Hugging Face's logo

Spaces:
TALP-Project
/
multi-agent-smart-contracts
Runtime error

App Files Community
Tales-Cunha commited on
Commit
5710d63
·
1 Parent(s): e8aa1e7

feat(tester): implement PoC generator with DeepSeek and Foundry loop

Browse files
Files changed (40) hide show
  1. .env.example +0 -1
  2. Dockerfile +33 -0
  3. README.md +8 -68
  4. README_GH.md +70 -0
  5. frontend/index.html +12 -0
  6. frontend/package-lock.json +1823 -0
  7. frontend/package.json +22 -0
  8. frontend/src/App.tsx +400 -0
  9. frontend/src/main.tsx +9 -0
  10. frontend/tsconfig.json +16 -0
  11. frontend/vite.config.ts +11 -0
  12. input/requirements.md +12 -0
  13. package-lock.json +0 -0
  14. package.json +13 -1
  15. patches/@langchain+core+1.1.47.patch +25 -0
  16. src/agents/auditor/agent.ts +263 -12
  17. src/agents/auditor/config.ts +23 -0
  18. src/agents/auditor/model.ts +0 -5
  19. src/agents/auditor/prompts.ts +50 -0
  20. src/agents/auditor/state.ts +37 -2
  21. src/agents/auditor/tools/repo-tree-tool.ts +103 -0
  22. src/agents/auditor/tools/slither-tool.ts +0 -15
  23. src/agents/auditor/tools/solidity-analyzer-tool.ts +567 -0
  24. src/agents/auditor/utils.ts +36 -0
  25. src/agents/coder/agent.ts +105 -8
  26. src/agents/coder/outputs/.gitkeep +0 -0
  27. src/agents/coder/prompts.ts +96 -0
  28. src/agents/coder/run.ts +33 -0
  29. src/agents/coder/state.ts +2 -0
  30. src/agents/coder/tools/compile-solidity.ts +50 -0
  31. src/agents/tester/Docs/01_ARCHITECTURE(1).md +189 -0
  32. src/agents/tester/Docs/02_ROADMAP(1).md +72 -0
  33. src/agents/tester/Docs/03_TASKS(2).md +1338 -0
  34. src/agents/tester/data/ExploitTest.t.sol +262 -0
  35. src/agents/tester/data/input.json +18 -0
  36. src/config/constants.ts +2 -0
  37. src/config/llm.ts +31 -0
  38. src/index.ts +43 -32
  39. src/logger.ts +29 -0
  40. src/server.ts +107 -0
.env.example DELETED
@@ -1 +0,0 @@
1
- OPENROUTER_API_KEY=
 
 
Dockerfile ADDED
@@ -0,0 +1,33 @@
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
+ # Build frontend
2
+ FROM node:22-slim AS frontend-build
3
+ WORKDIR /app/frontend
4
+ COPY frontend/package.json frontend/package-lock.json* ./
5
+ RUN npm install
6
+ COPY frontend/ .
7
+ RUN npm run build
8
+
9
+ # Build backend
10
+ FROM node:22-slim AS backend-build
11
+ WORKDIR /app
12
+ COPY package.json package-lock.json* ./
13
+ COPY patches/ ./patches/
14
+ RUN npm install
15
+ COPY tsconfig.json ./
16
+ COPY src/ ./src/
17
+ RUN npm run build
18
+
19
+ # Production
20
+ FROM node:22-slim
21
+ WORKDIR /app
22
+
23
+ COPY package.json package-lock.json* ./
24
+ COPY patches/ ./patches/
25
+ RUN npm install --omit=dev --ignore-scripts
26
+
27
+ COPY --from=backend-build /app/dist ./dist
28
+ COPY --from=frontend-build /app/frontend/dist ./frontend/dist
29
+
30
+ ENV PORT=7860
31
+ EXPOSE 7860
32
+
33
+ CMD ["node", "dist/server.js"]
README.md CHANGED
@@ -1,68 +1,8 @@
1
- # Projeto de TALP1
2
-
3
- Projeto desenvolvido para a disciplina **IN1045 — Tópicos Avançados em Linguagens de Programação 1 (TALP1)**, do curso de Mestrado em Ciência da Computação do **Centro de Informática da Universidade Federal de Pernambuco (CIn-UFPE)**.
4
-
5
- ## Visão Geral
6
-
7
- Este projeto tem como objetivo desenvolver um sistema multiagente inteligente para **geração**, **auditoria** e **validação de vulnerabilidades** em *smart contracts*.
8
-
9
- A proposta é receber documentos contendo requisitos, especificações e descrições funcionais do sistema, processar essas informações e utilizá-las para:
10
-
11
- * gerar contratos inteligentes automaticamente;
12
- * identificar potenciais vulnerabilidades de segurança;
13
- * criar provas de conceito (*Proofs of Concept — PoCs*) para validar as falhas encontradas;
14
- * executar um ciclo iterativo de refinamento e melhoria contínua.
15
-
16
- O sistema é implementado em **TypeScript** e **Node.js**, utilizando a biblioteca **LangGraph** para orquestração dos agentes inteligentes e definição dos fluxos de execução.
17
-
18
- ## Arquitetura Geral
19
-
20
- O sistema é composto por agentes especializados que colaboram entre si em diferentes etapas do processo:
21
-
22
- 1. **Exploração e análise dos requisitos**
23
-
24
- * Processamento e compreensão dos documentos fornecidos;
25
- * Extração de contexto técnico e requisitos relevantes.
26
-
27
- 2. **Geração de Smart Contracts**
28
-
29
- * Criação automática de contratos inteligentes com base nas especificações extraídas.
30
-
31
- 3. **Auditoria de Segurança**
32
-
33
- * Análise estática e contextual do código gerado;
34
- * Identificação de vulnerabilidades e comportamentos inseguros.
35
-
36
- 4. **Geração de PoCs**
37
-
38
- * Construção automática de provas de conceito para validar as vulnerabilidades detectadas.
39
-
40
- 5. **Refinamento Iterativo**
41
-
42
- * Uso do feedback da auditoria e das PoCs para aprimorar o código gerado.
43
-
44
- ## Agentes
45
-
46
- ### Gerador de Código
47
-
48
- Responsável por gerar *smart contracts* a partir dos requisitos e especificações fornecidos.
49
-
50
- ### Auditor de Smart Contracts
51
-
52
- Responsável por analisar o código gerado em busca de vulnerabilidades, inconsistências e problemas de segurança.
53
-
54
- ### Gerador de PoCs
55
-
56
- Responsável por criar provas de conceito capazes de validar e demonstrar as vulnerabilidades identificadas durante a auditoria.
57
-
58
- ## Tecnologias Utilizadas
59
-
60
- * TypeScript
61
- * Node.js
62
- * LangGraph
63
-
64
- ## Equipe
65
-
66
- * André Souza — [alssg@cin.ufpe.br](mailto:alssg@cin.ufpe.br)
67
- * Uanderson Ricardo Ferreira da Silva — [urfs@cin.ufpe.br](mailto:urfs@cin.ufpe.br)
68
- * Tales Vinicius Alves da Cunha — [tvac@cin.ufpe.br](mailto:tvac@cin.ufpe.br)
 
1
+ ---
2
+ title: Multi-Agent Smart Contracts
3
+ emoji: 📝
4
+ colorFrom: blue
5
+ colorTo: indigo
6
+ sdk: docker
7
+ app_port: 7860
8
+ ---
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
README_GH.md ADDED
@@ -0,0 +1,70 @@
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
+ # Projeto de TALP1
2
+
3
+ Projeto desenvolvido para a disciplina **IN1045 — Tópicos Avançados em Linguagens de Programação 1 (TALP1)**, do curso de Mestrado em Ciência da Computação do **Centro de Informática da Universidade Federal de Pernambuco (CIn-UFPE)**.
4
+
5
+ ## Visão Geral
6
+
7
+ Este projeto tem como objetivo desenvolver um sistema multiagente inteligente para **geração**, **auditoria** e **validação de vulnerabilidades** em *smart contracts*.
8
+
9
+ A proposta é receber documentos contendo requisitos, especificações e descrições funcionais do sistema, processar essas informações e utilizá-las para:
10
+
11
+ * gerar contratos inteligentes automaticamente;
12
+ * identificar potenciais vulnerabilidades de segurança;
13
+ * criar provas de conceito (*Proofs of Concept — PoCs*) para validar as falhas encontradas;
14
+ * executar um ciclo iterativo de refinamento e melhoria contínua.
15
+
16
+ O sistema é implementado em **TypeScript** e **Node.js**, utilizando a biblioteca **LangGraph** para orquestração dos agentes inteligentes e definição dos fluxos de execução.
17
+
18
+ ## Arquitetura Geral
19
+
20
+ O sistema é composto por agentes especializados que colaboram entre si em diferentes etapas do processo:
21
+
22
+ ![Arquitetura Geral](./assets/architecture.png)
23
+
24
+ 1. **Exploração e análise dos requisitos**
25
+
26
+ * Processamento e compreensão dos documentos fornecidos;
27
+ * Extração de contexto técnico e requisitos relevantes.
28
+
29
+ 2. **Geração de Smart Contracts**
30
+
31
+ * Criação automática de contratos inteligentes com base nas especificações extraídas.
32
+
33
+ 3. **Auditoria de Segurança**
34
+
35
+ * Análise estática e contextual do código gerado;
36
+ * Identificação de vulnerabilidades e comportamentos inseguros.
37
+
38
+ 4. **Geração de PoCs**
39
+
40
+ * Construção automática de provas de conceito para validar as vulnerabilidades detectadas.
41
+
42
+ 5. **Refinamento Iterativo**
43
+
44
+ * Uso do feedback da auditoria e das PoCs para aprimorar o código gerado.
45
+
46
+ ## Agentes
47
+
48
+ ### Gerador de Código
49
+
50
+ Responsável por gerar *smart contracts* a partir dos requisitos e especificações fornecidos.
51
+
52
+ ### Auditor de Smart Contracts
53
+
54
+ Responsável por analisar o código gerado em busca de vulnerabilidades, inconsistências e problemas de segurança.
55
+
56
+ ### Gerador de PoCs
57
+
58
+ Responsável por criar provas de conceito capazes de validar e demonstrar as vulnerabilidades identificadas durante a auditoria.
59
+
60
+ ## Tecnologias Utilizadas
61
+
62
+ * TypeScript
63
+ * Node.js
64
+ * LangGraph
65
+
66
+ ## Equipe
67
+
68
+ * André Souza — [alssg@cin.ufpe.br](mailto:alssg@cin.ufpe.br)
69
+ * Uanderson Ricardo Ferreira da Silva — [urfs@cin.ufpe.br](mailto:urfs@cin.ufpe.br)
70
+ * Tales Vinicius Alves da Cunha — [tvac@cin.ufpe.br](mailto:tvac@cin.ufpe.br)
frontend/index.html ADDED
@@ -0,0 +1,12 @@
 
 
 
 
 
 
 
 
 
 
 
 
 
