@dailephd/my-dev-kit-lab 0.3.2 → 0.3.3

package/dist/src/audits/core/jvmProjectMetadata.js

@@ -0,0 +1,106 @@
+import fs from "node:fs";
+import path from "node:path";
+const GRADLE_BUILD_FILE_NAMES = new Set(["build.gradle", "build.gradle.kts"]);
+const GRADLE_SETTINGS_FILE_NAMES = new Set(["settings.gradle", "settings.gradle.kts"]);
+const GRADLE_WRAPPER_FILE_NAMES = new Set(["gradlew", "gradlew.bat"]);
+// Conservative, single-line extraction: `rootProject.name = "foo"` (Groovy
+// or Kotlin DSL both use this exact call-and-assign shape). Does not handle
+// multi-line expressions, string concatenation, or computed values.
+const GRADLE_SETTINGS_PROJECT_NAME_PATTERN = /rootProject\.name\s*=\s*["']([^"']+)["']/;
+// Conservative, single-line/non-nested extraction: the first top-level
+// `<artifactId>...</artifactId>` in the file. Real pom.xml can nest an
+// `<artifactId>` inside `<parent>` or `<dependencies>`, which this naive
+// first-match scan cannot distinguish -- so this is intentionally treated as
+// best-effort only, matching this module's "leave null rather than guess"
+// policy for anything structurally ambiguous. A `<parent>` block, if present
+// before the project's own `<artifactId>`, is skipped over so the far more
+// common case (parent declared first, then the project's own coordinates)
+// resolves to the right value instead of the parent's.
+const POM_ARTIFACT_ID_PATTERN = /<artifactId>\s*([^<\s][^<]*?)\s*<\/artifactId>/;
+function findSourceSetDirectories(inventory, segment, language) {
+    const dirName = `src/${segment}/${language}`;
+    const prefix = `${dirName}/`;
+    const found = inventory.files.some((f) => f.relativePath === dirName || f.relativePath.startsWith(prefix));
+    return found ? [dirName] : [];
+}
+export function collectJvmProjectMetadata(targetRoot, inventory) {
+    const warnings = [];
+    const knownPaths = new Set(inventory.files.map((f) => f.relativePath));
+    const recognizedBuildFiles = inventory.files
+        .map((f) => f.relativePath)
+        .filter((relativePath) => {
+        const basename = path.posix.basename(relativePath);
+        return (GRADLE_BUILD_FILE_NAMES.has(basename) ||
+            GRADLE_SETTINGS_FILE_NAMES.has(basename) ||
+            GRADLE_WRAPPER_FILE_NAMES.has(basename) ||
+            basename === "pom.xml" ||
+            basename === "gradle.properties");
+    })
+        .sort((a, b) => a.localeCompare(b));
+    const hasGradleBuild = recognizedBuildFiles.some((p) => GRADLE_BUILD_FILE_NAMES.has(path.posix.basename(p)));
+    const hasGradleSettings = recognizedBuildFiles.some((p) => GRADLE_SETTINGS_FILE_NAMES.has(path.posix.basename(p)));
+    const hasMavenPom = knownPaths.has("pom.xml");
+    const hasGradleWrapper = recognizedBuildFiles.some((p) => GRADLE_WRAPPER_FILE_NAMES.has(path.posix.basename(p)));
+    const javaSourceDirs = findSourceSetDirectories(inventory, "main", "java");
+    const kotlinSourceDirs = findSourceSetDirectories(inventory, "main", "kotlin");
+    const javaTestDirs = findSourceSetDirectories(inventory, "test", "java");
+    const kotlinTestDirs = findSourceSetDirectories(inventory, "test", "kotlin");
+    // Source-set directory presence is a conservative signal only -- a
+    // project can validly keep Java/Kotlin files outside the conventional
+    // src/main|test/{java,kotlin} layout, so this does not attempt to prove
+    // "has no Java/Kotlin source"; it only reports the conventional-layout
+    // signal explicitly. hasJavaSource/hasKotlinSource below fall back to any
+    // scanned file of that language so they stay meaningful even for
+    // non-conventional layouts.
