@dailephd/my-dev-kit-lab 0.2.1 → 0.3.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 dailephd LLC
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,8 +1,10 @@
 # my-dev-kit-lab
 
-my-dev-kit-lab is the experiment, evidence, reporting, and demo companion for [my-dev-kit](https://github.com/your-org/my-dev-kit). It runs reproducible experiments that test whether my-dev-kit's graph-guided retrieval helps coding-agent workflows, collects metrics, renders reports, generates plots, captures screenshots, and builds gallery outputs.
+my-dev-kit-lab is the experiment, evidence, reporting, security-validation, and future audit companion for my-dev-kit. It runs reproducible experiments that test whether my-dev-kit's graph-guided retrieval helps coding-agent workflows, collects metrics, renders reports, generates plots, captures screenshots, builds gallery outputs, and performs automated CLI/package security validation.
 
-As of v0.2.1, my-dev-kit-lab also exposes a generic experiment-plugin framework for validating local developer tools, security checks, codebase workflows, retrieval strategies, and experiment outcomes. The first plugin is `context-strategy-comparison`, which preserves the existing raw-full-file vs my-dev-kit-guided workflow through the plugin runner.
+The current package version is `v0.3.0` (release-prepared; not yet published to npm, tagged, or released on GitHub). The latest published npm baseline is `v0.2.2`. Its generic experiment-plugin framework was introduced in v0.2.0. The first plugin is `context-strategy-comparison`, which preserves the existing raw-full-file vs my-dev-kit-guided workflow through the plugin runner.
+
+my-dev-kit is most useful when the repository is larger than the task. It helps coding agents work with large codebases through reusable structural indexing, graph-guided retrieval, targeted source slices, and auditable context selection. Results are scoped evidence; the project does not claim that my-dev-kit always saves tokens.
 
 **my-dev-kit** is the repo indexing and graph-guided retrieval engine.
 **my-dev-kit-lab** is the separate lab layer that feeds it benchmark inputs and records evaluation outputs.
@@ -29,7 +31,8 @@ As of v0.2.1, my-dev-kit-lab also exposes a generic experiment-plugin framework
 - First experiment plugin: `context-strategy-comparison`
 - Target-aware experiment execution for local projects via `experiment:run -- --target <path>`
 - Plugin-aware JSON and HTML reports with plugin, target, variant, metric, artifact, warning, skip, and failure metadata
-- Security validation framework: dependency audit, package tarball inspection, CLI adversarial tests, static scans (CodeQL/Semgrep), bounded fuzz smoke, and release verdict — runnable against any local project via `security:validate --target <path>`
+- Security validation framework: dependency audit, package tarball inspection, CLI adversarial tests, static scans (CodeQL/Semgrep), bounded fuzz smoke, attack-scenario checks, and structured verdict/report output — runnable against any local project via `security:validate --target <path>`
+- Generic audit framework (package.json now specifies version `v0.3.0`; release-prepared but not yet published to npm, tagged, or released on GitHub): `npm run audit` runs heuristic, conservative code-rot detectors and writes text/JSON reports under `reports/audits/code-rot/` by default. Only the `code-rot` audit type is currently implemented; `quality`, `security`, `project`, and `all` audit types are planned and fail cleanly instead of running. `npm run audit` supports `--target`, `--types code-rot`, and other flags — see [docs/COMMANDS.md](docs/COMMANDS.md). Audit does not modify target files, does not auto-fix issues, does not run `security:validate`, and does not perform release-readiness determination.
 
 ---
 
@@ -37,19 +40,14 @@ As of v0.2.1, my-dev-kit-lab also exposes a generic experiment-plugin framework
 
 ```mermaid
 flowchart TD
-  A[Benchmark Projects] --> B[Prompt Variants]
-  B --> C[Agent Adapters\nfake-agent / Codex / Claude]
-  C --> D[Controlled Experiment Runner]
-  D --> E[Experiment Artifacts\nJSON]
-  E --> F[Report Renderer]
-  E --> G[Plot Generator]
-  E --> H[Visualization Demos]
-  F --> I[HTML Report + optional PNG]
-  G --> J[SVG Charts]
-  H --> K[Demo Artifacts]
-  I --> L[Gallery]
-  J --> L
-  K --> L
+  A[scripts/experiments] --> B[Experiment plugin registry + runner]
+  B --> C[context-strategy-comparison]
+  C --> D[Controlled experiment foundations]
+  D --> E[Plugin + legacy artifacts]
+  E --> F[Plugin-aware reports]
+  E --> G[Plots / screenshots / gallery]
+  H[scripts/security] --> I[Automated security validation]
+  I --> J[Security reports + verdict]
 ```
 
 ---
@@ -205,7 +203,7 @@ See [docs/METRICS.md](docs/METRICS.md) for full metric definitions.
 