1
+ <!DOCTYPE html>
2
+ <html lang="pt-BR">
3
+ <head>
4
+ <meta charset="UTF-8" />
5
+ <meta name="viewport" content="width=device-width, initial-scale=1.0" />
6
+ <title>Multi-Agent Smart Contracts</title>
7
+ </head>
8
+ <body>
9
+ <div id="root"></div>
10
+ <script type="module" src="/src/main.tsx"></script>
11
+ </body>
12
+ </html>
frontend/package-lock.json ADDED
@@ -0,0 +1,1823 @@
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
+ {
2
+ "name": "frontend",
3
+ "version": "0.0.1",
4
+ "lockfileVersion": 3,
5
+ "requires": true,
6
+ "packages": {
7
+ "": {
8
+ "name": "frontend",
9
+ "version": "0.0.1",
10
+ "dependencies": {
11
+ "react": "^19.1.0",
12
+ "react-dom": "^19.1.0"
13
+ },
14
+ "devDependencies": {
15
+ "@types/react": "^19.1.0",
16
+ "@types/react-dom": "^19.1.0",
17
+ "@vitejs/plugin-react": "^4.5.2",
18
+ "typescript": "^5.8.3",
19
+ "vite": "^6.3.5"
20
+ }
21
+ },
22
+ "node_modules/@babel/code-frame": {
23
+ "version": "7.29.0",
24
+ "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.29.0.tgz",
25
+ "integrity": "sha512-9NhCeYjq9+3uxgdtp20LSiJXJvN0FeCtNGpJxuMFZ1Kv3cWUNb6DOhJwUvcVCzKGR66cw4njwM6hrJLqgOwbcw==",
26
+ "dev": true,
27
+ "license": "MIT",
28
+ "dependencies": {
29
+ "@babel/helper-validator-identifier": "^7.28.5",
30
+ "js-tokens": "^4.0.0",
31
+ "picocolors": "^1.1.1"
32
+ },
33
+ "engines": {
34
+ "node": ">=6.9.0"
35
+ }
36
+ },
37
+ "node_modules/@babel/compat-data": {
38
+ "version": "7.29.3",
39
+ "resolved": "https://registry.npmjs.org/@babel/compat-data/-/compat-data-7.29.3.tgz",
40
+ "integrity": "sha512-LIVqM46zQWZhj17qA8wb4nW/ixr2y1Nw+r1etiAWgRM6U1IqP+LNhL1yg440jYZR72jCWcWbLWzIosH+uP1fqg==",
41
+ "dev": true,
42
+ "license": "MIT",
43
+ "engines": {
44
+ "node": ">=6.9.0"
45
+ }
46
+ },
47
+ "node_modules/@babel/core": {
48
+ "version": "7.29.0",
49
+ "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.29.0.tgz",
50
+ "integrity": "sha512-CGOfOJqWjg2qW/Mb6zNsDm+u5vFQ8DxXfbM09z69p5Z6+mE1ikP2jUXw+j42Pf1XTYED2Rni5f95npYeuwMDQA==",
51
+ "dev": true,
52
+ "license": "MIT",
53
+ "dependencies": {
54
+ "@babel/code-frame": "^7.29.0",
55
+ "@babel/generator": "^7.29.0",
56
+ "@babel/helper-compilation-targets": "^7.28.6",
57
+ "@babel/helper-module-transforms": "^7.28.6",
58
+ "@babel/helpers": "^7.28.6",
59
+ "@babel/parser": "^7.29.0",
60
+ "@babel/template": "^7.28.6",
61
+ "@babel/traverse": "^7.29.0",
62
+ "@babel/types": "^7.29.0",
63
+ "@jridgewell/remapping": "^2.3.5",
64
+ "convert-source-map": "^2.0.0",
65
+ "debug": "^4.1.0",
66
+ "gensync": "^1.0.0-beta.2",
67
+ "json5": "^2.2.3",
68
+ "semver": "^6.3.1"
69
+ },
70
+ "engines": {
71
+ "node": ">=6.9.0"
72
+ },
73
+ "funding": {
74
+ "type": "opencollective",
75
+ "url": "https://opencollective.com/babel"
76
+ }
77
+ },
78
+ "node_modules/@babel/generator": {
79
+ "version": "7.29.1",
80
+ "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.29.1.tgz",
81
+ "integrity": "sha512-qsaF+9Qcm2Qv8SRIMMscAvG4O3lJ0F1GuMo5HR/Bp02LopNgnZBC/EkbevHFeGs4ls/oPz9v+Bsmzbkbe+0dUw==",
82
+ "dev": true,
83
+ "license": "MIT",
84
+ "dependencies": {
85
+ "@babel/parser": "^7.29.0",
86
+ "@babel/types": "^7.29.0",
87
+ "@jridgewell/gen-mapping": "^0.3.12",
88
+ "@jridgewell/trace-mapping": "^0.3.28",
89
+ "jsesc": "^3.0.2"
90
+ },
91
+ "engines": {
92
+ "node": ">=6.9.0"
93
+ }
94
+ },
95
+ "node_modules/@babel/helper-compilation-targets": {
96
+ "version": "7.28.6",
97
+ "resolved": "https://registry.npmjs.org/@babel/helper-compilation-targets/-/helper-compilation-targets-7.28.6.tgz",
98
+ "integrity": "sha512-JYtls3hqi15fcx5GaSNL7SCTJ2MNmjrkHXg4FSpOA/grxK8KwyZ5bubHsCq8FXCkua6xhuaaBit+3b7+VZRfcA==",
99
+ "dev": true,
100
+ "license": "MIT",
101
+ "dependencies": {
102
+ "@babel/compat-data": "^7.28.6",
103
+ "@babel/helper-validator-option": "^7.27.1",
104
+ "browserslist": "^4.24.0",
105
+ "lru-cache": "^5.1.1",
106
+ "semver": "^6.3.1"
107
+ },
108
+ "engines": {
109
+ "node": ">=6.9.0"
110
+ }
111
+ },
112
+ "node_modules/@babel/helper-globals": {
113
+ "version": "7.28.0",
114
+ "resolved": "https://registry.npmjs.org/@babel/helper-globals/-/helper-globals-7.28.0.tgz",
115
+ "integrity": "sha512-+W6cISkXFa1jXsDEdYA8HeevQT/FULhxzR99pxphltZcVaugps53THCeiWA8SguxxpSp3gKPiuYfSWopkLQ4hw==",
116
+ "dev": true,
117
+ "license": "MIT",
118
+ "engines": {
119
+ "node": ">=6.9.0"
120
+ }
121
+ },
122
+ "node_modules/@babel/helper-module-imports": {
123
+ "version": "7.28.6",
124
+ "resolved": "https://registry.npmjs.org/@babel/helper-module-imports/-/helper-module-imports-7.28.6.tgz",
125
+ "integrity": "sha512-l5XkZK7r7wa9LucGw9LwZyyCUscb4x37JWTPz7swwFE/0FMQAGpiWUZn8u9DzkSBWEcK25jmvubfpw2dnAMdbw==",
126
+ "dev": true,
127
+ "license": "MIT",
128
+ "dependencies": {
129
+ "@babel/traverse": "^7.28.6",
130
+ "@babel/types": "^7.28.6"
131
+ },
132
+ "engines": {
133
+ "node": ">=6.9.0"
134
+ }
135
+ },
136
+ "node_modules/@babel/helper-module-transforms": {
137
+ "version": "7.28.6",
138
+ "resolved": "https://registry.npmjs.org/@babel/helper-module-transforms/-/helper-module-transforms-7.28.6.tgz",
139
+ "integrity": "sha512-67oXFAYr2cDLDVGLXTEABjdBJZ6drElUSI7WKp70NrpyISso3plG9SAGEF6y7zbha/wOzUByWWTJvEDVNIUGcA==",
140
+ "dev": true,
141
+ "license": "MIT",
142
+ "dependencies": {
143
+ "@babel/helper-module-imports": "^7.28.6",
144
+ "@babel/helper-validator-identifier": "^7.28.5",
145
+ "@babel/traverse": "^7.28.6"
146
+ },
147
+ "engines": {
148
+ "node": ">=6.9.0"
149
+ },
150
+ "peerDependencies": {
151
+ "@babel/core": "^7.0.0"
152
+ }
153
+ },
154
+ "node_modules/@babel/helper-plugin-utils": {
155
+ "version": "7.28.6",
156
+ "resolved": "https://registry.npmjs.org/@babel/helper-plugin-utils/-/helper-plugin-utils-7.28.6.tgz",
157
+ "integrity": "sha512-S9gzZ/bz83GRysI7gAD4wPT/AI3uCnY+9xn+Mx/KPs2JwHJIz1W8PZkg2cqyt3RNOBM8ejcXhV6y8Og7ly/Dug==",
158
+ "dev": true,
159
+ "license": "MIT",
160
+ "engines": {
161
+ "node": ">=6.9.0"
162
+ }
163
+ },
164
+ "node_modules/@babel/helper-string-parser": {
165
+ "version": "7.27.1",
166
+ "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-7.27.1.tgz",
167
+ "integrity": "sha512-qMlSxKbpRlAridDExk92nSobyDdpPijUq2DW6oDnUqd0iOGxmQjyqhMIihI9+zv4LPyZdRje2cavWPbCbWm3eA==",
168
+ "dev": true,
169
+ "license": "MIT",
170
+ "engines": {
171
+ "node": ">=6.9.0"
172
+ }
173
+ },
174
+ "node_modules/@babel/helper-validator-identifier": {
175
+ "version": "7.28.5",
176
+ "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.28.5.tgz",
177
+ "integrity": "sha512-qSs4ifwzKJSV39ucNjsvc6WVHs6b7S03sOh2OcHF9UHfVPqWWALUsNUVzhSBiItjRZoLHx7nIarVjqKVusUZ1Q==",
178
+ "dev": true,
179
+ "license": "MIT",
180
+ "engines": {
181
+ "node": ">=6.9.0"
182
+ }
183
+ },
184
+ "node_modules/@babel/helper-validator-option": {
185
+ "version": "7.27.1",
186
+ "resolved": "https://registry.npmjs.org/@babel/helper-validator-option/-/helper-validator-option-7.27.1.tgz",
187
+ "integrity": "sha512-YvjJow9FxbhFFKDSuFnVCe2WxXk1zWc22fFePVNEaWJEu8IrZVlda6N0uHwzZrUM1il7NC9Mlp4MaJYbYd9JSg==",
188
+ "dev": true,
189
+ "license": "MIT",
190
+ "engines": {
191
+ "node": ">=6.9.0"
192
+ }
193
+ },
194
+ "node_modules/@babel/helpers": {
195
+ "version": "7.29.2",
196
+ "resolved": "https://registry.npmjs.org/@babel/helpers/-/helpers-7.29.2.tgz",
197
+ "integrity": "sha512-HoGuUs4sCZNezVEKdVcwqmZN8GoHirLUcLaYVNBK2J0DadGtdcqgr3BCbvH8+XUo4NGjNl3VOtSjEKNzqfFgKw==",
198
+ "dev": true,
199
+ "license": "MIT",
200
+ "dependencies": {
201
+ "@babel/template": "^7.28.6",
202
+ "@babel/types": "^7.29.0"
203
+ },
204
+ "engines": {
205
+ "node": ">=6.9.0"
206
+ }
207
+ },
208
+ "node_modules/@babel/parser": {
209
+ "version": "7.29.3",
210
+ "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.29.3.tgz",
211
+ "integrity": "sha512-b3ctpQwp+PROvU/cttc4OYl4MzfJUWy6FZg+PMXfzmt/+39iHVF0sDfqay8TQM3JA2EUOyKcFZt75jWriQijsA==",
212
+ "dev": true,
213
+ "license": "MIT",
214
+ "dependencies": {
215
+ "@babel/types": "^7.29.0"
216
+ },
217
+ "bin": {
218
+ "parser": "bin/babel-parser.js"
219
+ },
220
+ "engines": {
221
+ "node": ">=6.0.0"
222
+ }
223
+ },
224
+ "node_modules/@babel/plugin-transform-react-jsx-self": {
225
+ "version": "7.27.1",
226
+ "resolved": "https://registry.npmjs.org/@babel/plugin-transform-react-jsx-self/-/plugin-transform-react-jsx-self-7.27.1.tgz",
227
+ "integrity": "sha512-6UzkCs+ejGdZ5mFFC/OCUrv028ab2fp1znZmCZjAOBKiBK2jXD1O+BPSfX8X2qjJ75fZBMSnQn3Rq2mrBJK2mw==",
228
+ "dev": true,
229
+ "license": "MIT",
230
+ "dependencies": {
231
+ "@babel/helper-plugin-utils": "^7.27.1"
232
+ },
233
+ "engines": {
234
+ "node": ">=6.9.0"
235
+ },
236
+ "peerDependencies": {
237
+ "@babel/core": "^7.0.0-0"
238
+ }
239
+ },
240
+ "node_modules/@babel/plugin-transform-react-jsx-source": {
241
+ "version": "7.27.1",
242
+ "resolved": "https://registry.npmjs.org/@babel/plugin-transform-react-jsx-source/-/plugin-transform-react-jsx-source-7.27.1.tgz",
243
+ "integrity": "sha512-zbwoTsBruTeKB9hSq73ha66iFeJHuaFkUbwvqElnygoNbj/jHRsSeokowZFN3CZ64IvEqcmmkVe89OPXc7ldAw==",
244
+ "dev": true,
245
+ "license": "MIT",
246
+ "dependencies": {
247
+ "@babel/helper-plugin-utils": "^7.27.1"
248
+ },
249
+ "engines": {
250
+ "node": ">=6.9.0"
251
+ },
252
+ "peerDependencies": {
253
+ "@babel/core": "^7.0.0-0"
254
+ }
255
+ },
256
+ "node_modules/@babel/template": {
257
+ "version": "7.28.6",
258
+ "resolved": "https://registry.npmjs.org/@babel/template/-/template-7.28.6.tgz",
259
+ "integrity": "sha512-YA6Ma2KsCdGb+WC6UpBVFJGXL58MDA6oyONbjyF/+5sBgxY/dwkhLogbMT2GXXyU84/IhRw/2D1Os1B/giz+BQ==",
260
+ "dev": true,
261
+ "license": "MIT",
262
+ "dependencies": {
263
+ "@babel/code-frame": "^7.28.6",
264
+ "@babel/parser": "^7.28.6",
265
+ "@babel/types": "^7.28.6"
266
+ },
267
+ "engines": {
268
+ "node": ">=6.9.0"
269
+ }
270
+ },
271
+ "node_modules/@babel/traverse": {
272
+ "version": "7.29.0",
273
+ "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.29.0.tgz",
274
+ "integrity": "sha512-4HPiQr0X7+waHfyXPZpWPfWL/J7dcN1mx9gL6WdQVMbPnF3+ZhSMs8tCxN7oHddJE9fhNE7+lxdnlyemKfJRuA==",
275
+ "dev": true,
276
+ "license": "MIT",
277
+ "dependencies": {
278
+ "@babel/code-frame": "^7.29.0",
279
+ "@babel/generator": "^7.29.0",
280
+ "@babel/helper-globals": "^7.28.0",
281
+ "@babel/parser": "^7.29.0",
282
+ "@babel/template": "^7.28.6",
283
+ "@babel/types": "^7.29.0",
284
+ "debug": "^4.3.1"
285
+ },
286
+ "engines": {
287
+ "node": ">=6.9.0"
288
+ }
289
+ },
290
+ "node_modules/@babel/types": {
291
+ "version": "7.29.0",
292
+ "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.29.0.tgz",
293
+ "integrity": "sha512-LwdZHpScM4Qz8Xw2iKSzS+cfglZzJGvofQICy7W7v4caru4EaAmyUuO6BGrbyQ2mYV11W0U8j5mBhd14dd3B0A==",
294
+ "dev": true,
295
+ "license": "MIT",
296
+ "dependencies": {
297
+ "@babel/helper-string-parser": "^7.27.1",
298
+ "@babel/helper-validator-identifier": "^7.28.5"
299
+ },
300
+ "engines": {
301
+ "node": ">=6.9.0"
302
+ }
303
+ },
304
+ "node_modules/@esbuild/aix-ppc64": {
305
+ "version": "0.25.12",
306
+ "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.25.12.tgz",
307
+ "integrity": "sha512-Hhmwd6CInZ3dwpuGTF8fJG6yoWmsToE+vYgD4nytZVxcu1ulHpUQRAB1UJ8+N1Am3Mz4+xOByoQoSZf4D+CpkA==",
308
+ "cpu": [
309
+ "ppc64"
310
+ ],
311
+ "dev": true,
312
+ "license": "MIT",
313
+ "optional": true,
314
+ "os": [
315
+ "aix"
316
+ ],
317
+ "engines": {
318
+ "node": ">=18"
319
+ }
320
+ },
321
+ "node_modules/@esbuild/android-arm": {
322
+ "version": "0.25.12",
323
+ "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.25.12.tgz",
324
+ "integrity": "sha512-VJ+sKvNA/GE7Ccacc9Cha7bpS8nyzVv0jdVgwNDaR4gDMC/2TTRc33Ip8qrNYUcpkOHUT5OZ0bUcNNVZQ9RLlg==",
325
+ "cpu": [
326
+ "arm"
327
+ ],
328
+ "dev": true,
329
+ "license": "MIT",
330
+ "optional": true,
331
+ "os": [
332
+ "android"
333
+ ],
334
+ "engines": {
335
+ "node": ">=18"
336
+ }
337
+ },
338
+ "node_modules/@esbuild/android-arm64": {
339
+ "version": "0.25.12",
340
+ "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.25.12.tgz",
341
+ "integrity": "sha512-6AAmLG7zwD1Z159jCKPvAxZd4y/VTO0VkprYy+3N2FtJ8+BQWFXU+OxARIwA46c5tdD9SsKGZ/1ocqBS/gAKHg==",
342
+ "cpu": [
343
+ "arm64"
344
+ ],
345
+ "dev": true,
346
+ "license": "MIT",
347
+ "optional": true,
348
+ "os": [
349
+ "android"
350
+ ],
351
+ "engines": {
352
+ "node": ">=18"
353
+ }
354
+ },
355
+ "node_modules/@esbuild/android-x64": {
356
+ "version": "0.25.12",
357
+ "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.25.12.tgz",
358
+ "integrity": "sha512-5jbb+2hhDHx5phYR2By8GTWEzn6I9UqR11Kwf22iKbNpYrsmRB18aX/9ivc5cabcUiAT/wM+YIZ6SG9QO6a8kg==",
359
+ "cpu": [
360
+ "x64"
361
+ ],
362
+ "dev": true,
363
+ "license": "MIT",
364
+ "optional": true,
365
+ "os": [
366
+ "android"
367
+ ],
368
+ "engines": {
369
+ "node": ">=18"
370
+ }
371
+ },
372
+ "node_modules/@esbuild/darwin-arm64": {
373
+ "version": "0.25.12",
374
+ "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.25.12.tgz",
375
+ "integrity": "sha512-N3zl+lxHCifgIlcMUP5016ESkeQjLj/959RxxNYIthIg+CQHInujFuXeWbWMgnTo4cp5XVHqFPmpyu9J65C1Yg==",
376
+ "cpu": [
377
+ "arm64"
378
+ ],
379
+ "dev": true,
380
+ "license": "MIT",
381
+ "optional": true,
382
+ "os": [
383
+ "darwin"
384
+ ],
385
+ "engines": {
386
+ "node": ">=18"
387
+ }
388
+ },
389
+ "node_modules/@esbuild/darwin-x64": {
390
+ "version": "0.25.12",
391
+ "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.25.12.tgz",
392
+ "integrity": "sha512-HQ9ka4Kx21qHXwtlTUVbKJOAnmG1ipXhdWTmNXiPzPfWKpXqASVcWdnf2bnL73wgjNrFXAa3yYvBSd9pzfEIpA==",
393
+ "cpu": [
394
+ "x64"
395
+ ],
396
+ "dev": true,
397
+ "license": "MIT",
398
+ "optional": true,
399
+ "os": [
400
+ "darwin"
401
+ ],
402
+ "engines": {
403
+ "node": ">=18"
404
+ }
405
+ },
406
+ "node_modules/@esbuild/freebsd-arm64": {
407
+ "version": "0.25.12",
408
+ "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.25.12.tgz",
409
+ "integrity": "sha512-gA0Bx759+7Jve03K1S0vkOu5Lg/85dou3EseOGUes8flVOGxbhDDh/iZaoek11Y8mtyKPGF3vP8XhnkDEAmzeg==",
410
+ "cpu": [
411
+ "arm64"
412
+ ],
413
+ "dev": true,
414
+ "license": "MIT",
415
+ "optional": true,
416
+ "os": [
417
+ "freebsd"
418
+ ],
419
+ "engines": {
420
+ "node": ">=18"
421
+ }
422
+ },
423
+ "node_modules/@esbuild/freebsd-x64": {
424
+ "version": "0.25.12",
425
+ "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.25.12.tgz",
426
+ "integrity": "sha512-TGbO26Yw2xsHzxtbVFGEXBFH0FRAP7gtcPE7P5yP7wGy7cXK2oO7RyOhL5NLiqTlBh47XhmIUXuGciXEqYFfBQ==",
427
+ "cpu": [
428
+ "x64"
429
+ ],
430
+ "dev": true,
431
+ "license": "MIT",
432
+ "optional": true,
433
+ "os": [
434
+ "freebsd"
435
+ ],
436
+ "engines": {
437
+ "node": ">=18"
438
+ }
439
+ },
440
+ "node_modules/@esbuild/linux-arm": {
441
+ "version": "0.25.12",
442
+ "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.25.12.tgz",
443
+ "integrity": "sha512-lPDGyC1JPDou8kGcywY0YILzWlhhnRjdof3UlcoqYmS9El818LLfJJc3PXXgZHrHCAKs/Z2SeZtDJr5MrkxtOw==",
444
+ "cpu": [
445
+ "arm"
446
+ ],
447
+ "dev": true,
448
+ "license": "MIT",
449
+ "optional": true,
450
+ "os": [
451
+ "linux"
452
+ ],
453
+ "engines": {
454
+ "node": ">=18"
455
+ }
456
+ },
457
+ "node_modules/@esbuild/linux-arm64": {
458
+ "version": "0.25.12",
459
+ "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.25.12.tgz",
460
+ "integrity": "sha512-8bwX7a8FghIgrupcxb4aUmYDLp8pX06rGh5HqDT7bB+8Rdells6mHvrFHHW2JAOPZUbnjUpKTLg6ECyzvas2AQ==",
461
+ "cpu": [
462
+ "arm64"
463
+ ],
464
+ "dev": true,
465
+ "license": "MIT",
466
+ "optional": true,
467
+ "os": [
468
+ "linux"
469
+ ],
470
+ "engines": {
471
+ "node": ">=18"
472
+ }
473
+ },
474
+ "node_modules/@esbuild/linux-ia32": {
475
+ "version": "0.25.12",
476
+ "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.25.12.tgz",
477
+ "integrity": "sha512-0y9KrdVnbMM2/vG8KfU0byhUN+EFCny9+8g202gYqSSVMonbsCfLjUO+rCci7pM0WBEtz+oK/PIwHkzxkyharA==",
478
+ "cpu": [
479
+ "ia32"
480
+ ],
481
+ "dev": true,
482
+ "license": "MIT",
483
+ "optional": true,
484
+ "os": [
485
+ "linux"
486
+ ],
487
+ "engines": {
488
+ "node": ">=18"
489
+ }
490
+ },
491
+ "node_modules/@esbuild/linux-loong64": {
492
+ "version": "0.25.12",
493
+ "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.25.12.tgz",
494
+ "integrity": "sha512-h///Lr5a9rib/v1GGqXVGzjL4TMvVTv+s1DPoxQdz7l/AYv6LDSxdIwzxkrPW438oUXiDtwM10o9PmwS/6Z0Ng==",
495
+ "cpu": [
496
+ "loong64"
497
+ ],
498
+ "dev": true,
499
+ "license": "MIT",
500
+ "optional": true,
501
+ "os": [
502
+ "linux"
503
+ ],
504
+ "engines": {
505
+ "node": ">=18"
506
+ }
507
+ },
508
+ "node_modules/@esbuild/linux-mips64el": {
509
+ "version": "0.25.12",
510
+ "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.25.12.tgz",
511
+ "integrity": "sha512-iyRrM1Pzy9GFMDLsXn1iHUm18nhKnNMWscjmp4+hpafcZjrr2WbT//d20xaGljXDBYHqRcl8HnxbX6uaA/eGVw==",
512
+ "cpu": [
513
+ "mips64el"
514
+ ],
515
+ "dev": true,
516
+ "license": "MIT",
517
+ "optional": true,
518
+ "os": [
519
+ "linux"
520
+ ],
521
+ "engines": {
522
+ "node": ">=18"
523
+ }
524
+ },
525
+ "node_modules/@esbuild/linux-ppc64": {
526
+ "version": "0.25.12",
527
+ "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.25.12.tgz",
528
+ "integrity": "sha512-9meM/lRXxMi5PSUqEXRCtVjEZBGwB7P/D4yT8UG/mwIdze2aV4Vo6U5gD3+RsoHXKkHCfSxZKzmDssVlRj1QQA==",
529
+ "cpu": [
530
+ "ppc64"
531
+ ],
532
+ "dev": true,
533
+ "license": "MIT",
534
+ "optional": true,
535
+ "os": [
536
+ "linux"
537
+ ],
538
+ "engines": {
539
+ "node": ">=18"
540
+ }
541
+ },
542
+ "node_modules/@esbuild/linux-riscv64": {
543
+ "version": "0.25.12",
544
+ "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.25.12.tgz",
545
+ "integrity": "sha512-Zr7KR4hgKUpWAwb1f3o5ygT04MzqVrGEGXGLnj15YQDJErYu/BGg+wmFlIDOdJp0PmB0lLvxFIOXZgFRrdjR0w==",
546
+ "cpu": [
547
+ "riscv64"
548
+ ],
549
+ "dev": true,
550
+ "license": "MIT",
551
+ "optional": true,
552
+ "os": [
553
+ "linux"
554
+ ],
555
+ "engines": {
556
+ "node": ">=18"
557
+ }
558
+ },
559
+ "node_modules/@esbuild/linux-s390x": {
560
+ "version": "0.25.12",
561
+ "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.25.12.tgz",
562
+ "integrity": "sha512-MsKncOcgTNvdtiISc/jZs/Zf8d0cl/t3gYWX8J9ubBnVOwlk65UIEEvgBORTiljloIWnBzLs4qhzPkJcitIzIg==",
563
+ "cpu": [
564
+ "s390x"
565
+ ],
566
+ "dev": true,
567
+ "license": "MIT",
568
+ "optional": true,
569
+ "os": [
570
+ "linux"
571
+ ],
572
+ "engines": {
573
+ "node": ">=18"
574
+ }
575
+ },
576
+ "node_modules/@esbuild/linux-x64": {
577
+ "version": "0.25.12",
578
+ "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.25.12.tgz",
579
+ "integrity": "sha512-uqZMTLr/zR/ed4jIGnwSLkaHmPjOjJvnm6TVVitAa08SLS9Z0VM8wIRx7gWbJB5/J54YuIMInDquWyYvQLZkgw==",
580
+ "cpu": [
581
+ "x64"
582
+ ],
583
+ "dev": true,
584
+ "license": "MIT",
585
+ "optional": true,
586
+ "os": [
587
+ "linux"
588
+ ],
589
+ "engines": {
590
+ "node": ">=18"
591
+ }
592
+ },
593
+ "node_modules/@esbuild/netbsd-arm64": {
594
+ "version": "0.25.12",
595
+ "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.25.12.tgz",
596
+ "integrity": "sha512-xXwcTq4GhRM7J9A8Gv5boanHhRa/Q9KLVmcyXHCTaM4wKfIpWkdXiMog/KsnxzJ0A1+nD+zoecuzqPmCRyBGjg==",
597
+ "cpu": [
598
+ "arm64"
599
+ ],
600
+ "dev": true,
601
+ "license": "MIT",
602
+ "optional": true,
603
+ "os": [
604
+ "netbsd"
605
+ ],
606
+ "engines": {
607
+ "node": ">=18"
608
+ }
609
+ },
610
+ "node_modules/@esbuild/netbsd-x64": {
611
+ "version": "0.25.12",
612
+ "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.25.12.tgz",
613
+ "integrity": "sha512-Ld5pTlzPy3YwGec4OuHh1aCVCRvOXdH8DgRjfDy/oumVovmuSzWfnSJg+VtakB9Cm0gxNO9BzWkj6mtO1FMXkQ==",
614
+ "cpu": [
615
+ "x64"
616
+ ],
617
+ "dev": true,
618
+ "license": "MIT",
619
+ "optional": true,
620
+ "os": [
621
+ "netbsd"
622
+ ],
623
+ "engines": {
624
+ "node": ">=18"
625
+ }
626
+ },
627
+ "node_modules/@esbuild/openbsd-arm64": {
628
+ "version": "0.25.12",
629
+ "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.25.12.tgz",
630
+ "integrity": "sha512-fF96T6KsBo/pkQI950FARU9apGNTSlZGsv1jZBAlcLL1MLjLNIWPBkj5NlSz8aAzYKg+eNqknrUJ24QBybeR5A==",
631
+ "cpu": [
632
+ "arm64"
633
+ ],
634
+ "dev": true,
635
+ "license": "MIT",
636
+ "optional": true,
637
+ "os": [
638
+ "openbsd"
639
+ ],
640
+ "engines": {
641
+ "node": ">=18"
642
+ }
643
+ },
644
+ "node_modules/@esbuild/openbsd-x64": {
645
+ "version": "0.25.12",
646
+ "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.25.12.tgz",
647
+ "integrity": "sha512-MZyXUkZHjQxUvzK7rN8DJ3SRmrVrke8ZyRusHlP+kuwqTcfWLyqMOE3sScPPyeIXN/mDJIfGXvcMqCgYKekoQw==",
648
+ "cpu": [
649
+ "x64"
650
+ ],
651
+ "dev": true,
652
+ "license": "MIT",
653
+ "optional": true,
654
+ "os": [
655
+ "openbsd"
656
+ ],
657
+ "engines": {
658
+ "node": ">=18"
659
+ }
660
+ },
661
+ "node_modules/@esbuild/openharmony-arm64": {
662
+ "version": "0.25.12",
663
+ "resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.25.12.tgz",
664
+ "integrity": "sha512-rm0YWsqUSRrjncSXGA7Zv78Nbnw4XL6/dzr20cyrQf7ZmRcsovpcRBdhD43Nuk3y7XIoW2OxMVvwuRvk9XdASg==",
665
+ "cpu": [
666
+ "arm64"
667
+ ],
668
+ "dev": true,
669
+ "license": "MIT",
670
+ "optional": true,
671
+ "os": [
672
+ "openharmony"
673
+ ],
674
+ "engines": {
675
+ "node": ">=18"
676
+ }
677
+ },
678
+ "node_modules/@esbuild/sunos-x64": {
679
+ "version": "0.25.12",
680
+ "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.25.12.tgz",
681
+ "integrity": "sha512-3wGSCDyuTHQUzt0nV7bocDy72r2lI33QL3gkDNGkod22EsYl04sMf0qLb8luNKTOmgF/eDEDP5BFNwoBKH441w==",
682
+ "cpu": [
683
+ "x64"
684
+ ],
685
+ "dev": true,
686
+ "license": "MIT",
687
+ "optional": true,
688
+ "os": [
689
+ "sunos"
690
+ ],
691
+ "engines": {
692
+ "node": ">=18"
693
+ }
694
+ },
695
+ "node_modules/@esbuild/win32-arm64": {
696
+ "version": "0.25.12",
697
+ "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.25.12.tgz",
698
+ "integrity": "sha512-rMmLrur64A7+DKlnSuwqUdRKyd3UE7oPJZmnljqEptesKM8wx9J8gx5u0+9Pq0fQQW8vqeKebwNXdfOyP+8Bsg==",
699
+ "cpu": [
700
+ "arm64"
701
+ ],
702
+ "dev": true,
703
+ "license": "MIT",
704
+ "optional": true,
705
+ "os": [
706
+ "win32"
707
+ ],
708
+ "engines": {
709
+ "node": ">=18"
710
+ }
711
+ },
712
+ "node_modules/@esbuild/win32-ia32": {
713
+ "version": "0.25.12",
714
+ "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.25.12.tgz",
715
+ "integrity": "sha512-HkqnmmBoCbCwxUKKNPBixiWDGCpQGVsrQfJoVGYLPT41XWF8lHuE5N6WhVia2n4o5QK5M4tYr21827fNhi4byQ==",
716
+ "cpu": [
717
+ "ia32"
718
+ ],
719
+ "dev": true,
720
+ "license": "MIT",
721
+ "optional": true,
722
+ "os": [
723
+ "win32"
724
+ ],
725
+ "engines": {
726
+ "node": ">=18"
727
+ }
728
+ },
729
+ "node_modules/@esbuild/win32-x64": {
730
+ "version": "0.25.12",
731
+ "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.25.12.tgz",
732
+ "integrity": "sha512-alJC0uCZpTFrSL0CCDjcgleBXPnCrEAhTBILpeAp7M/OFgoqtAetfBzX0xM00MUsVVPpVjlPuMbREqnZCXaTnA==",
733
+ "cpu": [
734
+ "x64"
735
+ ],
736
+ "dev": true,
737
+ "license": "MIT",
738
+ "optional": true,
739
+ "os": [
740
+ "win32"
741
+ ],
742
+ "engines": {
743
+ "node": ">=18"
744
+ }
745
+ },
746
+ "node_modules/@jridgewell/gen-mapping": {
747
+ "version": "0.3.13",
748
+ "resolved": "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.3.13.tgz",
749
+ "integrity": "sha512-2kkt/7niJ6MgEPxF0bYdQ6etZaA+fQvDcLKckhy1yIQOzaoKjBBjSj63/aLVjYE3qhRt5dvM+uUyfCg6UKCBbA==",
750
+ "dev": true,
751
+ "license": "MIT",
752
+ "dependencies": {
753
+ "@jridgewell/sourcemap-codec": "^1.5.0",
754
+ "@jridgewell/trace-mapping": "^0.3.24"
755
+ }
756
+ },
757
+ "node_modules/@jridgewell/remapping": {
758
+ "version": "2.3.5",
759
+ "resolved": "https://registry.npmjs.org/@jridgewell/remapping/-/remapping-2.3.5.tgz",
760
+ "integrity": "sha512-LI9u/+laYG4Ds1TDKSJW2YPrIlcVYOwi2fUC6xB43lueCjgxV4lffOCZCtYFiH6TNOX+tQKXx97T4IKHbhyHEQ==",
761
+ "dev": true,
762
+ "license": "MIT",
763
+ "dependencies": {
764
+ "@jridgewell/gen-mapping": "^0.3.5",
765
+ "@jridgewell/trace-mapping": "^0.3.24"
766
+ }
767
+ },
768
+ "node_modules/@jridgewell/resolve-uri": {
769
+ "version": "3.1.2",
770
+ "resolved": "https://registry.npmjs.org/@jridgewell/resolve-uri/-/resolve-uri-3.1.2.tgz",
771
+ "integrity": "sha512-bRISgCIjP20/tbWSPWMEi54QVPRZExkuD9lJL+UIxUKtwVJA8wW1Trb1jMs1RFXo1CBTNZ/5hpC9QvmKWdopKw==",
772
+ "dev": true,
773
+ "license": "MIT",
774
+ "engines": {
775
+ "node": ">=6.0.0"
776
+ }
777
+ },
778
+ "node_modules/@jridgewell/sourcemap-codec": {
779
+ "version": "1.5.5",
780
+ "resolved": "https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.5.5.tgz",
781
+ "integrity": "sha512-cYQ9310grqxueWbl+WuIUIaiUaDcj7WOq5fVhEljNVgRfOUhY9fy2zTvfoqWsnebh8Sl70VScFbICvJnLKB0Og==",
782
+ "dev": true,
783
+ "license": "MIT"
784
+ },
785
+ "node_modules/@jridgewell/trace-mapping": {
786
+ "version": "0.3.31",
787
+ "resolved": "https://registry.npmjs.org/@jridgewell/trace-mapping/-/trace-mapping-0.3.31.tgz",
788
+ "integrity": "sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw==",
789
+ "dev": true,
790
+ "license": "MIT",
791
+ "dependencies": {
792
+ "@jridgewell/resolve-uri": "^3.1.0",
793
+ "@jridgewell/sourcemap-codec": "^1.4.14"
794
+ }
795
+ },
796
+ "node_modules/@rolldown/pluginutils": {
797
+ "version": "1.0.0-beta.27",
798
+ "resolved": "https://registry.npmjs.org/@rolldown/pluginutils/-/pluginutils-1.0.0-beta.27.tgz",
799
+ "integrity": "sha512-+d0F4MKMCbeVUJwG96uQ4SgAznZNSq93I3V+9NHA4OpvqG8mRCpGdKmK8l/dl02h2CCDHwW2FqilnTyDcAnqjA==",
800
+ "dev": true,
801
+ "license": "MIT"
802
+ },
803
+ "node_modules/@rollup/rollup-android-arm-eabi": {
804
+ "version": "4.60.4",
805
+ "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm-eabi/-/rollup-android-arm-eabi-4.60.4.tgz",
806
+ "integrity": "sha512-F5QXMSiFebS9hKZj02XhWLLnRpJ3B3AROP0tWbFBSj+6kCbg5m9j5JoHKd4mmSVy5mS/IMQloYgYxCuJC0fxEQ==",
807
+ "cpu": [
808
+ "arm"
809
+ ],
810
+ "dev": true,
811
+ "license": "MIT",
812
+ "optional": true,
813
+ "os": [
814
+ "android"
815
+ ]
816
+ },
817
+ "node_modules/@rollup/rollup-android-arm64": {
818
+ "version": "4.60.4",
819
+ "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm64/-/rollup-android-arm64-4.60.4.tgz",
820
+ "integrity": "sha512-GxxTKApUpzRhof7poWvCJHRF51C67u1R7D6DiluBE8wKU1u5GWE8t+v81JvJYtbawoBFX1hLv5Ei4eVjkWokaw==",
821
+ "cpu": [
822
+ "arm64"
823
+ ],
824
+ "dev": true,
825
+ "license": "MIT",
826
+ "optional": true,
827
+ "os": [
828
+ "android"
829
+ ]
830
+ },
831
+ "node_modules/@rollup/rollup-darwin-arm64": {
832
+ "version": "4.60.4",
833
+ "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-arm64/-/rollup-darwin-arm64-4.60.4.tgz",
834
+ "integrity": "sha512-tua0TaJxMOB1R0V0RS1jFZ/RpURFDJIOR2A6jWwQeawuFyS4gBW+rntLRaQd0EQ4bd6Vp44Z2rXW+YYDBsj6IA==",
835
+ "cpu": [
836
+ "arm64"
837
+ ],
838
+ "dev": true,
839
+ "license": "MIT",
840
+ "optional": true,
841
+ "os": [
842
+ "darwin"
843
+ ]
844
+ },
845
+ "node_modules/@rollup/rollup-darwin-x64": {
846
+ "version": "4.60.4",
847
+ "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-x64/-/rollup-darwin-x64-4.60.4.tgz",
848
+ "integrity": "sha512-CSKq7MsP+5PFIcydhAiR1K0UhEI1A2jWXVKHPCBZ151yOutENwvnPocgVHkivu2kviURtCEB6zUQw0vs8RrhMg==",
849
+ "cpu": [
850
+ "x64"
851
+ ],
852
+ "dev": true,
853
+ "license": "MIT",
854
+ "optional": true,
855
+ "os": [
856
+ "darwin"
857
+ ]
858
+ },
859
+ "node_modules/@rollup/rollup-freebsd-arm64": {
860
+ "version": "4.60.4",
861
+ "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-arm64/-/rollup-freebsd-arm64-4.60.4.tgz",
862
+ "integrity": "sha512-+O8OkVdyvXMtJEciu2wS/pzm1IxntEEQx3z5TAVy4l32G0etZn+RsA48ARRrFm6Ri8fvqPQfgrvNxSjKAbnd3g==",
863
+ "cpu": [
864
+ "arm64"
865
+ ],
866
+ "dev": true,
867
+ "license": "MIT",
868
+ "optional": true,
869
+ "os": [
870
+ "freebsd"
871
+ ]
872
+ },
873
+ "node_modules/@rollup/rollup-freebsd-x64": {
874
+ "version": "4.60.4",
875
+ "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-x64/-/rollup-freebsd-x64-4.60.4.tgz",
876
+ "integrity": "sha512-Iw3oMskH3AfNuhU0MSN7vNbdi4me/NiYo2azqPz/Le16zHSa+3RRmliCMWWQmh4lcndccU40xcJuTYJZxNo/lw==",
877
+ "cpu": [
878
+ "x64"
879
+ ],
880
+ "dev": true,
881
+ "license": "MIT",
882
+ "optional": true,
883
+ "os": [
884
+ "freebsd"
885
+ ]
886
+ },
887
+ "node_modules/@rollup/rollup-linux-arm-gnueabihf": {
888
+ "version": "4.60.4",
889
+ "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-gnueabihf/-/rollup-linux-arm-gnueabihf-4.60.4.tgz",
890
+ "integrity": "sha512-EIPRXTVQpHyF8WOo219AD2yEltPehLTcTMz2fn6JsatLYSzQf00hj3rulF+yauOlF9/FtM2WpkT/hJh/KJFGhA==",
891
+ "cpu": [
892
+ "arm"
893
+ ],
894
+ "dev": true,
895
+ "license": "MIT",
896
+ "optional": true,
897
+ "os": [
898
+ "linux"
899
+ ]
900
+ },
901
+ "node_modules/@rollup/rollup-linux-arm-musleabihf": {
902
+ "version": "4.60.4",
903
+ "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-musleabihf/-/rollup-linux-arm-musleabihf-4.60.4.tgz",
904
+ "integrity": "sha512-J3Yh9PzzF1Ovah2At+lHiGQdsYgArxBbXv/zHfSyaiFQEqvNv7DcW98pCrmdjCZBrqBiKrKKe2V+aaSGWuBe/w==",
905
+ "cpu": [
906
+ "arm"
907
+ ],
908
+ "dev": true,
909
+ "license": "MIT",
910
+ "optional": true,
911
+ "os": [
912
+ "linux"
913
+ ]
914
+ },
915
+ "node_modules/@rollup/rollup-linux-arm64-gnu": {
916
+ "version": "4.60.4",
917
+ "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-gnu/-/rollup-linux-arm64-gnu-4.60.4.tgz",
918
+ "integrity": "sha512-BFDEZMYfUvLn37ONE1yMBojPxnMlTFsdyNoqncT0qFq1mAfllL+ATMMJd8TeuVMiX84s1KbcxcZbXInmcO2mRg==",
919
+ "cpu": [
920
+ "arm64"
921
+ ],
922
+ "dev": true,
923
+ "license": "MIT",
924
+ "optional": true,
925
+ "os": [
926
+ "linux"
927
+ ]
928
+ },
929
+ "node_modules/@rollup/rollup-linux-arm64-musl": {
930
+ "version": "4.60.4",
931
+ "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-musl/-/rollup-linux-arm64-musl-4.60.4.tgz",
932
+ "integrity": "sha512-pc9EYOSlOgdQ2uPl1o9PF6/kLSgaUosia7gOuS8mB69IxJvlclko1MECXysjs5ryez1/5zjYqx3+xYU0TU6R1A==",
933
+ "cpu": [
934
+ "arm64"
935
+ ],
936
+ "dev": true,
937
+ "license": "MIT",
938
+ "optional": true,
939
+ "os": [
940
+ "linux"
941
+ ]
942
+ },
943
+ "node_modules/@rollup/rollup-linux-loong64-gnu": {
944
+ "version": "4.60.4",
945
+ "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loong64-gnu/-/rollup-linux-loong64-gnu-4.60.4.tgz",
946
+ "integrity": "sha512-NxnomyxYerDh5n4iLrNa+sH+Z+U4BMEE46V2PgQ/hoB909i8gV1M5wPojWg9fk1jWpO3IQnOs20K4wyZuFLEFQ==",
947
+ "cpu": [
948
+ "loong64"
949
+ ],
950
+ "dev": true,
951
+ "license": "MIT",
952
+ "optional": true,
953
+ "os": [
954
+ "linux"
955
+ ]
956
+ },
957
+ "node_modules/@rollup/rollup-linux-loong64-musl": {
958
+ "version": "4.60.4",
959
+ "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loong64-musl/-/rollup-linux-loong64-musl-4.60.4.tgz",
960
+ "integrity": "sha512-nbJnQ8a3z1mtmrwImCYhc6BGpThAyYVRQxw9uKSKG4wR6aAYno9sVjJ0zaZcW9BPJX1GbrDPf+SvdWjgTuDmnw==",
961
+ "cpu": [
962
+ "loong64"
963
+ ],
964
+ "dev": true,
965
+ "license": "MIT",
966
+ "optional": true,
967
+ "os": [
968
+ "linux"
969
+ ]
970
+ },
971
+ "node_modules/@rollup/rollup-linux-ppc64-gnu": {
972
+ "version": "4.60.4",
973
+ "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-gnu/-/rollup-linux-ppc64-gnu-4.60.4.tgz",
974
+ "integrity": "sha512-2EU6acNrQLd8tYvo/LXW535wupT3m6fo7HKo6lr7ktQoItxTyOL1ZCR/GfGCuXl2vR+zmfI6eRXkSemafv+iVg==",
975
+ "cpu": [
976
+ "ppc64"
977
+ ],
978
+ "dev": true,
979
+ "license": "MIT",
980
+ "optional": true,
981
+ "os": [
982
+ "linux"
983
+ ]
984
+ },
985
+ "node_modules/@rollup/rollup-linux-ppc64-musl": {
986
+ "version": "4.60.4",
987
+ "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-musl/-/rollup-linux-ppc64-musl-4.60.4.tgz",
988
+ "integrity": "sha512-WeBtoMuaMxiiIrO2IYP3xs6GMWkJP2C0EoT8beTLkUPmzV1i/UcOSVw1d5r9KBODtHKilG5yFxsGRnBbK3wJ4A==",
989
+ "cpu": [
990
+ "ppc64"
991
+ ],
992
+ "dev": true,
993
+ "license": "MIT",
994
+ "optional": true,
995
+ "os": [
996
+ "linux"
997
+ ]
998
+ },
999
+ "node_modules/@rollup/rollup-linux-riscv64-gnu": {
1000
+ "version": "4.60.4",
1001
+ "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-gnu/-/rollup-linux-riscv64-gnu-4.60.4.tgz",
1002
+ "integrity": "sha512-FJHFfqpKUI3A10WrWKiFbBZ7yVbGT4q4B5o1qKFFojqpaYoh9LrQgqWCmmcxQzVSXYtyB5bzkXrYzlHTs21MYA==",
1003
+ "cpu": [
1004
+ "riscv64"
1005
+ ],
1006
+ "dev": true,
1007
+ "license": "MIT",
1008
+ "optional": true,
1009
+ "os": [
1010
+ "linux"
1011
+ ]
1012
+ },
1013
+ "node_modules/@rollup/rollup-linux-riscv64-musl": {
1014
+ "version": "4.60.4",
1015
+ "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-musl/-/rollup-linux-riscv64-musl-4.60.4.tgz",
1016
+ "integrity": "sha512-mcEl6CUT5IAUmQf1m9FYSmVqCJlpQ8r8eyftFUHG8i9OhY7BkBXSUdnLH5DOf0wCOjcP9v/QO93zpmF1SptCCw==",
1017
+ "cpu": [
1018
+ "riscv64"
1019
+ ],
1020
+ "dev": true,
1021
+ "license": "MIT",
1022
+ "optional": true,
1023
+ "os": [
1024
+ "linux"
1025
+ ]
1026
+ },
1027
+ "node_modules/@rollup/rollup-linux-s390x-gnu": {
1028
+ "version": "4.60.4",
1029
+ "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-s390x-gnu/-/rollup-linux-s390x-gnu-4.60.4.tgz",
1030
+ "integrity": "sha512-ynt3JxVd2w2buzoKDWIyiV1pJW93xlQic1THVLXilz429oijRpSHivZAgp65KBu+cMcgf1eVVjdnTLvPxgCuoQ==",
1031
+ "cpu": [
1032
+ "s390x"
1033
+ ],
1034
+ "dev": true,
1035
+ "license": "MIT",
1036
+ "optional": true,
1037
+ "os": [
1038
+ "linux"
1039
+ ]
1040
+ },
1041
+ "node_modules/@rollup/rollup-linux-x64-gnu": {
1042
+ "version": "4.60.4",
1043
+ "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-gnu/-/rollup-linux-x64-gnu-4.60.4.tgz",
1044
+ "integrity": "sha512-Boiz5+MsaROEWDf+GGEwF8VMHGhlUoQMtIPjOgA5fv4osupqTVnJteQNKJwUcnUog2G55jYXH7KZFFiJe0TEzQ==",
1045
+ "cpu": [
1046
+ "x64"
1047
+ ],
1048
+ "dev": true,
1049
+ "license": "MIT",
1050
+ "optional": true,
1051
+ "os": [
1052
+ "linux"
1053
+ ]
1054
+ },
1055
+ "node_modules/@rollup/rollup-linux-x64-musl": {
1056
+ "version": "4.60.4",
1057
+ "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-musl/-/rollup-linux-x64-musl-4.60.4.tgz",
1058
+ "integrity": "sha512-+qfSY27qIrFfI/Hom04KYFw3GKZSGU4lXus51wsb5EuySfFlWRwjkKWoE9emgRw/ukoT4Udsj4W/+xxG8VbPKg==",
1059
+ "cpu": [
1060
+ "x64"
1061
+ ],
1062
+ "dev": true,
1063
+ "license": "MIT",
1064
+ "optional": true,
1065
+ "os": [
1066
+ "linux"
1067
+ ]
1068
+ },
1069
+ "node_modules/@rollup/rollup-openbsd-x64": {
1070
+ "version": "4.60.4",
1071
+ "resolved": "https://registry.npmjs.org/@rollup/rollup-openbsd-x64/-/rollup-openbsd-x64-4.60.4.tgz",
1072
+ "integrity": "sha512-VpTfOPHgVXEBeeR8hZ2O0F3aSso+JDWqTWmTmzcQKted54IAdUVbxE+j/MVxUsKa8L20HJhv3vUezVPoquqWjA==",
1073
+ "cpu": [
1074
+ "x64"
1075
+ ],
1076
+ "dev": true,
1077
+ "license": "MIT",
1078
+ "optional": true,
1079
+ "os": [
1080
+ "openbsd"
1081
+ ]
1082
+ },
1083
+ "node_modules/@rollup/rollup-openharmony-arm64": {
1084
+ "version": "4.60.4",
1085
+ "resolved": "https://registry.npmjs.org/@rollup/rollup-openharmony-arm64/-/rollup-openharmony-arm64-4.60.4.tgz",
1086
+ "integrity": "sha512-IPOsh5aRYuLv/nkU51X10Bf75Bsf6+gZdx1X+QP5QM6lIJFHHqbHLG0uJn/hWthzo13UAc2umiUorqZy3axoZg==",
1087
+ "cpu": [
1088
+ "arm64"
1089
+ ],
1090
+ "dev": true,
1091
+ "license": "MIT",
1092
+ "optional": true,
1093
+ "os": [
1094
+ "openharmony"
1095
+ ]
1096
+ },
1097
+ "node_modules/@rollup/rollup-win32-arm64-msvc": {
1098
+ "version": "4.60.4",
1099
+ "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-arm64-msvc/-/rollup-win32-arm64-msvc-4.60.4.tgz",
1100
+ "integrity": "sha512-4QzE9E81OohJ/HKzHhsqU+zcYYojVOXlFMs1DdyMT6qXl/niOH7AVElmmEdUNHHS/oRkc++d5k6Vy85zFs0DEw==",
1101
+ "cpu": [
1102
+ "arm64"
1103
+ ],
1104
+ "dev": true,
1105
+ "license": "MIT",
1106
+ "optional": true,
1107
+ "os": [
1108
+ "win32"
1109
+ ]
1110
+ },
1111
+ "node_modules/@rollup/rollup-win32-ia32-msvc": {
1112
+ "version": "4.60.4",
1113
