.push('\nconst b = 2;\n');
+        expect(verifier.getGeneratedCode()).toBe('const a = 1;\nconst b = 2;\n');
+    });
+    // ── Flush is no-op when buffer is fully covered ─────────────
+    it('flush returns empty when all code was already checked', () => {
+        const verifier = new StreamingVerifier({ language: 'typescript' });
+        verifier.push('const x = 1;\n');
+        const flushEvents = verifier.flush();
+        expect(flushEvents.length).toBe(0);
+    });
+});
+//# sourceMappingURL=streaming-verifier.test.js.map

package/dist/realtime/__tests__/streaming-verifier.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"streaming-verifier.test.js","sourceRoot":"","sources":["../../../src/realtime/__tests__/streaming-verifier.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAG7D,mEAAmE;AAEnE,8EAA8E;AAC9E,SAAS,cAAc,CAAC,QAA2B,EAAE,IAAY;IAC/D,MAAM,SAAS,GAAwB,EAAE,CAAC;IAC1C,KAAK,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC;QACtB,SAAS,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,mEAAmE;AAEnE,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,QAAQ,GAAG,IAAI,iBAAiB,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC;QACnE,MAAM,IAAI,GAAG,yDAAyD,CAAC;QACvE,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAE9C,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC;QAC1D,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;QAClD,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QACjE,MAAM,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;QACjC,MAAM,CAAC,UAAW,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,+DAA+D;IAE/D,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,MAAM,QAAQ,GAAG,IAAI,iBAAiB,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC;QACnE,MAAM,IAAI,GAAG,gBAAgB,CAAC;QAC9B,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAE9C,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC;QAC1D,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,+DAA+D;IAE/D,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,QAAQ,GAAG,IAAI,iBAAiB,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC;QACnE,MAAM,IAAI,GAAG;YACX,cAAc;YACd,uDAAuD;YACvD,cAAc;YACd,EAAE;SACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEb,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC9C,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC;QAE1D,uDAAuD;QACvD,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;QAClD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,+DAA+D;IAE/D,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,QAAQ,GAAG,IAAI,iBAAiB,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC;QACnE,+DAA+D;QAC/D,MAAM,IAAI,GAAG,qCAAqC,CAAC;QACnD,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEpB,8DAA8D;QAC9D,MAAM,YAAY,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;QAE5C,mDAAmD;QACnD,MAAM,WAAW,GAAG,QAAQ,CAAC,KAAK,EAAE,CAAC;QACrC,MAAM,aAAa,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC;QAEpE,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;QACvD,MAAM,aAAa,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC5E,MAAM,CAAC,aAAa,CAAC,CAAC,WAAW,EAAE,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,+DAA+D;IAE/D,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,QAAQ,GAAG,IAAI,iBAAiB,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC;QAEnE,QAAQ,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAChC,QAAQ,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAChC,QAAQ,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;QAEhE,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAClC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;QACvD,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QAC3C,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;QACjD,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;QACpD,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,+DAA+D;IAE/D,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,MAAM,QAAQ,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,IAAI,iBAAiB,CAAC;YACrC,QAAQ,EAAE,YAAY;YACtB,OAAO,EAAE,QAAQ;SAClB,CAAC,CAAC;QAEH,QAAQ,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAC;QAEzE,MAAM,CAAC,QAAQ,CAAC,CAAC,gBAAgB,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAsB,CAAC;QAC/D,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,+DAA+D;IAE/D,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,QAAQ,GAAG,IAAI,iBAAiB,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC;QAEnE,+BAA+B;QAC/B,QAAQ,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAChC,QAAQ,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAC;QACzE,QAAQ,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAEhC,MAAM,QAAQ,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;QACxC,sCAAsC;QACtC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC;QACD,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,+DAA+D;IAE/D,EAAE,CAAC,wBAAwB,EAAE,GAAG,EAAE;QAChC,MAAM,QAAQ,GAAG,IAAI,iBAAiB,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC;QAEnE,QAAQ,