 ## Current baseline release positioning
 
-my-dev-kit-lab is at a working baseline. The raw-vs-indexed experiment pipeline is fully implemented and produces reproducible artifacts. Real-agent campaign support exists for Codex and Claude. v0.2.1 keeps the generic experiment-plugin framework, preserves `context-strategy-comparison` as the first plugin, and fixes target-aware security validation so installed-package checks run `npm run test:security` in the external target project root.
+my-dev-kit-lab is at a working baseline. The raw-vs-indexed experiment pipeline is fully implemented and produces reproducible artifacts. Real-agent campaign support exists for Codex and Claude. The latest published npm baseline is `v0.2.2`, which implements the automated security-validation fortification work described below and has passed pre-release readiness and cross-platform validation. package.json now specifies version `v0.3.0`, which adds the generic audit framework described below; `v0.3.0` is release-prepared but has not yet been published to npm, tagged, or released on GitHub.
 
 ---
 
@@ -223,7 +221,7 @@ This is not a web application pentest framework. **my-dev-kit** is a local CLI/p
 - database-free
 - safe to run on local repositories
 
-The release gate is implemented as of v0.1.4. It combines static scans, dependency/package checks, adversarial CLI tests, bounded fuzz smoke tests, and a structured release security report with a four-category verdict.
+The automated validation gate is implemented. It combines static scans, dependency/package checks, adversarial CLI tests, bounded fuzz smoke tests, and attack-scenario checks with structured text/JSON reports and a four-category verdict.
 
 ### Security commands
 
@@ -233,15 +231,23 @@ The release gate is implemented as of v0.1.4. It combines static scans, dependen
 | `npm run security:package` | npm pack --dry-run, forbidden content detection |
 | `npm run security:codeql` | CodeQL CLI availability check; skipped gracefully when absent |
 | `npm run security:semgrep` | Semgrep scan via local binary or npx; skipped gracefully when both absent |
-| `npm run test:security` | 165 adversarial CLI tests (path traversal, read-only boundaries, malformed artifacts, JSON safety, fuzz targets) |
+| `npm run test:security` | Automated security and adversarial CLI tests (path traversal, read-only boundaries, malformed artifacts, JSON safety, and related checks) |
 | `npm run test:fuzz:smoke` | 9 bounded fuzz targets, seeded PRNG, completes in under 1 second |
-| `npm run security:validate` | Full release gate — runs all checks and writes `reports/security/<prefix>-security-validation.{txt,json}` |
+| `npm run security:validate` | Runs selected security checks, applies profile-aware defaults when requested, and writes text/JSON reports according to `--format` |
+
+CodeQL, Semgrep, and OSV-Scanner are optional. When unavailable locally, they are recorded as `skipped` in the report, not as passed. That can lead to `ready except optional manual checks`; it does not silently turn missing tooling into a clean pass.
+
+Each security command can validate my-dev-kit-lab itself or another local project via `--target <path>`. When `--target` is omitted, the framework performs self-validation. Target projects are inspected in place: their source files are not modified by default, generated artifacts stay under `reports/security/` unless `--out` is used, and external-target reports identify the tool root, target root, target package metadata, target git metadata, command cwd, exit code, and stdout/stderr summaries.
+
+`security:validate` supports `--checks`, `--profile`, `--format`, `--fail-on`, `--out`, and `--report-prefix`. The no-flag path remains backward compatible and still runs the classic implemented check groups: `deps`, `package`, `static`, `cli-adversarial`, and `fuzz`. Supplying `--profile` without `--checks` swaps in that profile's default checks; supplying explicit `--checks` always wins over profile defaults.
+
+The current attack-scenario checks cover boundary, subprocess, secrets, and network assumptions. They are automated adversarial checks, not a manual pentest. `verdictImpact` metadata from each registered scenario drives blocker categorization in report reasoning, and narrowed `--checks` runs are labeled as scoped rather than described as a full release gate.
 