+ "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-ia32-msvc/-/rollup-win32-ia32-msvc-4.60.4.tgz",
1114
+ "integrity": "sha512-zTPgT1YuHHcd+Tmx7h8aml0FWFVelV5N54oHow9SLj+GfoDy/huQ+UV396N/C7KpMDMiPspRktzM1/0r1usYEA==",
1115
+ "cpu": [
1116
+ "ia32"
1117
+ ],
1118
+ "dev": true,
1119
+ "license": "MIT",
1120
+ "optional": true,
1121
+ "os": [
1122
+ "win32"
1123
+ ]
1124
+ },
1125
+ "node_modules/@rollup/rollup-win32-x64-gnu": {
1126
+ "version": "4.60.4",
1127
+ "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-gnu/-/rollup-win32-x64-gnu-4.60.4.tgz",
1128
+ "integrity": "sha512-DRS4G7mi9lJxqEDezIkKCaUIKCrLUUDCUaCsTPCi/rtqaC6D/jjwslMQyiDU50Ka0JKpeXeRBFBAXwArY52vBw==",
1129
+ "cpu": [
1130
+ "x64"
1131
+ ],
1132
+ "dev": true,
1133
+ "license": "MIT",
1134
+ "optional": true,
1135
+ "os": [
1136
+ "win32"
1137
+ ]
1138
+ },
1139
+ "node_modules/@rollup/rollup-win32-x64-msvc": {
1140
+ "version": "4.60.4",
1141
+ "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-msvc/-/rollup-win32-x64-msvc-4.60.4.tgz",
1142
+ "integrity": "sha512-QVTUovf40zgTqlFVrKA1uXMVvU2QWEFWfAH8Wdc48IxLvrJMQVMBRjuQyUpzZCDkakImib9eVazbWlC6ksWtJw==",
1143
+ "cpu": [
1144
+ "x64"
1145
+ ],
1146
+ "dev": true,
1147
+ "license": "MIT",
1148
+ "optional": true,
1149
+ "os": [
1150
+ "win32"
1151
+ ]
1152
+ },
1153
+ "node_modules/@types/babel__core": {
1154
+ "version": "7.20.5",
1155
+ "resolved": "https://registry.npmjs.org/@types/babel__core/-/babel__core-7.20.5.tgz",
1156
+ "integrity": "sha512-qoQprZvz5wQFJwMDqeseRXWv3rqMvhgpbXFfVyWhbx9X47POIA6i/+dXefEmZKoAgOaTdaIgNSMqMIU61yRyzA==",
1157
+ "dev": true,
1158
+ "license": "MIT",
1159
+ "dependencies": {
1160
+ "@babel/parser": "^7.20.7",
1161
+ "@babel/types": "^7.20.7",
1162
+ "@types/babel__generator": "*",
1163
+ "@types/babel__template": "*",
1164
+ "@types/babel__traverse": "*"
1165
+ }
1166
+ },
1167
+ "node_modules/@types/babel__generator": {
1168
+ "version": "7.27.0",
1169
+ "resolved": "https://registry.npmjs.org/@types/babel__generator/-/babel__generator-7.27.0.tgz",
1170
+ "integrity": "sha512-ufFd2Xi92OAVPYsy+P4n7/U7e68fex0+Ee8gSG9KX7eo084CWiQ4sdxktvdl0bOPupXtVJPY19zk6EwWqUQ8lg==",
1171
+ "dev": true,
1172
+ "license": "MIT",
1173
+ "dependencies": {
1174
+ "@babel/types": "^7.0.0"
1175
+ }
1176
+ },
1177
+ "node_modules/@types/babel__template": {
1178
+ "version": "7.4.4",
1179
+ "resolved": "https://registry.npmjs.org/@types/babel__template/-/babel__template-7.4.4.tgz",
1180
+ "integrity": "sha512-h/NUaSyG5EyxBIp8YRxo4RMe2/qQgvyowRwVMzhYhBCONbW8PUsg4lkFMrhgZhUe5z3L3MiLDuvyJ/CaPa2A8A==",
1181
+ "dev": true,
1182
+ "license": "MIT",
1183
+ "dependencies": {
1184
+ "@babel/parser": "^7.1.0",
1185
+ "@babel/types": "^7.0.0"
1186
+ }
1187
+ },
1188
+ "node_modules/@types/babel__traverse": {
1189
+ "version": "7.28.0",
1190
+ "resolved": "https://registry.npmjs.org/@types/babel__traverse/-/babel__traverse-7.28.0.tgz",
1191
+ "integrity": "sha512-8PvcXf70gTDZBgt9ptxJ8elBeBjcLOAcOtoO/mPJjtji1+CdGbHgm77om1GrsPxsiE+uXIpNSK64UYaIwQXd4Q==",
1192
+ "dev": true,
1193
+ "license": "MIT",
1194
+ "dependencies": {
1195
+ "@babel/types": "^7.28.2"
1196
+ }
1197
+ },
1198
+ "node_modules/@types/estree": {
1199
+ "version": "1.0.8",
1200
+ "resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.8.tgz",
1201
+ "integrity": "sha512-dWHzHa2WqEXI/O1E9OjrocMTKJl2mSrEolh1Iomrv6U+JuNwaHXsXx9bLu5gG7BUWFIN0skIQJQ/L1rIex4X6w==",
1202
+ "dev": true,
1203
+ "license": "MIT"
1204
+ },
1205
+ "node_modules/@types/react": {
1206
+ "version": "19.2.15",
1207
+ "resolved": "https://registry.npmjs.org/@types/react/-/react-19.2.15.tgz",
1208
+ "integrity": "sha512-eRwcGNHve+E8qtEQSSRl6urh+rFop4v8gm6O8rGv25CodbvFdLjA1vVQ1KkiFE0w0UPOnb8tDiFKL5lp0rtY5Q==",
1209
+ "dev": true,
1210
+ "license": "MIT",
1211
+ "dependencies": {
1212
+ "csstype": "^3.2.2"
1213
+ }
1214
+ },
1215
+ "node_modules/@types/react-dom": {
1216
+ "version": "19.2.3",
1217
+ "resolved": "https://registry.npmjs.org/@types/react-dom/-/react-dom-19.2.3.tgz",
1218
+ "integrity": "sha512-jp2L/eY6fn+KgVVQAOqYItbF0VY/YApe5Mz2F0aykSO8gx31bYCZyvSeYxCHKvzHG5eZjc+zyaS5BrBWya2+kQ==",
1219
+ "dev": true,
1220
+ "license": "MIT",
1221
+ "peerDependencies": {
1222
+ "@types/react": "^19.2.0"
1223
+ }
1224
+ },
1225
+ "node_modules/@vitejs/plugin-react": {
1226
+ "version": "4.7.0",
1227
+ "resolved": "https://registry.npmjs.org/@vitejs/plugin-react/-/plugin-react-4.7.0.tgz",
1228
+ "integrity": "sha512-gUu9hwfWvvEDBBmgtAowQCojwZmJ5mcLn3aufeCsitijs3+f2NsrPtlAWIR6OPiqljl96GVCUbLe0HyqIpVaoA==",
1229
+ "dev": true,
1230
+ "license": "MIT",
1231
+ "dependencies": {
1232
+ "@babel/core": "^7.28.0",
1233
+ "@babel/plugin-transform-react-jsx-self": "^7.27.1",
1234
+ "@babel/plugin-transform-react-jsx-source": "^7.27.1",
1235
+ "@rolldown/pluginutils": "1.0.0-beta.27",
1236
+ "@types/babel__core": "^7.20.5",
1237
+ "react-refresh": "^0.17.0"
1238
+ },
1239
+ "engines": {
1240
+ "node": "^14.18.0 || >=16.0.0"
1241
+ },
1242
+ "peerDependencies": {
1243
+ "vite": "^4.2.0 || ^5.0.0 || ^6.0.0 || ^7.0.0"
1244
+ }
1245
+ },
1246
+ "node_modules/baseline-browser-mapping": {
1247
+ "version": "2.10.31",
1248
+ "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.10.31.tgz",
1249
+ "integrity": "sha512-MujYO3eP72uvmSE0i4wltsodRfIpZATP3jvzRNRGGxgzId7aVocVJJV3nf01qnzzKFGxQVC9bpWxl5cjxTr/7Q==",
1250
+ "dev": true,
1251
+ "license": "Apache-2.0",
1252
+ "bin": {
1253
+ "baseline-browser-mapping": "dist/cli.cjs"
1254
+ },
1255
+ "engines": {
1256
+ "node": ">=6.0.0"
1257
+ }
1258
+ },
1259
+ "node_modules/browserslist": {
1260
+ "version": "4.28.2",
1261
+ "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.2.tgz",
1262
+ "integrity": "sha512-48xSriZYYg+8qXna9kwqjIVzuQxi+KYWp2+5nCYnYKPTr0LvD89Jqk2Or5ogxz0NUMfIjhh2lIUX/LyX9B4oIg==",
1263
+ "dev": true,
1264
+ "funding": [
1265
+ {
1266
+ "type": "opencollective",
1267
+ "url": "https://opencollective.com/browserslist"
1268
+ },
1269
+ {
1270
+ "type": "tidelift",
1271
+ "url": "https://tidelift.com/funding/github/npm/browserslist"
1272
+ },
1273
+ {
1274
+ "type": "github",
1275
+ "url": "https://github.com/sponsors/ai"
1276
+ }
1277
+ ],
1278
+ "license": "MIT",
1279
+ "dependencies": {
1280
+ "baseline-browser-mapping": "^2.10.12",
1281
+ "caniuse-lite": "^1.0.30001782",
1282
+ "electron-to-chromium": "^1.5.328",
1283
+ "node-releases": "^2.0.36",
1284
+ "update-browserslist-db": "^1.2.3"
1285
+ },
1286
+ "bin": {
1287
+ "browserslist": "cli.js"
1288
+ },
1289
+ "engines": {
1290
+ "node": "^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7"
1291
+ }
1292
+ },
1293
+ "node_modules/caniuse-lite": {
1294
+ "version": "1.0.30001793",
1295
+ "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001793.tgz",
1296
+ "integrity": "sha512-iwSsYWaCOoh26cV8NwNRViHlrfUvYsHDfRVcbtmw0Kg6PJIZZXwMkj1442FYLBGkeUf1juAsU3DTfxW579mrPA==",
1297
+ "dev": true,
1298
+ "funding": [
1299
+ {
1300
+ "type": "opencollective",
1301
+ "url": "https://opencollective.com/browserslist"
1302
+ },
1303
+ {
1304
+ "type": "tidelift",
1305
+ "url": "https://tidelift.com/funding/github/npm/caniuse-lite"
1306
+ },
1307
+ {
1308
+ "type": "github",
1309
+ "url": "https://github.com/sponsors/ai"
1310
+ }
1311
+ ],
1312
+ "license": "CC-BY-4.0"
1313
+ },
1314
+ "node_modules/convert-source-map": {
1315
+ "version": "2.0.0",
1316
+ "resolved": "https://registry.npmjs.org/convert-source-map/-/convert-source-map-2.0.0.tgz",
1317
+ "integrity": "sha512-Kvp459HrV2FEJ1CAsi1Ku+MY3kasH19TFykTz2xWmMeq6bk2NU3XXvfJ+Q61m0xktWwt+1HSYf3JZsTms3aRJg==",
1318
+ "dev": true,
1319
+ "license": "MIT"
1320
+ },
1321
+ "node_modules/csstype": {
1322
+ "version": "3.2.3",
1323
+ "resolved": "https://registry.npmjs.org/csstype/-/csstype-3.2.3.tgz",
1324
+ "integrity": "sha512-z1HGKcYy2xA8AGQfwrn0PAy+PB7X/GSj3UVJW9qKyn43xWa+gl5nXmU4qqLMRzWVLFC8KusUX8T/0kCiOYpAIQ==",
1325
+ "dev": true,
1326
+ "license": "MIT"
1327
+ },
1328
+ "node_modules/debug": {
1329
+ "version": "4.4.3",
1330
+ "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
1331
+ "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
1332
+ "dev": true,
1333
+ "license": "MIT",
1334
+ "dependencies": {
1335
+ "ms": "^2.1.3"
1336
+ },
1337
+ "engines": {
1338
+ "node": ">=6.0"
1339
+ },
1340
+ "peerDependenciesMeta": {
1341
+ "supports-color": {
1342
+ "optional": true
1343
+ }
1344
+ }
1345
+ },
1346
+ "node_modules/electron-to-chromium": {
1347
+ "version": "1.5.360",
1348
+ "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.360.tgz",
1349
+ "integrity": "sha512-GkcBt6YYAw9SxFWn+xVar4cLVGlXVuswwtRLBozi2zp0GjXs4ZnOrqV4zbXzg35n7w81hCkyJNYicgXlVHAmBA==",
1350
+ "dev": true,
1351
+ "license": "ISC"
1352
+ },
1353
+ "node_modules/esbuild": {
1354
+ "version": "0.25.12",
1355
+ "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.25.12.tgz",
1356
+ "integrity": "sha512-bbPBYYrtZbkt6Os6FiTLCTFxvq4tt3JKall1vRwshA3fdVztsLAatFaZobhkBC8/BrPetoa0oksYoKXoG4ryJg==",
1357
+ "dev": true,
1358
+ "hasInstallScript": true,
1359
+ "license": "MIT",
1360
+ "bin": {
1361
+ "esbuild": "bin/esbuild"
1362
+ },
1363
+ "engines": {
1364
+ "node": ">=18"
1365
+ },
1366
+ "optionalDependencies": {
1367
+ "@esbuild/aix-ppc64": "0.25.12",
1368
+ "@esbuild/android-arm": "0.25.12",
1369
+ "@esbuild/android-arm64": "0.25.12",
1370
+ "@esbuild/android-x64": "0.25.12",
1371
+ "@esbuild/darwin-arm64": "0.25.12",
1372
+ "@esbuild/darwin-x64": "0.25.12",
1373
+ "@esbuild/freebsd-arm64": "0.25.12",
1374
+ "@esbuild/freebsd-x64": "0.25.12",
1375
+ "@esbuild/linux-arm": "0.25.12",
1376
+ "@esbuild/linux-arm64": "0.25.12",
1377
+ "@esbuild/linux-ia32": "0.25.12",
1378
+ "@esbuild/linux-loong64": "0.25.12",
1379
+ "@esbuild/linux-mips64el": "0.25.12",
1380
+ "@esbuild/linux-ppc64": "0.25.12",
1381
+ "@esbuild/linux-riscv64": "0.25.12",
1382
+ "@esbuild/linux-s390x": "0.25.12",
1383
+ "@esbuild/linux-x64": "0.25.12",
1384
+ "@esbuild/netbsd-arm64": "0.25.12",
1385
+ "@esbuild/netbsd-x64": "0.25.12",
1386
+ "@esbuild/openbsd-arm64": "0.25.12",
1387
+ "@esbuild/openbsd-x64": "0.25.12",
1388
+ "@esbuild/openharmony-arm64": "0.25.12",
1389
+ "@esbuild/sunos-x64": "0.25.12",
1390
+ "@esbuild/win32-arm64": "0.25.12",
1391
+ "@esbuild/win32-ia32": "0.25.12",
1392
+ "@esbuild/win32-x64": "0.25.12"
1393
+ }
1394
+ },
1395
+ "node_modules/escalade": {
1396
+ "version": "3.2.0",
1397
+ "resolved": "https://registry.npmjs.org/escalade/-/escalade-3.2.0.tgz",
1398
+ "integrity": "sha512-WUj2qlxaQtO4g6Pq5c29GTcWGDyd8itL8zTlipgECz3JesAiiOKotd8JU6otB3PACgG6xkJUyVhboMS+bje/jA==",
1399
+ "dev": true,
1400
+ "license": "MIT",
1401
+ "engines": {
1402
+ "node": ">=6"
1403
+ }
1404
+ },
1405
+ "node_modules/fdir": {
1406
+ "version": "6.5.0",
1407
+ "resolved": "https://registry.npmjs.org/fdir/-/fdir-6.5.0.tgz",
1408
+ "integrity": "sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==",
1409
+ "dev": true,
1410
+ "license": "MIT",
1411
+ "engines": {
1412
+ "node": ">=12.0.0"
1413
+ },
1414
+ "peerDependencies": {
1415
+ "picomatch": "^3 || ^4"
1416
+ },
1417
+ "peerDependenciesMeta": {
1418
+ "picomatch": {
1419
+ "optional": true
1420
+ }
1421
+ }
1422
+ },
1423
+ "node_modules/fsevents": {
1424
+ "version": "2.3.3",
1425
+ "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.3.tgz",
1426
+ "integrity": "sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==",
1427
+ "dev": true,
1428
+ "hasInstallScript": true,
1429
+ "license": "MIT",
1430
+ "optional": true,
1431
+ "os": [
1432
+ "darwin"
1433
+ ],
1434
+ "engines": {
1435
+ "node": "^8.16.0 || ^10.6.0 || >=11.0.0"
1436
+ }
1437
+ },
1438
+ "node_modules/gensync": {
1439
+ "version": "1.0.0-beta.2",
1440
+ "resolved": "https://registry.npmjs.org/gensync/-/gensync-1.0.0-beta.2.tgz",
1441
+ "integrity": "sha512-3hN7NaskYvMDLQY55gnW3NQ+mesEAepTqlg+VEbj7zzqEMBVNhzcGYYeqFo/TlYz6eQiFcp1HcsCZO+nGgS8zg==",
1442
+ "dev": true,
1443
+ "license": "MIT",
1444
+ "engines": {
1445
+ "node": ">=6.9.0"
1446
+ }
1447
+ },
1448
+ "node_modules/js-tokens": {
1449
+ "version": "4.0.0",
1450
+ "resolved": "https://registry.npmjs.org/js-tokens/-/js-tokens-4.0.0.tgz",
1451
+ "integrity": "sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==",
1452
+ "dev": true,
1453
+ "license": "MIT"
1454
+ },
1455
+ "node_modules/jsesc": {
1456
+ "version": "3.1.0",
1457
+ "resolved": "https://registry.npmjs.org/jsesc/-/jsesc-3.1.0.tgz",
1458
+ "integrity": "sha512-/sM3dO2FOzXjKQhJuo0Q173wf2KOo8t4I8vHy6lF9poUp7bKT0/NHE8fPX23PwfhnykfqnC2xRxOnVw5XuGIaA==",
1459
+ "dev": true,
1460
+ "license": "MIT",
1461
+ "bin": {
1462
+ "jsesc": "bin/jsesc"
1463
+ },
1464
+ "engines": {
1465
+ "node": ">=6"
1466
+ }
1467
+ },
1468
+ "node_modules/json5": {
1469
+ "version": "2.2.3",
1470
+ "resolved": "https://registry.npmjs.org/json5/-/json5-2.2.3.tgz",
1471
+ "integrity": "sha512-XmOWe7eyHYH14cLdVPoyg+GOH3rYX++KpzrylJwSW98t3Nk+U8XOl8FWKOgwtzdb8lXGf6zYwDUzeHMWfxasyg==",
1472
+ "dev": true,
1473
+ "license": "MIT",
1474
+ "bin": {
1475
+ "json5": "lib/cli.js"
1476
+ },
1477
+ "engines": {
1478
+ "node": ">=6"
1479
+ }
1480
+ },
1481
+ "node_modules/lru-cache": {
1482
+ "version": "5.1.1",
1483
+ "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-5.1.1.tgz",
1484
+ "integrity": "sha512-KpNARQA3Iwv+jTA0utUVVbrh+Jlrr1Fv0e56GGzAFOXN7dk/FviaDW8LHmK52DlcH4WP2n6gI8vN1aesBFgo9w==",
1485
+ "dev": true,
1486
+ "license": "ISC",
1487
+ "dependencies": {
1488
+ "yallist": "^3.0.2"
1489
+ }
1490
+ },
1491
+ "node_modules/ms": {
1492
+ "version": "2.1.3",
1493
+ "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
1494
+ "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
1495
+ "dev": true,
1496
+ "license": "MIT"
1497
+ },
1498
+ "node_modules/nanoid": {
1499
+ "version": "3.3.12",
1500
+ "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.12.tgz",
1501
+ "integrity": "sha512-ZB9RH/39qpq5Vu6Y+NmUaFhQR6pp+M2Xt76XBnEwDaGcVAqhlvxrl3B2bKS5D3NH3QR76v3aSrKaF/Kiy7lEtQ==",
1502
+ "dev": true,
1503
+ "funding": [
1504
+ {
1505
+ "type": "github",
1506
+ "url": "https://github.com/sponsors/ai"
1507
+ }
1508
+ ],
1509
+ "license": "MIT",
1510
+ "bin": {
1511
+ "nanoid": "bin/nanoid.cjs"
1512
+ },
1513
+ "engines": {
1514
+ "node": "^10 || ^12 || ^13.7 || ^14 || >=15.0.1"
1515
+ }
1516
+ },
1517
+ "node_modules/node-releases": {
1518
+ "version": "2.0.45",
1519
+ "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.45.tgz",
1520
+ "integrity": "sha512-iIbHXV9eBB2nB0wa7oTsrrXq+qQt+9SIlx9AX3T96YgobtEQfis5n6TJ6vV+3QP8DwdriEAcGhARaFCu37peBg==",
1521
+ "dev": true,
1522
+ "license": "MIT",
1523
+ "engines": {
1524
+ "node": ">=18"
1525
+ }
1526
+ },
1527
+ "node_modules/picocolors": {
1528
+ "version": "1.1.1",
1529
+ "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.1.1.tgz",
1530
+ "integrity": "sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==",
1531
+ "dev": true,
1532
+ "license": "ISC"
1533
+ },
1534
+ "node_modules/picomatch": {
1535
+ "version": "4.0.4",
1536
+ "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
1537
+ "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
1538
+ "dev": true,
1539
+ "license": "MIT",
1540
+ "engines": {
1541
+ "node": ">=12"
1542
+ },
1543
+ "funding": {
1544
+ "url": "https://github.com/sponsors/jonschlinkert"
1545
+ }
1546
+ },
1547
+ "node_modules/postcss": {
1548
+ "version": "8.5.15",
1549
+ "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.15.tgz",
1550
+ "integrity": "sha512-FfR8sjd4em2T6fb3I2MwAJU7HWVMr9zba+enmQeeWFfCbm+UOC/0X4DS8XtpUTMwWMGbjKYP7xjfNekzyGmB3A==",
1551
+ "dev": true,
1552
+ "funding": [
1553
+ {
1554
+ "type": "opencollective",
1555
+ "url": "https://opencollective.com/postcss/"
1556
+ },
1557
+ {
1558
+ "type": "tidelift",
1559
+ "url": "https://tidelift.com/funding/github/npm/postcss"
1560
+ },
1561
+ {
1562
+ "type": "github",
1563
+ "url": "https://github.com/sponsors/ai"
1564
+ }
1565
+ ],
1566
+ "license": "MIT",
1567
+ "dependencies": {
1568
+ "nanoid": "^3.3.12",
1569
+ "picocolors": "^1.1.1",
1570
+ "source-map-js": "^1.2.1"
1571
+ },
1572
+ "engines": {
1573
+ "node": "^10 || ^12 || >=14"
1574
+ }
1575
+ },
1576
+ "node_modules/react": {
1577
+ "version": "19.2.6",
1578
+ "resolved": "https://registry.npmjs.org/react/-/react-19.2.6.tgz",
1579
+ "integrity": "sha512-sfWGGfavi0xr8Pg0sVsyHMAOziVYKgPLNrS7ig+ivMNb3wbCBw3KxtflsGBAwD3gYQlE/AEZsTLgToRrSCjb0Q==",
1580
+ "license": "MIT",
1581
+ "engines": {
1582
+ "node": ">=0.10.0"
1583
+ }
1584
+ },
1585
+ "node_modules/react-dom": {
1586
+ "version": "19.2.6",
1587
+ "resolved": "https://registry.npmjs.org/react-dom/-/react-dom-19.2.6.tgz",
1588
+ "integrity": "sha512-0prMI+hvBbPjsWnxDLxlCGyM8PN6UuWjEUCYmZhO67xIV9Xasa/r/vDnq+Xyq4Lo27g8QSbO5YzARu0D1Sps3g==",
1589
+ "license": "MIT",
1590
+ "dependencies": {
1591
+ "scheduler": "^0.27.0"
1592
+ },
1593
+ "peerDependencies": {
1594
+ "react": "^19.2.6"
1595
+ }
1596
+ },
1597
+ "node_modules/react-refresh": {
1598
+ "version": "0.17.0",
1599
+ "resolved": "https://registry.npmjs.org/react-refresh/-/react-refresh-0.17.0.tgz",
1600
+ "integrity": "sha512-z6F7K9bV85EfseRCp2bzrpyQ0Gkw1uLoCel9XBVWPg/TjRj94SkJzUTGfOa4bs7iJvBWtQG0Wq7wnI0syw3EBQ==",
1601
+ "dev": true,
1602
+ "license": "MIT",
1603
+ "engines": {
1604
+ "node": ">=0.10.0"
1605
+ }
1606
+ },
1607
+ "node_modules/rollup": {
1608
+ "version": "4.60.4",
1609
+ "resolved": "https://registry.npmjs.org/rollup/-/rollup-4.60.4.tgz",
1610
+ "integrity": "sha512-WHeFSbZYsPu3+bLoNRUuAO+wavNlocOPf3wSHTP7hcFKVnJeWsYlCDbr3mTS14FCizf9ccIxXA8sGL8zKeQN3g==",
1611
+ "dev": true,
1612
+ "license": "MIT",
1613
+ "dependencies": {
1614
+ "@types/estree": "1.0.8"
1615
+ },
1616
+ "bin": {
1617
+ "rollup": "dist/bin/rollup"
1618
+ },
1619
+ "engines": {
1620
+ "node": ">=18.0.0",
1621
+ "npm": ">=8.0.0"
1622
+ },
1623
+ "optionalDependencies": {
1624
+ "@rollup/rollup-android-arm-eabi": "4.60.4",
1625
+ "@rollup/rollup-android-arm64": "4.60.4",
1626
+ "@rollup/rollup-darwin-arm64": "4.60.4",
1627
+ "@rollup/rollup-darwin-x64": "4.60.4",
1628
+ "@rollup/rollup-freebsd-arm64": "4.60.4",
1629
+ "@rollup/rollup-freebsd-x64": "4.60.4",
1630
+ "@rollup/rollup-linux-arm-gnueabihf": "4.60.4",
1631
+ "@rollup/rollup-linux-arm-musleabihf": "4.60.4",
1632
+ "@rollup/rollup-linux-arm64-gnu": "4.60.4",
1633
+ "@rollup/rollup-linux-arm64-musl": "4.60.4",
1634
+ "@rollup/rollup-linux-loong64-gnu": "4.60.4",
1635
+ "@rollup/rollup-linux-loong64-musl": "4.60.4",
1636
+ "@rollup/rollup-linux-ppc64-gnu": "4.60.4",
1637
+ "@rollup/rollup-linux-ppc64-musl": "4.60.4",
1638
+ "@rollup/rollup-linux-riscv64-gnu": "4.60.4",
1639
+ "@rollup/rollup-linux-riscv64-musl": "4.60.4",
1640
+ "@rollup/rollup-linux-s390x-gnu": "4.60.4",
1641
+ "@rollup/rollup-linux-x64-gnu": "4.60.4",
1642
+ "@rollup/rollup-linux-x64-musl": "4.60.4",
1643
+ "@rollup/rollup-openbsd-x64": "4.60.4",
1644
+ "@rollup/rollup-openharmony-arm64": "4.60.4",
1645
+ "@rollup/rollup-win32-arm64-msvc": "4.60.4",
1646
+ "@rollup/rollup-win32-ia32-msvc": "4.60.4",
1647
+ "@rollup/rollup-win32-x64-gnu": "4.60.4",
1648
+ "@rollup/rollup-win32-x64-msvc": "4.60.4",
1649
+ "fsevents": "~2.3.2"
1650
+ }
1651
+ },
1652
+ "node_modules/scheduler": {
1653
+ "version": "0.27.0",
1654
+ "resolved": "https://registry.npmjs.org/scheduler/-/scheduler-0.27.0.tgz",
1655
+ "integrity": "sha512-eNv+WrVbKu1f3vbYJT/xtiF5syA5HPIMtf9IgY/nKg0sWqzAUEvqY/xm7OcZc/qafLx/iO9FgOmeSAp4v5ti/Q==",
1656
+ "license": "MIT"
1657
+ },
1658
+ "node_modules/semver": {
1659
+ "version": "6.3.1",
1660
+ "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
1661
+ "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==",
1662
+ "dev": true,
1663
+ "license": "ISC",
1664
+ "bin": {
1665
+ "semver": "bin/semver.js"
1666
+ }
1667
+ },
1668
+ "node_modules/source-map-js": {
1669
+ "version": "1.2.1",
1670
+ "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.1.tgz",
1671
+ "integrity": "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==",
1672
+ "dev": true,
1673
+ "license": "BSD-3-Clause",
1674
+ "engines": {
1675
+ "node": ">=0.10.0"
1676
+ }
1677
+ },
1678
+ "node_modules/tinyglobby": {
1679
+ "version": "0.2.16",
1680
+ "resolved": "https://registry.npmjs.org/tinyglobby/-/tinyglobby-0.2.16.tgz",
1681
+ "integrity": "sha512-pn99VhoACYR8nFHhxqix+uvsbXineAasWm5ojXoN8xEwK5Kd3/TrhNn1wByuD52UxWRLy8pu+kRMniEi6Eq9Zg==",
1682
+ "dev": true,
1683
+ "license": "MIT",
1684
+ "dependencies": {
1685
+ "fdir": "^6.5.0",
1686
+ "picomatch": "^4.0.4"
1687
+ },
1688
+ "engines": {
1689
+ "node": ">=12.0.0"
1690
+ },
1691
+ "funding": {
1692
+ "url": "https://github.com/sponsors/SuperchupuDev"
1693
+ }
1694
+ },
1695
+ "node_modules/typescript": {
1696
+ "version": "5.9.3",
1697
+ "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz",
1698
+ "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
1699
+ "dev": true,
1700
+ "license": "Apache-2.0",
1701
+ "bin": {
1702
+ "tsc": "bin/tsc",
1703
+ "tsserver": "bin/tsserver"
1704
+ },
1705
+ "engines": {
1706
+ "node": ">=14.17"
1707
+ }
1708
+ },
1709
+ "node_modules/update-browserslist-db": {
1710
+ "version": "1.2.3",
1711
+ "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.2.3.tgz",
1712
+ "integrity": "sha512-Js0m9cx+qOgDxo0eMiFGEueWztz+d4+M3rGlmKPT+T4IS/jP4ylw3Nwpu6cpTTP8R1MAC1kF4VbdLt3ARf209w==",
1713
+ "dev": true,
1714
+ "funding": [
1715
+ {
1716
+ "type": "opencollective",
1717
+ "url": "https://opencollective.com/browserslist"
1718
+ },
1719
+ {
1720
+ "type": "tidelift",
1721
+ "url": "https://tidelift.com/funding/github/npm/browserslist"
1722
+ },
1723
+ {
1724
+ "type": "github",
1725
+ "url": "https://github.com/sponsors/ai"
1726
+ }
1727
+ ],
1728
+ "license": "MIT",
1729
+ "dependencies": {
1730
+ "escalade": "^3.2.0",
1731
+ "picocolors": "^1.1.1"
1732
+ },
1733
+ "bin": {
1734
+ "update-browserslist-db": "cli.js"
1735
+ },
1736
+ "peerDependencies": {
1737
+ "browserslist": ">= 4.21.0"
1738
+ }
1739
+ },
1740
+ "node_modules/vite": {
1741
+ "version": "6.4.2",
1742
+ "resolved": "https://registry.npmjs.org/vite/-/vite-6.4.2.tgz",
1743
+ "integrity": "sha512-2N/55r4JDJ4gdrCvGgINMy+HH3iRpNIz8K6SFwVsA+JbQScLiC+clmAxBgwiSPgcG9U15QmvqCGWzMbqda5zGQ==",
1744
+ "dev": true,
1745
+ "license": "MIT",
1746
+ "dependencies": {
1747
+ "esbuild": "^0.25.0",
1748
+ "fdir": "^6.4.4",
1749
+ "picomatch": "^4.0.2",
1750
+ "postcss": "^8.5.3",
1751
+ "rollup": "^4.34.9",
1752
+ "tinyglobby": "^0.2.13"
1753
+ },
1754
+ "bin": {
1755
+ "vite": "bin/vite.js"
1756
+ },
1757
+ "engines": {
1758
+ "node": "^18.0.0 || ^20.0.0 || >=22.0.0"
1759
+ },
1760
+ "funding": {
1761
+ "url": "https://github.com/vitejs/vite?sponsor=1"
1762
+ },
1763
+ "optionalDependencies": {
1764
+ "fsevents": "~2.3.3"
1765
+ },
1766
+ "peerDependencies": {
1767
+ "@types/node": "^18.0.0 || ^20.0.0 || >=22.0.0",
1768
+ "jiti": ">=1.21.0",
1769
+ "less": "*",
1770
+ "lightningcss": "^1.21.0",
1771
+ "sass": "*",
1772
+ "sass-embedded": "*",
1773
+ "stylus": "*",
1774
+ "sugarss": "*",
1775
+ "terser": "^5.16.0",
1776
+ "tsx": "^4.8.1",
1777
+ "yaml": "^2.4.2"
1778
+ },
1779
+ "peerDependenciesMeta": {
1780
+ "@types/node": {
1781
+ "optional": true
1782
+ },
1783
+ "jiti": {
1784
+ "optional": true
1785
+ },
1786
+ "less": {
1787
+ "optional": true
1788
+ },
1789
+ "lightningcss": {
1790
+ "optional": true
1791
+ },
1792
+ "sass": {
1793
+ "optional": true
1794
+ },
1795
+ "sass-embedded": {
1796
+ "optional": true
1797
+ },
1798
+ "stylus": {
1799
+ "optional": true
1800
+ },
1801
+ "sugarss": {
1802
+ "optional": true
1803
+ },
1804
+ "terser": {
1805
+ "optional": true
1806
+ },
1807
+ "tsx": {
1808
+ "optional": true
1809
+ },
1810
+ "yaml": {
1811
+ "optional": true
1812
+ }
1813
+ }
1814
+ },
1815
+ "node_modules/yallist": {
1816
+ "version": "3.1.1",
1817
+ "resolved": "https://registry.npmjs.org/yallist/-/yallist-3.1.1.tgz",
1818
+ "integrity": "sha512-a4UGQaWPH59mOXUYnAG2ewncQS4i4F43Tv3JoAM+s2VDAmS9NsK8GpDMLrCHPksFT7h3K6TOoUNn2pb7RoXx4g==",
1819
+ "dev": true,
1820
+ "license": "ISC"
1821
+ }
1822
+ }
1823
+ }
frontend/package.json ADDED
@@ -0,0 +1,22 @@
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
+ {
2
+ "name": "frontend",
3
+ "private": true,
4
+ "version": "0.0.1",
5
+ "type": "module",
6
+ "scripts": {
7
+ "dev": "vite",
8
+ "build": "tsc && vite build",
9
+ "preview": "vite preview"
10
+ },
11
+ "dependencies": {
12
+ "react": "^19.1.0",
13
+ "react-dom": "^19.1.0"
14
+ },
15
+ "devDependencies": {
16
+ "@types/react": "^19.1.0",
17
+ "@types/react-dom": "^19.1.0",
18
+ "@vitejs/plugin-react": "^4.5.2",
19
+ "typescript": "^5.8.3",
20
+ "vite": "^6.3.5"
21
+ }
22
+ }
frontend/src/App.tsx ADDED
@@ -0,0 +1,400 @@
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
+ import { useState, useRef, useCallback } from "react";
2
+
3
+ interface Finding {
4
+ title: string;
5
+ description: string;
6
+ recommendation: string;
7
+ severity: "high" | "medium" | "low";
8
+ codeSnippet: string;
9
+ location: string;
10
+ path: string;
11
+ judgeReview: {
12
+ review: string;
13
+ confidence: number;
14
+ exploitablePaths: string[];
15
+ };
16
+ }
17
+
18
+ interface AgentResult {
19
+ contract?: string;
20
+ compilationErrors?: string[];
21
+ reviewSummary?: string;
22
+ findings?: Finding[];
23
+ results?: unknown[];
24
+ }
25
+
26
+ export function App() {
27
+ const [requirements, setRequirements] = useState("");
28
+ const [logs, setLogs] = useState<string[]>([]);
29
+ const [coderResult, setCoderResult] = useState<AgentResult | null>(null);
30
+ const [auditorResult, setAuditorResult] = useState<AgentResult | null>(null);
31
+ const [testerResult, setTesterResult] = useState<AgentResult | null>(null);
32
+ const [running, setRunning] = useState(false);
33
+ const logsEndRef = useRef<HTMLDivElement>(null);
34
+
35
+ const appendLog = useCallback((msg: string) => {
36
+ setLogs((prev) => [...prev, msg]);
37
+ setTimeout(() => logsEndRef.current?.scrollIntoView({ behavior: "smooth" }), 50);
38
+ }, []);
39
+
40
+ const handleSubmit = async (e: React.FormEvent) => {
41
+ e.preventDefault();
42
+ if (!requirements.trim() || running) return;
43
+
44
+ setRunning(true);
45
+ setLogs([]);
46
+ setCoderResult(null);
47
+ setAuditorResult(null);
48
+ setTesterResult(null);
49
+ appendLog("Iniciando pipeline...");
50
+
51
+ try {
52
+ const res = await fetch("/api/run", {
53
+ method: "POST",
54
+ headers: { "Content-Type": "application/json" },
55
+ body: JSON.stringify({ requirements }),
56
+ });
57
+
58
+ const reader = res.body?.getReader();
59
+ if (!reader) throw new Error("Stream não disponível");
60
+
61
+ const decoder = new TextDecoder();
62
+ let buffer = "";
63
+
64
+ while (true) {
65
+ const { done, value } = await reader.read();
66
+ if (done) break;
67
+
68
+ buffer += decoder.decode(value, { stream: true });
69
+ const lines = buffer.split("\n");
70
+ buffer = lines.pop() || "";
71
+
72
+ let currentEvent = "";
73
+ for (const line of lines) {
74
+ if (line.startsWith("event:")) {
75
+ currentEvent = line.slice(6).trim();
76
+ console.log("event", currentEvent);
77
+ } else if (line.startsWith("data:")) {
78
+ const data = line.slice(5).trim();
79
+ console.log("data", data);
80
+ switch (currentEvent) {
81
+ case "log":
82
+ appendLog(data);
83
+ break;
84
+ case "coder":
85
+ setCoderResult(JSON.parse(data));
86
+ break;
87
+ case "auditor":
88
+ setAuditorResult(JSON.parse(data));
89
+ break;
90
+ case "tester":
91
+ setTesterResult(JSON.parse(data));
92
+ break;
93
+ case "error":
94
+ appendLog(`❌ ERRO: ${data}`);
95
+ break;
96
+ }
97
+ }
98
+ }
99
+ }
100
+ } catch (err) {
101
+ appendLog(`❌ Erro de conexão: ${err instanceof Error ? err.message : String(err)}`);
102
+ } finally {
103
+ setRunning(false);
104
+ }
105
+ };
106
+
107
+ return (
108
+ <div style={styles.container}>
109
+ <header style={styles.header}>
110
+ <h1 style={styles.title}>Multi-Agent: Geração, Auditoria e Teste de Smart Contracts</h1>
111
+ <p style={styles.subtitle}>
112
+ Descreva um cenário ou requisito cuja solução seja um smart contract em Solidity. O sistema irá gerar,
113
+ compilar, auditar e testar o contrato automaticamente.
114
+ </p>
115
+ </header>
116
+
117
+ <form onSubmit={handleSubmit} style={styles.form}>
118
+ <textarea
119
+ value={requirements}
120
+ onChange={(e) => setRequirements(e.target.value)}
121
+ placeholder={
122
+ "Ex: Crie um token ERC20 com as seguintes características:\n- Nome: MeuToken, Símbolo: MTK\n- Supply inicial de 1.000.000 tokens\n- Funções de mint (apenas owner) e burn\n- Pausável pelo owner"
123
+ }
124
+ style={styles.textarea}
125
+ rows={6}
126
+ disabled={running}
127
+ />
128
+ <button
129
+ type="submit"
130
+ disabled={running || !requirements.trim()}
131
+ style={{
132
+ ...styles.button,
133
+ opacity: running || !requirements.trim() ? 0.5 : 1,
134
+ }}
135
+ >
136
+ {running ? "Executando pipeline..." : "Executar Pipeline"}
137
+ </button>
138
+ </form>
139
+
140
+ {/* Logs */}
141
+ {logs.length > 0 && (
142
+ <section style={styles.section}>
143
+ <h2 style={styles.sectionTitle}>📋 Log de Execução</h2>
144
+ <div style={styles.logBox}>
145
+ {logs.map((log, i) => (
146
+ <div key={i} style={styles.logLine}>
147
+ {log}
148
+ </div>
149
+ ))}
150
+ <div ref={logsEndRef} />
151
+ </div>
152
+ </section>
153
+ )}
154
+
155
+ {/* Coder */}
156
+ {coderResult && (
157
+ <section style={styles.section}>
158
+ <h2 style={styles.sectionTitle}>🔨 Agente Coder</h2>
159
+
160
+ <h3 style={styles.subTitle}>Contrato Gerado</h3>
161
+ <div style={styles.codeBox}>
162
+ <pre style={styles.code}>{coderResult.contract}</pre>
163
+ </div>
164
+
165
+ {coderResult.compilationErrors && coderResult.compilationErrors.length > 0 && (
166
+ <>
167
+ <h3 style={{ ...styles.subTitle, color: "#ef4444" }}>Erros de Compilação</h3>
168
+ <div style={{ ...styles.codeBox, borderColor: "#ef4444" }}>
169
+ <pre style={styles.code}>{coderResult.compilationErrors.join("\n")}</pre>
170
+ </div>
171
+ </>
172
+ )}
173
+
174
+ {coderResult.reviewSummary && (
175
+ <>
176
+ <h3 style={styles.subTitle}>Revisão de Segurança</h3>
177
+ <div style={styles.resultBox}>
178
+ <p style={styles.resultText}>{coderResult.reviewSummary}</p>
179
+ </div>
180
+ </>
181
+ )}
182
+ </section>
183
+ )}
184
+
185
+ {/* Auditor */}
186
+ {auditorResult && (
187
+ <section style={styles.section}>
188
+ <h2 style={styles.sectionTitle}>🔍 Agente Auditor</h2>
189
+ {auditorResult.findings && auditorResult.findings.length > 0 ? (
190
+ auditorResult.findings.map((f, i) => (
191
+ <div key={i} style={{ ...styles.findingCard, borderColor: severityColor(f.severity) }}>
192
+ <div style={styles.findingHeader}>
193
+ <span style={{ ...styles.severityBadge, background: severityColor(f.severity) }}>
194
+ {f.severity.toUpperCase()}
195
+ </span>
196
+ <span style={styles.findingTitle}>{f.title}</span>
197
+ </div>
198
+ <p style={styles.findingText}>{f.description}</p>
199
+ <p style={{ ...styles.findingText, color: "#94a3b8" }}>
200
+ <strong>Localização:</strong> {f.location ?? "-"}
201
+ </p>
202
+ {f.codeSnippet && <pre style={styles.code}>{f.codeSnippet}</pre>}
203
+ <p style={{ ...styles.findingText, color: "#94a3b8" }}>
204
+ <strong>Recomendação:</strong> {f.recommendation}
205
+ </p>
206
+ <p style={{ ...styles.findingText, color: "#64748b", fontSize: 12 }}>
207
+ Confiança: {Math.round(f.judgeReview.confidence)}% — {f.judgeReview.review}
208
+ </p>
209
+ </div>
210
+ ))
211
+ ) : (
212
+ <div style={styles.resultBox}>
213
+ <p style={styles.resultText}>Nenhuma vulnerabilidade encontrada.</p>
214
+ </div>
215
+ )}
216
+ </section>
217
+ )}
218
+
219
+ {/* Tester */}
220
+ {testerResult && (
221
+ <section style={styles.section}>
222
+ <h2 style={styles.sectionTitle}>🧪 Agente Tester</h2>
223
+ <div style={styles.codeBox}>
224
+ <pre style={styles.code}>
225
+ {testerResult.results && testerResult.results.length > 0
226
+ ? JSON.stringify(testerResult.results, null, 2)
227
+ : "Nenhum resultado de teste gerado."}
228
+ </pre>
229
+ </div>
230
+ </section>
231
+ )}
232
+ </div>
233
+ );
234
+ }
235
+
236
+ const severityColor = (severity: string) => {
237
+ switch (severity) {
238
+ case "high":
239
+ return "#ef4444";
240
+ case "medium":
241
+ return "#f97316";
242
+ case "low":
243
+ return "#eab308";
244
+ default:
245
+ return "#64748b";
246
+ }
247
+ };
248
+
249
+ const styles: Record<string, React.CSSProperties> = {
250
+ container: {
251
+ maxWidth: 900,
252
+ margin: "0 auto",
253
+ padding: "32px 20px",
254
+ fontFamily: "'Segoe UI', system-ui, -apple-system, sans-serif",
255
+ color: "#e2e8f0",
256
+ background: "#0f172a",
257
+ minHeight: "100vh",
258
+ },
259
+ header: {
260
+ textAlign: "center",
261
+ marginBottom: 32,
262
+ },
263
+ title: {
264
+ fontSize: 28,
265
+ fontWeight: 700,
266
+ color: "#f8fafc",
267
+ margin: "0 0 12px",
268
+ lineHeight: 1.3,
269
+ },
270
+ subtitle: {
271
+ fontSize: 15,
272
+ color: "#94a3b8",
273
+ margin: 0,
274
+ lineHeight: 1.6,
275
+ },
276
+ form: {
277
+ display: "flex",
278
+ flexDirection: "column",
279
+ gap: 12,
280
+ marginBottom: 32,
281
+ },
282
+ textarea: {
283
+ width: "100%",
284
+ padding: 16,
285
+ fontSize: 14,
286
+ fontFamily: "inherit",
287
+ borderRadius: 8,
288
+ border: "1px solid #334155",
289
+ background: "#1e293b",
290
+ color: "#e2e8f0",
291
+ resize: "vertical",
292
+ outline: "none",
293
+ boxSizing: "border-box",
294
+ lineHeight: 1.6,
295
+ },
296
+ button: {
297
+ padding: "12px 24px",
298
+ fontSize: 15,
299
+ fontWeight: 600,
300
+ borderRadius: 8,
301
+ border: "none",
302
+ background: "#3b82f6",
303
+ color: "#fff",
304
+ cursor: "pointer",
305
+ transition: "background 0.2s",
306
+ },
307
+ section: {
308
+ marginBottom: 28,
309
+ },
310
+ sectionTitle: {
311
+ fontSize: 18,
312
+ fontWeight: 600,
313
+ color: "#f8fafc",
314
+ marginBottom: 10,
315
+ },
316
+ subTitle: {
317
+ fontSize: 14,
318
+ fontWeight: 600,
319
+ color: "#94a3b8",
320
+ marginTop: 14,
321
+ marginBottom: 6,
322
+ },
323
+ logBox: {
324
+ background: "#1e293b",
325
+ border: "1px solid #334155",
326
+ borderRadius: 8,
327
+ padding: 16,
328
+ maxHeight: 220,
329
+ overflowY: "auto",
330
+ fontSize: 13,
331
+ fontFamily: "'JetBrains Mono', 'Fira Code', monospace",
332
+ },
333
+ logLine: {
334
+ padding: "2px 0",
335
+ color: "#a5f3fc",
336
+ whiteSpace: "pre-wrap",
337
+ wordBreak: "break-word",
338
+ },
339
+ codeBox: {
340
+ background: "#1e293b",
341
+ border: "1px solid #334155",
342
+ borderRadius: 8,
343
+ padding: 16,
344
+ maxHeight: 400,
345
+ overflowY: "auto",
346
+ },
347
+ code: {
348
+ margin: 0,
349
+ fontSize: 13,
350
+ fontFamily: "'JetBrains Mono', 'Fira Code', monospace",
351
+ color: "#a5f3fc",
352
+ whiteSpace: "pre-wrap",
353
+ wordBreak: "break-word",
354
+ },
355
+ resultBox: {
356
+ background: "#1e293b",
357
+ border: "1px solid #334155",
358
+ borderRadius: 8,
359
+ padding: 16,
360
+ },
361
+ resultText: {
362
+ margin: 0,
363
+ fontSize: 14,
364
+ lineHeight: 1.6,
365
+ color: "#cbd5e1",
366
+ whiteSpace: "pre-wrap",
367
+ },
368
+ findingCard: {
369
+ background: "#1e293b",
370
+ border: "1px solid",
371
+ borderRadius: 8,
372
+ padding: 16,
373
+ marginBottom: 12,
374
+ },
375
+ findingHeader: {
376
+ display: "flex",
377
+ alignItems: "center",
378
+ gap: 10,
379
+ marginBottom: 8,
380
+ },
381
+ severityBadge: {
382
+ fontSize: 11,
383
+ fontWeight: 700,
384
+ color: "#fff",
385
+ padding: "2px 8px",
386
+ borderRadius: 4,
387
+ letterSpacing: "0.05em",
388
+ },
389
+ findingTitle: {
390
+ fontSize: 15,
391
+ fontWeight: 600,
392
+ color: "#f8fafc",
393
+ },
394
+ findingText: {
395
+ margin: "4px 0",
396
+ fontSize: 13,
397
+ lineHeight: 1.6,
398
+ color: "#cbd5e1",
399
+ },
400
+ };
frontend/src/main.tsx ADDED
@@ -0,0 +1,9 @@
 