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAC;QACzE,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,cAAc,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QAC9D,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QACzD,MAAM,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QAE9D,QAAQ,CAAC,KAAK,EAAE,CAAC;QAEjB,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAClC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC/B,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnC,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9C,MAAM,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,+DAA+D;IAE/D,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,QAAQ,GAAG,IAAI,iBAAiB,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC;QACnE,MAAM,IAAI,GACR,gGAAgG,CAAC;QAEnG,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC9C,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC;QAE1D,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;QAClD,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QACjE,MAAM,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,+DAA+D;IAE/D,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,QAAQ,GAAG,IAAI,iBAAiB,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC;QAEnE,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAChC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;YAC5B,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACzC,CAAC;QACD,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;QAE1C,MAAM,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,cAAc,CAAC,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;IAEH,+DAA+D;IAE/D,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,QAAQ,GAAG,IAAI,iBAAiB,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC;QACnE,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC9B,QAAQ,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAClC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,+DAA+D;IAE/D,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,QAAQ,GAAG,IAAI,iBAAiB,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC;QACnE,QAAQ,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAChC,MAAM,WAAW,GAAG,QAAQ,CAAC,KAAK,EAAE,CAAC;QACrC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/realtime/code-buffer.d.ts

@@ -0,0 +1,52 @@
+/**
+ * CodeBuffer: Accumulates streaming tokens and detects completed code units.
+ *
+ * Tracks brace depth, string/comment state, and semicolons to determine when
+ * a statement, function, block, or line is complete. This lets the streaming
+ * verifier run checks against structurally complete code rather than arbitrary
+ * token boundaries.
+ *
+ * Known limitation: Regex literals are not handled. A regex containing braces
+ * (e.g. /\d{3}/) could desync the brace depth tracker. This is acceptable for
+ * MVP since regex-heavy code units are rare and the conservative emission
+ * strategy means a missed boundary just produces a larger unit later.
+ */
+import type { CodeUnit } from './types.js';
+export declare class CodeBuffer {
+    private buffer;
+    private readonly lang;
+    private braceDepth;
+    private stringState;
+    private commentState;
+    private templateDepth;
+    private escaped;
+    /** Start offset (in the full buffer) of the current in-progress unit. */
+    private unitStart;
+    constructor(language: string);
+    /**
+     * Append tokens to the buffer and return any newly completed code units.
+     */
+    push(tokens: string): CodeUnit[];
+    /** Return all accumulated text. */
+    getFullBuffer(): string;
+    /** Return configured language. */
+    getLanguage(): string;
+    /** Clear all state. */
+    reset(): void;
+    /**
+     * Build a CodeUnit from unitStart..endIndex (inclusive) and advance unitStart.
+     * Returns null if the text is only whitespace.
+     */
+    private emitUnit;
+    /**
+     * Try to emit a line unit at a newline character. Only emits if the line
+     * content doesn't end with `{` or `;` (those are handled by block/statement
+     * detectors instead).
+     */
+    private tryEmitLine;
+    /**
+     * Upgrade a generic 'block' kind to 'function' if the text looks like a
+     * function or method declaration.
+     */
+    private classifyKind;
+}

package/dist/realtime/code-buffer.js

@@ -0,0 +1,276 @@
+/**
+ * CodeBuffer: Accumulates streaming tokens and detects completed code units.
+ *
+ * Tracks brace depth, string/comment state, and semicolons to determine when
+ * a statement, function, block, or line is complete. This lets the streaming
+ * verifier run checks against structurally complete code rather than arbitrary
+ * token boundaries.
+ *
+ * Known limitation: Regex literals are not handled. A regex containing braces
+ * (e.g. /\d{3}/) could desync the brace depth tracker. This is acceptable for
+ * MVP since regex-heavy code units are rare and the conservative emission
+ * strategy means a missed boundary just produces a larger unit later.