+    const hasJavaSource = javaSourceDirs.length > 0 || inventory.filesByLanguage.java > 0;
+    const hasKotlinSource = kotlinSourceDirs.length > 0 || inventory.filesByLanguage.kotlin > 0;
+    const hasJavaTests = javaTestDirs.length > 0;
+    const hasKotlinTests = kotlinTestDirs.length > 0;
+    const recognizedSourceDirectories = [...new Set([...javaSourceDirs, ...kotlinSourceDirs])].sort((a, b) => a.localeCompare(b));
+    const recognizedTestDirectories = [...new Set([...javaTestDirs, ...kotlinTestDirs])].sort((a, b) => a.localeCompare(b));
+    let projectName = null;
+    if (hasGradleSettings) {
+        const settingsPath = recognizedBuildFiles.find((p) => GRADLE_SETTINGS_FILE_NAMES.has(path.posix.basename(p)));
+        if (settingsPath) {
+            const content = readSafely(targetRoot, settingsPath, warnings);
+            if (content !== null) {
+                const match = content.match(GRADLE_SETTINGS_PROJECT_NAME_PATTERN);
+                if (match)
+                    projectName = match[1];
+            }
+        }
+    }
+    if (projectName === null && hasMavenPom) {
+        const content = readSafely(targetRoot, "pom.xml", warnings);
+        if (content !== null) {
+            const withoutParentBlock = content.replace(/<parent>[\s\S]*?<\/parent>/, "");
+            const match = withoutParentBlock.match(POM_ARTIFACT_ID_PATTERN);
+            if (match)
+                projectName = match[1];
+        }
+    }
+    return {
+        hasGradleBuild,
+        hasGradleSettings,
+        hasMavenPom,
+        hasGradleWrapper,
+        hasJavaSource,
+        hasKotlinSource,
+        hasJavaTests,
+        hasKotlinTests,
+        recognizedBuildFiles,
+        recognizedSourceDirectories,
+        recognizedTestDirectories,
+        projectName,
+        warnings,
+    };
+}
+function readSafely(targetRoot, relativePath, warnings) {
+    try {
+        return fs.readFileSync(path.join(targetRoot, relativePath), "utf8");
+    }
+    catch (err) {
+        warnings.push(`Could not read ${relativePath}: ${err instanceof Error ? err.message : String(err)}`);
+        return null;
+    }
+}

package/dist/src/audits/core/kotlinAnalyzer.js

@@ -0,0 +1,280 @@
+// ---------------------------------------------------------------------------
+// v0.3.3 Batch 1 -- conservative, dependency-free Kotlin source analyzer.
+//
+// There is no Kotlin compiler/parser available in this Node/TypeScript
+// project, and per this batch's scope this analyzer must not add a new
+// parser dependency. Facts are extracted with the same style of
+// brace-depth-tracking line scan as javaAnalyzer.ts -- not a real
+// tokenizer, not an AST, and not a syntax validator.
+//
+// What this DOES extract:
+//   - a single `package foo.bar` declaration (no trailing `;` required)
+//   - `import foo.bar.Baz` and `import foo.bar.Baz as Alias` (recorded via
+//     the existing generic ImportFactKind "static" -- "resolved through a
+//     static, syntactic import statement", the same meaning already used
+//     by every other analyzer in this project)
+//   - class, data class, interface, and object declarations (data class ->
+//     DeclarationFactKind "class"; object -> "class", the closest safe
+//     existing kind for a singleton declaration -- there is no dedicated
+//     object kind in the shared model)
+//   - `enum class Foo` -> DeclarationFactKind "enum"
+//   - top-level function declarations (`fun foo(...)`) -> kind "function"
+//   - member function declarations directly inside a class/interface/
+//     object body -> kind "method"
+//   - visibility (public/internal/protected/private), folded into the
+//     existing `exported` boolean -- see "Visibility mapping" below
+//   - line counts, parse/analyze status, and diagnostics for degraded
+//     parsing
+//
+// What this explicitly does NOT do: real Kotlin compilation, type
+// inference, extension-function semantic resolution (an extension
+// function's receiver type is not modeled -- only the function's own
+// identifier is recorded as its name), coroutine behavior, multiplatform
+// source-set semantics, Android/Compose lifecycle behavior, runtime
+// behavior, semantic duplicate-implementation proof, or dead-code proof.
