@decohere/ci-tools 0.0.1-dev.6 → 0.0.1-dev.61

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decohere/ci-tools",
-  "version": "0.0.1-dev.6",
+  "version": "0.0.1-dev.61",
   "description": "CI utility scripts for badge generation, coverage reporting, pages artifact assembly, and GitHub API tooling",
   "keywords": [
     "typescript",
@@ -22,9 +22,11 @@
     "./badges/ci-status": "./src/badges/ci-status.mjs",
     "./pages/artifact": "./src/pages/artifact.mjs",
     "./pages/smoke": "./src/pages/smoke.mjs",
+    "./audit/format": "./src/audit/format.mjs",
     "./audit/summarize": "./src/audit/summarize.mjs",
     "./audit/enforce": "./src/audit/enforce.mjs",
     "./audit/upsert-issue": "./src/audit/upsert-issue.mjs",
+    "./audit/upsert-clickup": "./src/audit/upsert-clickup.mjs",
     "./bench/bench": "./src/bench/bench.mjs",
     "./bench/trace": "./src/bench/trace.mjs",
     "./changeset/aggregate-changelog": "./src/changeset/aggregate-changelog.mjs",

package/src/audit/enforce.mjs

@@ -1,4 +1,5 @@
 import { readFileSync } from "node:fs";
+import { formatLog, highCritical, parseAudit } from "./format.mjs";
 
 const auditFilePath = process.argv[2] ?? "npm-audit.json";
 
@@ -10,12 +11,13 @@ try {
 	process.exit(1);
 }
 
-const vulnerabilities = data.metadata?.vulnerabilities ?? {};
-const high = vulnerabilities.high ?? 0;
-const critical = vulnerabilities.critical ?? 0;
+const parsed = parseAudit(data);
+const blocking = highCritical(parsed);
 
-if (high > 0 || critical > 0) {
-	console.error(`Security gate failed: high=${high}, critical=${critical}`);
+if (blocking.length > 0) {
+	console.error(
+		`Security gate failed: high=${parsed.high}, critical=${parsed.critical}\n${formatLog({ ...parsed, advisories: blocking })}`,
+	);
 	process.exit(1);
 }
 