+ */
+// ---------------------------------------------------------------------------
+// CodeBuffer
+// ---------------------------------------------------------------------------
+export class CodeBuffer {
+    buffer = '';
+    lang;
+    // Parser state ----------------------------------------------------------
+    braceDepth = 0;
+    stringState = 0 /* StringState.None */;
+    commentState = 0 /* CommentState.None */;
+    templateDepth = 0; // nesting of ${} inside template literals
+    escaped = false;
+    // Unit tracking ---------------------------------------------------------
+    /** Start offset (in the full buffer) of the current in-progress unit. */
+    unitStart = 0;
+    constructor(language) {
+        this.lang = language;
+    }
+    // -- Public API ---------------------------------------------------------
+    /**
+     * Append tokens to the buffer and return any newly completed code units.
+     */
+    push(tokens) {
+        if (tokens.length === 0)
+            return [];
+        const units = [];
+        const startLen = this.buffer.length;
+        this.buffer += tokens;
+        for (let i = startLen; i < this.buffer.length; i++) {
+            const ch = this.buffer[i];
+            const prev = i > 0 ? this.buffer[i - 1] : '';
+            // ---- Handle escape sequences inside strings ----
+            if (this.escaped) {
+                this.escaped = false;
+                continue;
+            }
+            if (this.stringState !== 0 /* StringState.None */ &&
+                ch === '\\') {
+                this.escaped = true;
+                continue;
+            }
+            // ---- Inside a line comment ----
+            if (this.commentState === 1 /* CommentState.LineComment */) {
+                if (ch === '\n') {
+                    this.commentState = 0 /* CommentState.None */;
+                    // Emit the comment line as a line unit (or skip if whitespace-only).
+                    // This prevents comment text from merging into the next code unit.
+                    const commentText = this.buffer.slice(this.unitStart, i + 1).trim();
+                    if (commentText.length > 0) {
+                        const unit = {
+                            text: commentText,
+                            kind: 'line',
+                            startOffset: this.unitStart,
+                            endOffset: i + 1,
+                            language: this.lang,
+                        };
+                        this.unitStart = i + 1;
+                        units.push(unit);
+                    }
+                    else {
+                        this.unitStart = i + 1;
+                    }
+                }
+                continue;
+            }
+            // ---- Inside a block comment ----
+            if (this.commentState === 2 /* CommentState.BlockComment */) {
+                if (ch === '/' && prev === '*') {
+                    this.commentState = 0 /* CommentState.None */;
+                }
+                continue;
+            }
+            // ---- Inside a string literal ----
+            if (this.stringState !== 0 /* StringState.None */) {
+                if (this.stringState === 3 /* StringState.Backtick */) {
+                    // Handle template expression ${...}
+                    if (ch === '$' && i + 1 < this.buffer.length && this.buffer[i + 1] === '{') {
+                        this.templateDepth++;
+                        i++; // skip the {
+                        continue;
+                    }
+                    if (this.templateDepth > 0) {
+                        if (ch === '{') {
+                            this.templateDepth++;
+                        }
+                        else if (ch === '}') {
+                            this.templateDepth--;
+                        }
+                        continue;
+                    }
+                    if (ch === '`') {
+                        this.stringState = 0 /* StringState.None */;
+                    }
+                }
+                else if (this.stringState === 1 /* StringState.SingleQuote */ && ch === "'") {
+                    this.stringState = 0 /* StringState.None */;
+                }
+                else if (this.stringState === 2 /* StringState.DoubleQuote */ && ch === '"') {
+                    this.stringState = 0 /* StringState.None */;
+                }
+                continue;
+            }
+            // ---- Not inside string or comment: detect openers ----
+            // Comment detection (must come before string detection)
+            if (ch === '/') {
+                if (i + 1 < this.buffer.length) {
+                    const next = this.buffer[i + 1];
+                    if (next === '/') {
+                        this.commentState = 1 /* CommentState.LineComment */;
+                        i++; // skip second /
+                        continue;
+                    }
+                    if (next === '*') {