+// Property (`val`/`var`) declarations are not extracted (out of this
+// batch's required scope, and harder to distinguish conservatively from
+// local variable declarations via regex alone).
+//
+// Visibility mapping (no SourceFacts schema change):
+//   Same reasoning as javaAnalyzer.ts. Kotlin's default (no modifier) is
+//   `public`, unlike Java's package-private default -- so `exported` is
+//   true unless an explicit `internal`, `protected`, or `private` modifier
+//   is present. This intentionally collapses internal/protected/private
+//   into a single "not exported" bucket; callers needing that distinction
+//   must re-derive it from source.
+// ---------------------------------------------------------------------------
+export const KOTLIN_ANALYZER_ID = "kotlin-analyzer";
+const SUPPORTED_EXTENSIONS = [".kt", ".kts"];
+// Mirrors typescriptJavaScriptAnalyzer.ts/pythonAnalyzer.ts/javaAnalyzer.ts's
+// bound.
+const MAX_ANALYZABLE_BYTES = 1_000_000;
+const PACKAGE_LINE_PATTERN = /^\s*package\s+([\w.]+)\s*;?\s*$/;
+const IMPORT_LINE_PATTERN = /^\s*import\s+([\w.]+(?:\.\*)?)(?:\s+as\s+(\w+))?\s*;?\s*$/;
+const VISIBILITY_WORDS = "(?:public|internal|protected|private)";
+const OTHER_TYPE_MODIFIER_WORDS = "(?:open|final|abstract|sealed|inner|data|annotation|enum|companion|value|actual|expect)";
+const TYPE_DECL_PATTERN = new RegExp(`^\\s*(${VISIBILITY_WORDS}\\s+)?((?:${OTHER_TYPE_MODIFIER_WORDS}\\s+)*)(class|interface|object)\\s+(\\w+)`);
+// Optional generic receiver/type parameters and an optional extension-
+// function receiver (`ReceiverType.`) before the function name -- the
+// receiver itself is discarded, only the final identifier is kept as the
+// function's name (see header comment).
+const FUN_LINE_PATTERN = new RegExp(`^\\s*(${VISIBILITY_WORDS}\\s+)?(?:(?:override|open|final|abstract|inline|suspend|operator|infix|tailrec|external)\\s+)*fun(?:\\s*<[^>]*>)?\\s+(?:[\\w<>?.]+\\.)?(\\w+)\\s*\\(`);
+export const KOTLIN_ANALYZER = {
+    id: KOTLIN_ANALYZER_ID,
+    supportedLanguages: ["kotlin"],
+    supportedExtensions: SUPPORTED_EXTENSIONS,
+    analyzeFile,
+};
+function analyzeFile(input) {
+    const { relativePath, language, role, content, inventoryEntry } = input;
+    if (Buffer.byteLength(content, "utf8") > MAX_ANALYZABLE_BYTES) {
+        return {
+            relativePath,
+            language,
+            role,
+            parseStatus: "file-level-only",
+            analyzerId: KOTLIN_ANALYZER_ID,
+            lineCount: inventoryEntry.lineCount,
+            imports: [],
+            exports: [],
+            declarations: [],
+            references: [],
+            diagnostics: [
+                {
+                    severity: "info",
+                    code: "file-too-large-for-analysis",
+                    message: `File exceeds the ${MAX_ANALYZABLE_BYTES}-byte analyzer bound; only inventory-level facts are available.`,
+                    path: relativePath,
+                    analyzerId: KOTLIN_ANALYZER_ID,
+                },
+            ],
+        };
+    }
+    const diagnostics = [];
+    const { logical, hadUnterminatedBlockComment, hadUnterminatedRawString } = buildLogicalLines(content);
+    const imports = [];
+    const declarations = [];
+    const scopeStack = [];
+    let depth = 0;
+    for (let i = 0; i < logical.length; i++) {
+        const line = logical[i];
+        const lineNumber = i + 1;
+        if (line.trim().length === 0) {
+            continue;
+        }
+        const importMatch = line.match(IMPORT_LINE_PATTERN);
+        if (importMatch) {
+            imports.push({
+                source: importMatch[1],
+                kind: "static",
+                line: lineNumber,
+                ...(importMatch[2] ? { importedNames: [importMatch[2]] } : {}),
+            });
+        }
+        const typeMatch = line.match(TYPE_DECL_PATTERN);
+        let isEnumClass = false;
+        if (typeMatch) {
+            isEnumClass = /(?:^|\s)enum(?:\s|$)/.test(typeMatch[2]);
+        }
+        if (typeMatch) {