-CodeQL, Semgrep, and OSV-Scanner are optional. When unavailable locally, they are recorded as `skipped` in the report — not as failures — and the verdict is `ready except optional manual checks` rather than `not ready`.
+JSON report poisoning/config-injection checks use a baseline-diff schema guard so legitimate additive JSON fields do not fail the guard while payload-created trusted top-level fields still do. Text reports are sanitized to strip ANSI/control-byte payloads before rendering.
 
-Each security command can validate my-dev-kit-lab itself or another local project via `--target <path>`. When `--target` is omitted, the framework performs self-validation. Target projects are inspected in place: their source files are not modified, generated artifacts stay under `reports/security/`, and external-target reports identify the tool root, target root, target package metadata, target git metadata, command cwd, exit code, and stdout/stderr summaries.
-
-For external-target validation, `security:validate` reads the target `package.json`, detects `scripts.test:security`, and runs `npm run test:security` in the target project root when that script exists. This behavior is validated both from the source checkout and from an installed packed tarball because published-package execution differs from local source execution.
+Known limits remain intentionally explicit: secret scanning is bounded rather than exhaustive, the network/local-first check is a bounded static assumption check rather than proof of runtime isolation, package-boundary severity is still result-level rather than per-evidence-item, and profile-specific scenario behavior is limited to profile-based scenario selection/default checks.
+
+For external-target validation, `security:validate` reads the target `package.json`, detects `scripts.test:security`, and runs `npm run test:security` in the target project root when that script exists. This behavior is validated both from the source checkout and from an installed packed tarball because published-package execution differs from local source execution.
 
 Generated security reports under `reports/security/` are excluded from git by default. They are produced locally or in CI as release-gate evidence and are not committed to the repository.
 
@@ -249,6 +255,12 @@ See [docs/COMMANDS.md](docs/COMMANDS.md) for full command options and [docs/secu
 
 ---
 
+## License
+
+MIT License. See [LICENSE](LICENSE) for the full text.
+
+---
+
 ## Support
 
 my-dev-kit-lab is an independent project by dailephd LLC, developed and maintained by Dai Le.