+                        this.commentState = 2 /* CommentState.BlockComment */;
+                        i++; // skip *
+                        continue;
+                    }
+                }
+            }
+            // String openers
+            if (ch === "'") {
+                this.stringState = 1 /* StringState.SingleQuote */;
+                continue;
+            }
+            if (ch === '"') {
+                this.stringState = 2 /* StringState.DoubleQuote */;
+                continue;
+            }
+            if (ch === '`') {
+                this.stringState = 3 /* StringState.Backtick */;
+                continue;
+            }
+            // ---- Brace tracking ----
+            if (ch === '{') {
+                this.braceDepth++;
+                continue;
+            }
+            if (ch === '}') {
+                this.braceDepth--;
+                if (this.braceDepth <= 0) {
+                    this.braceDepth = 0;
+                    // Look ahead: if the next non-whitespace is `;`, wait for it
+                    // (e.g. `const fn = () => { ... };`)
+                    const remaining = this.buffer.slice(i + 1);
+                    const nextSignificant = remaining.match(/^\s*;/);
+                    if (nextSignificant) {
+                        // Don't emit yet; the semicolon handler will emit
+                        continue;
+                    }
+                    const unit = this.emitUnit(i, 'block');
+                    if (unit)
+                        units.push(unit);
+                }
+                continue;
+            }
+            // ---- Statement detection (semicolon at depth 0) ----
+            if (ch === ';' && this.braceDepth === 0) {
+                const unit = this.emitUnit(i, 'statement');
+                if (unit)
+                    units.push(unit);
+                continue;
+            }
+            // ---- Line detection (newline at depth 0) ----
+            if (ch === '\n' && this.braceDepth === 0) {
+                const unit = this.tryEmitLine(i);
+                if (unit)
+                    units.push(unit);
+                continue;
+            }
+        }
+        return units;
+    }
+    /** Return all accumulated text. */
+    getFullBuffer() {
+        return this.buffer;
+    }
+    /** Return configured language. */
+    getLanguage() {
+        return this.lang;
+    }
+    /** Clear all state. */
+    reset() {
+        this.buffer = '';
+        this.braceDepth = 0;
+        this.stringState = 0 /* StringState.None */;
+        this.commentState = 0 /* CommentState.None */;
+        this.templateDepth = 0;
+        this.escaped = false;
+        this.unitStart = 0;
+    }
+    // -- Private helpers ----------------------------------------------------
+    /**
+     * Build a CodeUnit from unitStart..endIndex (inclusive) and advance unitStart.
+     * Returns null if the text is only whitespace.
+     */
+    emitUnit(endIndex, kind) {
+        const text = this.buffer.slice(this.unitStart, endIndex + 1);
+        const trimmed = text.trim();
+        if (trimmed.length === 0) {
+            this.unitStart = endIndex + 1;
+            return null;
+        }
+        // Classify: if the text contains a function/class keyword at depth-0, upgrade kind
+        const resolvedKind = this.classifyKind(trimmed, kind);
+        const unit = {
+            text: trimmed,
+            kind: resolvedKind,
+            startOffset: this.unitStart,
+            endOffset: endIndex + 1,
+            language: this.lang,
+        };
+        this.unitStart = endIndex + 1;
+        return unit;
+    }
+    /**
+     * Try to emit a line unit at a newline character. Only emits if the line
+     * content doesn't end with `{` or `;` (those are handled by block/statement
+     * detectors instead).
+     */
+    tryEmitLine(newlineIndex) {
+        const text = this.buffer.slice(this.unitStart, newlineIndex + 1);
+        const trimmed = text.trim();
+        if (trimmed.length === 0) {
+            this.unitStart = newlineIndex + 1;
+            return null;
+        }
+        // If the line ends with { or ;, don't emit as a line —
+        // the block/statement handler will catch it.
+        if (trimmed.endsWith('{') || trimmed.endsWith(';')) {
+            return null;
+        }
+        // Don't emit partial lines that are clearly continuations
+        // (e.g., line ending with an operator)
+        const lastChar = trimmed[trimmed.length - 1];
+        if (lastChar === '(' || lastChar === ',' || lastChar === '+' || lastChar === '-' || lastChar === '=') {
+            return null;
+        }
+        const unit = {
+            text: trimmed,
+            kind: 'line',
+            startOffset: this.unitStart,
+            endOffset: newlineIndex + 1,
+            language: this.lang,
+        };
+        this.unitStart = newlineIndex + 1;
+        return unit;
+    }
+    /**
+     * Upgrade a generic 'block' kind to 'function' if the text looks like a
+     * function or method declaration.