+            const rawKeyword = typeMatch[3]; // "class" | "interface" | "object"
+            const name = typeMatch[4];
+            const exported = typeMatch[1] === undefined || typeMatch[1].trim() === "public";
+            declarations.push({
+                name,
+                kind: isEnumClass ? "enum" : rawKeyword === "interface" ? "interface" : "class",
+                exported,
+                line: lineNumber,
+            });
+        }
+        else if (scopeStack.length > 0 && depth === scopeStack[scopeStack.length - 1].bodyDepth) {
+            const funMatch = line.match(FUN_LINE_PATTERN);
+            if (funMatch) {
+                const exported = funMatch[1] === undefined || funMatch[1].trim() === "public";
+                declarations.push({ name: funMatch[2], kind: "method", exported, line: lineNumber });
+            }
+        }
+        else if (scopeStack.length === 0) {
+            const funMatch = line.match(FUN_LINE_PATTERN);
+            if (funMatch) {
+                const exported = funMatch[1] === undefined || funMatch[1].trim() === "public";
+                declarations.push({ name: funMatch[2], kind: "function", exported, line: lineNumber });
+            }
+        }
+        const depthBefore = depth;
+        depth += countChar(line, "{") - countChar(line, "}");
+        if (typeMatch) {
+            const rawKeyword = typeMatch[3];
+            // class/object and interface both get a scope frame ("object" is
+            // tracked as a "class"-kind scope for member-function purposes);
+            // whether the opening `{` lands on this line or a later one, the
+            // eventual `{` bumps depth to exactly depthBefore + 1 either way --
+            // same reasoning as javaAnalyzer.ts's scope push.
+            const scopeKind = rawKeyword === "interface" ? "interface" : "class";
+            scopeStack.push({ kind: scopeKind, bodyDepth: depthBefore + 1 });
+        }
+        while (scopeStack.length > 0 && depth < scopeStack[scopeStack.length - 1].bodyDepth) {
+            scopeStack.pop();
+        }
+    }
+    if (hadUnterminatedRawString) {
+        diagnostics.push({
+            severity: "error",
+            code: "unterminated-raw-string",
+            message: 'File appears to contain an unterminated """ raw string; facts from this best-effort scan may be incomplete.',
+            path: relativePath,
+            analyzerId: KOTLIN_ANALYZER_ID,
+        });
+    }
+    if (hadUnterminatedBlockComment) {
+        diagnostics.push({
+            severity: "error",
+            code: "unterminated-block-comment",
+            message: "File appears to contain an unterminated /* block comment; facts from this best-effort scan may be incomplete.",
+            path: relativePath,
+            analyzerId: KOTLIN_ANALYZER_ID,
+        });
+    }
+    const parseStatus = hadUnterminatedRawString || hadUnterminatedBlockComment ? "parse-error" : "parsed";
+    return {
+        relativePath,
+        language,
+        role,
+        parseStatus,
+        analyzerId: KOTLIN_ANALYZER_ID,
+        lineCount: inventoryEntry.lineCount,
+        imports,
+        exports: [],
+        declarations,
+        references: [],
+        diagnostics,
+    };
+}
+function countChar(line, ch) {
+    let count = 0;
+    for (let i = 0; i < line.length; i++) {
+        if (line[i] === ch)
+            count += 1;
+    }
+    return count;
+}
+// ---------------------------------------------------------------------------
+// Comment/string stripping (heuristic, not a tokenizer). Strips `//` line
+// comments and `/* ... */` block comments (which may span multiple lines),
+// blanks out `"..."`/`'...'` single-line literal contents (escape-aware),
+// and blanks out `"""..."""` raw strings (which may span multiple lines,
+// no escape processing inside -- mirrors pythonAnalyzer.ts's triple-quote
+// handling, since Kotlin raw strings share the same "arbitrary content
+// until the next matching triple-quote marker" shape).