package/dist/scripts/audits/runAudit.js

@@ -0,0 +1,101 @@
+#!/usr/bin/env node
+import { parseAuditArgs, normalizeAuditConfig } from "../../src/audits/core/auditConfig.js";
+import { resolveAuditTarget } from "../../src/audits/core/auditTarget.js";
+import { runAudit } from "../../src/audits/core/auditRunner.js";
+import { AUDIT_EXIT_CODES } from "../../src/audits/core/auditExitCode.js";
+import { resolveToolRoot } from "../security/resolveToolRoot.js";
+import { buildAuditReportModel } from "../../src/audits/report/auditReportModel.js";
+import { writeAuditReports } from "../../src/audits/report/writeAuditReports.js";
+// ---------------------------------------------------------------------------
+// v0.3.0 Batch 5 -- npm run audit entrypoint.
+//
+// Thin wiring only: parse args -> normalize config -> resolve target ->
+// runAudit() -> buildAuditReportModel() -> writeAuditReports() -> print a
+// concise console summary -> set process.exitCode. All report-shaping logic
+// (the former inline buildJsonReport()/renderMinimalTextSummary()/
+// summarizeInventory()/summarizeSourceOfTruth() functions from Batch 1/2)
+// now lives in src/audits/report/ -- see auditReportModel.ts,
+// renderAuditJsonReport.ts, renderAuditTextReport.ts, writeAuditReports.ts.
+// Mirrors the structure of scripts/security/validate.ts.
+// ---------------------------------------------------------------------------
+const USAGE = "Usage: npm run audit -- [--target <path>] [--types code-rot] " +
+    "[--include docs,tests,package,architecture,cli] [--format text,json] " +
+    "[--fail-on blocker|high|medium|low|none] [--out <path>]";
+const rawArgs = process.argv.slice(2);
+const toolRoot = resolveToolRoot(import.meta.url);
+let config;
+try {
+    const args = parseAuditArgs(rawArgs);
+    config = normalizeAuditConfig(args, toolRoot);
+}
+catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    console.error(`\nERROR: ${msg}`);
+    console.error(USAGE);
+    process.exitCode = AUDIT_EXIT_CODES.FATAL_ERROR;
+    process.exit(AUDIT_EXIT_CODES.FATAL_ERROR);
+}
+let target;
+try {
+    target = resolveAuditTarget(config.targetPathArg, toolRoot);
+}
+catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    console.error(`\nERROR: ${msg}`);
+    console.error(USAGE);
+    process.exitCode = AUDIT_EXIT_CODES.FATAL_ERROR;
+    process.exit(AUDIT_EXIT_CODES.FATAL_ERROR);
+}
+console.log("=".repeat(60));
+console.log("my-dev-kit-lab audit");
+console.log("=".repeat(60));
+console.log(`Tool root  : ${toolRoot}`);
+if (!target.isSelf) {
+    console.log(`Target     : ${target.rootPath}`);
+}
+else {
+    console.log(`Mode       : self-audit`);
+}
+console.log(`Types      : ${config.types.join(", ")}`);
+console.log(`Include    : ${config.include.join(", ")}`);
+console.log("");
+let result;
+try {
+    result = await runAudit({ config, toolRoot, target });
+}
+catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    console.error(`\nERROR: audit runtime failure: ${msg}`);
+    process.exitCode = AUDIT_EXIT_CODES.FATAL_ERROR;
+    process.exit(AUDIT_EXIT_CODES.FATAL_ERROR);
+}
+const model = buildAuditReportModel(result, { target });
+const { writtenPaths } = writeAuditReports({ model, config, outDir: config.out });
+console.log(`Issues found        : ${model.summary.totalIssues}`);
+console.log(`  blocker=${model.summary.issuesBySeverity.blocker} high=${model.summary.issuesBySeverity.high} medium=${model.summary.issuesBySeverity.medium} low=${model.summary.issuesBySeverity.low} info=${model.summary.issuesBySeverity.info}`);
+console.log(`Skipped detectors    : ${model.summary.skippedDetectorCount}`);
+if (model.summary.detectorErrorCount > 0) {
+    console.log(`Detector errors      : ${model.summary.detectorErrorCount}`);
+    for (const e of model.detectorErrors) {
+        console.log(`  [${e.id}] ${e.message}`);
+    }
+}
+if (model.summary.noDetectorsRegistered) {
+    console.log(`Note: no code-rot detectors are registered for this run's --types/--include selection -- this run collected inventory/source-of-truth data only.`);
+}
+console.log(`\nInventory: ${model.inventory.totalScannedFileCount} file(s) scanned, ${model.inventory.skippedFileCount} skipped`);
+console.log(`  source=${model.inventory.filesByCategory.source} tests=${model.inventory.filesByCategory.tests} docs=${model.inventory.filesByCategory.docs} package=${model.inventory.filesByCategory.package} config=${model.inventory.filesByCategory.config} scripts=${model.inventory.filesByCategory.scripts} ci=${model.inventory.filesByCategory.ci}`);
+console.log(`Source of truth: package=${model.sourceOfTruth.packageName ?? "(none)"}@${model.sourceOfTruth.packageVersion ?? "?"} readme=${model.sourceOfTruth.hasReadme} changelog=${model.sourceOfTruth.hasChangelog} ciWorkflows=${model.sourceOfTruth.ciWorkflowCount}`);
+if (writtenPaths.length > 0) {
+    console.log(`\nReports written:`);
+    for (const p of writtenPaths) {
+        console.log(`  ${p}`);
+    }
+}
+console.log(`\nHighest severity: ${model.summary.highestSeverity ?? "(none)"}`);
+console.log(`Verdict: ${model.summary.finalVerdictLabel}`);
+console.log(`Exit reason: ${model.exit.reason}`);
+console.log(model.exit.code === AUDIT_EXIT_CODES.SUCCESS
+    ? `Exit 0 -- audit completed.`
+    : `Exit 1 -- fail-on threshold breached.`);
+process.exitCode = model.exit.code;