+     */
+    classifyKind(text, fallback) {
+        if (fallback === 'statement' || fallback === 'line')
+            return fallback;
+        // Check for function-like patterns
+        if (/^\s*(export\s+)?(default\s+)?(async\s+)?function\b/.test(text) ||
+            /^\s*(export\s+)?(default\s+)?class\b/.test(text)) {
+            return 'function';
+        }
+        return fallback;
+    }
+}
+//# sourceMappingURL=code-buffer.js.map

package/dist/realtime/code-buffer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"code-buffer.js","sourceRoot":"","sources":["../../src/realtime/code-buffer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAqBH,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E,MAAM,OAAO,UAAU;IACb,MAAM,GAAG,EAAE,CAAC;IACH,IAAI,CAAS;IAE9B,0EAA0E;IAClE,UAAU,GAAG,CAAC,CAAC;IACf,WAAW,4BAAiC;IAC5C,YAAY,6BAAmC;IAC/C,aAAa,GAAG,CAAC,CAAC,CAAC,0CAA0C;IAC7D,OAAO,GAAG,KAAK,CAAC;IAExB,0EAA0E;IAC1E,yEAAyE;IACjE,SAAS,GAAG,CAAC,CAAC;IAEtB,YAAY,QAAgB;QAC1B,IAAI,CAAC,IAAI,GAAG,QAAQ,CAAC;IACvB,CAAC;IAED,0EAA0E;IAE1E;;OAEG;IACH,IAAI,CAAC,MAAc;QACjB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAEnC,MAAM,KAAK,GAAe,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;QACpC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC;QAEtB,KAAK,IAAI,CAAC,GAAG,QAAQ,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACnD,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC1B,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAE7C,mDAAmD;YACnD,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBACjB,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;gBACrB,SAAS;YACX,CAAC;YAED,IACE,IAAI,CAAC,WAAW,6BAAqB;gBACrC,EAAE,KAAK,IAAI,EACX,CAAC;gBACD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;gBACpB,SAAS;YACX,CAAC;YAED,kCAAkC;YAClC,IAAI,IAAI,CAAC,YAAY,qCAA6B,EAAE,CAAC;gBACnD,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;oBAChB,IAAI,CAAC,YAAY,4BAAoB,CAAC;oBACtC,qEAAqE;oBACrE,mEAAmE;oBACnE,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;oBACpE,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBAC3B,MAAM,IAAI,GAAa;4BACrB,IAAI,EAAE,WAAW;4BACjB,IAAI,EAAE,MAAM;4BACZ,WAAW,EAAE,IAAI,CAAC,SAAS;4BAC3B,SAAS,EAAE,CAAC,GAAG,CAAC;4BAChB,QAAQ,EAAE,IAAI,CAAC,IAAI;yBACpB,CAAC;wBACF,IAAI,CAAC,SAAS,GAAG,CAAC,GAAG,CAAC,CAAC;wBACvB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACnB,CAAC;yBAAM,CAAC;wBACN,IAAI,CAAC,SAAS,GAAG,CAAC,GAAG,CAAC,CAAC;oBACzB,CAAC;gBACH,CAAC;gBACD,SAAS;YACX,CAAC;YAED,mCAAmC;YACnC,IAAI,IAAI,CAAC,YAAY,sCAA8B,EAAE,CAAC;gBACpD,IAAI,EAAE,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;oBAC/B,IAAI,CAAC,YAAY,4BAAoB,CAAC;gBACxC,CAAC;gBACD,SAAS;YACX,CAAC;YAED,oCAAoC;YACpC,IAAI,IAAI,CAAC,WAAW,6BAAqB,EAAE,CAAC;gBAC1C,IAAI,IAAI,CAAC,WAAW,iCAAyB,EAAE,CAAC;oBAC9C,oCAAoC;oBACpC,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;wBAC3E,IAAI,CAAC,aAAa,EAAE,CAAC;wBACrB,CAAC,EAAE,CAAC,CAAC,aAAa;wBAClB,SAAS;oBACX,CAAC;oBACD,IAAI,IAAI,CAAC,aAAa,GAAG,CAAC,EAAE,CAAC;wBAC3B,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;4BACf,IAAI,CAAC,aAAa,EAAE,CAAC;wBACvB,CAAC;6BAAM,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;4BACtB,IAAI,CAAC,aAAa,EAAE,CAAC;wBACvB,CAAC;wBACD,SAAS;oBACX,CAAC;oBACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;wBACf,IAAI,CAAC,WAAW,2BAAmB,CAAC;oBACtC,CAAC;gBACH,CAAC;qBAAM,IAAI,IAAI,CAAC,WAAW,oCAA4B,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;oBACtE,IAAI,CAAC,WAAW,2BAAmB,CAAC;gBACtC,CAAC;qBAAM,IAAI,IAAI,CAAC,WAAW,oCAA4B,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;oBACtE,IAAI,CAAC,WAAW,2BAAmB,CAAC;gBACtC,CAAC;gBACD,SAAS;YACX,CAAC;YAED,yDAAyD;YAEzD,wDAAwD;YACxD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;gBACf,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;oBAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;oBAChC,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;wBACjB,IAAI,CAAC,YAAY,mCAA2B,CAAC;wBAC7C,CAAC,EAAE,CAAC,CAAC,gBAAgB;wBACrB,SAAS;oBACX,CAAC;oBACD,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;wBACjB,IAAI,CAAC,YAAY,oCAA4B,CAAC;wBAC9C,CAAC,EAAE,CAAC,CAAC,SAAS;wBACd,SAAS;oBACX,CAAC;gBACH,CAAC;YACH,CAAC;YAED,iBAAiB;YACjB,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;gBACf,IAAI,CAAC,WAAW,kCAA0B,CAAC;gBAC3C,SAAS;YACX,CAAC;YACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;gBACf,IAAI,CAAC,WAAW,kCAA0B,CAAC;gBAC3C,SAAS;YACX,CAAC;YACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;gBACf,IAAI,CAAC,WAAW,+BAAuB,CAAC;gBACxC,SAAS;YACX,CAAC;YAED,2BAA2B;YAC3B,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;gBACf,IAAI,CAAC,UAAU,EAAE,CAAC;gBAClB,SAAS;YACX,CAAC;YAED,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;gBACf,IAAI,CAAC,UAAU,EAAE,CAAC;gBAClB,IAAI,IAAI,CAAC,UAAU,IAAI,CAAC,EAAE,CAAC;oBACzB,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC;oBACpB,6DAA6D;oBAC7D,qCAAqC;oBACrC,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;oBAC3C,MAAM,eAAe,GAAG,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;oBACjD,IAAI,eAAe,EAAE,CAAC;wBACpB,kDAAkD;wBAClD,SAAS;oBACX,CAAC;oBACD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;oBACvC,IAAI,IAAI;wBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC7B,CAAC;gBACD,SAAS;YACX,CAAC;YAED,uDAAuD;YACvD,IAAI,EAAE,KAAK,GAAG,IAAI,IAAI,CAAC,UAAU,KAAK,CAAC,EAAE,CAAC;gBACxC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;gBAC3C,IAAI,IAAI;oBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC3B,SAAS;YACX,CAAC;YAED,gDAAgD;YAChD,IAAI,EAAE,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,KAAK,CAAC,EAAE,CAAC;gBACzC,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;gBACjC,IAAI,IAAI;oBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC3B,SAAS;YACX,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED,mCAAmC;IACnC,aAAa;QACX,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,kCAAkC;IAClC,WAAW;QACT,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,uBAAuB;IACvB,KAAK;QACH,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC;QACjB,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC;QACpB,IAAI,CAAC,WAAW,2BAAmB,CAAC;QACpC,IAAI,CAAC,YAAY,4BAAoB,CAAC;QACtC,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC;QACvB,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QACrB,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC;IACrB,CAAC;IAED,0EAA0E;IAE1E;;;OAGG;IACK,QAAQ,CAAC,QAAgB,EAAE,IAAkB;QACnD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,GAAG,CAAC,CAAC,CAAC;QAC7D,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,IAAI,CAAC,SAAS,GAAG,QAAQ,GAAG,CAAC,CAAC;YAC9B