+// ---------------------------------------------------------------------------
+function buildLogicalLines(content) {
+    const rawLines = content.split(/\r\n|\r|\n/);
+    const logical = [];
+    let inBlockComment = false;
+    let inRawString = false;
+    for (const rawLine of rawLines) {
+        if (inRawString) {
+            const closeIdx = rawLine.indexOf('"""');
+            if (closeIdx === -1) {
+                logical.push("");
+                continue;
+            }
+            inRawString = false;
+            logical.push(stripLine(rawLine.slice(closeIdx + 3)));
+            continue;
+        }
+        logical.push(stripLine(rawLine));
+    }
+    return { logical, hadUnterminatedBlockComment: inBlockComment, hadUnterminatedRawString: inRawString };
+    function stripLine(line) {
+        let result = "";
+        let i = 0;
+        while (i < line.length) {
+            if (inBlockComment) {
+                const closeIdx = line.indexOf("*/", i);
+                if (closeIdx === -1)
+                    return result;
+                inBlockComment = false;
+                i = closeIdx + 2;
+                continue;
+            }
+            const ch = line[i];
+            if (ch === "/" && line[i + 1] === "/")
+                return result;
+            if (ch === "/" && line[i + 1] === "*") {
+                inBlockComment = true;
+                i += 2;
+                continue;
+            }
+            if (line.slice(i, i + 3) === '"""') {
+                const closeIdx = line.indexOf('"""', i + 3);
+                if (closeIdx === -1) {
+                    inRawString = true;
+                    return result;
+                }
+                i = closeIdx + 3;
+                continue;
+            }
+            if (ch === '"' || ch === "'") {
+                const quote = ch;
+                let j = i + 1;
+                while (j < line.length) {
+                    if (line[j] === "\\") {
+                        j += 2;
+                        continue;
+                    }
+                    if (line[j] === quote) {
+                        j += 1;
+                        break;
+                    }
+                    j += 1;
+                }
+                i = j;
+                continue;
+            }
+            result += ch;
+            i += 1;
+        }
+        return result;
+    }
+}

package/dist/src/audits/core/languageAnalyzerRegistry.js

@@ -1,5 +1,7 @@
 import { TYPESCRIPT_JAVASCRIPT_ANALYZER } from "./typescriptJavaScriptAnalyzer.js";
 import { PYTHON_ANALYZER } from "./pythonAnalyzer.js";
+import { JAVA_ANALYZER } from "./javaAnalyzer.js";
+import { KOTLIN_ANALYZER } from "./kotlinAnalyzer.js";
 // Validates a list has no duplicate analyzer ids. Later batches call this
 // when assembling their own registries; Batch 2's empty default trivially
 // passes.
@@ -27,10 +29,14 @@ export function selectLanguageAnalyzer(registry, language, extension) {
     return null;
 }
 // v0.3.1 Batch 3 -- registers the TypeScript/JavaScript analyzer. v0.3.2
-// Batch 1 adds the Python analyzer alongside it. Java and Kotlin remain
-// fallback-only (no analyzer registered for them) -- see
-// collectSourceFacts.ts's fallback policy.
+// Batch 1 adds the Python analyzer alongside it. v0.3.3 Batch 1 adds Java
+// and Kotlin (see javaAnalyzer.ts/kotlinAnalyzer.ts) -- no other language
+// remains fallback-only by design change here; any language not in this
+// list still degrades through collectSourceFacts.ts's existing fallback
+// policy unchanged.