 
 
 
 
 
 
 
 
 
1
+ import { StrictMode } from "react";
2
+ import { createRoot } from "react-dom/client";
3
+ import { App } from "./App.tsx";
4
+
5
+ createRoot(document.getElementById("root")!).render(
6
+ <StrictMode>
7
+ <App />
8
+ </StrictMode>,
9
+ );
frontend/tsconfig.json ADDED
@@ -0,0 +1,16 @@
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
+ {
2
+ "compilerOptions": {
3
+ "target": "ES2020",
4
+ "module": "ESNext",
5
+ "lib": ["ES2020", "DOM", "DOM.Iterable"],
6
+ "jsx": "react-jsx",
7
+ "moduleResolution": "bundler",
8
+ "strict": true,
9
+ "skipLibCheck": true,
10
+ "esModuleInterop": true,
11
+ "allowImportingTsExtensions": true,
12
+ "noEmit": true,
13
+ "isolatedModules": true
14
+ },
15
+ "include": ["src"]
16
+ }
frontend/vite.config.ts ADDED
@@ -0,0 +1,11 @@
 
 
 
 
 
 
 
 
 
 
 
 
1
+ import { defineConfig } from "vite";
2
+ import react from "@vitejs/plugin-react";
3
+
4
+ export default defineConfig({
5
+ plugins: [react()],
6
+ server: {
7
+ proxy: {
8
+ "/api": "http://localhost:7860",
9
+ },
10
+ },
11
+ });
input/requirements.md ADDED
@@ -0,0 +1,12 @@
 
 
 
 
 
 
 
 
 
 
 
 
 
1
+ # Requisitos do Smart Contract
2
+
3
+ ## Descrição
4
+ Token ERC20 com funcionalidades de controle de acesso e pausa.
5
+
6
+ ## Requisitos Funcionais
7
+
8
+ 1. Implementar um token ERC20 com nome, símbolo e supply configuráveis
9
+ 2. O contrato deve ser pausável (funções de transferência bloqueadas quando pausado)
10
+ 3. Apenas o owner pode pausar e despausar o contrato
11
+ 4. O owner pode criar (mint) novos tokens
12
+ 5. Qualquer holder pode queimar (burn) seus próprios tokens
package-lock.json CHANGED
The diff for this file is too large to render. See raw diff
 
package.json CHANGED
@@ -8,7 +8,10 @@
8
  "test": "vitest",
9
  "coverage": "vitest run --coverage",
10
  "build": "tsc",
11
- "start": "npm run build && node dist/index.js"
 
 
 
12
  },
13
  "repository": {
14
  "type": "git",
@@ -23,17 +26,26 @@
23
  "devDependencies": {
24
  "@biomejs/biome": "2.4.14",
25
  "@types/node": "^25.9.1",
 
26
  "ts-node": "^10.9.2",
27
  "typescript": "^6.0.3",
28
  "vitest": "^4.1.5"
29
  },
30
  "dependencies": {
 
 
31
  "@langchain/core": "^1.1.45",
 
32
  "@langchain/langgraph": "^1.3.2",
33
  "@langchain/openai": "^1.4.6",
34
  "@langchain/openrouter": "^0.2.4",
 
35
  "dotenv": "^17.4.2",
 
36
  "langchain": "^1.4.0",
 
 
 
37
  "zod": "^4.4.3"
38
  }
39
  }
 
8
  "test": "vitest",
9
  "coverage": "vitest run --coverage",
10
  "build": "tsc",
11
+ "start": "npm run build && node dist/index.js",
12
+ "server": "npm run build && node dist/server.js",
13
+ "dev:server": "npx tsx src/server.ts",
14
+ "postinstall": "patch-package"
15
  },
16
  "repository": {
17
  "type": "git",
 
26
  "devDependencies": {
27
  "@biomejs/biome": "2.4.14",
28
  "@types/node": "^25.9.1",
29
+ "patch-package": "^8.0.1",
30
  "ts-node": "^10.9.2",
31
  "typescript": "^6.0.3",
32
  "vitest": "^4.1.5"
33
  },
34
  "dependencies": {
35
+ "@hono/node-server": "^2.0.3",
36
+ "@langchain/anthropic": "^1.3.29",
37
  "@langchain/core": "^1.1.45",
38
+ "@langchain/google-genai": "^2.1.31",
39
  "@langchain/langgraph": "^1.3.2",
40
  "@langchain/openai": "^1.4.6",
41
  "@langchain/openrouter": "^0.2.4",
42
+ "@solidity-parser/parser": "^0.20.2",
43
  "dotenv": "^17.4.2",
44
+ "hono": "^4.12.21",
45
  "langchain": "^1.4.0",
46
+ "solc": "^0.8.35",
47
+ "uuid": "^11.1.1",
48
+ "winston": "^3.19.0",
49
  "zod": "^4.4.3"
50
  }
51
  }
patches/@langchain+core+1.1.47.patch ADDED
@@ -0,0 +1,25 @@
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
+ diff --git a/node_modules/@langchain/core/dist/utils/uuid/index.cjs b/node_modules/@langchain/core/dist/utils/uuid/index.cjs
2
+ index 1151178..c05caf9 100644
3
+ --- a/node_modules/@langchain/core/dist/utils/uuid/index.cjs
4
+ +++ b/node_modules/@langchain/core/dist/utils/uuid/index.cjs
5
+ @@ -36,12 +36,12 @@ Object.defineProperty(exports, "uuid_exports", {
6
+ return uuid_exports;
7
+ }
8
+ });
9
+ -exports.v1 = require_v1;
10
+ -exports.v4 = require_v4;
11
+ -exports.v5 = require_v5;
12
+ -exports.v6 = require_v6;
13
+ -exports.v7 = require_v7;
14
+ -exports.validate = require_validate;
15
+ -exports.version = require_version;
16
+ +exports.v1 = require_v1.default;
17
+ +exports.v4 = require_v4.default;
18
+ +exports.v5 = require_v5.default;
19
+ +exports.v6 = require_v6.default;
20
+ +exports.v7 = require_v7.default;
21
+ +exports.validate = require_validate.default;
22
+ +exports.version = require_version.default;
23
+
24
+ //# sourceMappingURL=index.cjs.map
25
+
src/agents/auditor/agent.ts CHANGED
@@ -1,20 +1,271 @@
 
 
 
 
1
  import { END, type GraphNode, START, StateGraph } from "@langchain/langgraph";
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
2
 
3
- import { AuditorState } from "./state.ts";
4
- import { slitherTool } from "./tools/slither-tool.ts";
5
 
6
- const PLACEHOLDER_VULNERABILITIES = [
7
- { type: "reentrancy", severity: "high", description: "Unchecked external call allows reentrancy attack." },
8
- { type: "integer-overflow", severity: "medium", description: "Arithmetic operation may overflow." },
9
- ];
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
10
 
11
- const auditContract: GraphNode<typeof AuditorState> = async (state) => {
12
- await slitherTool.invoke({ solidityFile: state.solidityFile });
13
- return { vulnerabilities: PLACEHOLDER_VULNERABILITIES };
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
14
  };
15
 
16
  export const auditorAgent = new StateGraph(AuditorState)
17
- .addNode("auditContract", auditContract)
18
- .addEdge(START, "auditContract")
19
- .addEdge("auditContract", END)
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
20
  .compile();
 
1
+ import fs from "node:fs";
2
+ import path from "node:path";
3
+
4
+ import { HumanMessage, SystemMessage } from "@langchain/core/messages";
5
  import { END, type GraphNode, START, StateGraph } from "@langchain/langgraph";
6
+ import { z } from "zod";
7
+
8
+ import { logger } from "../../logger.ts";
9
+ import { createLLM } from "../../config/llm.ts";
10
+ import { JUDGE_FINDINGS_PROMPT, FIND_VULNERABILITIES_PROMPT, GATHER_CONTEXT_PROMPT } from "./prompts.ts";
11
+ import { AuditorState, JudgeReviewSchema, CandidateFindingSchema } from "./state.ts";
12
+ import { analyzeSolidityFile } from "./tools/solidity-analyzer-tool.ts";
13
+ import { buildRepoTree } from "./tools/repo-tree-tool.ts";
14
+ import {
15
+ DOC_BASENAMES,
16
+ DOC_EXTS,
17
+ MAX_DEPTH,
18
+ MAX_DOC_CHARS,
19
+ MAX_REFLECTIONS,
20
+ MAX_SOL_CHARS,
21
+ SKIP_DIRS,
22
+ SOL_EXT,
23
+ SOL_TEST_SUFFIXES,
24
+ } from "./config.ts";
25
+ import { matchLines } from "./utils.ts";
26
+
27
+ const llm = createLLM();
28
+
29
+ const walkDirectory = (dir: string, depth: number, solFiles: string[], docFiles: string[]) => {
30
+ if (depth > MAX_DEPTH) return;
31
+
32
+ let entries: fs.Dirent[];
33
+ try {
34
+ entries = fs.readdirSync(dir, { withFileTypes: true });
35
+ } catch {
36
+ return;
37
+ }
38
+
39
+ for (const entry of entries) {
40
+ if (entry.isDirectory()) {
41
+ if (!SKIP_DIRS.has(entry.name)) {
42
+ walkDirectory(path.join(dir, entry.name), depth + 1, solFiles, docFiles);
43
+ }
44
+ } else if (entry.isFile()) {
45
+ const fullPath = path.join(dir, entry.name);
46
+ const ext = path.extname(entry.name).toLowerCase();
47
+ const base = path.basename(entry.name, ext).toLowerCase();
48
+
49
+ if (ext === SOL_EXT) {
50
+ const isTest = SOL_TEST_SUFFIXES.some((suffix) => entry.name.endsWith(suffix));
51
+ if (!isTest) solFiles.push(fullPath);
52
+ } else if (DOC_EXTS.has(ext) || DOC_BASENAMES.has(base)) {
53
+ docFiles.push(fullPath);
54
+ }
55
+ }
56
+ }
57
+ };
58
+
59
+ const defineScope: GraphNode<typeof AuditorState> = async (state) => {
60
+ logger.info(`defineScope: walking repo at ${state.repoPath}`);
61
+
62
+ const solFiles: string[] = [];
63
+ const docFiles: string[] = [];
64
+
65
+ walkDirectory(state.repoPath, 0, solFiles, docFiles);
66
+
67
+ const fileTree = buildRepoTree(state.repoPath);
68
+
69
+ logger.info(`defineScope: found ${solFiles.length} Solidity file(s), ${docFiles.length} doc file(s)`);
70
+ logger.debug(`defineScope: Solidity files: ${JSON.stringify(solFiles)}`);
71
+ logger.debug(`defineScope: doc files: ${JSON.stringify(docFiles)}`);
72
+ logger.debug(`defineScope: file tree:\n${fileTree}`);
73
+
74
+ return { scope: solFiles, docs: docFiles, fileTree };
75
+ };
76
+
77
+ const gatherContext: GraphNode<typeof AuditorState> = async (state) => {
78
+ logger.info(`gatherContext: processing ${state.scope.length} Solidity file(s) and ${state.docs.length} doc file(s)`);
79
+
80
+ const readFile = (filePath: string): string => {
81
+ try {
82
+ return fs.readFileSync(filePath, "utf-8");
83
+ } catch {
84
+ return "";
85
+ }
86
+ };
87
+
88
+ // Read and analyze each Solidity file
89
+ const solidityEntries: { filePath: string; source: string; analysis: string }[] = [];
90
+ for (const filePath of state.scope) {
91
+ const source = readFile(filePath).slice(0, MAX_SOL_CHARS);
92
+ if (!source) continue;
93
+ const analysis = await analyzeSolidityFile(source, "full");
94
+ solidityEntries.push({ filePath, source, analysis });
95
+ }
96
+
97
+ // Read documentation files
98
+ const docEntries: { filePath: string; content: string }[] = [];
99
+ for (const filePath of state.docs) {
100
+ const content = readFile(filePath).slice(0, MAX_DOC_CHARS);
101
+ if (content) docEntries.push({ filePath, content });
102
+ }
103
+
104
+ // Build the LLM input
105
+ const parts: string[] = [];
106
+
107
+ if (docEntries.length > 0) {
108
+ parts.push("## Documentation\n");
109
+ for (const { filePath, content } of docEntries) {
110
+ parts.push(`### ${filePath}\n${content}`);
111
+ }
112
+ }
113
+
114
+ parts.push("## Structural Analysis (auto-generated)\n");
115
+ for (const { filePath, analysis } of solidityEntries) {
116
+ parts.push(`### ${filePath}\n${analysis}`);
117
+ }
118
+
119
+ parts.push("## Contract Source Code\n");
120
+ for (const { filePath, source } of solidityEntries) {
121
+ parts.push(`### ${filePath}\n\`\`\`solidity\n${source}\n\`\`\``);
122
+ }
123
+
124
+ const model = llm.withStructuredOutput(z.object({ context: z.string() }));
125
+ const result = await model.invoke([new SystemMessage(GATHER_CONTEXT_PROMPT), new HumanMessage(parts.join("\n\n"))]);
126
 
127
+ logger.info(`gatherContext: context built (${parts.join("\n\n").length} chars)`);
128
+ logger.debug(`gatherContext: full context:\n${parts.join("\n\n")}`);
129
 
130
+ return { repoContext: result.context };
131
+ };
132
+
133
+ const findVulnerabilities: GraphNode<typeof AuditorState> = async (state) => {
134
+ const model = llm.withStructuredOutput(z.object({ findings: z.array(CandidateFindingSchema) }));
135
+
136
+ const previousFeedback =
137
+ state.judgeReviews.length > 0
138
+ ? state.judgeReviews
139
+ .map((r, i) => {
140
+ const title = state.candidateFindings[i]?.title ?? `Finding ${i + 1}`;
141
+ return `- "${title}": ${r.isFalsePositive ? "FALSE POSITIVE" : "TRUE POSITIVE"}\n Judge: ${r.review}`;
142
+ })
143
+ .join("\n")
144
+ : null;
145
+
146
+ logger.info(
147
+ `findVulnerabilities: invoking LLM for ${state.scope.length} file(s) in parallel (iteration ${state.reflectionCount + 1})`,
148
+ );
149
+
150
+ const allFindings = await Promise.all(
151
+ state.scope.map(async (filePath) => {
152
+ let source: string;
153
+ try {
154
+ source = fs.readFileSync(filePath, "utf-8").slice(0, MAX_SOL_CHARS);
155
+ } catch {
156
+ return [];
157
+ }
158
+ if (!source) return [];
159
+
160
+ let userMessage = `Contract (${filePath}):\n\n${source}\n\nProtocol Context:\n${state.repoContext}`;
161
+ if (previousFeedback) {
162
+ userMessage += `\n\nJudge feedback from previous iteration (iteration ${state.reflectionCount}):\n${previousFeedback}\n\nRevise your findings accordingly.`;
163
+ }
164
+
165
+ logger.debug(`findVulnerabilities: processing ${filePath}`);
166
+
167
+ const result = await model.invoke([
168
+ new SystemMessage(FIND_VULNERABILITIES_PROMPT),
169
+ new HumanMessage(userMessage),
170
+ ]);
171
+
172
+ return result.findings.map((finding: any) => ({
173
+ ...finding,
174
+ path: filePath,
175
+ location: matchLines(source, finding.codeSnippet) ?? "",
176
+ }));
177
+ }),
178
+ );
179
+
180
+ const candidateFindings = allFindings.flat();
181
+ logger.info(`findVulnerabilities: LLM returned ${candidateFindings.length} total candidate finding(s)`);
182
+ logger.debug(`findVulnerabilities: findings:\n${JSON.stringify(candidateFindings, null, 2)}`);
183
+
184
+ return { candidateFindings };
185
+ };
186
 
187
+ const judgeFindings: GraphNode<typeof AuditorState> = async (state) => {
188
+ if (state.candidateFindings.length === 0) {
189
+ logger.info("judgeFindings: no candidate findings to review, skipping LLM call");
190
+ return {
191
+ judgeReviews: [],
192
+ findings: [],
193
+ reflectionCount: state.reflectionCount + 1,
194
+ };
195
+ }
196
+
197
+ const model = llm.withStructuredOutput(JudgeReviewSchema);
198
+
199
+ logger.info(`judgeFindings: reviewing ${state.candidateFindings.length} candidate finding(s) in parallel`);
200
+
201
+ const reviews = await Promise.all(
202
+ state.candidateFindings.map(async (finding, i) => {
203
+ let source: string;
204
+ try {
205
+ source = fs.readFileSync(finding.path, "utf-8").slice(0, MAX_SOL_CHARS);
206
+ } catch {
207
+ source = "";
208
+ }
209
+
210
+ const findingText = `[Finding ${i + 1}] ${finding.title}\nSeverity: ${finding.severity}\nDescription: ${finding.description}\nLocation: ${finding.path} lines ${finding.location}\nCode:\n\`\`\`solidity\n${finding.codeSnippet}\n\`\`\``;
211
+
212
+ logger.debug(`judgeFindings: reviewing finding ${i + 1}: ${finding.title}`);
213
+ return model.invoke([
214
+ new SystemMessage(JUDGE_FINDINGS_PROMPT),
215
+ new HumanMessage(
216
+ `Contract (${finding.path}):\n\n${source}\n\nProtocol Context:\n${state.repoContext}\n\nFinding to Review:\n\n${findingText}`,
217
+ ),
218
+ ]);
219
+ }),
220
+ );
221
+
222
+ const confirmedEntries = state.candidateFindings
223
+ .map((finding, i) => ({ finding, review: reviews[i] }))
224
+ .filter(({ review }) => !review.isFalsePositive);
225
+
226
+ const findings = confirmedEntries.map(({ finding, review }) => ({
227
+ ...finding,
228
+ judgeReview: {
229
+ review: review.review,
230
+ confidence: review.confidence,
231
+ exploitablePaths: review.exploitablePaths,
232
+ },
233
+ }));
234
+
235
+ const falsePositiveCount = state.candidateFindings.length - findings.length;
236
+
237
+ logger.info(`judgeFindings: ${findings.length} confirmed, ${falsePositiveCount} false positive(s)`);
238
+ logger.debug(`judgeFindings: reviews:\n${JSON.stringify(reviews, null, 2)}`);
239
+
240
+ return {
241
+ judgeReviews: reviews,
242
+ findings,
243
+ reflectionCount: state.reflectionCount + 1,
244
+ };
245
  };
246
 
247
  export const auditorAgent = new StateGraph(AuditorState)
248
+ .addNode("defineScope", defineScope)
249
+ .addNode("gatherContext", gatherContext)
250
+ .addNode("findVulnerabilities", findVulnerabilities)
251
+ .addNode("judgeFindings", judgeFindings)
252
+ .addEdge(START, "defineScope")
253
+ .addEdge("defineScope", "gatherContext")
254
+ .addEdge("gatherContext", "findVulnerabilities")
255
+ .addEdge("findVulnerabilities", "judgeFindings")
256
+ .addConditionalEdges("judgeFindings", (state) => {
257
+ const hasFalsePositives = state.judgeReviews.some((r) => r.isFalsePositive);
258
+ if (hasFalsePositives && state.reflectionCount < MAX_REFLECTIONS) {
259
+ return "findVulnerabilities";
260
+ }
261
+ return END;
262
+ })
263
+ .compile();
264
+
265
+ export const testAgent = new StateGraph(AuditorState)
266
+ .addNode("defineScope", defineScope)
267
+ .addNode("gatherContext", gatherContext)
268
+ .addEdge(START, "defineScope")
269
+ .addEdge("defineScope", "gatherContext")
270
+ .addEdge("gatherContext", END)
271
  .compile();
src/agents/auditor/config.ts ADDED
@@ -0,0 +1,23 @@
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
+ export const SOL_EXT = ".sol";
2
+ export const SOL_TEST_SUFFIXES = [".t.sol", ".test.sol", ".spec.sol"];
3
+ export const DOC_EXTS = new Set([".md", ".rst", ".adoc"]);
4
+ export const DOC_BASENAMES = new Set(["readme", "whitepaper", "spec", "architecture", "design", "overview", "docs"]);
5
+ export const SKIP_DIRS = new Set([
6
+ "node_modules",
7
+ ".git",
8
+ "out",
9
+ "artifacts",
10
+ "cache",
11
+ "lib",
12
+ ".deps",
13
+ "build",
14
+ "dist",
15
+ "test",
16
+ "tests",
17
+ "script",
18
+ "scripts",
19
+ ]);
20
+ export const MAX_DEPTH = 6;
21
+ export const MAX_DOC_CHARS = 12_000;
22
+ export const MAX_SOL_CHARS = 40_000;
23
+ export const MAX_REFLECTIONS = 1;
src/agents/auditor/model.ts DELETED
@@ -1,5 +0,0 @@
1
- import { ChatOpenRouter } from "@langchain/openrouter";
2
-
3
- export const auditorModel = new ChatOpenRouter({
4
- model: "moonshotai/kimi-k2.6",
5
- });
 
 
 
 
 
 
src/agents/auditor/prompts.ts ADDED
@@ -0,0 +1,50 @@
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
+ export const GATHER_CONTEXT_PROMPT = `Você é um especialista em segurança de smart contracts. Você receberá documentação, uma análise estrutural e o código-fonte completo de todos os contratos Solidity em escopo. Produza um contexto detalhado do protocolo que guiará a descoberta de vulnerabilidades.
2
+
3
+ Estruture sua resposta nas seguintes seções:
4
+
5
+ ## 1. Visão Geral dos Contratos
6
+ Para cada contrato: seu propósito, tipo (contract/interface/library/abstract), cadeia de herança e principais dependências de outros contratos em escopo ou protocolos externos.
7
+
8
+ ## 2. Mapa de Estado e Armazenamento
9
+ Liste todas as variáveis de estado relevantes entre os contratos, o que representam e quais funções as leem ou escrevem. Sinalize armazenamento compartilhado ou herdado.
10
+
11
+ ## 3. Fluxos Principais
12
+ Trace os principais caminhos de execução e transições de estado de ponta a ponta entre contratos (ex.: depósito → cunhar shares → atualizar recompensas; saque → queimar shares → transferir ETH). Inclua chamadas entre contratos.
13
+
14
+ ## 4. Invariantes
15
+ Condições que devem sempre ser verdadeiras (ex.: "o supply total deve ser igual à soma de todos os saldos", "o saldo de ETH do contrato ≥ soma de todos os depósitos dos usuários"). Derive-as tanto do código-fonte quanto da documentação.
16
+
17
+ ## 5. Premissas de Design
18
+ O que o protocolo assume sobre chamadores, contratos externos, oráculos, chaves de administrador e comportamento de tokens (ex.: "tokens são compatíveis com ERC-20", "o admin é confiável", "sem tokens com taxa de transferência").
19
+
20
+ ## 6. Regras de Negócio
21
+ Controles de acesso, estruturas de taxas, timelocks, limites, mecanismos de pausa, padrões de atualização e quaisquer outras restrições de domínio.
22
+
23
+ Seja preciso e exaustivo — quanto mais rico o contexto, com mais precisão as vulnerabilidades podem ser identificadas e validadas.`;
24
+
25
+ export const FIND_VULNERABILITIES_PROMPT = `Você é um auditor especialista em segurança de smart contracts com foco em Solidity. Analise sistematicamente o código-fonte do contrato e o contexto do protocolo para identificar vulnerabilidades de segurança.
26
+
27
+ Para cada vulnerabilidade, forneça TODOS os seguintes campos:
28
+
29
+ - **title**: Nome curto e preciso (ex.: "Reentrância em withdraw", "Controle de acesso ausente em setFee").
30
+ - **description**: Explique o comportamento ESPERADO versus o comportamento OBSERVADO (vulnerável) em 2 a 4 frases.
31
+ - **recommendation**: Correção específica e acionável (ex.: "Aplicar o padrão checks-effects-interactions", "Adicionar o modificador onlyOwner").
32
+ - **severity**: Um de "high" (perda direta de fundos ou tomada de controle do contrato), "medium" (risco indireto ou condicional), "low" (problema de boas práticas, sem risco financeiro imediato).
33
+ - **codeSnippet**: O bloco de código vulnerável exatamente como aparece no código-fonte.
34
+
35
+ Categorias de vulnerabilidades a verificar sistematicamente: reentrância (simples e entre funções), controle de acesso, overflow/underflow de inteiros, manipulação de oráculo, ataques de flash loan, front-running/MEV, replay de assinatura, colisões de armazenamento, proxies não inicializados, delegatecall inseguro, griefing de gas, negação de serviço, perda de precisão e violações de lógica/regras de negócio.
36
+
37
+ Se feedback do juiz de uma iteração anterior for fornecido, remova os falsos positivos confirmados da sua lista e refine ou expanda os achados restantes com base na crítica.`;
38
+
39
+ export const JUDGE_FINDINGS_PROMPT = `Você é um revisor rigoroso de segurança de smart contracts. Avalie cada vulnerabilidade candidata submetida pelo auditor e determine se é um verdadeiro positivo ou um falso positivo.
40
+
41
+ Para cada achado, forneça TODOS os seguintes campos:
42
+
43
+ - **review**: Análise detalhada (3 a 6 frases) explicando por que a vulnerabilidade é ou não real. Referencie código específico, invariantes do protocolo, pré-condições e controles mitigadores.
44
+ - **isFalsePositive**: true se o achado NÃO for explorável na prática; false se for uma vulnerabilidade real.
45
+ - **confidence**: Número inteiro de 0 a 100 refletindo sua confiança no veredicto.
46
+ - **exploitablePaths**: Array de strings. Se for verdadeiro positivo, forneça caminhos concretos confirmando a explorabilidade com valores reais. Cada rastreamento deve descrever os passos do atacante com entradas/valores realistas (ex.: "1. Atacante chama deposit(100 ETH) 2. Contrato do atacante no fallback chama withdraw() novamente antes da atualização do saldo 3. Atacante drena 100 ETH duas vezes"). Se for falso positivo, forneça o raciocínio que bloqueia o exploit.
47
+
48
+ Um achado é falso positivo somente se: o caminho de exploit for inacessível dados os controles de acesso ou pré-condições, já estiver totalmente mitigado pelo código, exigir condições impossíveis ou economicamente inviáveis, ou for explicitamente documentado como comportamento esperado nas premissas do protocolo.
49
+
50
+ Você deve fornecer exatamente um objeto de revisão por achado, na mesma ordem em que os achados foram apresentados.`;
src/agents/auditor/state.ts CHANGED
@@ -1,7 +1,42 @@
1
  import { StateSchema } from "@langchain/langgraph";
2
  import { z } from "zod";
3
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
4
  export const AuditorState = new StateSchema({
5
- solidityFile: z.string().default(""),
6
- vulnerabilities: z.array(z.record(z.string(), z.any())).default([]),
 
 
 
 
 
 
 
7
  });
 
1
  import { StateSchema } from "@langchain/langgraph";
2
  import { z } from "zod";
3
 