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,mFAAmF;QACnF,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAEtD,MAAM,IAAI,GAAa;YACrB,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,YAAY;YAClB,WAAW,EAAE,IAAI,CAAC,SAAS;YAC3B,SAAS,EAAE,QAAQ,GAAG,CAAC;YACvB,QAAQ,EAAE,IAAI,CAAC,IAAI;SACpB,CAAC;QACF,IAAI,CAAC,SAAS,GAAG,QAAQ,GAAG,CAAC,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;OAIG;IACK,WAAW,CAAC,YAAoB;QACtC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,GAAG,CAAC,CAAC,CAAC;QACjE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,IAAI,CAAC,SAAS,GAAG,YAAY,GAAG,CAAC,CAAC;YAClC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,uDAAuD;QACvD,6CAA6C;QAC7C,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACnD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,0DAA0D;QAC1D,uCAAuC;QACvC,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC7C,IAAI,QAAQ,KAAK,GAAG,IAAI,QAAQ,KAAK,GAAG,IAAI,QAAQ,KAAK,GAAG,IAAI,QAAQ,KAAK,GAAG,IAAI,QAAQ,KAAK,GAAG,EAAE,CAAC;YACrG,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,IAAI,GAAa;YACrB,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,MAAM;YACZ,WAAW,EAAE,IAAI,CAAC,SAAS;YAC3B,SAAS,EAAE,YAAY,GAAG,CAAC;YAC3B,QAAQ,EAAE,IAAI,CAAC,IAAI;SACpB,CAAC;QACF,IAAI,CAAC,SAAS,GAAG,YAAY,GAAG,CAAC,CAAC;QAClC,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;OAGG;IACK,YAAY,CAAC,IAAY,EAAE,QAAsB;QACvD,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,MAAM;YAAE,OAAO,QAAQ,CAAC;QACrE,mCAAmC;QACnC,IACE,oDAAoD,CAAC,IAAI,CAAC,IAAI,CAAC;YAC/D,sCAAsC,CAAC,IAAI,CAAC,IAAI,CAAC,EACjD,CAAC;YACD,OAAO,UAAU,CAAC;QACpB,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF"}

package/dist/realtime/correction-injector.d.ts

@@ -0,0 +1,56 @@
+/**
+ * CorrectionInjector — decides whether to correct a finding mid-stream
+ * and builds the prompt messages for re-generation.
+ *
+ * Strategy: Prefill technique (Option B).
+ * When a finding triggers:
+ *   1. Stop the current stream
+ *   2. Take all text generated so far as the assistant's partial response (prefill)
+ *   3. Add a user message explaining the issue and requesting a fix
+ *   4. Resume generation — the LLM continues from where it left off
+ */
+import type { CheckSeverity, VerificationEvent } from './types.js';
+declare const SEVERITY_RANK: Record<CheckSeverity, number>;
+export interface CorrectionInjectorOptions {
+    /** Only correct findings at or above this severity. Default: 'high' */
+    minSeverity?: CheckSeverity;
+    /** Maximum corrections per stream to avoid infinite loops. Default: 5 */
+    maxCorrections?: number;
+}
+export interface CorrectionMessage {
+    role: 'user' | 'assistant';
+    content: string;
+}
+export declare class CorrectionInjector {
+    private readonly minSeverity;
+    private readonly maxCorrections;
+    private correctionCount;
+    constructor(options?: CorrectionInjectorOptions);
+    /**
+     * Decide if this finding warrants stopping and correcting.
+     *
+     * Returns false when:
+     *  - verdict is not FAIL
+     *  - severity is below minSeverity
+     *  - maxCorrections has been reached
+     */
+    shouldCorrect(event: VerificationEvent): boolean;
+    /**
+     * Build the messages array for the correction re-generation.