package/dist/scripts/security/validate.js

@@ -4,11 +4,34 @@ import fs from "node:fs";
 import { runSecurityValidation } from "../../src/securityValidation/validate/runSecurityValidation.js";
 import { resolveValidationTarget, reportFilenamePrefix } from "../../src/securityValidation/validate/resolveTarget.js";
 import { renderTextReport, renderJsonReport } from "../../src/securityValidation/report/renderSecurityReport.js";
+import { parseSecurityValidateArgs, normalizeSecurityValidateConfig, applyProfileDefaultChecksIfApplicable, } from "../../src/securityValidation/validate/cliOptions.js";
+import { resolveAttackProfile } from "../../src/securityValidation/attackScenarios/attackProfile.js";
+import { findingsBreachFailOnThreshold } from "../../src/securityValidation/validate/verdict.js";
 import { resolveToolRoot } from "./resolveToolRoot.js";
+const USAGE = "Usage: npm run security:validate -- [--target <path>] [--out <dir>] [--report-prefix <name>] " +
+    "[--checks deps,package,static,cli-adversarial,fuzz,boundary,subprocess,secrets,network] " +
+    "[--profile node-cli-package|local-tool|npm-package] [--format text,json] [--fail-on blocker|high|medium|low]";
 // Parse CLI arguments from process.argv (after the node/tsx and script path).
 const rawArgs = process.argv.slice(2);
-const args = parseArgs(rawArgs);
 const toolRoot = resolveToolRoot(import.meta.url);
+let args;
+let config;
+try {
+    args = parseSecurityValidateArgs(rawArgs);
+    config = normalizeSecurityValidateConfig(args, toolRoot);
+    // v0.2.2 Batch 5: --profile with no --checks uses that profile's declared
+    // default checks. No-op unless the user passed --profile without --checks
+    // (see applyProfileDefaultChecksIfApplicable's guard) — the true no-flag
+    // case and any explicit --checks case are always unaffected.
+    config = applyProfileDefaultChecksIfApplicable(config, resolveAttackProfile(config.profile).defaultCheckIds);
+}
+catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    console.error(`\nERROR: ${msg}`);
+    console.error(USAGE);
+    process.exitCode = 1;
+    process.exit(1);
+}
 // Resolve and validate target early so we can fail fast with a clean error.
 let target;
 try {
@@ -17,7 +40,7 @@ try {
 catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     console.error(`\nERROR: ${msg}`);
-    console.error("Usage: npm run security:validate -- [--target <path>] [--out <dir>] [--report-prefix <name>]");
+    console.error(USAGE);
     process.exitCode = 1;
     process.exit(1);
 }
@@ -33,13 +56,30 @@ if (!target.isSelf) {
 else {
     console.log(`Mode       : self-validation`);
 }
+if (!config.checksWereDefault) {
+    console.log(`Checks     : ${config.checks.join(", ")}`);
+}
+if (config.plannedChecksRequested.length > 0) {
+    console.log(`Note       : ${config.plannedChecksRequested.join(", ")} are routed through the attack-scenario framework rather than the classic check-group runners. Review the attack-scenario section in the report for their concrete results.`);
+}
 console.log("");
 const summary = await runSecurityValidation({
     cwd: toolRoot,
     targetPath: args.target,
     fuzzIterations: parseInt(process.env["FUZZ_ITERATIONS"] ?? "50", 10),
     fuzzSeed: parseInt(process.env["FUZZ_SEED"] ?? "0xDEADBEEF", 16),
+    // Full selection (implemented + planned/attack-scenario ids) — the runner
+    // gates both implemented check groups and attack-scenario checks off the
+    // same selectedChecks set.
+    selectedChecks: config.checks,
+    profile: config.profile,
 });
+// v0.2.2 Batch 5: --fail-on breach is additive to (never a substitute for)
+// the existing verdict-based exit decision below — it can only escalate
+// exit 0 to exit 1 (e.g. --fail-on medium/low catching minor/informational
+// findings the verdict policy doesn't already treat as blocking), never
+// downgrade an existing blocker.
+const failOnBreached = findingsBreachFailOnThreshold(summary.findings, config.failOnThreshold);
 // Build report object
 const report = {
     metadata: {
@@ -55,19 +95,25 @@ const report = {
         isSelf: summary.isSelf,
         generatedAt: summary.finishedAt,
         totalDurationMs: new Date(summary.finishedAt).getTime() - new Date(summary.startedAt).getTime(),
+        profile: config.profile,
+        selectedChecks: config.checks,
+        failOnThreshold: config.failOnThreshold,
+        formats: config.formats,
+        failOnBreached,
+        isFullReleaseGate: summary.isFullReleaseGate,
     },
     sections: [],
     allChecks: summary.checks,
     allFindings: summary.findings,
     verdict: summary.verdict,
     recommendedNextStep: summary.recommendedNextStep,
+    attackResults: summary.attackResults,
+    verdictReasonSummary: summary.verdictReasonSummary,
 };
 const textReport = renderTextReport(report);
 const jsonReport = renderJsonReport(report);
 // Determine output directory
-const reportsDir = args.out
-    ? path.resolve(args.out)
-    : path.join(toolRoot, "reports", "security");
+const reportsDir = config.out;
 if (!fs.existsSync(reportsDir)) {
     fs.mkdirSync(reportsDir, { recursive: true });
 }
@@ -75,14 +121,22 @@ if (!fs.existsSync(reportsDir)) {
 const prefix = args.reportPrefix ?? reportFilenamePrefix(target);
 const txtPath = path.join(reportsDir, `${prefix}-security-validation.txt`);
 const jsonPath = path.join(reportsDir, `${prefix}-security-validation.json`);
-fs.writeFileSync(txtPath, textReport, "utf8");
-fs.writeFileSync(jsonPath, jsonReport, "utf8");
+const writtenPaths = [];
+if (config.formats.includes("text")) {
+    fs.writeFileSync(txtPath, textReport, "utf8");
+    writtenPaths.push(txtPath);
+}
+if (config.formats.includes("json")) {
+    fs.writeFileSync(jsonPath, jsonReport, "utf8");
+    writtenPaths.push(jsonPath);
+}
 // Print report to stdout
 console.log(textReport);
 console.log(`\nReports written:`);
-console.log(`  ${txtPath}`);
-console.log(`  ${jsonPath}`);
-// Exit code based on verdict
+for (const p of writtenPaths) {
+    console.log(`  ${p}`);
+}
+// Exit code based on verdict, escalated (never downgraded) by --fail-on.
 const blockerExists = summary.verdict === "not-ready-security-blocker-remains";
 const inconclusive = summary.verdict === "inconclusive-audit-environment-incomplete";
 if (blockerExists) {
@@ -93,26 +147,11 @@ else if (inconclusive) {
     console.warn("\nExit 2 — audit environment incomplete.");
     process.exitCode = 2;
 }
+else if (failOnBreached) {
+    console.error(`\nExit 1 — --fail-on ${config.failOnThreshold} threshold breached.`);
+    process.exitCode = 1;
+}
 else {
     console.log("\nExit 0 — validation completed.");
     process.exitCode = 0;
 }
-// ---------------------------------------------------------------------------
-// Argument parser
-// ---------------------------------------------------------------------------
-function parseArgs(argv) {
-    const result = {};
-    for (let i = 0; i < argv.length; i++) {
-        const arg = argv[i];
-        if ((arg === "--target" || arg === "-t") && i + 1 < argv.length) {
-            result.target = argv[++i];
-        }
-        else if (arg === "--out" && i + 1 < argv.length) {
-            result.out = argv[++i];
-        }
-        else if (arg === "--report-prefix" && i + 1 < argv.length) {
-            result.reportPrefix = argv[++i];
-        }
-    }
-    return result;
-}