4
+ export const CandidateFindingSchema = z.object({
5
+ title: z.string(),
6
+ description: z.string(),
7
+ recommendation: z.string(),
8
+ severity: z.enum(["high", "medium", "low"]),
9
+ codeSnippet: z.string(),
10
+ });
11
+
12
+ export const LocatedFindingSchema = CandidateFindingSchema.extend({
13
+ location: z.string(),
14
+ path: z.string(),
15
+ });
16
+
17
+ export const JudgeReviewSchema = z.object({
18
+ review: z.string(),
19
+ isFalsePositive: z.boolean(),
20
+ confidence: z.number(),
21
+ exploitablePaths: z.array(z.string()),
22
+ });
23
+
24
+ export const FindingSchema = LocatedFindingSchema.extend({
25
+ judgeReview: z.object({
26
+ review: z.string(),
27
+ confidence: z.number(),
28
+ exploitablePaths: z.array(z.string()),
29
+ }),
30
+ });
31
+
32
  export const AuditorState = new StateSchema({
33
+ repoPath: z.string().default(""),
34
+ scope: z.array(z.string()).default([]),
35
+ docs: z.array(z.string()).default([]),
36
+ fileTree: z.string().default(""),
37
+ repoContext: z.string().default(""),
38
+ candidateFindings: z.array(LocatedFindingSchema).default([]),
39
+ judgeReviews: z.array(JudgeReviewSchema).default([]),
40
+ findings: z.array(FindingSchema).default([]),
41
+ reflectionCount: z.number().default(0),
42
  });
src/agents/auditor/tools/repo-tree-tool.ts ADDED
@@ -0,0 +1,103 @@
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
+ import fs from "node:fs";
2
+ import path from "node:path";
3
+
4
+ import { tool } from "langchain";
5
+ import { z } from "zod";
6
+
7
+ import { DOC_BASENAMES, DOC_EXTS, MAX_DEPTH, SKIP_DIRS, SOL_EXT, SOL_TEST_SUFFIXES } from "../config.ts";
8
+
9
+ const CONFIG_FILES = new Set([
10
+ "foundry.toml",
11
+ "hardhat.config.js",
12
+ "hardhat.config.ts",
13
+ "remappings.txt",
14
+ "package.json",
15
+ ]);
16
+
17
+ interface TreeNode {
18
+ name: string;
19
+ isDir: boolean;
20
+ children?: TreeNode[];
21
+ tag?: string;
22
+ }
23
+
24
+ const buildTree = (dir: string, depth: number): TreeNode[] => {
25
+ if (depth > MAX_DEPTH) return [];
26
+
27
+ let entries: fs.Dirent[];
28
+ try {
29
+ entries = fs.readdirSync(dir, { withFileTypes: true });
30
+ } catch {
31
+ return [];
32
+ }
33
+
34
+ const nodes: TreeNode[] = [];
35
+
36
+ for (const entry of [...entries].sort((a, b) => {
37
+ if (a.isDirectory() && !b.isDirectory()) return -1;
38
+ if (!a.isDirectory() && b.isDirectory()) return 1;
39
+ return a.name.localeCompare(b.name);
40
+ })) {
41
+ if (entry.isDirectory()) {
42
+ if (SKIP_DIRS.has(entry.name)) continue;
43
+ const children = buildTree(path.join(dir, entry.name), depth + 1);
44
+ if (children.length > 0) nodes.push({ name: entry.name, isDir: true, children });
45
+ } else if (entry.isFile()) {
46
+ const ext = path.extname(entry.name).toLowerCase();
47
+ const base = path.basename(entry.name, ext).toLowerCase();
48
+
49
+ if (ext === SOL_EXT) {
50
+ const isTest = SOL_TEST_SUFFIXES.some((suffix) => entry.name.endsWith(suffix));
51
+ nodes.push({ name: entry.name, isDir: false, tag: isTest ? "[test]" : "[sol]" });
52
+ } else if (DOC_EXTS.has(ext) || DOC_BASENAMES.has(base)) {
53
+ nodes.push({ name: entry.name, isDir: false, tag: "[doc]" });
54
+ } else if (CONFIG_FILES.has(entry.name)) {
55
+ nodes.push({ name: entry.name, isDir: false, tag: "[config]" });
56
+ }
57
+ }
58
+ }
59
+
60
+ return nodes;
61
+ };
62
+
63
+ const renderTree = (nodes: TreeNode[], prefix: string): string => {
64
+ const lines: string[] = [];
65
+
66
+ for (let i = 0; i < nodes.length; i++) {
67
+ const node = nodes[i];
68
+ const isLast = i === nodes.length - 1;
69
+ const connector = isLast ? "└── " : "├── ";
70
+ const childPrefix = isLast ? " " : "│ ";
71
+
72
+ if (node.isDir) {
73
+ lines.push(`${prefix}${connector}${node.name}/`);
74
+ if (node.children && node.children.length > 0) {
75
+ lines.push(renderTree(node.children, prefix + childPrefix));
76
+ }
77
+ } else {
78
+ lines.push(`${prefix}${connector}${node.name} ${node.tag}`);
79
+ }
80
+ }
81
+
82
+ return lines.join("\n");
83
+ };
84
+
85
+ export const buildRepoTree = (repoPath: string): string => {
86
+ const nodes = buildTree(repoPath, 0);
87
+ if (nodes.length === 0) return "(no relevant files found)";
88
+
89
+ const repoName = path.basename(repoPath);
90
+ return `${repoName}/\n${renderTree(nodes, "")}`;
91
+ };
92
+
93
+ export const repoTreeTool = tool(
94
+ async ({ repoPath }) => buildRepoTree(repoPath),
95
+ {
96
+ name: "repo_tree",
97
+ description:
98
+ "Walk a repository and return a file-system tree of relevant files tagged by kind: [sol] for auditable Solidity contracts, [test] for Solidity test files, [doc] for documentation, and [config] for project config files. Use this during Define Scope to understand repository layout before selecting which files to audit.",
99
+ schema: z.object({
100
+ repoPath: z.string().describe("Absolute path to the repository root."),
101
+ }),
102
+ },
103
+ );
src/agents/auditor/tools/slither-tool.ts DELETED
@@ -1,15 +0,0 @@
1
- import { tool } from "langchain";
2
- import { z } from "zod";
3
-
4
- export const slitherTool = tool(
5
- async (_input) => {
6
- return [];
7
- },
8
- {
9
- name: "slither",
10
- description: "Run slither static analysis on a Solidity contract.",
11
- schema: z.object({
12
- solidityFile: z.string().describe("The Solidity source code to analyze."),
13
- }),
14
- },
15
- );
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
src/agents/auditor/tools/solidity-analyzer-tool.ts ADDED
@@ -0,0 +1,567 @@
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
+ import { parse, visit } from "@solidity-parser/parser";
2
+ import { tool } from "langchain";
3
+ import { z } from "zod";
4
+
5
+ const ASSIGNMENT_OPS = new Set(["=", "+=", "-=", "*=", "/=", "%=", "|=", "&=", "^=", "<<=", ">>=", "**="]);
6
+ const BUILTIN_NAMESPACES = new Set(["abi", "block", "msg", "tx", "bytes", "string", "type"]);
7
+
8
+ interface StateVar {
9
+ name: string;
10
+ type: string;
11
+ visibility: string;
12
+ constant: boolean;
13
+ immutable: boolean;
14
+ }
15
+
16
+ interface EventDef {
17
+ name: string;
18
+ params: string[];
19
+ anonymous: boolean;
20
+ }
21
+
22
+ interface ModifierDef {
23
+ name: string;
24
+ params: string[];
25
+ }
26
+
27
+ interface FunctionDef {
28
+ name: string;
29
+ isConstructor: boolean;
30
+ isReceive: boolean;
31
+ isFallback: boolean;
32
+ visibility: string;
33
+ mutability: string;
34
+ params: string[];
35
+ returns: string[];
36
+ modifiers: string[];
37
+ internalCalls: string[];
38
+ externalCalls: string[];
39
+ stateReads: string[];
40
+ stateWrites: string[];
41
+ }
42
+
43
+ interface ContractAnalysis {
44
+ name: string;
45
+ kind: string;
46
+ baseContracts: string[];
47
+ usingFor: string[];
48
+ stateVars: StateVar[];
49
+ events: EventDef[];
50
+ modifiers: ModifierDef[];
51
+ functions: FunctionDef[];
52
+ }
53
+
54
+ const typeToString = (node: any): string => {
55
+ if (!node) return "unknown";
56
+
57
+ switch (node.type) {
58
+ case "ElementaryTypeName":
59
+ return node.name as string;
60
+ case "UserDefinedTypeName":
61
+ return (node.namePath ?? node.name) as string;
62
+ case "ArrayTypeName":
63
+ return `${typeToString(node.baseTypeName)}[${node.length ?? ""}]`;
64
+ case "Mapping":
65
+ return `mapping(${typeToString(node.keyType)} => ${typeToString(node.valueType)})`;
66
+ case "FunctionTypeName":
67
+ return "function";
68
+ default:
69
+ return "unknown";
70
+ }
71
+ };
72
+
73
+ const paramToString = (p: any) => {
74
+ if (!p) return "?";
75
+ const type = typeToString(p.typeName);
76
+ return p.name ? `${type} ${p.name}` : type;
77
+ };
78
+
79
+ const collectLHSRoots = (node: any, targets: Set<string>) => {
80
+ if (!node) return;
81
+ switch (node.type) {
82
+ case "Identifier":
83
+ targets.add(node.name as string);
84
+ break;
85
+ case "MemberAccess":
86
+ collectLHSRoots(node.expression, targets);
87
+ break;
88
+ case "IndexAccess":
89
+ collectLHSRoots(node.base, targets);
90
+ break;
91
+ case "TupleExpression":
92
+ for (const c of node.components ?? []) collectLHSRoots(c, targets);
93
+ break;
94
+ }
95
+ };
96
+
97
+ const analyzeFunction = (funcNode: any, stateVarNames: Set<string>) => {
98
+ const internalCalls = new Set<string>();
99
+ const externalCalls = new Set<string>();
100
+ const writeTargets = new Set<string>();
101
+ const allStateAccesses = new Set<string>();
102
+ const localVars = new Set<string>();
103
+
104
+ if (!funcNode.body) {
105
+ return { internalCalls: [], externalCalls: [], stateReads: [], stateWrites: [] };
106
+ }
107
+
108
+ // Collect function params and return params as locals so they don't shadow state vars
109
+ for (const p of funcNode.parameters ?? []) {
110
+ if (p?.name) localVars.add(p.name as string);
111
+ }
112
+ for (const p of funcNode.returnParameters ?? []) {
113
+ if (p?.name) localVars.add(p.name as string);
114
+ }
115
+
116
+ // Collect local variable declarations
117
+ visit(funcNode.body, {
118
+ VariableDeclarationStatement: (node: any) => {
119
+ for (const v of node.variables ?? []) {
120
+ if (v?.name) localVars.add(v.name as string);
121
+ }
122
+ },
123
+ });
124
+
125
+ const effectiveStateVars = new Set([...stateVarNames].filter((v) => !localVars.has(v)));
126
+
127
+ // Collect write targets from assignment LHS, unary mutations, and delete
128
+ visit(funcNode.body, {
129
+ ExpressionStatement: (node: any) => {
130
+ const expr = node.expression;
131
+ if (expr?.type === "BinaryOperation" && ASSIGNMENT_OPS.has(expr.operator as string)) {
132
+ collectLHSRoots(expr.left, writeTargets);
133
+ }
134
+ // Handle ++, --, and delete — all work on any lvalue (arr[i]++, delete s.field, etc.)
135
+ if (
136
+ expr?.type === "UnaryOperation" &&
137
+ (expr.operator === "++" || expr.operator === "--" || expr.operator === "delete")
138
+ ) {
139
+ collectLHSRoots(expr.subExpression, writeTargets);
140
+ }
141
+ },
142
+ });
143
+
144
+ // Collect calls and state-var identifier accesses
145
+ visit(funcNode.body, {
146
+ FunctionCall: (node: any) => {
147
+ const expr = node.expression;
148
+ if (expr?.type === "Identifier") {
149
+ internalCalls.add(expr.name as string);
150
+ } else if (expr?.type === "MemberAccess") {
151
+ const base = expr.expression;
152
+ if (base?.type === "Identifier" && (base.name === "this" || base.name === "super")) {
153
+ internalCalls.add(expr.memberName as string);
154
+ } else if (base?.type === "Identifier" && BUILTIN_NAMESPACES.has(base.name as string)) {
155
+ // abi.encode, block.xxx, msg.xxx, etc. — not external calls
156
+ } else {
157
+ const baseStr = base?.type === "Identifier" ? (base.name as string) : "<expr>";
158
+ externalCalls.add(`${baseStr}.${expr.memberName as string}`);
159
+ }
160
+ }
161
+ },
162
+ Identifier: (node: any) => {
163
+ if (effectiveStateVars.has(node.name as string)) {
164
+ allStateAccesses.add(node.name as string);
165
+ }
166
+ },
167
+ });
168
+
169
+ const stateWrites = [...allStateAccesses].filter((v) => writeTargets.has(v));
170
+ // A var can be in both — e.g. x = x + 1 is both a read and a write.
171
+ const stateReads = [...allStateAccesses];
172
+
173
+ return {
174
+ internalCalls: [...internalCalls],
175
+ externalCalls: [...externalCalls],
176
+ stateReads,
177
+ stateWrites,
178
+ };
179
+ };
180
+
181
+ const hasCycle = (start: string, current: string, callMap: Map<string, string[]>, visited: Set<string>) => {
182
+ for (const callee of callMap.get(current) ?? []) {
183
+ if (callee === start) return true;
184
+ if (!visited.has(callee)) {
185
+ visited.add(callee);
186
+ if (hasCycle(start, callee, callMap, visited)) return true;
187
+ }
188
+ }
189
+
190
+ return false;
191
+ };
192
+
193
+ const fnLabel = (fn: FunctionDef) => {
194
+ if (fn.isConstructor) return "constructor";
195
+ if (fn.isReceive) return "receive";
196
+ if (fn.isFallback) return "fallback";
197
+ return fn.name;
198
+ };
199
+
200
+ const generateShortMarkdown = (imports: string[], contracts: ContractAnalysis[]) => {
201
+ const lines: string[] = [];
202
+ lines.push("# Solidity Analysis\n");
203
+
204
+ if (imports.length > 0) {
205
+ lines.push(`**Imports:** ${imports.map((i) => `\`${i}\``).join(", ")}\n`);
206
+ }
207
+
208
+ for (const contract of contracts) {
209
+ const inheritance =
210
+ contract.baseContracts.length > 0 ? ` : ${contract.baseContracts.map((b) => `\`${b}\``).join(", ")}` : "";
211
+ lines.push(`---\n\n## \`${contract.name}\` (${contract.kind})${inheritance}\n`);
212
+
213
+ // State variables — one line, name:type
214
+ if (contract.stateVars.length > 0) {
215
+ const vars = contract.stateVars.map((v) => {
216
+ const flags = [v.constant && "constant", v.immutable && "immutable"].filter(Boolean);
217
+ const suffix = flags.length > 0 ? `, ${flags.join(", ")}` : "";
218
+ return `\`${v.name}: ${v.type}\` (${v.visibility}${suffix})`;
219
+ });
220
+ lines.push(`**State:** ${vars.join(", ")}\n`);
221
+ }
222
+
223
+ // Modifiers — names only
224
+ if (contract.modifiers.length > 0) {
225
+ const mods = contract.modifiers.map(
226
+ (m) => `\`${m.name}${m.params.length > 0 ? `(${m.params.join(", ")})` : ""}\``,
227
+ );
228
+ lines.push(`**Modifiers:** ${mods.join(", ")}\n`);
229
+ }
230
+
231
+ // Events — name + params, one line each
232
+ if (contract.events.length > 0) {
233
+ const evts = contract.events.map((e) => `\`${e.name}(${e.params.join(", ")})\``);
234
+ lines.push(`**Events:** ${evts.join(", ")}\n`);
235
+ }
236
+
237
+ // Function list — compact, one line per function
238
+ if (contract.functions.length > 0) {
239
+ lines.push("**Functions:**");
240
+ for (const fn of contract.functions) {
241
+ const label = fnLabel(fn);
242
+ const params = fn.params.join(", ");
243
+ const ret = fn.returns.length > 0 ? ` → ${fn.returns.join(", ")}` : "";
244
+ const mods = fn.modifiers.length > 0 ? ` [${fn.modifiers.join(", ")}]` : "";
245
+ lines.push(`- \`${label}(${params})${ret}\` — ${fn.visibility} ${fn.mutability}${mods}`);
246
+ }
247
+ lines.push("");
248
+ }
249
+
250
+ // External calls — only functions that make them
251
+ const externalFuncs = contract.functions.filter((f) => f.externalCalls.length > 0);
252
+ if (externalFuncs.length > 0) {
253
+ lines.push("**External Calls:**");
254
+ for (const fn of externalFuncs) {
255
+ lines.push(`- \`${fnLabel(fn)}\`: ${fn.externalCalls.map((c) => `\`${c}\``).join(", ")}`);
256
+ }
257
+ lines.push("");
258
+ }
259
+ }
260
+
261
+ return lines.join("\n");
262
+ };
263
+
264
+ const generateMarkdown = (imports: string[], contracts: ContractAnalysis[]) => {
265
+ const lines: string[] = [];
266
+ lines.push("# Solidity Contract Analysis\n");
267
+
268
+ // Imports
269
+ lines.push("## Imports\n");
270
+ if (imports.length === 0) {
271
+ lines.push("_No imports._\n");
272
+ } else {
273
+ for (const imp of imports) lines.push(`- \`${imp}\``);
274
+ lines.push("");
275
+ }
276
+
277
+ for (const contract of contracts) {
278
+ const kindLabel = contract.kind.charAt(0).toUpperCase() + contract.kind.slice(1);
279
+ lines.push(`---\n\n## ${kindLabel}: \`${contract.name}\`\n`);
280
+
281
+ // Inheritance
282
+ lines.push("### Inheritance\n");
283
+ if (contract.baseContracts.length === 0) {
284
+ lines.push("_None._\n");
285
+ } else {
286
+ for (const base of contract.baseContracts) lines.push(`- \`${base}\``);
287
+ lines.push("");
288
+ }
289
+
290
+ // Using For
291
+ if (contract.usingFor.length > 0) {
292
+ lines.push("### Using For\n");
293
+ for (const u of contract.usingFor) lines.push(`- ${u}`);
294
+ lines.push("");
295
+ }
296
+
297
+ // Storage layout
298
+ lines.push("### Storage Layout (State Variables)\n");
299
+ if (contract.stateVars.length === 0) {
300
+ lines.push("_No state variables._\n");
301
+ } else {
302
+ lines.push("| Slot | Name | Type | Visibility | Flags |");
303
+ lines.push("|------|------|------|------------|-------|");
304
+ contract.stateVars.forEach((v, i) => {
305
+ const flags = [v.constant && "constant", v.immutable && "immutable"].filter(Boolean).join(", ");
306
+ lines.push(`| ${i} | \`${v.name}\` | \`${v.type}\` | ${v.visibility} | ${flags} |`);
307
+ });
308
+ lines.push("");
309
+ }
310
+
311
+ // Events
312
+ lines.push("### Events\n");
313
+ if (contract.events.length === 0) {
314
+ lines.push("_No events._\n");
315
+ } else {
316
+ for (const evt of contract.events) {
317
+ const params = evt.params.join(", ");
318
+ lines.push(`- **\`${evt.name}\`**\`(${params})\`${evt.anonymous ? " _(anonymous)_" : ""}`);
319
+ }
320
+ lines.push("");
321
+ }
322
+
323
+ // Modifiers
324
+ lines.push("### Modifiers\n");
325
+ if (contract.modifiers.length === 0) {
326
+ lines.push("_No modifiers._\n");
327
+ } else {
328
+ for (const mod of contract.modifiers) {
329
+ lines.push(`- **\`${mod.name}\`**\`(${mod.params.join(", ")})\``);
330
+ }
331
+ lines.push("");
332
+ }
333
+
334
+ // Function list
335
+ lines.push("### Function List\n");
336
+ if (contract.functions.length === 0) {
337
+ lines.push("_No functions._\n");
338
+ } else {
339
+ lines.push("| Name | Visibility | Mutability | Parameters | Returns | Modifiers |");
340
+ lines.push("|------|------------|------------|------------|---------|-----------|");
341
+ for (const fn of contract.functions) {
342
+ lines.push(
343
+ `| \`${fnLabel(fn)}\` | ${fn.visibility} | ${fn.mutability} | \`${fn.params.join(", ")}\` | \`${fn.returns.join(", ")}\` | ${fn.modifiers.join(", ")} |`,
344
+ );
345
+ }
346
+ lines.push("");
347
+ }
348
+
349
+ // Call graph
350
+ lines.push("### Call Graph\n");
351
+ const hasCalls = contract.functions.some((f) => f.internalCalls.length > 0 || f.externalCalls.length > 0);
352
+ if (!hasCalls) {
353
+ lines.push("_No function calls detected._\n");
354
+ } else {
355
+ for (const fn of contract.functions) {
356
+ if (fn.internalCalls.length === 0 && fn.externalCalls.length === 0) continue;
357
+ lines.push(`**\`${fnLabel(fn)}\`**`);
358
+ for (const call of fn.internalCalls) lines.push(` - → \`${call}\` _(internal)_`);
359
+ for (const call of fn.externalCalls) lines.push(` - → \`${call}\` _(external)_`);
360
+ }
361
+ lines.push("");
362
+ }
363
+
364
+ // External calls
365
+ lines.push("### External Calls\n");
366
+ const externalFuncs = contract.functions.filter((f) => f.externalCalls.length > 0);
367
+ if (externalFuncs.length === 0) {
368
+ lines.push("_No external calls detected._\n");
369
+ } else {
370
+ for (const fn of externalFuncs) {
371
+ lines.push(`**\`${fnLabel(fn)}\`**`);
372
+ for (const call of fn.externalCalls) lines.push(` - \`${call}\``);
373
+ }
374
+ lines.push("");
375
+ }
376
+
377
+ // Internal recursion
378
+ lines.push("### Internal Recursion\n");
379
+ const callMap = new Map(contract.functions.map((f) => [fnLabel(f), f.internalCalls]));
380
+ const recursiveFns = contract.functions.filter((fn) => hasCycle(fnLabel(fn), fnLabel(fn), callMap, new Set()));
381
+ if (recursiveFns.length === 0) {
382
+ lines.push("_No recursive functions detected._\n");
383
+ } else {
384
+ for (const fn of recursiveFns) lines.push(`- **\`${fnLabel(fn)}\`** is recursive`);
385
+ lines.push("");
386
+ }
387
+
388
+ // State variable touchpoints
389
+ lines.push("### State Variable Touchpoints\n");
390
+ const touchedFns = contract.functions.filter((f) => f.stateReads.length > 0 || f.stateWrites.length > 0);
391
+ if (touchedFns.length === 0) {
392
+ lines.push("_No state variable accesses detected._\n");
393
+ } else {
394
+ lines.push("| Function | Reads | Writes |");
395
+ lines.push("|----------|-------|--------|");
396
+ for (const fn of touchedFns) {
397
+ const reads = fn.stateReads.map((r) => `\`${r}\``).join(", ");
398
+ const writes = fn.stateWrites.map((w) => `\`${w}\``).join(", ");
399
+ lines.push(`| \`${fnLabel(fn)}\` | ${reads} | ${writes} |`);
400
+ }
401
+ lines.push("");
402
+ }
403
+ }
404
+
405
+ // External dependencies summary
406
+ lines.push("---\n\n## External Dependencies\n");
407
+
408
+ lines.push("### Import Paths\n");
409
+ if (imports.length === 0) {
410
+ lines.push("_No imports._\n");
411
+ } else {
412
+ for (const imp of imports) lines.push(`- \`${imp}\``);
413
+ lines.push("");
414
+ }
415
+
416
+ const externalTargets = new Set<string>();
417
+ for (const contract of contracts) {
418
+ for (const fn of contract.functions) {
419
+ for (const call of fn.externalCalls) {
420
+ const target = call.split(".")[0];
421
+ if (target && target !== "<expr>") externalTargets.add(target);
422
+ }
423
+ }
424
+ }
425
+
426
+ lines.push("### External Contract Interactions\n");
427
+ if (externalTargets.size === 0) {
428
+ lines.push("_No external contract interactions detected._\n");
429
+ } else {
430
+ for (const dep of externalTargets) lines.push(`- \`${dep}\``);
431
+ lines.push("");
432
+ }
433
+
434
+ return lines.join("\n");
435
+ };
436
+
437
+ export const analyzeSolidityFile = async (soliditySource: string, mode: "full" | "short") => {
438
+ let ast: any;
439
+
440
+ try {
441
+ ast = parse(soliditySource, { tolerant: true, loc: true, range: true });
442
+ } catch (e: any) {
443
+ return `# Parse Error\n\nFailed to parse Solidity source: ${e.message as string}`;
444
+ }
445
+
446
+ const imports: string[] = [];
447
+ const contracts: ContractAnalysis[] = [];
448
+
449
+ for (const node of ast.children ?? []) {
450
+ if (node.type === "ImportDirective") {
451
+ imports.push(node.path as string);
452
+ }
453
+ }
454
+
455
+ for (const node of ast.children ?? []) {
456
+ if (node.type !== "ContractDefinition") continue;
457
+
458
+ const contract: ContractAnalysis = {
459
+ name: node.name as string,
460
+ kind: (node.kind as string) ?? "contract",
461
+ baseContracts: (node.baseContracts ?? []).map(
462
+ (bc: any) => (bc.baseName?.namePath ?? bc.baseName?.name ?? "?") as string,
463
+ ),
464
+ usingFor: [],
465
+ stateVars: [],
466
+ events: [],
467
+ modifiers: [],
468
+ functions: [],
469
+ };
470
+
471
+ const stateVarNames = new Set<string>();
472
+
473
+ for (const member of node.subNodes ?? []) {
474
+ switch (member.type) {
475
+ case "StateVariableDeclaration":
476
+ for (const v of member.variables ?? []) {
477
+ stateVarNames.add(v.name as string);
478
+ contract.stateVars.push({
479
+ name: v.name as string,
480
+ type: typeToString(v.typeName),
481
+ visibility: (v.visibility as string) ?? "internal",
482
+ constant: (v.isDeclaredConst as boolean) ?? false,
483
+ immutable: (v.isImmutable as boolean) ?? false,
484
+ });
485
+ }
486
+ break;
487
+
488
+ case "EventDefinition": {
489
+ const params = (member.parameters ?? []).map((p: any) => {
490
+ const indexed = p.isIndexed ? "indexed " : "";
491
+ const name = p.name ? ` ${p.name as string}` : "";
492
+ return `${indexed}${typeToString(p.typeName)}${name}`;
493
+ });
494
+ contract.events.push({
495
+ name: member.name as string,
496
+ params,
497
+ anonymous: (member.isAnonymous as boolean) ?? false,
498
+ });
499
+ break;
500
+ }
501
+
502
+ case "ModifierDefinition":
503
+ contract.modifiers.push({
504
+ name: member.name as string,
505
+ params: (member.parameters ?? []).map(paramToString),
506
+ });
507
+ break;
508
+
509
+ case "FunctionDefinition": {
510
+ const { internalCalls, externalCalls, stateReads, stateWrites } = analyzeFunction(member, stateVarNames);
511
+ contract.functions.push({
512
+ name: (member.name as string) ?? "",
513
+ isConstructor: (member.isConstructor as boolean) ?? false,
514
+ isReceive: (member.isReceiveEther as boolean) ?? false,
515
+ isFallback: (member.isFallback as boolean) ?? false,
516
+ visibility: (member.visibility as string) ?? "internal",
517
+ mutability: (member.stateMutability as string) ?? "nonpayable",
518
+ params: (member.parameters ?? []).map(paramToString),
519
+ returns: (member.returnParameters ?? []).map(paramToString),
520
+ modifiers: (member.modifiers ?? []).map((m: any) => m.name as string),
521
+ internalCalls,
522
+ externalCalls,
523
+ stateReads,
524
+ stateWrites,
525
+ });
526
+ break;
527
+ }
528
+
529
+ case "UsingForDeclaration": {
530
+ const forType = member.typeName ? typeToString(member.typeName) : "*";
531
+ if (member.libraryName) {
532
+ contract.usingFor.push(`\`${member.libraryName as string}\` for \`${forType}\``);
533
+ } else {
534
+ // New-style: using {fn1, fn2, ...} for T
535
+ const fns = (member.functions ?? [])
536
+ .map((f: any) => (f.typeName?.namePath ?? f.typeName?.name ?? f.path ?? "?") as string)
537
+ .join(", ");
538
+ contract.usingFor.push(`{${fns}} for \`${forType}\``);
539
+ }
540
+ break;
541
+ }
542
+ }
543
+ }
544
+
545
+ contracts.push(contract);
546
+ }
547
+
548
+ return mode === "short" ? generateShortMarkdown(imports, contracts) : generateMarkdown(imports, contracts);
549
+ };
550
+
551
+ export const solidityAnalyzerTool = tool(
552
+ async ({ solidityFile, mode }) => {
553
+ return analyzeSolidityFile(solidityFile, mode);
554
+ },
555
+ {
556
+ name: "solidity_analyzer",
557
+ description:
558
+ "Parse a Solidity source file and generate a markdown report. Use mode='short' for a compact token-efficient summary (imports, state, modifiers, events, function signatures, external calls). Use mode='full' for the complete report including storage layout table, call graph, recursion detection, state variable touchpoints, and external dependencies.",
559
+ schema: z.object({
560
+ solidityFile: z.string().describe("The full Solidity source code to analyze."),
561
+ mode: z
562
+ .enum(["full", "short"])
563
+ .default("full")
564
+ .describe("Report verbosity. 'short' saves tokens; 'full' provides the complete analysis."),
565
+ }),
566
+ },
567
+ );
src/agents/auditor/utils.ts ADDED
@@ -0,0 +1,36 @@
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
+ export const matchLines = (fileContent: string, codeSnippet: string): string | null => {
2
+ const fileLines = fileContent.split("\n");
3
+ const snippetLines = codeSnippet.split("\n").map((line) => line.trim());
4
+
5
+ for (let i = 0; i < fileLines.length; i++) {
6
+ const fileLine = fileLines[i].trim();
7
+
8
+ if (fileLine === snippetLines[0]) {
9
+ let snippetIndex = 1;
10
+ const startLine = i + 1;
11
+ let endLine = i + 1;
12
+ let fileIndex = i + 1;
13
+
14
+ while (snippetIndex < snippetLines.length && fileIndex < fileLines.length) {
15
+ const currentFileLine = fileLines[fileIndex].trim();
16
+
17
+ if (currentFileLine === snippetLines[snippetIndex]) {
18
+ endLine = fileIndex + 1;
19
+ snippetIndex++;
20
+ }
21
+
22
+ fileIndex++;
23
+ }
24
+
25
+ if (snippetIndex === snippetLines.length) {
26
+ if (startLine === endLine) {
27
+ return `L${startLine}`;
28
+ }
29
+
30
+ return `L${startLine}-${endLine}`;
31
+ }
32
+ }
33
+ }
34
+
35
+ return null;
36
+ };
src/agents/coder/agent.ts CHANGED
@@ -1,20 +1,117 @@
1
  import { END, type GraphNode, START, StateGraph } from "@langchain/langgraph";
2
 
3
  import { CoderState } from "./state.ts";
 
 
 
4
 
5
- const PLACEHOLDER_CONTRACT = `// SPDX-License-Identifier: MIT
6
- pragma solidity ^0.8.0;
7
 
8
- contract Placeholder {
9
- // TODO: implement contract based on requirements
10
- }`;
 
 
 
 
 
 
11
 
12
- const generateContract: GraphNode<typeof CoderState> = async (_state) => {
13
- return { contract: PLACEHOLDER_CONTRACT };
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
14
  };
15
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
16
  export const coderAgent = new StateGraph(CoderState)
17
  .addNode("generateContract", generateContract)
 
 
 
18
  .addEdge(START, "generateContract")
19
- .addEdge("generateContract", END)
 
 
 
20
  .compile();
 
1
  import { END, type GraphNode, START, StateGraph } from "@langchain/langgraph";
2
 
3
  import { CoderState } from "./state.ts";
4
+ import { solidityCoderPrompt, solidityFixPrompt, solidityReviewPrompt } from "./prompts.ts";
5
+ import { compileSolidityTool } from "./tools/compile-solidity.ts";
6
+ import { createLLM } from "../../config/llm.ts";
7
 
8
+ const MAX_FIX_ATTEMPTS = 3;
 
9
 
10
+ /**
11
+ * Extrai apenas o bloco de código Solidity de uma resposta do LLM.
12
+ */
13
+ function extractSolidityCode(text: string): string {
14
+ const match = text.match(/```(?:solidity)?\s*\n([\s\S]*?)```/);
15
+ if (match) return match[1].trim();
16
+ // Se não tem bloco de código, assume que a resposta inteira é código
17
+ return text.trim();
18
+ }
19
 
20
+ /**
21
+ * Nó 1: Gera o smart contract a partir dos requisitos.
22
+ */
23
+ const generateContract: GraphNode<typeof CoderState> = async (state) => {
24
+ const llm = createLLM();
25
+ const chain = solidityCoderPrompt.pipe(llm);
26
+
27
+ const requirementsText = state.requirements
28
+ .map((r, i) => `${i + 1}. ${r}`)
29
+ .join("\n");
30
+
31
+ const result = await chain.invoke({ requirements: requirementsText });
32
+ const code = extractSolidityCode(
33
+ typeof result.content === "string" ? result.content : JSON.stringify(result.content),
34
+ );
35
+
36
+ return { contract: code, compilationErrors: [] };
37
+ };
38
+
39
+ /**
40
+ * Nó 2: Compila o contrato e armazena erros (se houver).
41
+ */
42
+ const compileContract: GraphNode<typeof CoderState> = async (state) => {
43
+ const result = await compileSolidityTool.invoke({
44
+ sourceCode: state.contract,
45
+ filename: "Contract.sol",
46
+ });
47
+
48
+ return { compilationErrors: result.errors };
49
+ };
50
+
51
+ /**
52
+ * Nó 3: Corrige o contrato com base nos erros de compilação.
53
+ */
54
+ const fixContract: GraphNode<typeof CoderState> = async (state) => {
55
+ const llm = createLLM();
56
+ const chain = solidityFixPrompt.pipe(llm);
57
+
58
+ const errorsText = state.compilationErrors.join("\n\n");
59
+
60
+ const result = await chain.invoke({
61
+ contract: state.contract,
62
+ errors: errorsText,
63
+ });
64
+
65
+ const code = extractSolidityCode(
66
+ typeof result.content === "string" ? result.content : JSON.stringify(result.content),
67
+ );
68
+
69
+ return { contract: code, compilationErrors: [] };
70
+ };
71
+
72
+ /**
73
+ * Nó 4: Revisa o contrato compilado quanto a segurança e boas práticas.
74
+ */
75
+ const reviewContract: GraphNode<typeof CoderState> = async (state) => {
76
+ const llm = createLLM();
77
+ const chain = solidityReviewPrompt.pipe(llm);
78
+
79
+ const requirementsText = state.requirements.join(", ");
80
+
81
+ const result = await chain.invoke({
82
+ requirements: requirementsText,
83
+ contract: state.contract,
84
+ });
85
+
86
+ const summary =
87
+ typeof result.content === "string" ? result.content : JSON.stringify(result.content);
88
+
89
+ return { reviewSummary: summary };
90
  };
91
 
92
+ /**
93
+ * Roteador: decide se precisa corrigir ou se pode seguir para revisão.
94
+ * Controla o número de tentativas de correção.
95
+ */
96
+ let fixAttempts = 0;
97
+
98
+ function shouldFix(state: { compilationErrors: string[] }): "fixContract" | "reviewContract" {
99
+ if (state.compilationErrors.length > 0 && fixAttempts < MAX_FIX_ATTEMPTS) {
100
+ fixAttempts++;
101
+ return "fixContract";
102
+ }
103
+ fixAttempts = 0; // reset para próxima execução
104
+ return "reviewContract";
105
+ }
106
+
107
  export const coderAgent = new StateGraph(CoderState)
108
  .addNode("generateContract", generateContract)
109
+ .addNode("compileContract", compileContract)
110
+ .addNode("fixContract", fixContract)
111
+ .addNode("reviewContract", reviewContract)
112
  .addEdge(START, "generateContract")
113
+ .addEdge("generateContract", "compileContract")
114
+ .addConditionalEdges("compileContract", shouldFix)
115
+ .addEdge("fixContract", "compileContract")
116
+ .addEdge("reviewContract", END)
117
  .compile();
src/agents/coder/outputs/.gitkeep ADDED
File without changes
src/agents/coder/prompts.ts ADDED
@@ -0,0 +1,96 @@
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
+ import { ChatPromptTemplate } from "@langchain/core/prompts";
2
+
3
+ /**
4
+ * Prompt para gerar smart contracts Solidity a partir de requisitos.
5
+ */
6
+ export const solidityCoderPrompt = ChatPromptTemplate.fromMessages([
7
+ [
8
+ "system",
9
+ `Você é um desenvolvedor sênior especialista em smart contracts Solidity.
10
+ Sua função é gerar contratos Solidity completos, compiláveis e seguros.
11
+
12
+ Regras:
13
+ - Gere código Solidity production-ready
14
+ - Use pragma solidity ^0.8.20
15
+ - NÃO use imports externos (OpenZeppelin, etc.) — implemente tudo inline
16
+ - Adicione comentários NatDoc explicativos
17
+ - Inclua eventos para todas as operações relevantes
18
+ - Use modificadores de acesso customizados (ex: onlyOwner)
19
+ - Inclua tratamento de erros com require e mensagens claras
20
+ - Siga boas práticas de segurança (checks-effects-interactions, proteção contra reentrância)
21
+ - NÃO use placeholders como "TODO" ou "implementar depois"
22
+ - O contrato deve compilar sem erros com solc 0.8.20+`,
23
+ ],
24
+ [
25
+ "human",
26
+ `Gere um smart contract Solidity completo com base nos seguintes requisitos:
27
+
28
+ {requirements}
29
+
30
+ Retorne APENAS o código Solidity completo, sem explicações adicionais.
31
+ O código deve ser auto-contido (sem imports externos).`,
32
+ ],
33
+ ]);
34
+
35
+ /**
36
+ * Prompt para corrigir erros de compilação em contratos Solidity.
37
+ */
38
+ export const solidityFixPrompt = ChatPromptTemplate.fromMessages([
39
+ [
40
+ "system",
41
+ `Você é um desenvolvedor sênior especialista em smart contracts Solidity.
42
+ Sua função é corrigir erros de compilação em contratos Solidity.
43
+
44
+ Regras:
45
+ - Corrija TODOS os erros indicados
46
+ - Mantenha a lógica de negócio original intacta
47
+ - NÃO adicione imports externos
48
+ - O contrato deve compilar sem erros com solc 0.8.20+
49
+ - Retorne APENAS o código Solidity corrigido completo`,
50
+ ],
51
+ [
52
+ "human",
53
+ `O seguinte contrato Solidity tem erros de compilação. Corrija-os:
54
+
55
+ **Código atual:**
56
+ \`\`\`solidity
57
+ {contract}
58
+ \`\`\`
59
+
60
+ **Erros de compilação:**
61
+ {errors}
62
+
63
+ Retorne APENAS o código Solidity corrigido completo, sem explicações.`,
64
+ ],
65
+ ]);
66
+
67
+ /**
68
+ * Prompt para revisar contratos Solidity quanto a segurança e boas práticas.
69
+ */
70
+ export const solidityReviewPrompt = ChatPromptTemplate.fromMessages([
71
+ [
72
+ "system",
73
+ `Você é um auditor de segurança sênior especialista em smart contracts Solidity.
74
+ Analise o contrato quanto a:
75
+ - Vulnerabilidades de segurança (reentrância, overflow, acesso não autorizado)
76
+ - Aderência a boas práticas Solidity
77
+ - Legibilidade e manutenibilidade
78
+ - Potenciais problemas de gas
79
+
80
+ Seja objetivo e conciso. Responda em português brasileiro.`,
81
+ ],
82
+ [
83
+ "human",
84
+ `Revise o seguinte smart contract:
85
+
86
+ **Requisitos originais:**
87
+ {requirements}
88
+
89
+ **Código:**
90
+ \`\`\`solidity
91
+ {contract}
92
+ \`\`\`
93
+
94
+ Forneça um resumo breve da revisão em 2-3 frases destacando se o contrato está seguro e funcional.`,
95
+ ],
96
+ ]);
src/agents/coder/run.ts ADDED
@@ -0,0 +1,33 @@
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
+ import "dotenv/config";
2
+ import { readFileSync, mkdirSync, writeFileSync } from "node:fs";
3
+ import { resolve, dirname } from "node:path";
4
+ import { fileURLToPath } from "node:url";
5
+ import { coderAgent } from "./agent.ts";
6
+
7
+ const inputPath = process.argv[2];
8
+
9
+ if (!inputPath) {
10
+ console.log("Uso: npx tsx src/agents/coder/run.ts <caminho-do-arquivo-de-requisitos>");
11
+ console.log("Exemplo: npx tsx src/agents/coder/run.ts input/requirements.md");
12
+ process.exit(1);
13
+ }
14
+
15
+ const requirementsText = readFileSync(resolve(inputPath), "utf-8");
16
+ console.log("Requisitos carregados de:", inputPath);
17
+ console.log("Gerando contrato...\n");
18
+
19
+ const result = await coderAgent.invoke({ requirements: [requirementsText] });
20
+
21
+ console.log("======= Contrato Gerado =======");
22
+ console.log(result.contract);
23
+ console.log("\n======= Erros de Compilação =======");
24
+ console.log(result.compilationErrors.length === 0 ? "Nenhum erro" : result.compilationErrors.join("\n"));
25
+ console.log("\n======= Revisão de Segurança =======");
26
+ console.log(result.reviewSummary);
27
+
28
+ const __dirname = dirname(fileURLToPath(import.meta.url));
29
+ const outputDir = resolve(__dirname, "outputs");
30
+ mkdirSync(outputDir, { recursive: true });
31
+ const outputPath = resolve(outputDir, "Contract.sol");
32
+ writeFileSync(outputPath, result.contract, "utf-8");
33
+ console.log("\nContrato salvo em:", outputPath);
src/agents/coder/state.ts CHANGED
@@ -4,4 +4,6 @@ import { z } from "zod";
4
  export const CoderState = new StateSchema({
5
  requirements: z.array(z.string()).default([]),
6
  contract: z.string().default(""),
 