 export const DEFAULT_LANGUAGE_ANALYZER_REGISTRY = createLanguageAnalyzerRegistry([
     TYPESCRIPT_JAVASCRIPT_ANALYZER,
     PYTHON_ANALYZER,
+    JAVA_ANALYZER,
+    KOTLIN_ANALYZER,
 ]);

package/dist/src/audits/core/projectInventory.js

@@ -384,6 +384,25 @@ function isPythonTestFile(relativePath, basename) {
         return true;
     return /^test_.*\.py$/.test(basename) || /^.*_test\.py$/.test(basename);
 }
+// v0.3.3 Batch 1 -- conservative JVM (Java/Kotlin) test naming/source-set
+// conventions. Gated to .java/.kt so this can never reclassify an unrelated
+// file. "tests/**/*.java" and "tests/**/*.kt" are already covered by the
+// generic, extension-agnostic check above; this adds the Gradle/Maven
+// standard "src/test/{java,kotlin}" source-set layout, the singular "test/"
+// directory convention (same style as isPythonTestFile's "test/" check
+// above), and the "*Test(s).java" / "*Test(s).kt" / "*Spec.kt" filename
+// conventions.
+function isJvmTestFile(relativePath, basename, extension) {
+    if (relativePath.includes("src/test/java/") || relativePath.includes("src/test/kotlin/"))
+        return true;
+    if (relativePath.startsWith("test/") || relativePath.includes("/test/"))
+        return true;
+    if (extension === ".java")
+        return /Tests?\.java$/.test(basename);
+    if (extension === ".kt")
+        return /Tests?\.kt$/.test(basename) || /Spec\.kt$/.test(basename);
+    return false;
+}
 function isTestFile(relativePath, basename, extension) {
     if (relativePath.startsWith("tests/") || relativePath.includes("/tests/"))
         return true;
@@ -391,6 +410,8 @@ function isTestFile(relativePath, basename, extension) {
         return true;
     if (extension === ".py" && isPythonTestFile(relativePath, basename))
         return true;
+    if ((extension === ".java" || extension === ".kt") && isJvmTestFile(relativePath, basename, extension))
+        return true;
     return false;
 }
 // v0.3.2 Batch 1 -- recognized Python project/config metadata filenames.
@@ -405,6 +426,24 @@ const PYTHON_PROJECT_METADATA_FILE_NAMES = new Set([
     "tox.ini",
     "pytest.ini",
 ]);
+// v0.3.3 Batch 1 -- recognized JVM (Gradle/Maven) project/build metadata
+// filenames. Same narrow, basename-only convention as
+// PYTHON_PROJECT_METADATA_FILE_NAMES above: does not match arbitrary *.xml/
+// *.properties files, only these exact names. `build.gradle.kts` and
+// `settings.gradle.kts` matter in particular: without this, a Gradle Kotlin
+// DSL build script would otherwise fall through to the generic
+// KNOWN_SOURCE_EXTENSIONS ".kts" -> "source" classification below and be fed
+// to the Kotlin source-facts analyzer as if it were application code.
+const JVM_PROJECT_METADATA_FILE_NAMES = new Set([
+    "build.gradle",
+    "build.gradle.kts",
+    "settings.gradle",
+    "settings.gradle.kts",
+    "pom.xml",
+    "gradle.properties",
+    "gradlew",
+    "gradlew.bat",
+]);
 function isConfigFile(relativePath, basename, extension) {
     if (/^tsconfig(\..+)?\.json$/.test(basename))
         return true;
@@ -420,6 +459,8 @@ function isConfigFile(relativePath, basename, extension) {
     // here for the same "project metadata, not source" reasoning.
     if (basename === "setup.py" || PYTHON_PROJECT_METADATA_FILE_NAMES.has(basename))
         return true;
+    if (JVM_PROJECT_METADATA_FILE_NAMES.has(basename))
+        return true;
     // Root-level dotfile configs (e.g. .prettierrc, .babelrc) not already
     // covered above -- deliberately conservative (root-only, not recursive)
     // to avoid misclassifying dotfiles inside fixture/benchmark projects.