+     *
+     * Uses the Anthropic API prefill technique:
+     *  1. Original user prompt
+     *  2. Assistant prefill (everything generated so far)
+     *  3. User message explaining the issue
+     *
+     * The system prompt is passed separately to the API, not included here.
+     */
+    buildCorrectionMessages(generatedSoFar: string, event: VerificationEvent, _originalSystemPrompt: string, originalUserPrompt: string): CorrectionMessage[];
+    /** Record that a correction was made (for tracking max corrections). */
+    recordCorrection(_event: VerificationEvent): void;
+    /** Get number of corrections made so far. */
+    getCorrectionCount(): number;
+    /** Reset correction counter (e.g. for a new stream). */
+    reset(): void;
+}
+export { SEVERITY_RANK };

package/dist/realtime/correction-injector.js

@@ -0,0 +1,96 @@
+/**
+ * CorrectionInjector — decides whether to correct a finding mid-stream
+ * and builds the prompt messages for re-generation.
+ *
+ * Strategy: Prefill technique (Option B).
+ * When a finding triggers:
+ *   1. Stop the current stream
+ *   2. Take all text generated so far as the assistant's partial response (prefill)
+ *   3. Add a user message explaining the issue and requesting a fix
+ *   4. Resume generation — the LLM continues from where it left off
+ */
+// ---------------------------------------------------------------------------
+// Severity ordering (higher index = more severe)
+// ---------------------------------------------------------------------------
+const SEVERITY_RANK = {
+    low: 0,
+    medium: 1,
+    high: 2,
+    critical: 3,
+};
+// ---------------------------------------------------------------------------
+// CorrectionInjector
+// ---------------------------------------------------------------------------
+export class CorrectionInjector {
+    minSeverity;
+    maxCorrections;
+    correctionCount = 0;
+    constructor(options) {
+        this.minSeverity = options?.minSeverity ?? 'high';
+        this.maxCorrections = options?.maxCorrections ?? 5;
+    }
+    /**
+     * Decide if this finding warrants stopping and correcting.
+     *
+     * Returns false when:
+     *  - verdict is not FAIL
+     *  - severity is below minSeverity
+     *  - maxCorrections has been reached
+     */
+    shouldCorrect(event) {
+        if (event.verdict !== 'FAIL')
+            return false;
+        if (SEVERITY_RANK[event.severity] < SEVERITY_RANK[this.minSeverity])
+            return false;
+        if (this.correctionCount >= this.maxCorrections)
+            return false;
+        return true;
+    }
+    /**
+     * Build the messages array for the correction re-generation.
+     *
+     * Uses the Anthropic API prefill technique:
+     *  1. Original user prompt
+     *  2. Assistant prefill (everything generated so far)
+     *  3. User message explaining the issue
+     *
+     * The system prompt is passed separately to the API, not included here.
+     */
+    buildCorrectionMessages(generatedSoFar, event, _originalSystemPrompt, originalUserPrompt) {
+        const correctionText = buildCorrectionText(event);
+        return [
+            { role: 'user', content: originalUserPrompt },
+            { role: 'assistant', content: generatedSoFar },
+            { role: 'user', content: correctionText },
+        ];
+    }
+    /** Record that a correction was made (for tracking max corrections). */
+    recordCorrection(_event) {
+        this.correctionCount++;
+    }
+    /** Get number of corrections made so far. */
+    getCorrectionCount() {
+        return this.correctionCount;
+    }
+    /** Reset correction counter (e.g. for a new stream). */
+    reset() {
+        this.correctionCount = 0;
+    }
+}
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+function buildCorrectionText(event) {
+    const lines = [
+        'The code you just wrote has an issue:',
+        `${event.checkName}: ${event.evidence}`,
+    ];
+    if (event.suggestion) {
+        lines.push(event.suggestion);
+    }
+    lines.push('', 'Please continue generating code, fixing this issue. Do not repeat the code you already wrote — just continue from where you left off with the fix applied.');
+    return lines.join('\n');
+}
+// Re-export for testing
+export { SEVERITY_RANK };
+//# sourceMappingURL=correction-injector.js.map