 
7
  });
 
4
  export const CoderState = new StateSchema({
5
  requirements: z.array(z.string()).default([]),
6
  contract: z.string().default(""),
7
+ compilationErrors: z.array(z.string()).default([]),
8
+ reviewSummary: z.string().default(""),
9
  });
src/agents/coder/tools/compile-solidity.ts ADDED
@@ -0,0 +1,50 @@
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
+ import { tool } from "langchain";
2
+ import { z } from "zod";
3
+ import solc from "solc";
4
+
5
+ /**
6
+ * Tool que compila código Solidity usando solc e retorna erros/warnings.
7
+ */
8
+ export const compileSolidityTool = tool(
9
+ async (input) => {
10
+ const compilerInput = {
11
+ language: "Solidity",
12
+ sources: {
13
+ [input.filename]: { content: input.sourceCode },
14
+ },
15
+ settings: {
16
+ outputSelection: {
17
+ "*": { "*": ["abi", "evm.bytecode.object"] },
18
+ },
19
+ },
20
+ };
21
+
22
+ const output = JSON.parse(solc.compile(JSON.stringify(compilerInput)));
23
+
24
+ const errors = (output.errors || [])
25
+ .filter((e: { severity: string }) => e.severity === "error")
26
+ .map((e: { formattedMessage: string }) => e.formattedMessage);
27
+
28
+ const warnings = (output.errors || [])
29
+ .filter((e: { severity: string }) => e.severity === "warning")
30
+ .map((e: { formattedMessage: string }) => e.formattedMessage);
31
+
32
+ const contracts = output.contracts?.[input.filename] || {};
33
+ const contractNames = Object.keys(contracts);
34
+
35
+ return {
36
+ success: errors.length === 0,
37
+ errors,
38
+ warnings,
39
+ contracts: contractNames,
40
+ };
41
+ },
42
+ {
43
+ name: "compilar_solidity",
44
+ description: "Compila código Solidity com solc e retorna erros, warnings e contratos encontrados.",
45
+ schema: z.object({
46
+ sourceCode: z.string().describe("Código-fonte Solidity completo"),
47
+ filename: z.string().default("Contract.sol").describe("Nome do arquivo .sol"),
48
+ }),
49
+ },
50
+ );
src/agents/tester/Docs/01_ARCHITECTURE(1).md ADDED
@@ -0,0 +1,189 @@
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
+ # Agente Gerador de PoCs — Arquitetura e Fluxo de Dados
2
+
3
+ **Projeto:** TALP1 — CIn/UFPE
4
+ **Agente:** Agente Gerador de PoCs
5
+ **Responsável:** Tales Vinicius Alves da Cunha
6
+ **Stack:** TypeScript · Node.js · LangGraph · Foundry
7
+
8
+ ---
9
+
10
+ ## 1. Visão Geral
11
+
12
+ O Agente Gerador de PoCs recebe um relatório de vulnerabilidade estruturado (JSON) do Agente Auditor e produz automaticamente um exploit em Solidity verificado pelo Foundry. O agente executa um **loop ReAct**: gerar → executar → refletir → repetir, até que o exploit passe nos testes ou o limite de iterações seja atingido.
13
+
14
+ Diferente de abordagens de "mainnet fork", este agente foca em **simulação local controlada** (abordagem inspirada no PoCo — Bergman et al., KTH 2025), onde o ambiente é montado do zero para cada ataque.
15
+
16
+ > **Diferencial em relação ao PoCo:** o PoCo deixava o LLM escrever o `setUp()` do Foundry livremente, o que gerava erros frequentes de instanciação. Este agente introduz o **Oracle** como camada dedicada de preparação do ambiente, fornecendo um scaffold com deploy automático do contrato vítima — o LLM foca exclusivamente na lógica do exploit.
17
+
18
+ ---
19
+
20
+ ## 2. Posição no Sistema Multi-agente
21
+
22
+ ```
23
+ Requisitos (PDF/MD)
24
+ │
25
+ ▼
26
+ ┌─────────────────────┐
27
+ │ Agente Gerador │ ── Compiler, RAG
28
+ │ de Código │
29
+ └──────────┬──────────┘
30
+ │ Repositório Solidity
31
+ ▼
32
+ ┌─────────────────────┐
33
+ │ Agente Auditor │ ── Slither, AST
34
+ └──────────┬──────────┘
35
+ │ Relatório de Vulnerabilidades (JSON)
36
+ ▼
37
+ ┌─────────────────────┐
38
+ │ Agente Gerador │ ── Local Oracle, Foundry ◄─── você está aqui
39
+ │ de PoCs │
40
+ └──────────┬──────────┘
41
+ │ Exploit.t.sol (Projeto Solidity)
42
+ ▼
43
+ Projeto Final
44
+ ```
45
+
46
+ ---
47
+
48
+ ## 3. Arquitetura Interna do Agente
49
+
50
+ ### 3.1 Fluxo Principal (grafo LangGraph)
51
+
52
+ ```
53
+ ┌─────────────────────────────────┐
54
+ │ ESTADO DO AGENTE │
55
+ │ report · oracleContext · pocCode │
56
+ │ executionLogs · lastError │
57
+ │ iterations · status │
58
+ └─────────────────────────────────┘
59
+
60
+ Auditor Report (JSON)
61
+ │
62
+ ▼
63
+ ┌───────────────────┐
64
+ │ oracleNode │ ← Preparação do ambiente: gera o setup inicial local
65
+ └────────┬──────────┘
66
+ │ OracleContext (scaffold Solidity com deploy local da vítima)
67
+ ▼
68
+ ┌───────────────────┐ ┌──────────────────────┐
69
+ │ generatePoCNode │ ◄───────│ reflectNode │
70
+ │ (LLM + prompts) │ │ (análise de logs) │
71
+ └────────┬──────────┘ └──────────▲────────────┘
72
+ │ Solidity code │ feedback estruturado
73
+ ▼ │ (categoria de erro + resumo)
74
+ ┌───────────────────┐ FAIL / ERROR │
75
+ │ runFoundryNode │────────────────────┘
76
+ │ (forge test -vvvv)│
77
+ └────────┬──────────┘
78
+ │
79
+ ┌────┴────┐
80
+ PASS FAIL (≥5 iterações ou timeout)
81
+ │ │
82
+ ▼ ▼
83
+ END END
84
+ (success) (failed)
85
+ ```
86
+
87
+ ---
88
+
89
+ ## 4. O Oracle — O Que É e Por Que Existe
90
+
91
+ ### 4.1 Contexto
92
+
93
+ No contexto deste agente, o Oracle é um **gerador de ambiente de teste**. Ao invés de buscar dados na blockchain real, ele prepara um "sandbox" local onde o contrato vulnerável é implantado e financiado automaticamente.
94
+
95
+ ### 4.2 Problema que o Oracle resolve
96
+
97
+ O LLM muitas vezes tem dificuldade em escrever a função `setUp()` do Foundry porque não sabe como instanciar o contrato vítima ou dar saldo ao atacante. O Oracle resolve isso fornecendo um **scaffold (template)** pronto, permitindo que o LLM foque exclusivamente na lógica do exploit.
98
+
99
+ ### 4.3 Os 2 sub-tools do Oracle
100
+
101
+ ```
102
+ oracleNode
103
+ │
104
+ ├── 1. stateInitializer → Define saldos e condições iniciais (ex: 100 ETH para a vítima)
105
+ │
106
+ └── 2. scaffoldGenerator → Gera o Exploit.t.sol com o deploy do contrato e setUp() pronto
107
+ Retorna: string (código Solidity parcial)
108
+ ```
109
+
110
+ ---
111
+
112
+ ## 5. Fluxo de Dados Completo (entrada → saída)
113
+
114
+ ### 5.1 Input: VulnerabilityReport (do Agente Auditor)
115
+
116
+ ```typescript
117
+ interface VulnerabilityReport {
118
+ id: string;
119
+ severity: "critical" | "high" | "medium" | "low";
120
+ type: string;
121
+ title: string;
122
+ description: string;
123
+ affectedContract: {
124
+ name: string;
125
+ sourceCode: string; // código Solidity completo (preferencialmente flattened)
126
+ };
127
+ attackVector: string;
128
+ suggestedCheatcodes?: string[];
129
+ }
130
+ ```
131
+
132
+ ### 5.2 Output: PoCResult
133
+
134
+ ```typescript
135
+ interface PoCResult {
136
+ reportId: string;
137
+ status: "success" | "failed" | "timeout";
138
+ solidityCode: string; // conteúdo final do Exploit.t.sol
139
+ executionLogs: string[];
140
+ iterations: number;
141
+ }
142
+ ```
143
+
144
+ ---
145
+
146
+ ## 6. Estrutura de Arquivos
147
+
148
+ ```
149
+ src/agents/poc-generator/
150
+ ├── agent.ts # grafo LangGraph, nodes, roteamento
151
+ ├── state.ts # PoCStateAnnotation
152
+ │
153
+ ├── tools/
154
+ │ ├── scaffoldGenerator.ts # Oracle sub-tool (gera template local)
155
+ │ └── foundryRunner.ts # executa forge test via child_process
156
+ │
157
+ ├── prompts/
158
+ │ └── system.ts # system prompt do LLM gerador
159
+ │
160
+ └── utils/
161
+ ├── extractSolidity.ts # parser do output do LLM
162
+ └── logAnalyzer.ts # classifica erros do forge
163
+ ```
164
+
165
+ ---
166
+
167
+ ## 7. Variáveis de Ambiente
168
+
169
+ ```env
170
+ OPENROUTER_API_KEY=... # chave do LLM
171
+ ```
172
+
173
+ ---
174
+
175
+ ## 8. Riscos e Mitigações
176
+
177
+ | Risco | Mitigação |
178
+ |-------|-----------|
179
+ | LLM reescreve o scaffold ao invés de completar | System prompt proíbe explicitamente modificar `setUp()`; validação pós-extração |
180
+ | Contrato vítima tem muitas dependências | Auditor deve fornecer código "flattened"; Oracle lida com imports locais no sandbox |
181
+ | LLM não gera bloco Solidity válido | `extractSolidity` lança erro; `generatePoCNode` captura e retenta |
182
+ | Timeout no Foundry | Limite de 60s por execução; análise de loops infinitos no `logAnalyzer` |
183
+
184
+ ---
185
+
186
+ ## 9. Base Acadêmica
187
+
188
+ - **PoCo** (Bergman et al., KTH 2025) — framework agêntico para geração de PoC exploits em smart contracts. Artefatos: `ASSERT-KTH/PoCo-public`
189
+ - **Proof-of-Patch** (ASSERT-KTH) — dataset de 23 vulnerabilidades reais (2022–2025) com patches correspondentes, usado como benchmark de avaliação
src/agents/tester/Docs/02_ROADMAP(1).md ADDED
@@ -0,0 +1,72 @@
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
+ # Agente Gerador de PoCs — Plano de Implementação (Roadmap)
2
+
3
+ **Projeto:** TALP1 — CIn/UFPE
4
+ **Agente:** Agente Gerador de PoCs
5
+ **Responsável:** Tales Vinicius Alves da Cunha
6
+
7
+ ---
8
+
9
+ ## Visão Geral das Fases
10
+
11
+ | Fase | Tema | Semana | Critério de Conclusão |
12
+ |------|------|--------|----------------------|
13
+ | 1 | Setup, Estado & Oracle | Semana 1 | Grafo linear roda com stubs; `oracleNode` gera scaffold que compila com `forge build` |
14
+ | 2 | LLM + Foundry + Loop ReAct | Semana 2 | Pipeline completo roda: LLM gera → Foundry executa → loop corrige ao menos 1 erro |
15
+ | 3 | Integração, Smoke Test & Avaliação | Semana 3 | PoC de reentrancy passa end-to-end; taxa de sucesso medida em ≥5 casos do benchmark |
16
+
17
+ ---
18
+
19
+ ## Semana 1 — Setup, Estado & Oracle
20
+
21
+ **Objetivo:** Ter o grafo LangGraph rodando com o Oracle funcional.
22
+
23
+ ### Tasks
24
+ - **Task 1.1** — Inicializar o projeto TypeScript (tsconfig, dependências LangGraph, Foundry local)
25
+ - **Task 1.2** — Definir o estado do agente (`PoCStateAnnotation`) e interfaces (`VulnerabilityReport`, `PoCResult`)
26
+ - **Task 1.3** — Criar nodes stub e grafo linear (sem LLM ainda)
27
+ - **Task 1.4** — Implementar `scaffoldGenerator` (gera `setUp()` com deploy local do contrato vítima)
28
+ - **Task 1.5** — Implementar `oracleNode` (integra `stateInitializer` + `scaffoldGenerator`)
29
+
30
+ **Gate:** `oracleNode` recebe um `VulnerabilityReport` fake e retorna scaffold que passa em `forge build`
31
+
32
+ ---
33
+
34
+ ## Semana 2 — LLM + Foundry + Loop ReAct
35
+
36
+ **Objetivo:** Pipeline completo rodando com loop de correção.
37
+
38
+ ### Tasks
39
+ - **Task 2.1** — Criar o system prompt (`prompts/system.ts`)
40
+ - **Task 2.2** — Implementar `extractSolidity` (parser do output do LLM)
41
+ - **Task 2.3** — Implementar `generatePoCNode` (chamada LLM + retry em caso de bloco Solidity inválido)
42
+ - **Task 2.4** — Setup do sandbox Foundry em `/tmp/poc-sandbox/`
43
+ - **Task 2.5** — Implementar `foundryRunner` (executa `forge test -vvvv` via `child_process`, retorna output estruturado)
44
+ - **Task 2.6** — Implementar `logAnalyzer` (classifica erros: compilation / assertion / timeout)
45
+ - **Task 2.7** — Implementar `reflectNode` (LLM analisa logs e produz feedback estruturado)
46
+ - **Task 2.8** — Implementar `routeAfterFoundry` (router condicional: pass → END, fail → reflect → generate)
47
+
48
+ **Gate:** Agente faz ≥2 iterações completas e melhora o código após erro de compilação
49
+
50
+ ---
51
+
52
+ ## Semana 3 — Integração, Smoke Test & Avaliação
53
+
54
+ **Objetivo:** Pipeline validado end-to-end com métricas.
55
+
56
+ ### Tasks
57
+ - **Task 3.1** — Definir interface pública (`runPoCGenerator`)
58
+ - **Task 3.2** — Smoke test com reentrancy simples (contrato vítima hardcoded)
59
+ - **Task 3.3** — Preparar `benchmark.json` com ≥5 casos do dataset Proof-of-Patch (ASSERT-KTH)
60
+ - **Task 3.4** — Implementar `evaluate.ts` (roda agente em batch, coleta status/iterations/logs)
61
+
62
+ **Gate:** PoC de reentrancy passa end-to-end; taxa de sucesso medida e documentada
63
+
64
+ ---
65
+
66
+ ## Critérios de Conclusão (GATES)
67
+
68
+ | Semana | Critério de Conclusão |
69
+ |--------|------------------------------|
70
+ | Semana 1 | `oracleNode` gera scaffold que compila sozinho com `forge build` |
71
+ | Semana 2 | Loop ReAct faz ≥2 iterações e produz correção após erro |
72
+ | Semana 3 | PoC de reentrancy passa end-to-end; benchmark com ≥5 casos executado |
src/agents/tester/Docs/03_TASKS(2).md ADDED
@@ -0,0 +1,1338 @@
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
+ # Agente Gerador de PoCs — Tasks (formato Jira)
2
+
3
+ **Projeto:** TALP1 — CIn/UFPE
4
+ **Agente:** Agente Gerador de PoCs
5
+ **Responsável:** Tales Vinicius Alves da Cunha
6
+ **Stack:** TypeScript · Node.js · LangGraph · Foundry
7
+
8
+ ---
9
+
10
+ ## SEMANA 1 — Setup, Estado & Oracle
11
+
12
+ ---
13
+
14
+ ### TALP-1.1 — Inicializar o projeto TypeScript
15
+
16
+ | Campo | Valor |
17
+ |-------|-------|
18
+ | **Tipo** | Setup |
19
+ | **Prioridade** | Crítica |
20
+ | **Estimativa** | 1h |
21
+ | **Depende de** | — |
22
+
23
+ **Descrição**
24
+ Criar a estrutura base do projeto TypeScript com todas as dependências necessárias para rodar o agente LangGraph com Foundry.
25
+
26
+ **Arquivos a criar**
27
+ ```
28
+ src/agents/poc-generator/ ← criar diretório
29
+ tsconfig.json ← criar na raiz
30
+ package.json ← atualizar
31
+ ```
32
+
33
+ **Setup**
34
+ ```bash
35
+ mkdir -p src/agents/poc-generator/tools
36
+ mkdir -p src/agents/poc-generator/prompts
37
+ mkdir -p src/agents/poc-generator/utils
38
+ mkdir -p tests/e2e
39
+ mkdir -p scripts
40
+ mkdir -p data
41
+
42
+ npm install @langchain/langgraph @langchain/openai zod
43
+ npm install -D typescript ts-node @types/node
44
+ ```
45
+
46
+ `tsconfig.json`:
47
+ ```json
48
+ {
49
+ "compilerOptions": {
50
+ "target": "ES2022",
51
+ "module": "Node16",
52
+ "moduleResolution": "node16",
53
+ "strict": true,
54
+ "outDir": "dist",
55
+ "rootDir": "src",
56
+ "esModuleInterop": true
57
+ }
58
+ }
59
+ ```
60
+
61
+ **Critérios de aceitação**
62
+ - [ ] `npx tsc --noEmit` roda sem erros em um arquivo vazio em `src/agents/poc-generator/agent.ts`
63
+ - [ ] Todas as dependências aparecem no `package.json`
64
+ - [ ] Estrutura de diretórios criada conforme acima
65
+
66
+ **Como testar**
67
+ ```bash
68
+ npx tsc --noEmit # deve sair com código 0
69
+ ls src/agents/poc-generator/tools/ # deve existir
70
+ ```
71
+
72
+ ---
73
+
74
+ ### TALP-1.2 — Definir interfaces e estado do agente
75
+
76
+ | Campo | Valor |
77
+ |-------|-------|
78
+ | **Tipo** | Implementação |
79
+ | **Prioridade** | Crítica |
80
+ | **Estimativa** | 2h |
81
+ | **Depende de** | TALP-1.1 |
82
+
83
+ **Descrição**
84
+ Criar os tipos TypeScript que definem o contrato de dados do agente: o que entra (`VulnerabilityReport`), o que sai (`PoCResult`), e o estado interno do grafo LangGraph (`PoCStateAnnotation`).
85
+
86
+ **Arquivos a criar**
87
+ ```
88
+ src/agents/poc-generator/types.ts ← interfaces de input/output
89
+ src/agents/poc-generator/state.ts ← PoCStateAnnotation (LangGraph)
90
+ ```
91
+
92
+ **Implementação — `types.ts`**
93
+ ```typescript
94
+ export interface VulnerabilityReport {
95
+ id: string;
96
+ severity: "critical" | "high" | "medium" | "low";
97
+ type: string;
98
+ title: string;
99
+ description: string;
100
+ affectedContract: {
101
+ name: string;
102
+ sourceCode: string; // Solidity completo, preferencialmente flattened
103
+ };
104
+ attackVector: string;
105
+ suggestedCheatcodes?: string[];
106
+ }
107
+
108
+ export interface OracleContext {
109
+ solidityScaffold: string; // Exploit.t.sol parcial com setUp() pronto
110
+ }
111
+
112
+ export interface PoCResult {
113
+ reportId: string;
114
+ status: "success" | "failed" | "timeout";
115
+ solidityCode: string;
116
+ executionLogs: string[];
117
+ iterations: number;
118
+ }
119
+ ```
120
+
121
+ **Implementação — `state.ts`**
122
+ ```typescript
123
+ import { Annotation } from "@langchain/langgraph";
124
+ import { VulnerabilityReport, OracleContext } from "./types";
125
+
126
+ export const PoCStateAnnotation = Annotation.Root({
127
+ report: Annotation<VulnerabilityReport>(),
128
+
129
+ oracleContext: Annotation<OracleContext | null>({
130
+ default: () => null,
131
+ reducer: (_, y) => y, // overwrite — preenchido 1x pelo oracleNode
132
+ }),
133
+
134
+ pocCode: Annotation<string>({
135
+ default: () => "",
136
+ reducer: (_, y) => y, // overwrite — sempre a versão mais recente
137
+ }),
138
+
139
+ executionLogs: Annotation<string[]>({
140
+ default: () => [],
141
+ reducer: (x, y) => x.concat(y), // append — nunca perde logs anteriores
142
+ }),
143
+
144
+ lastError: Annotation<string | null>({
145
+ default: () => null,
146
+ reducer: (_, y) => y, // overwrite — última análise de erro
147
+ }),
148
+
149
+ iterations: Annotation<number>({
150
+ default: () => 0,
151
+ reducer: (x, y) => x + y, // aditivo — incrementado em +1 por chamada
152
+ }),
153
+
154
+ status: Annotation<"running" | "success" | "failed" | "timeout">({
155
+ default: () => "running",
156
+ reducer: (_, y) => y, // overwrite
157
+ }),
158
+ });
159
+
160
+ export type PoCState = typeof PoCStateAnnotation.State;
161
+ ```
162
+
163
+ **Critérios de aceitação**
164
+ - [ ] `npx tsc --noEmit` passa sem erros
165
+ - [ ] `iterations` usa reducer aditivo (não overwrite)
166
+ - [ ] `executionLogs` usa reducer de append (nunca trunca histórico)
167
+ - [ ] `oracleContext` usa overwrite mas default é `null`
168
+ - [ ] Todos os campos têm `default` e `reducer` definidos
169
+
170
+ **Como testar**
171
+ ```bash
172
+ npx tsc --noEmit
173
+ ```
174
+ Criar arquivo de teste manual `tests/state.test.ts`:
175
+ ```typescript
176
+ import { PoCStateAnnotation } from "../src/agents/poc-generator/state";
177
+ const s = PoCStateAnnotation.spec;
178
+ console.assert(s.iterations !== undefined, "iterations deve existir");
179
+ console.log("Estado OK");
180
+ ```
181
+
182
+ ---
183
+
184
+ ### TALP-1.3 — Criar nodes stub e grafo linear
185
+
186
+ | Campo | Valor |
187
+ |-------|-------|
188
+ | **Tipo** | Implementação |
189
+ | **Prioridade** | Crítica |
190
+ | **Estimativa** | 2h |
191
+ | **Depende de** | TALP-1.2 |
192
+
193
+ **Descrição**
194
+ Criar o grafo LangGraph com quatro nodes stub (sem lógica real ainda) conectados linearmente. Objetivo: validar que o grafo compila, executa e passa o estado corretamente entre os nodes.
195
+
196
+ **Arquivos a criar/modificar**
197
+ ```
198
+ src/agents/poc-generator/agent.ts ← criar
199
+ ```
200
+
201
+ **Implementação**
202
+ ```typescript
203
+ import { StateGraph, END, START } from "@langchain/langgraph";
204
+ import { PoCStateAnnotation, PoCState } from "./state";
205
+
206
+ async function oracleNode(state: PoCState): Promise<Partial<PoCState>> {
207
+ console.log("[oracleNode] stub — report recebido:", state.report.id);
208
+ return {};
209
+ }
210
+
211
+ async function generatePoCNode(state: PoCState): Promise<Partial<PoCState>> {
212
+ console.log("[generatePoCNode] stub — iteração:", state.iterations);
213
+ return { iterations: 1 };
214
+ }
215
+
216
+ async function runFoundryNode(state: PoCState): Promise<Partial<PoCState>> {
217
+ console.log("[runFoundryNode] stub");
218
+ return { status: "success" };
219
+ }
220
+
221
+ async function reflectNode(state: PoCState): Promise<Partial<PoCState>> {
222
+ console.log("[reflectNode] stub");
223
+ return {};
224
+ }
225
+
226
+ const graph = new StateGraph(PoCStateAnnotation)
227
+ .addNode("oracleNode", oracleNode)
228
+ .addNode("generatePoCNode", generatePoCNode)
229
+ .addNode("runFoundryNode", runFoundryNode)
230
+ .addNode("reflectNode", reflectNode)
231
+ .addEdge(START, "oracleNode")
232
+ .addEdge("oracleNode", "generatePoCNode")
233
+ .addEdge("generatePoCNode", "runFoundryNode")
234
+ .addEdge("runFoundryNode", END);
235
+
236
+ export const pocGeneratorAgent = graph.compile();
237
+ ```
238
+
239
+ **Critérios de aceitação**
240
+ - [ ] `pocGeneratorAgent.invoke({ report: mockReport })` executa sem erros
241
+ - [ ] Console exibe os 4 nomes de nodes em ordem correta
242
+ - [ ] Estado final tem `status: "success"` e `iterations: 1`
243
+ - [ ] `npx tsc --noEmit` passa
244
+
245
+ **Como testar**
246
+ ```typescript
247
+ // tests/stub-run.ts
248
+ import { pocGeneratorAgent } from "../src/agents/poc-generator/agent";
249
+ const mockReport = {
250
+ id: "test-stub", severity: "high" as const, type: "reentrancy",
251
+ title: "Test", description: "Test", attackVector: "Test",
252
+ affectedContract: { name: "Test", sourceCode: "pragma solidity ^0.8.0;" }
253
+ };
254
+ const result = await pocGeneratorAgent.invoke({ report: mockReport });
255
+ console.assert(result.status === "success", "status deve ser success");
256
+ console.assert(result.iterations === 1, "iterations deve ser 1");
257
+ console.log("Grafo stub OK:", result.status);
258
+ ```
259
+ ```bash
260
+ npx ts-node tests/stub-run.ts
261
+ ```
262
+
263
+ ---
264
+
265
+ ### TALP-1.4 — Implementar `scaffoldGenerator`
266
+
267
+ | Campo | Valor |
268
+ |-------|-------|
269
+ | **Tipo** | Implementação |
270
+ | **Prioridade** | Crítica |
271
+ | **Estimativa** | 3h |
272
+ | **Depende de** | TALP-1.2 |
273
+
274
+ **Descrição**
275
+ Implementar a função que gera o scaffold Solidity com `setUp()` pronto. O LLM receberá este arquivo parcial e precisará completar apenas a função `test_Exploit()`. Isso elimina o erro mais comum do PoCo: o LLM instanciar o contrato vítima de forma incorreta.
276
+
277
+ **Arquivos a criar**
278
+ ```
279
+ src/agents/poc-generator/tools/scaffoldGenerator.ts
280
+ ```
281
+
282
+ **Implementação**
283
+ ```typescript
284
+ import { VulnerabilityReport } from "../types";
285
+
286
+ export function generateLocalScaffold(report: VulnerabilityReport): string {
287
+ const cheatcodes = report.suggestedCheatcodes?.join(", ") ?? "vm.deal, vm.prank, vm.warp";
288
+
289
+ return `// SPDX-License-Identifier: UNLICENSED
290
+ pragma solidity ^0.8.20;
291
+
292
+ import "forge-std/Test.sol";
293
+ import "forge-std/console.sol";
294
+
295
+ // ── Código-fonte do contrato vulnerável ──────────────────────────────────────
296
+ ${report.affectedContract.sourceCode}
297
+ // ─────────────────────────────────────────────────────────────────────────────
298
+
299
+ contract ExploitTest is Test {
300
+ ${report.affectedContract.name} target;
301
+ address constant ATTACKER = address(0xBEEF);
302
+
303
+ // setUp() gerado automaticamente pelo Oracle — NÃO MODIFICAR
304
+ function setUp() public {
305
+ target = new ${report.affectedContract.name}();
306
+ vm.deal(address(target), 100 ether);
307
+ vm.deal(ATTACKER, 10 ether);
308
+ vm.label(address(target), "TARGET");
309
+ vm.label(ATTACKER, "ATTACKER");
310
+ }
311
+
312
+ // Vulnerabilidade: ${report.title}
313
+ // Tipo: ${report.type}
314
+ // Vetor: ${report.attackVector}
315
+ // Cheatcodes sugeridos: ${cheatcodes}
316
+ //
317
+ // COMPLETE APENAS ESTA FUNÇÃO — não altere setUp() nem os campos acima
318
+ function test_Exploit() public {
319
+ vm.startPrank(ATTACKER);
320
+ // TODO: implementar exploit aqui
321
+ vm.stopPrank();
322
+ }
323
+ }`.trim();
324
+ }
325
+ ```
326
+
327
+ **Critérios de aceitação**
328
+ - [ ] Output é Solidity sintaticamente válido (passa `forge build`)
329
+ - [ ] `setUp()` inclui `vm.deal` para target (100 ETH) e ATTACKER (10 ETH)
330
+ - [ ] Comentários indicam claramente o que o LLM deve completar
331
+ - [ ] `suggestedCheatcodes` aparece no scaffold quando presentes no report
332
+ - [ ] Contrato vítima é incluído inline (sem imports externos)
333
+
334
+ **Como testar**
335
+ ```bash
336
+ # 1. Gerar o scaffold manualmente
337
+ npx ts-node -e "
338
+ import { generateLocalScaffold } from './src/agents/poc-generator/tools/scaffoldGenerator';
339
+ const scaffold = generateLocalScaffold({
340
+ id:'t1', severity:'high', type:'reentrancy', title:'Reentrancy em withdraw()',
341
+ description:'...', attackVector:'callback malicioso',
342
+ affectedContract: { name: 'VulnerableBank', sourceCode: \`
343
+ pragma solidity ^0.8.20;
344
+ contract VulnerableBank {
345
+ mapping(address=>uint) public balances;
346
+ function deposit() external payable { balances[msg.sender] += msg.value; }
347
+ function withdraw() external {
348
+ uint a = balances[msg.sender];
349
+ (bool ok,) = msg.sender.call{value:a}('');
350
+ require(ok); balances[msg.sender] = 0;
351
+ }
352
+ }\`}
353
+ });
354
+ console.log(scaffold);
355
+ " > /tmp/poc-sandbox/test/Exploit.t.sol
356
+
357
+ # 2. Verificar compilação
358
+ cd /tmp/poc-sandbox && forge build
359
+ ```
360
+
361
+ ---
362
+
363
+ ### TALP-1.5 — Implementar `oracleNode`
364
+
365
+ | Campo | Valor |
366
+ |-------|-------|
367
+ | **Tipo** | Implementação |
368
+ | **Prioridade** | Crítica |
369
+ | **Estimativa** | 1h |
370
+ | **Depende de** | TALP-1.3, TALP-1.4 |
371
+
372
+ **Descrição**
373
+ Substituir o stub do `oracleNode` pela implementação real que chama o `scaffoldGenerator` e persiste o resultado no estado.
374
+
375
+ **Arquivos a modificar**
376
+ ```
377
+ src/agents/poc-generator/agent.ts ← substituir stub do oracleNode
378
+ ```
379
+
380
+ **Implementação**
381
+ ```typescript
382
+ import { generateLocalScaffold } from "./tools/scaffoldGenerator";
383
+
384
+ async function oracleNode(state: PoCState): Promise<Partial<PoCState>> {
385
+ console.log("[oracleNode] gerando scaffold para:", state.report.title);
386
+
387
+ const solidityScaffold = generateLocalScaffold(state.report);
388
+ const oracleContext: OracleContext = { solidityScaffold };
389
+
390
+ console.log("[oracleNode] scaffold gerado, tamanho:", solidityScaffold.length, "chars");
391
+ return { oracleContext };
392
+ }
393
+ ```
394
+
395
+ **Critérios de aceitação**
396
+ - [ ] `oracleContext` não é mais `null` após a execução do node
397
+ - [ ] Scaffold gerado passa `forge build` sem erros de compilação
398
+ - [ ] Não há chamadas de rede, RPC ou I/O externo neste node
399
+ - [ ] Log mostra o título do report e o tamanho do scaffold
400
+
401
+ **Gate da Semana 1:** Rodar o grafo stub com um `VulnerabilityReport` fake e verificar que `oracleContext.solidityScaffold` compila com `forge build`.
402
+
403
+ ```bash
404
+ # Teste do gate
405
+ npx ts-node tests/stub-run.ts
406
+ # Copiar o scaffold para o sandbox e compilar
407
+ cd /tmp/poc-sandbox && forge build
408
+ ```
409
+
410
+ ---
411
+
412
+ ## SEMANA 2 — LLM + Foundry + Loop ReAct
413
+
414
+ ---
415
+
416
+ ### TALP-2.1 — Criar o system prompt
417
+
418
+ | Campo | Valor |
419
+ |-------|-------|
420
+ | **Tipo** | Implementação |
421
+ | **Prioridade** | Alta |
422
+ | **Estimativa** | 2h |
423
+ | **Depende de** | TALP-1.4 |
424
+
425
+ **Descrição**
426
+ Criar o system prompt que instrui o LLM a agir como pesquisador de segurança Solidity. O prompt precisa garantir: (1) output é apenas Solidity em bloco, (2) o LLM não reescreve o `setUp()`, (3) toda linha não-óbvia tem comentário.
427
+
428
+ **Arquivos a criar**
429
+ ```
430
+ src/agents/poc-generator/prompts/system.ts
431
+ ```
432
+
433
+ **Implementação**
434
+ ```typescript
435
+ export const SYSTEM_PROMPT = `Você é um Pesquisador de Segurança Solidity especializado em escrever exploits Proof of Concept (PoC) para Foundry.
436
+
437
+ ## TAREFA
438
+ Você receberá:
439
+ 1. Um relatório de vulnerabilidade descrevendo uma falha de segurança em Solidity.
440
+ 2. Um scaffold Foundry parcialmente completo com setUp() já implementado.
441
+
442
+ Sua missão: completar APENAS a função test_Exploit() — e, se necessário, adicionar contratos auxiliares (ex: atacante com fallback()) ANTES do contrato ExploitTest.
443
+
444
+ ## RESTRIÇÕES ABSOLUTAS
445
+ - NÃO modifique setUp(), imports, constants ou qualquer campo marcado com "NÃO MODIFICAR".
446
+ - NÃO adicione novos imports além dos já presentes.
447
+ - Output APENAS um bloco \`\`\`solidity ... \`\`\` com o arquivo completo. Sem texto fora do bloco.
448
+
449
+ ## REGRAS DE QUALIDADE
450
+ - Use cheatcodes Foundry quando necessário: vm.warp(), vm.roll(), vm.prank(), vm.deal(), vm.expectRevert().
451
+ - A assertion final DEVE usar assertTrue(), assertGt() ou assertEq() para provar que o exploit teve sucesso.
452
+ - Cada linha não-óbvia DEVE ter um comentário inline explicando por que existe.
453
+ - Se precisar de flash loan, implemente o callback do provider já configurado no setUp().
454
+ - Se não conseguir completar o exploit, implemente o máximo possível e adicione comentários // TODO: explicando o que falta.
455
+
456
+ ## FORMATO DE OUTPUT
457
+ \`\`\`solidity
458
+ // arquivo completo aqui
459
+ \`\`\`
460
+ `.trim();
461
+ ```
462
+
463
+ **Critérios de aceitação**
464
+ - [ ] LLM sempre produz um bloco ` ```solidity``` ` no output (validar em ≥5 chamadas manuais)
465
+ - [ ] LLM nunca reescreve `setUp()` (testar com prompt de retry)
466
+ - [ ] LLM sempre inclui pelo menos uma assertion no `test_Exploit()`
467
+ - [ ] Prompt cabe em menos de 500 tokens (verificar com `tiktoken`)
468
+
469
+ **Como testar**
470
+ ```typescript
471
+ // Teste manual: chamar o LLM diretamente com o system prompt
472
+ import { ChatOpenAI } from "@langchain/openai";
473
+ import { SYSTEM_PROMPT } from "./src/agents/poc-generator/prompts/system";
474
+ const llm = new ChatOpenAI({ modelName: "gpt-4o", openAIApiKey: process.env.OPENROUTER_API_KEY });
475
+ const resp = await llm.invoke([
476
+ { role: "system", content: SYSTEM_PROMPT },
477
+ { role: "user", content: "Scaffold: ...\nVulnerabilidade: reentrancy simples" }
478
+ ]);
479
+ console.log(resp.content);
480
+ // Verificar manualmente: contém ```solidity```? Não modificou setUp()?
481
+ ```
482
+
483
+ ---
484
+
485
+ ### TALP-2.2 — Implementar `extractSolidity`
486
+
487
+ | Campo | Valor |
488
+ |-------|-------|
489
+ | **Tipo** | Implementação |
490
+ | **Prioridade** | Alta |
491
+ | **Estimativa** | 1h |
492
+ | **Depende de** | TALP-2.1 |
493
+
494
+ **Descrição**
495
+ Parser robusto que extrai o bloco Solidity do output do LLM, com fallbacks para casos onde o modelo omite os backticks.
496
+
497
+ **Arquivos a criar**
498
+ ```
499
+ src/agents/poc-generator/utils/extractSolidity.ts
500
+ ```
501
+
502
+ **Implementação**
503
+ ```typescript
504
+ export function extractSolidity(llmOutput: string): string {
505
+ // Caso 1: bloco ```solidity ... ``` padrão
506
+ const match = llmOutput.match(/```solidity\s*([\s\S]*?)```/);
507
+ if (match) return match[1].trim();
508
+
509
+ // Caso 2: LLM omitiu backticks mas começa com pragma/SPDX
510
+ const trimmed = llmOutput.trim();
511
+ if (trimmed.startsWith("// SPDX") || trimmed.startsWith("pragma")) {
512
+ return trimmed;
513
+ }
514
+
515
+ // Caso 3: output inválido — lançar erro descritivo
516
+ throw new Error(
517
+ `LLM output não contém bloco Solidity válido. Preview: "${llmOutput.slice(0, 200)}"`
518
+ );
519
+ }
520
+ ```
521
+
522
+ **Critérios de aceitação**
523
+ - [ ] Extrai corretamente de bloco ` ```solidity``` ` padrão
524
+ - [ ] Usa fallback quando LLM omite backticks mas começa com `pragma` ou `// SPDX`
525
+ - [ ] Lança `Error` descritivo quando output é texto puro sem Solidity
526
+ - [ ] Resultado nunca contém os backticks do bloco
527
+
528
+ **Como testar**
529
+ ```typescript
530
+ // tests/unit/extractSolidity.test.ts
531
+ import { extractSolidity } from "../../src/agents/poc-generator/utils/extractSolidity";
532
+
533
+ // Caso 1: bloco padrão
534
+ const r1 = extractSolidity("Aqui está:\n```solidity\npragma solidity ^0.8.0;\n```");
535
+ console.assert(r1 === "pragma solidity ^0.8.0;", "Caso 1 falhou");
536
+
537
+ // Caso 2: sem backticks
538
+ const r2 = extractSolidity("pragma solidity ^0.8.0;\ncontract A {}");
539
+ console.assert(r2.startsWith("pragma"), "Caso 2 falhou");
540
+
541
+ // Caso 3: inválido — deve lançar
542
+ try {
543
+ extractSolidity("Desculpe, não consigo gerar isso.");
544
+ console.error("Caso 3 deveria ter lançado erro!");
545
+ } catch (e) {
546
+ console.log("Caso 3 OK — erro lançado:", (e as Error).message.slice(0, 50));
547
+ }
548
+
549
+ console.log("Todos os testes de extractSolidity passaram");
550
+ ```
551
+
552
+ ---
553
+
554
+ ### TALP-2.3 — Implementar `generatePoCNode`
555
+
556
+ | Campo | Valor |
557
+ |-------|-------|
558
+ | **Tipo** | Implementação |
559
+ | **Prioridade** | Crítica |
560
+ | **Estimativa** | 3h |
561
+ | **Depende de** | TALP-2.1, TALP-2.2 |
562
+
563
+ **Descrição**
564
+ Substituir o stub por um node real que chama o LLM. O prompt do usuário muda dependendo se é a primeira tentativa (passa o scaffold) ou um retry (passa o código com erro anterior).
565
+
566
+ **Arquivos a modificar**
567
+ ```
568
+ src/agents/poc-generator/agent.ts ← substituir stub do generatePoCNode
569
+ ```
570
+
571
+ **Implementação**
572
+ ```typescript
573
+ import { ChatOpenAI } from "@langchain/openai";
574
+ import { SYSTEM_PROMPT } from "./prompts/system";
575
+ import { extractSolidity } from "./utils/extractSolidity";
576
+
577
+ const llm = new ChatOpenAI({
578
+ modelName: "gpt-4o",
579
+ temperature: 0.2,
580
+ openAIApiKey: process.env.OPENROUTER_API_KEY,
581
+ configuration: { baseURL: "https://openrouter.ai/api/v1" },
582
+ });
583
+
584
+ async function generatePoCNode(state: PoCState): Promise<Partial<PoCState>> {
585
+ const { report, oracleContext, executionLogs, pocCode, iterations, lastError } = state;
586
+ const isRetry = iterations > 0;
587
+
588
+ const userMessage = isRetry
589
+ ? `O seguinte exploit FALHOU no Foundry.
590
+
591
+ Código anterior:
592
+ \`\`\`solidity
593
+ ${pocCode}
594
+ \`\`\`
595
+
596
+ Output do Forge (última execução):
597
+ ${executionLogs[executionLogs.length - 1]?.slice(0, 3000) ?? "sem logs"}
598
+
599
+ Análise do erro: ${lastError ?? "desconhecido"}
600
+
601
+ Corrija o código. Retorne o arquivo Solidity completo corrigido.`
602
+ : `Relatório de Vulnerabilidade:
603
+ - Título: ${report.title}
604
+ - Tipo: ${report.type}
605
+ - Descrição: ${report.description}
606
+ - Vetor de Ataque: ${report.attackVector}
607
+
608
+ Scaffold (complete APENAS test_Exploit):
609
+ \`\`\`solidity
610
+ ${oracleContext!.solidityScaffold}
611
+ \`\`\``;
612
+
613
+ console.log(`[generatePoCNode] iteração ${iterations + 1}, isRetry=${isRetry}`);
614
+
615
+ try {
616
+ const response = await llm.invoke([
617
+ { role: "system", content: SYSTEM_PROMPT },
618
+ { role: "user", content: userMessage },
619
+ ]);
620
+ const solidityCode = extractSolidity(response.content as string);
621
+ console.log("[generatePoCNode] Solidity extraído, tamanho:", solidityCode.length);
622
+ return { pocCode: solidityCode, iterations: 1 };
623
+ } catch (err) {
624
+ console.error("[generatePoCNode] falha na extração:", (err as Error).message);
625
+ return { iterations: 1, lastError: `Falha ao extrair Solidity: ${(err as Error).message}` };
626
+ }
627
+ }
628
+ ```
629
+
630
+ **Critérios de aceitação**
631
+ - [ ] Na primeira iteração: passa scaffold completo + descrição da vulnerabilidade
632
+ - [ ] No retry: passa código anterior + logs do forge + análise do erro
633
+ - [ ] `iterations` incrementa em +1 a cada chamada (via reducer aditivo)
634
+ - [ ] Erro de extração não trava o grafo — registra `lastError` e continua
635
+ - [ ] Logs do forge são truncados a 3000 chars (evitar ultrapassar context window)
636
+
637
+ ---
638
+
639
+ ### TALP-2.4 — Setup do sandbox Foundry
640
+
641
+ | Campo | Valor |
642
+ |-------|-------|
643
+ | **Tipo** | Setup/Infra |
644
+ | **Prioridade** | Crítica |
645
+ | **Estimativa** | 1h |
646
+ | **Depende de** | TALP-1.1 |
647
+
648
+ **Descrição**
649
+ Criar script de inicialização do sandbox Foundry local em `/tmp/poc-sandbox/`. O agente escreve o arquivo `Exploit.t.sol` aqui e executa `forge test`.
650
+
651
+ **Arquivos a criar**
652
+ ```
653
+ scripts/setup-sandbox.sh
654
+ foundry.toml ← copiado para o sandbox
655
+ ```
656
+
657
+ **Implementação — `setup-sandbox.sh`**
658
+ ```bash
659
+ #!/bin/bash
660
+ set -e
661
+
662
+ SANDBOX="/tmp/poc-sandbox"
663
+
664
+ echo "Inicializando sandbox Foundry em $SANDBOX..."
665
+ rm -rf "$SANDBOX"
666
+ mkdir -p "$SANDBOX"
667
+ cd "$SANDBOX"
668
+
669
+ forge init --no-git --quiet
670
+ forge install foundry-rs/forge-std --no-git --quiet
671
+
672
+ cat > foundry.toml << 'EOF'
673
+ [profile.default]
674
+ src = "src"
675
+ test = "test"
676
+ out = "out"
677
+ libs = ["lib"]
678
+ solc-version = "0.8.20"
679
+ EOF
680
+
681
+ # Remover o contrato e teste de exemplo do forge init
682
+ rm -f src/Counter.sol test/Counter.t.sol
683
+
684
+ echo "Sandbox pronto. Testando com forge build..."
685
+ forge build
686
+ echo "OK — sandbox funcionando em $SANDBOX"
687
+ ```
688
+
689
+ **Critérios de aceitação**
690
+ - [ ] Script roda sem erros em máquina com Foundry instalado (`forge --version`)
691
+ - [ ] `forge build` dentro de `/tmp/poc-sandbox` tem sucesso após o script
692
+ - [ ] Diretório `test/` existe e está vazio (pronto para receber `Exploit.t.sol`)
693
+ - [ ] `forge-std` instalado corretamente (import `"forge-std/Test.sol"` funciona)
694
+
695
+ **Como testar**
696
+ ```bash
697
+ chmod +x scripts/setup-sandbox.sh
698
+ ./scripts/setup-sandbox.sh
699
+ echo "// SPDX-License-Identifier: UNLICENSED
700
+ pragma solidity ^0.8.20;
701
+ import 'forge-std/Test.sol';
702
+ contract SmokeTest is Test {
703
+ function test_ok() public { assertTrue(true); }
704
+ }" > /tmp/poc-sandbox/test/Smoke.t.sol
705
+ cd /tmp/poc-sandbox && forge test
706
+ ```
707
+
708
+ ---
709
+
710
+ ### TALP-2.5 — Implementar `foundryRunner`
711
+
712
+ | Campo | Valor |
713
+ |-------|-------|
714
+ | **Tipo** | Implementação |
715
+ | **Prioridade** | Crítica |
716
+ | **Estimativa** | 2h |
717
+ | **Depende de** | TALP-2.4 |
718
+
719
+ **Descrição**
720
+ Módulo que escreve o código Solidity no sandbox, executa `forge test` via `child_process` e retorna o resultado estruturado. Nunca lança erro — sempre retorna `FoundryResult`.
721
+
722
+ **Arquivos a criar**
723
+ ```
724
+ src/agents/poc-generator/tools/foundryRunner.ts
725
+ ```
726
+
727
+ **Implementação**
728
+ ```typescript
729
+ import { exec } from "child_process";
730
+ import { promisify } from "util";
731
+ import { writeFile } from "fs/promises";
732
+
733
+ const execAsync = promisify(exec);
734
+ const SANDBOX = "/tmp/poc-sandbox";
735
+ const TIMEOUT_MS = 60_000;
736
+
737
+ export interface FoundryResult {
738
+ exitCode: number;
739
+ stdout: string;
740
+ stderr: string;
741
+ combined: string;
742
+ timedOut: boolean;
743
+ }
744
+
745
+ export async function runFoundry(solidityCode: string): Promise<FoundryResult> {
746