package/dist/src/audits/security/securityAuditAdapter.js

@@ -1,9 +1,8 @@
-import fs from "node:fs";
 import path from "node:path";
 import { runSecurityValidation } from "../../securityValidation/validate/runSecurityValidation.js";
 import { reportFilenamePrefix } from "../../securityValidation/validate/resolveTarget.js";
-import { renderJsonReport, renderTextReport } from "../../securityValidation/report/renderSecurityReport.js";
 import { buildSecurityReportFromSummary } from "../../securityValidation/report/buildSecurityReport.js";
+import { writeSecurityReportFiles } from "../../securityValidation/report/writeSecurityReportFiles.js";
 import { DEFAULT_SECURITY_CHECKS, DEFAULT_SECURITY_PROFILE } from "../../securityValidation/validate/cliOptions.js";
 import { verdictToHumanLabel } from "../../securityValidation/validate/verdict.js";
 import { mapSecurityFindingToAuditIssue } from "./mapSecurityFindingToAuditIssue.js";
@@ -23,23 +22,21 @@ export async function runSecurityAuditAdapter(options) {
         selectedChecks: [...DEFAULT_SECURITY_CHECKS],
         formats: ["text", "json"],
     });
-    // Always under my-dev-kit-lab's own reports/ tree (toolRoot), never under
-    // the audited target's root — matches the target-safety guarantee
-    // AuditTarget.safeReportOutputRoot already documents for code-rot reports.
     const reportDir = path.join(toolRoot, "reports", "security");
-    if (!fs.existsSync(reportDir)) {
-        fs.mkdirSync(reportDir, { recursive: true });
-    }
     const prefix = reportFilenamePrefix({
         isSelf: summary.isSelf,
         packageName: summary.packageName,
         packageVersion: summary.packageVersion,
         targetRoot: summary.targetRoot,
     });
-    const textPath = path.join(reportDir, `${prefix}-security-validation.txt`);
-    const jsonPath = path.join(reportDir, `${prefix}-security-validation.json`);
-    fs.writeFileSync(textPath, renderTextReport(report), "utf8");
-    fs.writeFileSync(jsonPath, renderJsonReport(report), "utf8");
+    const runSuffix = buildRunScopedReportSuffix(summary.startedAt, summary.finishedAt);
+    const { textPath, jsonPath } = writeSecurityReportFiles({
+        outDir: reportDir,
+        prefix,
+        report,
+        formats: ["text", "json"],
+        reportPathSuffix: runSuffix,
+    });
     const findingCounts = {
         blocker: summary.findings.filter((f) => f.severity === "blocker").length,
         major: summary.findings.filter((f) => f.severity === "major").length,
@@ -65,3 +62,9 @@ export async function runSecurityAuditAdapter(options) {
     };
     return { issues, summary: securitySummary };
 }
+function buildRunScopedReportSuffix(startedAt, finishedAt) {
+    return `${sanitizeTimestamp(startedAt)}-${sanitizeTimestamp(finishedAt)}-${process.pid}`;
+}
+function sanitizeTimestamp(value) {
+    return value.replace(/[^0-9]/g, "").slice(0, 14) || "run";
+}

package/dist/src/securityValidation/report/writeSecurityReportFiles.js

@@ -0,0 +1,28 @@
+import fs from "node:fs";
+import path from "node:path";
+import { renderJsonReport, renderTextReport } from "./renderSecurityReport.js";
+export function writeSecurityReportFiles(options) {
+    const reportDir = options.outDir;
+    if (!fs.existsSync(reportDir)) {
+        fs.mkdirSync(reportDir, { recursive: true });
+    }
+    const basename = options.reportPathSuffix
+        ? `${options.prefix}-${options.reportPathSuffix}-security-validation`
+        : `${options.prefix}-security-validation`;
+    const textPath = options.formats.includes("text")
+        ? path.join(reportDir, `${basename}.txt`)
+        : null;
+    const jsonPath = options.formats.includes("json")
+        ? path.join(reportDir, `${basename}.json`)
+        : null;
+    const writtenPaths = [];
+    if (textPath) {
+        fs.writeFileSync(textPath, renderTextReport(options.report), "utf8");
+        writtenPaths.push(textPath);
+    }
+    if (jsonPath) {
+        fs.writeFileSync(jsonPath, renderJsonReport(options.report), "utf8");
+        writtenPaths.push(jsonPath);
+    }
+    return { textPath, jsonPath, writtenPaths };
+}