package/dist/src/audits/codeRot/codeRotDetectors.js

@@ -0,0 +1,17 @@
+// ---------------------------------------------------------------------------
+// v0.3.0 Batch 3 — code-rot detector aggregator.
+//
+// Single import surface for src/audits/core/auditRegistry.ts's
+// DEFAULT_AUDIT_REGISTRY. Keeps the registry file from needing to know each
+// detector's individual file path.
+// ---------------------------------------------------------------------------
+export { STALE_COMMAND_REFERENCE_DETECTOR } from "./detectors/staleCommandReferenceDetector.js";
+export { DOCS_CODE_MISMATCH_DETECTOR } from "./detectors/docsCodeMismatchDetector.js";
+export { PACKAGE_RELEASE_ROT_DETECTOR } from "./detectors/packageReleaseRotDetector.js";
+export { DUPLICATE_IMPLEMENTATION_DETECTOR } from "./detectors/duplicateImplementationDetector.js";
+export { DEAD_CODE_CANDIDATE_DETECTOR } from "./detectors/deadCodeCandidateDetector.js";
+export { TEST_ROT_DETECTOR } from "./detectors/testRotDetector.js";
+export { ARCHITECTURE_DRIFT_DETECTOR } from "./detectors/architectureDriftDetector.js";
+export { DEPENDENCY_ENVIRONMENT_ROT_DETECTOR } from "./detectors/dependencyEnvironmentRotDetector.js";
+export { CROSS_PLATFORM_ROT_DETECTOR } from "./detectors/crossPlatformRotDetector.js";
+export { SECURITY_VALIDATION_ASSUMPTION_ROT_DETECTOR } from "./detectors/securityValidationAssumptionRotDetector.js";