+ // Escrever o arquivo no sandbox
747
+ await writeFile(`${SANDBOX}/test/Exploit.t.sol`, solidityCode, "utf-8");
748
+
749
+ try {
750
+ const { stdout, stderr } = await execAsync(
751
+ "forge test --match-contract ExploitTest -vvvv",
752
+ { cwd: SANDBOX, timeout: TIMEOUT_MS, env: { ...process.env } }
753
+ );
754
+ return {
755
+ exitCode: 0,
756
+ stdout,
757
+ stderr,
758
+ combined: `STDOUT:\n${stdout}\nSTDERR:\n${stderr}`,
759
+ timedOut: false,
760
+ };
761
+ } catch (err: any) {
762
+ if (err.killed || err.signal === "SIGTERM") {
763
+ return {
764
+ exitCode: -1, stdout: "", stderr: "Forge timed out",
765
+ combined: `TIMEOUT após ${TIMEOUT_MS / 1000}s`,
766
+ timedOut: true,
767
+ };
768
+ }
769
+ return {
770
+ exitCode: err.code ?? 1,
771
+ stdout: err.stdout ?? "",
772
+ stderr: err.stderr ?? "",
773
+ combined: `STDOUT:\n${err.stdout ?? ""}\nSTDERR:\n${err.stderr ?? ""}`,
774
+ timedOut: false,
775
+ };
776
+ }
777
+ }
778
+ ```
779
+
780
+ **Critérios de aceitação**
781
+ - [ ] Detecta test pass: `exitCode === 0` + stdout contém `"ok"`
782
+ - [ ] Detecta compiler error: `exitCode !== 0` + stderr contém `"Compiler run failed"`
783
+ - [ ] Detecta timeout: `timedOut === true`, processo morto após 60s
784
+ - [ ] Nunca lança exceção — sempre retorna `FoundryResult`
785
+ - [ ] `combined` contém stdout e stderr separados por label
786
+
787
+ **Como testar**
788
+ ```typescript
789
+ // tests/unit/foundryRunner.test.ts
790
+ import { runFoundry } from "../../src/agents/poc-generator/tools/foundryRunner";
791
+
792
+ // Caso 1: código válido que passa
793
+ const validCode = `// SPDX-License-Identifier: UNLICENSED
794
+ pragma solidity ^0.8.20;
795
+ import "forge-std/Test.sol";
796
+ contract ExploitTest is Test {
797
+ function setUp() public {}
798
+ function test_Exploit() public { assertTrue(true); }
799
+ }`;
800
+ const r1 = await runFoundry(validCode);
801
+ console.assert(r1.exitCode === 0, "Deveria passar");
802
+ console.assert(r1.stdout.includes("ok"), "Deveria ter 'ok' no stdout");
803
+
804
+ // Caso 2: código com erro de compilação
805
+ const invalidCode = `pragma solidity ^0.8.20; contract Bad { function foo( }`;
806
+ const r2 = await runFoundry(invalidCode);
807
+ console.assert(r2.exitCode !== 0, "Deveria falhar");
808
+ console.assert(r2.stderr.includes("Error") || r2.combined.includes("Error"), "Deveria ter erro");
809
+
810
+ console.log("foundryRunner OK");
811
+ ```
812
+
813
+ ---
814
+
815
+ ### TALP-2.6 — Implementar `logAnalyzer`
816
+
817
+ | Campo | Valor |
818
+ |-------|-------|
819
+ | **Tipo** | Implementação |
820
+ | **Prioridade** | Alta |
821
+ | **Estimativa** | 2h |
822
+ | **Depende de** | TALP-2.5 |
823
+
824
+ **Descrição**
825
+ Módulo que lê o output bruto do `forge test` e produz um resumo legível em linguagem natural para o LLM. Classifica o erro em uma de 5 categorias.
826
+
827
+ **Arquivos a criar**
828
+ ```
829
+ src/agents/poc-generator/utils/logAnalyzer.ts
830
+ ```
831
+
832
+ **Implementação**
833
+ ```typescript
834
+ import { FoundryResult } from "../tools/foundryRunner";
835
+
836
+ export type ErrorCategory =
837
+ | "compiler_error"
838
+ | "revert_no_message"
839
+ | "revert_with_message"
840
+ | "assertion_failed"
841
+ | "timeout"
842
+ | "unknown";
843
+
844
+ export interface LogAnalysis {
845
+ category: ErrorCategory;
846
+ summary: string; // 1-2 frases em linguagem natural para o LLM
847
+ relevantLines: string[]; // máx 10 linhas do log original
848
+ }
849
+
850
+ export function analyzeFoundryLog(result: FoundryResult): LogAnalysis {
851
+ if (result.timedOut) return {
852
+ category: "timeout",
853
+ summary: "Forge excedeu 60s. O exploit pode ter entrado em loop infinito ou a lógica está bloqueante.",
854
+ relevantLines: [],
855
+ };
856
+
857
+ if (result.combined.includes("Compiler run failed")) {
858
+ const lines = result.combined.split("\n")
859
+ .filter(l => l.includes("Error") || l.includes("error") || l.includes("-->"))
860
+ .slice(0, 10);
861
+ return {
862
+ category: "compiler_error",
863
+ summary: "Erro de compilação Solidity. Verifique: interfaces faltando, assinaturas incorretas, tipos incompatíveis.",
864
+ relevantLines: lines,
865
+ };
866
+ }
867
+
868
+ if (result.combined.includes("FAIL")) {
869
+ const revertReason = result.combined.match(/revert: (.+)/)?.[1];
870
+ const assertionFail = result.combined.includes("Assertion Failed") || result.combined.includes("assertion failed");
871
+
872
+ if (assertionFail) return {
873
+ category: "assertion_failed",
874
+ summary: "O exploit executou mas a assertion final falhou — o atacante não obteve o resultado esperado.",
875
+ relevantLines: result.combined.split("\n")
876
+ .filter(l => l.includes("assertion") || l.includes("FAIL")).slice(0, 10),
877
+ };
878
+
879
+ if (revertReason) return {
880
+ category: "revert_with_message",
881
+ summary: `Transação reverteu com: "${revertReason}". O contrato rejeitou a operação.`,
882
+ relevantLines: [revertReason],
883
+ };
884
+
885
+ return {
886
+ category: "revert_no_message",
887
+ summary: "Transação reverteu sem mensagem. Verifique a ordem das chamadas, permissões e estado do contrato.",
888
+ relevantLines: result.combined.split("\n")
889
+ .filter(l => l.includes("revert") || l.includes("FAIL")).slice(0, 5),
890
+ };
891
+ }
892
+
893
+ return {
894
+ category: "unknown",
895
+ summary: "Erro desconhecido. Revisar output completo do forge.",
896
+ relevantLines: result.combined.split("\n").slice(0, 10),
897
+ };
898
+ }
899
+ ```
900
+
901
+ **Critérios de aceitação**
902
+ - [ ] Classifica `compiler_error` quando stderr contém `"Compiler run failed"`
903
+ - [ ] Classifica `assertion_failed` quando stdout contém `"FAIL"` + `"Assertion Failed"`
904
+ - [ ] Classifica `revert_with_message` quando há `revert: <mensagem>`
905
+ - [ ] `relevantLines` nunca tem mais de 10 linhas
906
+ - [ ] `summary` é sempre linguagem natural (não reproduz stack trace bruto)
907
+
908
+ **Como testar**
909
+ ```typescript
910
+ // tests/unit/logAnalyzer.test.ts
911
+ import { analyzeFoundryLog } from "../../src/agents/poc-generator/utils/logAnalyzer";
912
+
913
+ const compilerError = { exitCode: 1, timedOut: false, stdout: "", stderr: "Compiler run failed\nError: ...\n--> src/A.sol:10:5", combined: "STDOUT:\n\nSTDERR:\nCompiler run failed\nError: ...\n--> src/A.sol:10:5" };
914
+ const r1 = analyzeFoundryLog(compilerError as any);
915
+ console.assert(r1.category === "compiler_error", "Caso 1 falhou");
916
+ console.assert(r1.relevantLines.length <= 10, "Muitas linhas");
917
+
918
+ const timeout = { exitCode: -1, timedOut: true, stdout: "", stderr: "", combined: "TIMEOUT" };
919
+ const r2 = analyzeFoundryLog(timeout as any);
920
+ console.assert(r2.category === "timeout", "Caso timeout falhou");
921
+
922
+ console.log("logAnalyzer OK");
923
+ ```
924
+
925
+ ---
926
+
927
+ ### TALP-2.7 — Implementar `reflectNode`
928
+
929
+ | Campo | Valor |
930
+ |-------|-------|
931
+ | **Tipo** | Implementação |
932
+ | **Prioridade** | Alta |
933
+ | **Estimativa** | 2h |
934
+ | **Depende de** | TALP-2.6 |
935
+
936
+ **Descrição**
937
+ Node que usa o `logAnalyzer` para produzir um `lastError` estruturado e legível. Este valor é passado para o `generatePoCNode` no retry, orientando o LLM sobre o que corrigir.
938
+
939
+ **Arquivos a modificar**
940
+ ```
941
+ src/agents/poc-generator/agent.ts ← substituir stub do reflectNode
942
+ ```
943
+
944
+ **Implementação**
945
+ ```typescript
946
+ import { analyzeFoundryLog } from "./utils/logAnalyzer";
947
+
948
+ async function reflectNode(state: PoCState): Promise<Partial<PoCState>> {
949
+ // Pegar o último log de execução
950
+ const lastLog = state.executionLogs[state.executionLogs.length - 1];
951
+ if (!lastLog) {
952
+ return { lastError: "Sem logs disponíveis para análise." };
953
+ }
954
+
955
+ // Reconstruir FoundryResult mínimo a partir do log combinado
956
+ const mockResult = {
957
+ exitCode: 1, timedOut: lastLog.includes("TIMEOUT"),
958
+ stdout: "", stderr: "", combined: lastLog,
959
+ };
960
+
961
+ const analysis = analyzeFoundryLog(mockResult as any);
962
+
963
+ console.log(`[reflectNode] categoria: ${analysis.category}`);
964
+ console.log(`[reflectNode] resumo: ${analysis.summary}`);
965
+
966
+ return {
967
+ lastError: `[${analysis.category.toUpperCase()}] ${analysis.summary}\n\nLinhas relevantes:\n${analysis.relevantLines.join("\n")}`,
968
+ };
969
+ }
970
+ ```
971
+
972
+ **Critérios de aceitação**
973
+ - [ ] `lastError` sempre é uma string não-vazia após o node
974
+ - [ ] `lastError` inclui a categoria do erro entre colchetes
975
+ - [ ] `lastError` inclui as linhas relevantes do log (não o log inteiro)
976
+ - [ ] Node não trava se `executionLogs` estiver vazio
977
+
978
+ ---
979
+
980
+ ### TALP-2.8 — Implementar router condicional e fechar o loop
981
+
982
+ | Campo | Valor |
983
+ |-------|-------|
984
+ | **Tipo** | Implementação |
985
+ | **Prioridade** | Crítica |
986
+ | **Estimativa** | 2h |
987
+ | **Depende de** | TALP-2.3, TALP-2.5, TALP-2.7 |
988
+
989
+ **Descrição**
990
+ Substituir as edges fixas do grafo por edges condicionais que implementam o loop ReAct. Atualizar o `runFoundryNode` real e conectar tudo.
991
+
992
+ **Arquivos a modificar**
993
+ ```
994
+ src/agents/poc-generator/agent.ts ← refatorar grafo completo
995
+ ```
996
+
997
+ **Implementação**
998
+ ```typescript
999
+ const MAX_ITERATIONS = 5;
1000
+
1001
+ function routeAfterFoundry(state: PoCState): "reflectNode" | "__end__" {
1002
+ if (state.status === "success") return "__end__";
1003
+ if (state.status === "timeout") return "__end__";
1004
+ if (state.iterations >= MAX_ITERATIONS) return "__end__";
1005
+ return "reflectNode";
1006
+ }
1007
+
1008
+ async function runFoundryNode(state: PoCState): Promise<Partial<PoCState>> {
1009
+ const result = await runFoundry(state.pocCode);
1010
+ const analysis = analyzeFoundryLog(result);
1011
+ const passed = result.exitCode === 0 && result.stdout.includes("ok");
1012
+
1013
+ console.log(`[runFoundryNode] exitCode=${result.exitCode}, passed=${passed}`);
1014
+
1015
+ return {
1016
+ executionLogs: [result.combined], // reducer append
1017
+ lastError: analysis.summary,
1018
+ status: passed ? "success"
1019
+ : result.timedOut ? "timeout"
1020
+ : "running",
1021
+ };
1022
+ }
1023
+
1024
+ // Grafo final com loop ReAct
1025
+ const graph = new StateGraph(PoCStateAnnotation)
1026
+ .addNode("oracleNode", oracleNode)
1027
+ .addNode("generatePoCNode", generatePoCNode)
1028
+ .addNode("runFoundryNode", runFoundryNode)
1029
+ .addNode("reflectNode", reflectNode)
1030
+ .addEdge(START, "oracleNode")
1031
+ .addEdge("oracleNode", "generatePoCNode")
1032
+ .addEdge("generatePoCNode", "runFoundryNode")
1033
+ .addConditionalEdges("runFoundryNode", routeAfterFoundry, {
1034
+ reflectNode: "reflectNode",
1035
+ __end__: END,
1036
+ })
1037
+ .addEdge("reflectNode", "generatePoCNode"); // fecha o loop
1038
+
1039
+ export const pocGeneratorAgent = graph.compile();
1040
+ ```
1041
+
1042
+ **Critérios de aceitação**
1043
+ - [ ] Loop executa ≥2 iterações quando a primeira tentativa falha
1044
+ - [ ] Para em `END` quando `status === "success"`
1045
+ - [ ] Para em `END` quando `iterations >= 5` (mesmo sem sucesso)
1046
+ - [ ] Para em `END` quando `status === "timeout"`
1047
+ - [ ] `executionLogs` tem uma entrada por iteração ao final
1048
+
1049
+ **Gate da Semana 2:** Rodar o agente com o `VulnerableBank` e confirmar que o loop executa ≥2 iterações e melhora o código após erro de compilação.
1050
+
1051
+ ---
1052
+
1053
+ ## SEMANA 3 — Integração, Smoke Test & Avaliação
1054
+
1055
+ ---
1056
+
1057
+ ### TALP-3.1 — Interface pública do agente
1058
+
1059
+ | Campo | Valor |
1060
+ |-------|-------|
1061
+ | **Tipo** | Implementação |
1062
+ | **Prioridade** | Alta |
1063
+ | **Estimativa** | 1h |
1064
+ | **Depende de** | TALP-2.8 |
1065
+
1066
+ **Descrição**
1067
+ Criar o entry point público que o restante do sistema (Agente Auditor) usará para invocar o Agente de PoCs.
1068
+
1069
+ **Arquivos a criar**
1070
+ ```
1071
+ src/agents/poc-generator/index.ts
1072
+ ```
1073
+
1074
+ **Implementação**
1075
+ ```typescript
1076
+ import { pocGeneratorAgent } from "./agent";
1077
+ import { VulnerabilityReport, PoCResult } from "./types";
1078
+
1079
+ export async function runPoCGenerator(report: VulnerabilityReport): Promise<PoCResult> {
1080
+ console.log(`[runPoCGenerator] iniciando para: ${report.id} — ${report.title}`);
1081
+
1082
+ const finalState = await pocGeneratorAgent.invoke({ report });
1083
+
1084
+ const result: PoCResult = {
1085
+ reportId: report.id,
1086
+ status: finalState.status === "running" ? "failed" : finalState.status,
1087
+ solidityCode: finalState.pocCode,
1088
+ executionLogs: finalState.executionLogs,
1089
+ iterations: finalState.iterations,
1090
+ };
1091
+
1092
+ console.log(`[runPoCGenerator] concluído — status=${result.status}, iterações=${result.iterations}`);
1093
+ return result;
1094
+ }
1095
+
1096
+ export type { VulnerabilityReport, PoCResult };
1097
+ ```
1098
+
1099
+ **Critérios de aceitação**
1100
+ - [ ] Nunca lança exceção — retorna `PoCResult` em qualquer cenário
1101
+ - [ ] `status` nunca é `"running"` no resultado final (mapeia para `"failed"`)
1102
+ - [ ] Tipos exportados batem com o contrato esperado pelo Agente Auditor
1103
+
1104
+ ---
1105
+
1106
+ ### TALP-3.2 — Smoke test end-to-end com reentrancy
1107
+
1108
+ | Campo | Valor |
1109
+ |-------|-------|
1110
+ | **Tipo** | Teste |
1111
+ | **Prioridade** | Crítica |
1112
+ | **Estimativa** | 3h |
1113
+ | **Depende de** | TALP-3.1 |
1114
+
1115
+ **Descrição**
1116
+ Validar o pipeline completo com um contrato vulnerável simples de reentrancy escrito manualmente. Este teste não depende de dataset externo.
1117
+
1118
+ **Arquivos a criar**
1119
+ ```
1120
+ tests/e2e/poc-generator.test.ts
1121
+ ```
1122
+
1123
+ **Implementação**
1124
+ ```typescript
1125
+ import { runPoCGenerator } from "../../src/agents/poc-generator";
1126
+ import { VulnerabilityReport } from "../../src/agents/poc-generator/types";
1127
+
1128
+ const VULNERABLE_BANK = `
1129
+ pragma solidity ^0.8.20;
1130
+ contract VulnerableBank {
1131
+ mapping(address => uint) public balances;
1132
+ function deposit() external payable { balances[msg.sender] += msg.value; }
1133
+ function withdraw() external {
1134
+ uint amount = balances[msg.sender];
1135
+ (bool ok,) = msg.sender.call{value: amount}("");
1136
+ require(ok);
1137
+ balances[msg.sender] = 0; // atualiza DEPOIS — reentrancy
1138
+ }
1139
+ receive() external payable {}
1140
+ }`.trim();
1141
+
1142
+ const mockReport: VulnerabilityReport = {
1143
+ id: "e2e-reentrancy-001",
1144
+ severity: "critical",
1145
+ type: "reentrancy",
1146
+ title: "Reentrancy em withdraw()",
1147
+ description: "withdraw() envia ETH antes de zerar o saldo, permitindo re-entrada.",
1148
+ affectedContract: { name: "VulnerableBank", sourceCode: VULNERABLE_BANK },
1149
+ attackVector: "Contrato atacante com fallback() que chama withdraw() novamente antes do saldo ser zerado.",
1150
+ suggestedCheatcodes: ["vm.deal", "vm.startPrank", "vm.stopPrank"],
1151
+ };
1152
+
1153
+ async function runE2ETest() {
1154
+ console.log("Iniciando smoke test end-to-end...");
1155
+ const result = await runPoCGenerator(mockReport);
1156
+
1157
+ console.log(`Status: ${result.status}`);
1158
+ console.log(`Iterações: ${result.iterations}`);
1159
+ console.log(`Logs: ${result.executionLogs.length} entrada(s)`);
1160
+
1161
+ console.assert(result.status === "success", `FALHOU: status esperado 'success', recebido '${result.status}'`);
1162
+ console.assert(result.iterations <= 5, `FALHOU: muitas iterações (${result.iterations})`);
1163
+ console.assert(result.solidityCode.includes("test_Exploit"), "FALHOU: código não contém test_Exploit");
1164
+
1165
+ console.log("Smoke test PASSOU");
1166
+ return result;
1167
+ }
1168
+
1169
+ runE2ETest().catch(console.error);
1170
+ ```
1171
+
1172
+ **Critérios de aceitação**
1173
+ - [ ] `result.status === "success"`
1174
+ - [ ] `result.iterations <= 5`
1175
+ - [ ] `result.solidityCode` contém `test_Exploit`
1176
+ - [ ] Teste completo roda em menos de 3 minutos
1177
+ - [ ] Não requer variável `MAINNET_RPC_URL` (contrato é local)
1178
+
1179
+ **Como executar**
1180
+ ```bash
1181
+ OPENROUTER_API_KEY=sk-... npx ts-node tests/e2e/poc-generator.test.ts
1182
+ ```
1183
+
1184
+ ---
1185
+
1186
+ ### TALP-3.3 — Preparar dataset de benchmark
1187
+
1188
+ | Campo | Valor |
1189
+ |-------|-------|
1190
+ | **Tipo** | Dados |
1191
+ | **Prioridade** | Alta |
1192
+ | **Estimativa** | 3h |
1193
+ | **Depende de** | — |
1194
+
1195
+ **Descrição**
1196
+ Selecionar ≥5 casos reais do dataset **Proof-of-Patch** (ASSERT-KTH) e montar o `benchmark.json`. Priorizar: reentrancy, access control bypass, integer overflow.
1197
+
1198
+ **Arquivos a criar**
1199
+ ```
1200
+ data/benchmark.json
1201
+ ```
1202
+
1203
+ **Formato**
1204
+ ```json
1205
+ [
1206
+ {
1207
+ "id": "bench-001",
1208
+ "vulnerability": "Reentrancy em withdraw()",
1209
+ "type": "reentrancy",
1210
+ "severity": "critical",
1211
+ "contractName": "VulnerableBank",
1212
+ "sourceCode": "pragma solidity ^0.8.20; ...",
1213
+ "attackVector": "Contrato atacante com fallback reentrant",
1214
+ "source": "Proof-of-Patch / ASSERT-KTH",
1215
+ "referencePoC": "disponível no repositório ASSERT-KTH/Proof-of-Patch"
1216
+ }
1217
+ ]
1218
+ ```
1219
+
1220
+ **Critérios de aceitação**
1221
+ - [ ] ≥5 entradas com `sourceCode` completo e compilável
1222
+ - [ ] Cobre pelo menos 3 tipos de vulnerabilidade diferentes
1223
+ - [ ] Cada entrada tem `attackVector` descrito
1224
+ - [ ] Todos os contratos compilam com `forge build` (verificar antes de incluir)
1225
+
1226
+ ---
1227
+
1228
+ ### TALP-3.4 — Script de avaliação em batch
1229
+
1230
+ | Campo | Valor |
1231
+ |-------|-------|
1232
+ | **Tipo** | Avaliação |
1233
+ | **Prioridade** | Alta |
1234
+ | **Estimativa** | 2h |
1235
+ | **Depende de** | TALP-3.1, TALP-3.3 |
1236
+
1237
+ **Descrição**
1238
+ Script que roda o agente sobre todos os casos do benchmark e reporta a taxa de sucesso. Um caso que falha não interrompe o batch.
1239
+
1240
+ **Arquivos a criar**
1241
+ ```
1242
+ scripts/evaluate.ts
1243
+ data/eval-results.json ← gerado pelo script
1244
+ ```
1245
+
1246
+ **Implementação**
1247
+ ```typescript
1248
+ import { readFileSync, writeFileSync } from "fs";
1249
+ import { runPoCGenerator } from "../src/agents/poc-generator";
1250
+
1251
+ interface BenchmarkCase {
1252
+ id: string; vulnerability: string; type: string; severity: string;
1253
+ contractName: string; sourceCode: string; attackVector: string;
1254
+ }
1255
+
1256
+ interface EvalResult {
1257
+ id: string; status: string; iterations: number;
1258
+ passed: boolean; durationMs: number;
1259
+ }
1260
+
1261
+ async function main() {
1262
+ const dataset: BenchmarkCase[] = JSON.parse(readFileSync("data/benchmark.json", "utf-8"));
1263
+ const results: EvalResult[] = [];
1264
+
1265
+ console.log(`Iniciando avaliação — ${dataset.length} caso(s)\n`);
1266
+
1267
+ for (const item of dataset) {
1268
+ const start = Date.now();
1269
+ console.log(`[${item.id}] Rodando: ${item.vulnerability}...`);
1270
+
1271
+ try {
1272
+ const result = await runPoCGenerator({
1273
+ id: item.id, severity: item.severity as any, type: item.type,
1274
+ title: item.vulnerability, description: item.vulnerability,
1275
+ affectedContract: { name: item.contractName, sourceCode: item.sourceCode },
1276
+ attackVector: item.attackVector,
1277
+ });
1278
+ const dur = Date.now() - start;
1279
+ results.push({ id: item.id, status: result.status, iterations: result.iterations, passed: result.status === "success", durationMs: dur });
1280
+ console.log(` → ${result.status} em ${result.iterations} iter(s), ${(dur/1000).toFixed(1)}s`);
1281
+ } catch (err) {
1282
+ const dur = Date.now() - start;
1283
+ results.push({ id: item.id, status: "error", iterations: 0, passed: false, durationMs: dur });
1284
+ console.error(` → ERRO: ${(err as Error).message}`);
1285
+ }
1286
+ }
1287
+
1288
+ const passed = results.filter(r => r.passed).length;
1289
+ const total = results.length;
1290
+ const successRate = ((passed / total) * 100).toFixed(1);
1291
+ const avgIter = (results.reduce((s, r) => s + r.iterations, 0) / total).toFixed(1);
1292
+
1293
+ console.log(`\n${"=".repeat(40)}`);
1294
+ console.log(`Taxa de sucesso: ${successRate}% (${passed}/${total})`);
1295
+ console.log(`Média de iterações: ${avgIter}`);
1296
+ console.log(`${"=".repeat(40)}`);
1297
+
1298
+ writeFileSync("data/eval-results.json", JSON.stringify({ summary: { successRate: parseFloat(successRate), passed, total, avgIterations: parseFloat(avgIter) }, results }, null, 2));
1299
+ console.log("\nResultados salvos em data/eval-results.json");
1300
+ }
1301
+
1302
+ main().catch(console.error);
1303
+ ```
1304
+
1305
+ **Critérios de aceitação**
1306
+ - [ ] Roda todos os casos sem travar (erro individual registrado e continua)
1307
+ - [ ] Gera `data/eval-results.json` com resultados por caso + sumário
1308
+ - [ ] Reporta taxa de sucesso, total de casos e média de iterações
1309
+ - [ ] **Taxa alvo:** ≥50% de sucesso nos casos do benchmark
1310
+
1311
+ **Como executar**
1312
+ ```bash
1313
+ OPENROUTER_API_KEY=sk-... npx ts-node scripts/evaluate.ts
1314
+ ```
1315
+
1316
+ ---
1317
+
1318
+ ## Resumo de Arquivos por Task
1319
+
1320
+ | Task | Arquivo | Ação |
1321
+ |------|---------|------|
1322
+ | TALP-1.1 | `tsconfig.json`, `package.json` | criar/atualizar |
1323
+ | TALP-1.2 | `src/.../types.ts`, `src/.../state.ts` | criar |
1324
+ | TALP-1.3 | `src/.../agent.ts` | criar (stubs) |
1325
+ | TALP-1.4 | `src/.../tools/scaffoldGenerator.ts` | criar |
1326
+ | TALP-1.5 | `src/.../agent.ts` | modificar (oracleNode real) |
1327
+ | TALP-2.1 | `src/.../prompts/system.ts` | criar |
1328
+ | TALP-2.2 | `src/.../utils/extractSolidity.ts` | criar |
1329
+ | TALP-2.3 | `src/.../agent.ts` | modificar (generatePoCNode real) |
1330
+ | TALP-2.4 | `scripts/setup-sandbox.sh`, `foundry.toml` | criar |
1331
+ | TALP-2.5 | `src/.../tools/foundryRunner.ts` | criar |
1332
+ | TALP-2.6 | `src/.../utils/logAnalyzer.ts` | criar |
1333
+ | TALP-2.7 | `src/.../agent.ts` | modificar (reflectNode real) |
1334
+ | TALP-2.8 | `src/.../agent.ts` | modificar (grafo final com loop) |
1335
+ | TALP-3.1 | `src/.../index.ts` | criar |
1336
+ | TALP-3.2 | `tests/e2e/poc-generator.test.ts` | criar |
1337
+ | TALP-3.3 | `data/benchmark.json` | criar |
1338
+ | TALP-3.4 | `scripts/evaluate.ts` | criar |
src/agents/tester/data/ExploitTest.t.sol ADDED
@@ -0,0 +1,262 @@
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
+ // SPDX-License-Identifier: MIT
2
+ pragma solidity 0.8.23;
3
+
4
+ import {Test} from "forge-std/Test.sol";
5
+ import {console} from "forge-std/console.sol";
6
+ import {Size} from "@src/Size.sol";
7
+ import {DepositParams} from "@src/libraries/actions/Deposit.sol";
8
+ import {WithdrawParams} from "@src/libraries/actions/Withdraw.sol";
9
+ import {RepayParams} from "@src/libraries/actions/Repay.sol";
10
+ import {BuyCreditMarketParams} from "@src/libraries/actions/BuyCreditMarket.sol";
11
+ import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
12
+ import {RESERVED_ID} from "@src/libraries/LoanLibrary.sol";
13
+
14
+ /**
15
+ * @title MulticallInvariantBypassPoC
16
+ * @notice Demonstrates how the multicall invariant check can be bypassed
17
+ *
18
+ * VULNERABILITY: The multicall function validates that borrowAToken increase <= debtToken decrease
19
+ * only at the END of all operations, checking NET changes. This allows attackers to:
20
+ * 1. Deposit massive amounts (exceeding cap)
21
+ * 2. Perform operations with excess liquidity
22
+ * 3. Withdraw excess before final validation
23
+ *
24
+ * The invariant passes because net changes appear compliant, but intermediate states
25
+ * violate the cap restrictions.
26
+ */
27
+ contract MulticallInvariantBypassPoC is Test {
28
+ Size public size;
29
+
30
+ address public attacker;
31
+ address public victim;
32
+ address public lender;
33
+
34
+ IERC20 public borrowToken;
35
+ IERC20 public collateralToken;
36
+
37
+ uint256 public constant INITIAL_BORROW_SUPPLY = 9_990_000e6; // 9.99M (10k below cap)
38
+ uint256 public constant BORROW_CAP = 10_000_000e6; // 10M cap
39
+ uint256 public constant ATTACKER_DEBT = 100_000e6; // 100k debt
40
+ uint256 public constant EXPLOIT_DEPOSIT = 5_000_000e6; // 5M deposit (far exceeds cap)
41
+ uint256 public constant EXPLOIT_WITHDRAW = 4_900_000e6; // 4.9M withdraw
42
+
43
+ function setUp() public {
44
+ // Setup test accounts
45
+ attacker = makeAddr("attacker");
46
+ victim = makeAddr("victim");
47
+ lender = makeAddr("lender");
48
+
49
+ // Deploy Size contract
50
+ // Note: In a real test, you would need to properly initialize Size with all dependencies
51
+ // For this PoC, we'll use a mock setup that demonstrates the vulnerability
52
+
53
+ vm.label(attacker, "Attacker");
54
+ vm.label(victim, "Victim");
55
+ vm.label(lender, "Lender");
56
+ }
57
+
58
+ /**
59
+ * @notice Demonstrates the cap bypass exploit
60
+ *
61
+ * ATTACK FLOW:
62
+ * 1. Deposit 5M USDC → borrowAToken supply jumps to 14.99M (4.99M over cap!)
63
+ * 2. Repay 100k debt → debtToken decreases by 100k
64
+ * 3. Withdraw 4.9M USDC → borrowAToken supply drops to 10M
65
+ *
66
+ * RESULT:
67
+ * - Net borrowAToken increase: 10k
68
+ * - Net debtToken decrease: 100k
69
+ * - Invariant check: 10k <= 100k ✓ PASSES
70
+ * - But attacker temporarily held 4.99M excess borrowAToken!
71
+ */
72
+ function testMulticallCapBypass() public {
73
+ // This test demonstrates the vulnerability conceptually
74
+ // In a real scenario, you would:
75
+ // 1. Deploy and initialize Size with proper configuration
76
+ // 2. Setup initial state with borrowAToken supply near cap
77
+ // 3. Create a debt position for the attacker
78
+ // 4. Execute the multicall exploit
79
+
80
+ console.log("=== MULTICALL CAP BYPASS VULNERABILITY ===");
81
+ console.log("");
82
+ console.log("INITIAL STATE:");
83
+ console.log("- BorrowAToken Supply: %s", INITIAL_BORROW_SUPPLY);
84
+ console.log("- BorrowAToken Cap: %s", BORROW_CAP);
85
+ console.log("- Space below cap: %s", BORROW_CAP - INITIAL_BORROW_SUPPLY);
86
+ console.log("- Attacker's debt: %s", ATTACKER_DEBT);
87
+ console.log("");
88
+
89
+ // Simulate the exploit flow
90
+ uint256 borrowSupplyBefore = INITIAL_BORROW_SUPPLY;
91
+ uint256 debtSupplyBefore = ATTACKER_DEBT;
92
+
93
+ console.log("EXPLOIT EXECUTION:");
94
+ console.log("");
95
+
96
+ // Step 1: Deposit 5M (exceeds cap by 4.99M)
97
+ console.log("Step 1: Deposit %s USDC", EXPLOIT_DEPOSIT);
98
+ uint256 borrowSupplyAfterDeposit = borrowSupplyBefore + EXPLOIT_DEPOSIT;
99
+ console.log(" -> BorrowAToken supply: %s", borrowSupplyAfterDeposit);
100
+ console.log(" -> EXCEEDS CAP BY: %s", borrowSupplyAfterDeposit - BORROW_CAP);
101
+ console.log("");
102
+
103
+ // Step 2: Repay 100k debt
104
+ console.log("Step 2: Repay %s debt", ATTACKER_DEBT);
105
+ uint256 debtSupplyAfterRepay = debtSupplyBefore - ATTACKER_DEBT;
106
+ uint256 borrowSupplyAfterRepay = borrowSupplyAfterDeposit - ATTACKER_DEBT;
107
+ console.log(" -> DebtToken supply: %s", debtSupplyAfterRepay);
108
+ console.log(" -> BorrowAToken supply: %s", borrowSupplyAfterRepay);
109
+ console.log("");
110
+
111
+ // Step 3: Withdraw 4.9M
112
+ console.log("Step 3: Withdraw %s USDC", EXPLOIT_WITHDRAW);
113
+ uint256 borrowSupplyAfter = borrowSupplyAfterRepay - EXPLOIT_WITHDRAW;
114
+ console.log(" -> BorrowAToken supply: %s", borrowSupplyAfter);
115
+ console.log("");
116
+
117
+ // Calculate net changes
118
+ uint256 netBorrowIncrease = borrowSupplyAfter - borrowSupplyBefore;
119
+ uint256 netDebtDecrease = debtSupplyBefore - 0; // All debt repaid
120
+
121
+ console.log("FINAL STATE:");
122
+ console.log("- Net borrowAToken increase: %s", netBorrowIncrease);
123
+ console.log("- Net debtToken decrease: %s", netDebtDecrease);
124
+ console.log("- Invariant check: %s <= %s", netBorrowIncrease, netDebtDecrease);
125
+ console.log("- Invariant status: %s", netBorrowIncrease <= netDebtDecrease ? "PASS" : "FAIL");
126
+ console.log("");
127
+
128
+ // Verify the invariant passes
129
+ assertLe(netBorrowIncrease, netDebtDecrease, "Invariant should pass");
130
+
131
+ console.log("=== VULNERABILITY CONFIRMED ===");
132
+ console.log("During execution, borrowAToken supply reached: %s", borrowSupplyAfterDeposit);
133
+ console.log("This EXCEEDED the cap of %s by: %s", BORROW_CAP, borrowSupplyAfterDeposit - BORROW_CAP);
134
+ console.log("");
135
+ console.log("The attacker temporarily held %s excess borrowAToken", EXPLOIT_DEPOSIT - ATTACKER_DEBT);
136
+ console.log("This excess could be used for:");
137
+ console.log(" - Market manipulation");
138
+ console.log(" - Arbitrage opportunities");
139
+ console.log(" - Flash-loan-like attacks");
140
+ console.log(" - Bypassing risk parameters");
141
+ console.log("");
142
+ console.log("Yet the invariant check PASSED because it only validates NET changes!");
143
+ }
144
+
145
+ /**
146
+ * @notice Demonstrates using excess liquidity for market manipulation
147
+ *
148
+ * This shows how the temporarily available excess borrowAToken can be weaponized
149
+ * during the multicall execution to manipulate markets or perform other attacks.
150
+ */
151
+ function testMulticallMarketManipulation() public {
152
+ console.log("=== MARKET MANIPULATION EXPLOIT ===");
153
+ console.log("");
154
+ console.log("ATTACK SCENARIO:");
155
+ console.log("1. Deposit %s USDC (exceeds cap)", EXPLOIT_DEPOSIT);
156
+ console.log("2. Use %s borrowAToken for market operations", EXPLOIT_WITHDRAW);
157
+ console.log("3. Repay %s debt", ATTACKER_DEBT);
158
+ console.log("4. Withdraw remaining excess");
159
+ console.log("");
160
+
161
+ uint256 excessLiquidity = EXPLOIT_DEPOSIT - ATTACKER_DEBT;
162
+
163
+ console.log("IMPACT:");
164
+ console.log("- Attacker gains temporary access to %s excess liquidity", excessLiquidity);
165
+ console.log("- This can be used to:");
166
+ console.log(" * Buy large credit positions (distorting market prices)");
167
+ console.log(" * Manipulate interest rates");
168
+ console.log(" * Front-run other users");
169
+ console.log(" * Extract value from the protocol");
170
+ console.log("");
171
+ console.log("- All while the invariant check passes!");
172
+ console.log("- The cap is meant to prevent exactly this kind of exposure");
173
+
174
+ // Verify the exploit provides significant excess liquidity
175
+ assertGt(excessLiquidity, 1_000_000e6, "Exploit should provide >1M excess liquidity");
176
+ }
177
+
178
+ /**
179
+ * @notice Demonstrates the root cause of the vulnerability
180
+ *
181
+ * The issue is that the invariant validation happens AFTER all multicall operations,
182
+ * checking only NET changes rather than intermediate states.
183
+ */
184
+ function testRootCauseAnalysis() public {
185
+ console.log("=== ROOT CAUSE ANALYSIS ===");
186
+ console.log("");
187
+ console.log("VULNERABLE CODE PATTERN:");
188
+ console.log("1. Multicall executes all operations sequentially");
189
+ console.log("2. During execution, deposit() skips cap validation:");
190
+ console.log(" if (!state.data.isMulticall) {");
191
+ console.log(" state.validateBorrowATokenCap();");
192
+ console.log(" }");
193
+ console.log("");
194
+ console.log("3. After all operations, invariant is checked:");
195
+ console.log(" validateBorrowATokenIncreaseLteDebtTokenDecrease()");
196
+ console.log("");
197
+ console.log("4. Invariant only compares NET changes:");
198
+ console.log(" borrowATokenSupplyIncrease = supplyAfter - supplyBefore");
199
+ console.log(" debtTokenSupplyDecrease = debtBefore - debtAfter");
200
+ console.log(" require(increase <= decrease)");
201
+ console.log("");
202
+ console.log("PROBLEM:");
203
+ console.log("- Intermediate states are NEVER validated");
204
+ console.log("- Attacker can deposit huge amounts, use them, then withdraw");
205
+ console.log("- As long as net changes satisfy the invariant, exploit succeeds");
206
+ console.log("");
207
+ console.log("CORRECT APPROACH:");
208
+ console.log("- Validate cap on EVERY deposit, even in multicall");
209
+ console.log("- OR track maximum supply reached during multicall");
210
+ console.log("- OR validate intermediate states, not just final state");
211
+ }
212
+
213
+ /**
214
+ * @notice Shows the mathematical proof of the bypass
215
+ */
216
+ function testMathematicalProof() public {
217
+ console.log("=== MATHEMATICAL PROOF ===");
218
+ console.log("");
219
+
220
+ uint256 S0 = INITIAL_BORROW_SUPPLY; // Initial supply
221
+ uint256 C = BORROW_CAP; // Cap
222
+ uint256 D = ATTACKER_DEBT; // Debt to repay
223
+ uint256 X = EXPLOIT_DEPOSIT; // Exploit deposit amount
224
+
225
+ console.log("Given:");
226
+ console.log(" S0 = %s (initial supply)", S0);
227
+ console.log(" C = %s (cap)", C);
228
+ console.log(" D = %s (debt)", D);
229
+ console.log(" X = %s (deposit amount)", X);
230
+ console.log("");
231
+
232
+ console.log("Execution:");
233
+ uint256 S1 = S0 + X;
234
+ console.log(" After deposit: S1 = S0 + X = %s", S1);
235
+ console.log(" Cap violation: S1 - C = %s", S1 - C);
236
+ console.log("");
237
+
238
+ uint256 S2 = S1 - D;
239
+ console.log(" After repay: S2 = S1 - D = %s", S2);
240
+ console.log("");
241
+
242
+ uint256 W = X - D;
243
+ uint256 S3 = S2 - W;
244
+ console.log(" After withdraw W = X - D = %s: S3 = %s", W, S3);
245
+ console.log("");
246
+
247
+ console.log("Invariant check:");
248
+ uint256 netIncrease = S3 - S0;
249
+ uint256 netDecrease = D;
250
+ console.log(" Net increase: S3 - S0 = %s", netIncrease);
251
+ console.log(" Net decrease: D = %s", netDecrease);
252
+ console.log(" Check: %s <= %s ? %s", netIncrease, netDecrease, netIncrease <= netDecrease);
253
+ console.log("");
254
+
255
+ console.log("Conclusion:");
256
+ console.log(" Invariant PASSES, but S1 = %s exceeded cap C = %s", S1, C);
257
+ console.log(" Excess exposure: %s", S1 - C);
258
+
259
+ assertTrue(netIncrease <= netDecrease, "Invariant passes");
260
+ assertTrue(S1 > C, "But cap was violated during execution");
261
+ }
262
+ }
src/agents/tester/data/input.json ADDED
@@ -0,0 +1,18 @@
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
+ {
2
+ "title": "Unrestricted Reward String in burn() Enables Log Poisoning and Off-Chain Manipulation",
3
+ "description": "The burn() function accepts an arbitrary user-supplied string as the 'recompensa' parameter and emits it directly in the RewardRedeemed event without any validation, allowlist check, or length restriction. Any caller can pass malicious, misleading, or excessively long strings into the on-chain event log. Off-chain systems (loyalty backends, indexers, dashboards) that consume this event and trust the 'recompensa' field are vulnerable to: (1) log poisoning / event spoofing — a user can emit 'recompensa' values like 'Admin Grant: 1000 free coffees' that were never authorized; (2) denial-of-service on indexers via extremely large strings; (3) injection attacks if the string is rendered in a web UI without sanitization.",
4
+ "recommendation": "Replace the free-form string parameter with an enumerated reward identifier (e.g. uint8 rewardId) and maintain an owner-controlled mapping of valid reward IDs to descriptions. This constrains what can appear in event logs to only administrator-approved values. Example refactor:\n\nsolidity\n// Owner-managed reward catalogue\nmapping(uint8 => string) public rewardCatalogue;\n\nfunction setReward(uint8 id, string calldata description) external onlyOwner {\n rewardCatalogue[id] = description;\n}\n\nfunction burn(uint256 amount, uint8 rewardId) public {\n require(amount > 0, \"CafeToken: quantidade invalida\");\n require(bytes(rewardCatalogue[rewardId]).length > 0, \"CafeToken: recompensa invalida\");\n require(balanceOf(msg.sender) >= amount, \"CafeToken: saldo insuficiente\");\n _burn(msg.sender, amount);\n emit RewardRedeemed(msg.sender, amount, rewardId);\n}\n\nThis ensures only legitimate, pre-approved rewards are ever recorded on-chain.",
5
+ "severity": "medium",
6
+ "codeSnippet": "function burn(uint256 amount, string memory recompensa) public {\n require(amount > 0, \"CafeToken: a quantidade a queimar deve ser maior que zero\");\n require(balanceOf(msg.sender) >= amount, \"CafeToken: saldo insuficiente para queimar tokens\");\n _burn(msg.sender, amount);\n emit RewardRedeemed(msg.sender, amount, recompensa); // <-- arbitrary user input emitted as event data\n}",
7
+ "location": "L71-L81",
8
+ "path": "contracts/CafeToken.sol",
9
+ "judgeReview": {
10
+ "review": "Confirmed valid finding. The vulnerability is real and the attack surface is well-defined. The burn() function places zero constraints on the 'recompensa' string before broadcasting it as an authoritative event. The severity is appropriately rated medium rather than high because: (a) no funds are directly at risk from the contract itself — a caller can only burn their own tokens; (b) the primary damage surface is off-chain systems and UX layers that consume events, not the on-chain state. However, in a loyalty program context where the event log IS the business record, the ability for any token holder to forge arbitrary reward redemption records is a meaningful integrity risk. The exploit is trivially reproducible with zero prerequisites beyond holding at least 1 CAFE token. The recommendation to use an enumerated reward catalogue with owner-gated registration is sound and idiomatic for this pattern.",
11
+ "confidence": 0.91,
12
+ "exploitablePaths": [
13
+ "Attacker holds ≥1 CAFE token → calls burn(1, 'Gold Member Upgrade: 500 free coffees') → forged RewardRedeemed event is emitted and indexed by the loyalty backend as a legitimate redemption record",
14
+ "Attacker calls burn(1, <64KB string>) repeatedly → bloats event logs and causes out-of-memory or timeout failures in off-chain indexers processing the RewardRedeemed event stream",
15
+ "Web dashboard renders recompensa field as raw HTML → attacker passes '<script>...</script>' as recompensa → stored XSS executes in the admin panel of any operator that displays redemption history without sanitization"
16
+ ]
17
+ }
18
+ }
src/config/constants.ts CHANGED
@@ -1,5 +1,7 @@
1
  const constants = {
2
  OPENROUTER_API_KEY: process.env.OPENROUTER_API_KEY || "",
 
 
3
  };
4
 
5
  export default constants;
 
1
  const constants = {
2
  OPENROUTER_API_KEY: process.env.OPENROUTER_API_KEY || "",
3
+ GOOGLE_API_KEY: process.env.GOOGLE_API_KEY || "",
4
+ MODEL_NAME: process.env.MODEL_NAME || "gemini-2.5-flash",
5
  };
6
 
7
  export default constants;
src/config/llm.ts ADDED
@@ -0,0 +1,31 @@
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
+ import { ChatGoogleGenerativeAI } from "@langchain/google-genai";
2
+ import { ChatAnthropic } from "@langchain/anthropic";
3
+ import type { BaseChatModel } from "@langchain/core/language_models/chat_models";
4
+
5
+ export type LLMProvider = "google" | "openrouter" | "anthropic";
6
+
7
+ export function createLLM(overrideProvider?: LLMProvider): BaseChatModel {
8
+ const provider = overrideProvider || (process.env.LLM_PROVIDER as LLMProvider) || "google";
9
+
10
+ switch (provider) {
11
+ case "openrouter": {
12
+ const { ChatOpenRouter } = require("@langchain/openrouter");
13
+ return new ChatOpenRouter({
14
+ model: process.env.OPENROUTER_MODEL || "google/gemini-2.5-flash",
15
+ temperature: 0.2,
16
+ }) as BaseChatModel;
17
+ }
18
+ case "anthropic":
19
+ return new ChatAnthropic({
20
+ model: process.env.ANTHROPIC_MODEL || "claude-sonnet-4-6",
21
+ temperature: 0.2,
22
+ });
23
+ case "google":
24
+ default:
25
+ return new ChatGoogleGenerativeAI({
26
+ apiKey: process.env.GOOGLE_API_KEY || "",
27
+ model: process.env.MODEL_NAME || "gemini-2.5-flash",
28
+ temperature: 0.2,
29
+ });
30
+ }
31
+ }
src/index.ts CHANGED
@@ -1,50 +1,61 @@
1
  import "dotenv/config";
2
 
 
 
 
 
3
  import { auditorAgent } from "./agents/auditor/agent.js";
4
  import { coderAgent } from "./agents/coder/agent.js";
5
  import { testerAgent } from "./agents/tester/agent.js";
 
6
  import type { VulnerabilityReport, Finding } from "./agents/tester/types.js";
7
 
8
- const requirements = ["ERC20 token", "pausable", "ownable"];
 
 
 
 
 
 
9
 
10
- const coderResult = await coderAgent.invoke({ requirements });
 
 
 
11
  console.log("======= Coder =======");
12
- // console.log(coderResult.contract);
13
 
14
- const auditorResult = await auditorAgent.invoke({ solidityFile: coderResult.contract });
 
 
 
 
 
 
15
  console.log("\n======= Auditor =======");
16
- // console.log(auditorResult.vulnerabilities);
17
 
18
- function mapFindingToReport(finding: Partial<Finding> & { type?: string; severity?: string }, sourceCode: string): VulnerabilityReport {
19
- const title = typeof finding.title === "string" && finding.title.trim().length > 0
20
- ? finding.title
21
- : typeof finding.type === "string" && finding.type.trim().length > 0
22
- ? finding.type
23
- : "Unknown vulnerability";
24
 
25
- const description = typeof finding.description === "string" && finding.description.trim().length > 0
26
- ? finding.description
27
- : "No description provided by auditor.";
 
 
28
 
 
 
 
 
29
  const nameMatch = finding.path?.match(/([^\/]+)\.sol$/);
30
  const contractName = nameMatch ? nameMatch[1] : "TargetContract";
31
 
32
- const exploitablePaths = Array.isArray(finding.judgeReview?.exploitablePaths)
33
- ? finding.judgeReview.exploitablePaths
34
- : [];
35
-
36
- const severity = finding.severity === "high" || finding.severity === "medium" || finding.severity === "low"
37
- ? finding.severity
38
- : "low";
39
-
40
- if (!finding.path || !finding.judgeReview) {
41
- console.warn("Auditor returned incomplete finding; using fallbacks for PoC generation.");
42
- }
43
 
44
  return {
45
  id: title.toLowerCase().replace(/[^a-z0-9]+/g, "-").slice(0, 50),
46
- severity,
47
- type: typeof finding.type === "string" && finding.type.trim().length > 0 ? finding.type : "custom",
 
48
  title,
49
  description,
50
  affectedContract: {
@@ -53,18 +64,18 @@ function mapFindingToReport(finding: Partial<Finding> & { type?: string; severit
53
  },
54
  attackVector: exploitablePaths[0] ?? "Unknown vector",
55
  exploitablePaths,
56
- codeSnippet: typeof finding.codeSnippet === "string" ? finding.codeSnippet : undefined,
57
- location: typeof finding.location === "string" ? finding.location : undefined,
58
  };
59
  }
60
 
61
- if (auditorResult.vulnerabilities.length > 0) {
62
- const finding = auditorResult.vulnerabilities[0] as Finding;
63
  const report = mapFindingToReport(finding, coderResult.contract);
64
 
 
65
  const testerResult = await testerAgent.invoke({ report });
66
 
67
- console.log("\n======= Tester =======");
68
  console.log("Status:", testerResult.status);
69
  console.log("Iterations:", testerResult.iterations);
70
  } else {
 
1
  import "dotenv/config";
2
 
3
+ import { readFileSync, mkdirSync, writeFileSync } from "node:fs";
4
+ import { resolve, dirname } from "node:path";
5
+ import { fileURLToPath } from "node:url";
6
+
7
  import { auditorAgent } from "./agents/auditor/agent.js";
8
  import { coderAgent } from "./agents/coder/agent.js";
9
  import { testerAgent } from "./agents/tester/agent.js";
10
+ import { logger } from "./logger.js";
11
  import type { VulnerabilityReport, Finding } from "./agents/tester/types.js";
12
 
13
+ const inputPath = process.argv[2];
14
+
15
+ if (!inputPath) {
16
+ console.log("Uso: npm start -- <caminho-do-arquivo-de-requisitos>");
17
+ console.log("Exemplo: npm start -- input/requirements.md");
18
+ process.exit(1);
19
+ }
20
 
21
+ const requirementsText = readFileSync(resolve(inputPath), "utf-8");
22
+ console.log("Requisitos carregados de:", inputPath);
23
+
24
+ const coderResult = await coderAgent.invoke({ requirements: [requirementsText] });
25
  console.log("======= Coder =======");
 
26
 
27
+ const __dirname = dirname(fileURLToPath(import.meta.url));
28
+ const outputDir = resolve(__dirname, "agents/coder/outputs");
29
+ mkdirSync(outputDir, { recursive: true });
30
+ writeFileSync(resolve(outputDir, "Contract.sol"), coderResult.contract, "utf-8");
31
+ writeFileSync(resolve(outputDir, "README.md"), requirementsText, "utf-8");
32
+ console.log("\nContrato e requisitos salvos em:", outputDir);
33
+
34
  console.log("\n======= Auditor =======");
35
+ logger.info("Starting auditorAgent");
36
 
37
+ const auditorResult = await auditorAgent.invoke({ repoPath: outputDir });
 
 
 
 
 
38
 
39
+ logger.info("Agent completed");
40
+ logger.info(`Findings: ${auditorResult.findings.length}`);
41
+ for (const f of auditorResult.findings) {
42
+ logger.info(` [${f.severity.toUpperCase()}] ${f.title} — ${f.location}`);
43
+ }
44
 
45
+ function mapFindingToReport(finding: any, sourceCode: string): VulnerabilityReport {
46
+ const title = finding.title || finding.type || "Unknown vulnerability";
47
+ const description = finding.description || "No description provided by auditor.";
48
+
49
  const nameMatch = finding.path?.match(/([^\/]+)\.sol$/);
50
  const contractName = nameMatch ? nameMatch[1] : "TargetContract";
51
 
52
+ const exploitablePaths = finding.judgeReview?.exploitablePaths || [];
 
 
 
 
 
 
 
 
 
 
53
 
54
  return {
55
  id: title.toLowerCase().replace(/[^a-z0-9]+/g, "-").slice(0, 50),
56
+ severity: (finding.severity === "high" || finding.severity === "medium" || finding.severity === "low")
57
+ ? finding.severity : "low",
58
+ type: finding.type || "custom",
59
  title,
60
  description,
61
  affectedContract: {
 
64
  },
65
  attackVector: exploitablePaths[0] ?? "Unknown vector",
66
  exploitablePaths,
67
+ codeSnippet: finding.codeSnippet,
68
+ location: finding.location
69
  };
70
  }
71
 
72
+ if (auditorResult.findings.length > 0) {
73
+ const finding = auditorResult.findings[0];
74
  const report = mapFindingToReport(finding, coderResult.contract);
75
 
76
+ console.log("\n======= Tester =======");
77
  const testerResult = await testerAgent.invoke({ report });
78
 
 
79
  console.log("Status:", testerResult.status);
80
  console.log("Iterations:", testerResult.iterations);
81
  } else {
src/logger.ts ADDED
@@ -0,0 +1,29 @@
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
+ import fs from "node:fs";
2
+ import path from "node:path";
3
+
4
+ import winston from "winston";
5
+
6
+ const logsDir = path.join(process.cwd(), "logs");
7
+ fs.mkdirSync(logsDir, { recursive: true });
8
+
9
+ const runTimestamp = new Date().toISOString().replace(/[:.]/g, "-");
10
+
11
+ const { combine, colorize, errors, printf, timestamp } = winston.format;
12
+
13
+ const lineFormat = printf(({ level, message, timestamp: ts, stack }) => {
14
+ const base = `${ts} [${level}] ${message}`;
15
+ return stack ? `${base}\n${stack}` : base;
16
+ });
17
+
18
+ export const logger = winston.createLogger({
19
+ level: "debug",
20
+ transports: [
21
+ new winston.transports.Console({
22
+ format: combine(colorize({ all: true }), timestamp({ format: "HH:mm:ss" }), errors({ stack: true }), lineFormat),
23
+ }),
24
+ new winston.transports.File({
25
+ filename: path.join(logsDir, `app-${runTimestamp}.log`),
26
+ format: combine(timestamp(), errors({ stack: true }), lineFormat),
27
+ }),
28
+ ],
29
+ });
src/server.ts ADDED
@@ -0,0 +1,107 @@
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
+ import "dotenv/config";
2
+
3
+ import { mkdirSync, writeFileSync } from "node:fs";
4
+ import { resolve } from "node:path";
5
+ import { tmpdir } from "node:os";
6
+ import { serve } from "@hono/node-server";
7
+ import { Hono } from "hono";
8
+ import { cors } from "hono/cors";
9
+ import { streamSSE } from "hono/streaming";
10
+ import { serveStatic } from "@hono/node-server/serve-static";
11
+
12
+ import { coderAgent } from "./agents/coder/agent.ts";
13
+ import { auditorAgent } from "./agents/auditor/agent.ts";
14
+ import { testerAgent } from "./agents/tester/agent.ts";
15
+
16
+ const app = new Hono();
17
+
18
+ app.use("/api/*", cors());
19
+
20
+ app.post("/api/run", (c) => {
21
+ return streamSSE(c, async (stream) => {
22
+ const body = await c.req.json<{ requirements: string }>();
23
+ const requirements = body.requirements?.trim();
24
+
25
+ if (!requirements) {
26
+ await stream.writeSSE({ event: "error", data: "Requisitos não fornecidos." });
27
+ return;
28
+ }
29
+
30
+ let eventId = 0;
31
+
32
+ const send = async (event: string, data: string) => {
33
+ await stream.writeSSE({ id: String(eventId++), event, data });
34
+ };
35
+
36
+ try {
37
+ // === CODER ===
38
+ await send("log", "[Coder] Gerando smart contract a partir dos requisitos...");
39
+ const coderResult = await coderAgent.invoke({ requirements: [requirements] });
40
+
41
+ await send("log", "[Coder] Contrato gerado com sucesso.");
42
+
43
+ if (coderResult.compilationErrors.length > 0) {
44
+ await send("log", `[Coder] Erros de compilação restantes: ${coderResult.compilationErrors.length}`);
45
+ } else {
46
+ await send("log", "[Coder] Contrato compilado sem erros.");
47
+ }
48
+
49
+ await send(
50
+ "coder",
51
+ JSON.stringify({
52
+ contract: coderResult.contract,
53
+ compilationErrors: coderResult.compilationErrors,
54
+ reviewSummary: coderResult.reviewSummary,
55
+ }),
56
+ );
57
+
58
+ // === AUDITOR ===
59
+ const outputDir = resolve(tmpdir(), `talp1-${Date.now()}`);
60
+ mkdirSync(outputDir, { recursive: true });
61
+ writeFileSync(resolve(outputDir, "Contract.sol"), coderResult.contract, "utf-8");
62
+ writeFileSync(resolve(outputDir, "README.md"), requirements, "utf-8");
63
+
64
+ await send("log", "[Auditor] Iniciando auditoria de segurança...");
65
+ const auditorResult = await auditorAgent.invoke({ repoPath: outputDir });
66
+ await send("log", `[Auditor] ${auditorResult.findings.length} vulnerabilidade(s) encontrada(s).`);
67
+ for (const f of auditorResult.findings) {
68
+ await send("log", `[Auditor] [${f.severity.toUpperCase()}] ${f.title} — ${f.location}`);
69
+ }
70
+
71
+ await send(
72
+ "auditor",
73
+ JSON.stringify({
74
+ findings: auditorResult.findings,
75
+ }),
76
+ );
77
+
78
+ // === TESTER ===
79
+ await send("log", "[Tester] Gerando testes de prova de conceito...");
80
+ const testerResult = await testerAgent.invoke({
81
+ solidityFiles: [coderResult.contract],
82
+ vulnerability: auditorResult.findings[0] ?? {},
83
+ });
84
+ await send("log", `[Tester] ${testerResult.results.length} resultado(s) de teste.`);
85
+
86
+ await send(
87
+ "tester",
88
+ JSON.stringify({
89
+ results: testerResult.results,
90
+ }),
91
+ );
92
+
93
+ await send("log", "Pipeline concluído.");
94
+ await send("done", "ok");
95
+ } catch (err) {
96
+ const message = err instanceof Error ? err.message : String(err);
97
+ await send("error", message);
98
+ }
99
+ });
100
+ });
101
+
102
+ // Serve static frontend files (built React app)
103
+ app.use("/*", serveStatic({ root: "./frontend/dist" }));
104
+
105
+ const port = Number(process.env.PORT) || 7860;
106
+ console.log(`Servidor rodando em http://localhost:${port}`);
107
+ serve({ fetch: app.fetch, port });