package/src/audit/format.mjs

@@ -0,0 +1,133 @@
+/**
+ * Shared npm/pnpm audit JSON helpers.
+ *
+ * Supports pnpm's classic `{ advisories }` report and npm audit v2
+ * `{ auditReportVersion: 2, vulnerabilities }` (pnpm 9+/10).
+ */
+
+const SEVERITY_ORDER = ["critical", "high", "moderate", "low", "info"];
+
+function ghsaFromUrl(url) {
+	return typeof url === "string" ? (url.match(/GHSA-[a-z0-9-]+/i)?.[0] ?? "") : "";
+}
+
+function fromClassicAdvisories(data) {
+	return Object.values(data?.advisories ?? {}).map((raw) => {
+		const paths = (raw.findings ?? []).flatMap((f) => f.paths ?? []);
+		const url = raw.url ?? "";
+		return {
+			id: raw.id,
+			module: raw.module_name ?? "(unknown)",
+			severity: String(raw.severity ?? "info").toLowerCase(),
+			title: raw.title ?? "",
+			url,
+			vulnerable: raw.vulnerable_versions ?? "",
+			patched: raw.patched_versions ?? "",
+			cves: raw.cves ?? [],
+			ghsa: ghsaFromUrl(url),
+			paths: paths.slice(0, 3),
+		};
+	});
+}
+
+function fromNpmV2(data) {
+	const byKey = new Map();
+	for (const vuln of Object.values(data?.vulnerabilities ?? {})) {
+		const vias = Array.isArray(vuln.via) ? vuln.via : [];
+		for (const via of vias) {
+			if (via == null || typeof via !== "object") continue;
+			const url = via.url ?? "";
+			const key = url || `${via.name ?? vuln.name}:${via.title ?? ""}`;
+			const existing = byKey.get(key);
+			const node = Array.isArray(vuln.nodes) ? vuln.nodes[0] : undefined;
+			if (existing) {
+				if (node && existing.paths.length < 3 && !existing.paths.includes(node)) {
+					existing.paths.push(node);
+				}
+				continue;
+			}
+			byKey.set(key, {
+				id: via.source,
+				module: via.name ?? vuln.name ?? "(unknown)",
+				severity: String(via.severity ?? vuln.severity ?? "info").toLowerCase(),
+				title: via.title ?? "",
+				url,
+				vulnerable: via.range ?? vuln.range ?? "",
+				patched: "",
+				cves: [],
+				ghsa: ghsaFromUrl(url),
+				paths: node ? [node] : [],
+			});
+		}
+	}
+	return [...byKey.values()];
+}
+
+export function parseAudit(data) {
+	const counts = data?.metadata?.vulnerabilities ?? {};
+	const info = counts.info ?? 0;
+	const low = counts.low ?? 0;
+	const moderate = counts.moderate ?? 0;
+	const high = counts.high ?? 0;
+	const critical = counts.critical ?? 0;
+	const total = counts.total ?? info + low + moderate + high + critical;
+
+	const classic = data?.advisories != null && Object.keys(data.advisories).length > 0;
+	const advisories = classic ? fromClassicAdvisories(data) : fromNpmV2(data);
+
+	advisories.sort((a, b) => {
+		const d = SEVERITY_ORDER.indexOf(a.severity) - SEVERITY_ORDER.indexOf(b.severity);
+		if (d !== 0) return d;
+		return String(a.module).localeCompare(String(b.module));
+	});
+
+	return { total, critical, high, moderate, low, info, advisories };
+}
+
+export function formatLog(parsed) {
+	const lines = [
+		`npm audit: total=${parsed.total} critical=${parsed.critical} high=${parsed.high} moderate=${parsed.moderate} low=${parsed.low} info=${parsed.info}`,
+	];
+	for (const a of parsed.advisories) {
+		const id = a.ghsa || a.cves[0] || a.id;
+		lines.push(
+			`  [${a.severity}] ${a.module} ${id}: ${a.title} (vulnerable ${a.vulnerable}; patched ${a.patched})`,
+		);
+		if (a.url) lines.push(`    ${a.url}`);
+		if (a.paths[0]) lines.push(`    ${a.paths[0]}`);
+	}
+	return `${lines.join("\n")}\n`;
+}
+
+export function formatMarkdown(parsed) {
+	const lines = [
+		"## npm audit",
+		"",
+		"| Severity | Count |",
+		"|---|---|",
+		`| Critical | ${parsed.critical} |`,
+		`| High | ${parsed.high} |`,
+		`| Moderate | ${parsed.moderate} |`,
+		`| Low | ${parsed.low} |`,
+		`| Info | ${parsed.info} |`,
+		`| **Total** | **${parsed.total}** |`,
+		"",
+	];
+	if (parsed.advisories.length === 0) {
+		lines.push("No advisories.");
+		return `${lines.join("\n")}\n`;
+	}
+	lines.push("### Advisories", "");
+	for (const a of parsed.advisories) {
+		const id = a.ghsa || a.cves.join(", ") || a.id;
+		const link = a.url ? `[${id}](${a.url})` : id;
+		lines.push(`- **${a.severity}** \`${a.module}\` ${link} — ${a.title}`);
+		lines.push(`  - vulnerable: \`${a.vulnerable}\`; patched: \`${a.patched}\``);
+		if (a.paths[0]) lines.push(`  - ${a.paths[0]}`);
+	}
+	return `${lines.join("\n")}\n`;
+}
+
+export function highCritical(parsed) {
+	return parsed.advisories.filter((a) => a.severity === "high" || a.severity === "critical");
+}

package/src/audit/summarize.mjs

@@ -1,46 +1,24 @@
 import { appendFileSync, readFileSync } from "node:fs";
+import { formatLog, formatMarkdown, parseAudit } from "./format.mjs";
 
 const auditFilePath = process.argv[2] ?? "npm-audit.json";
 
-function writeSummary(lines) {
-	const summaryText = `${lines.join("\n")}\n`;
+function writeSummary(text) {
 	if (process.env.GITHUB_STEP_SUMMARY) {
-		appendFileSync(process.env.GITHUB_STEP_SUMMARY, summaryText);
-		return;
+		appendFileSync(process.env.GITHUB_STEP_SUMMARY, text);
 	}
-	process.stdout.write(summaryText);
 }
 
 let data = null;
 try {
 	data = JSON.parse(readFileSync(auditFilePath, "utf8"));
 } catch {
-	writeSummary([
-		"## Security Audit",
-		"",
-		"- npm audit output could not be parsed.",
-		`- See uploaded \`${auditFilePath}\` artifact for raw output.`,
-	]);
-	process.exit(0);
+	const msg = `npm audit output could not be parsed (${auditFilePath}).\n`;
+	process.stderr.write(msg);
+	writeSummary(`## Security Audit\n\n- ${msg}`);
+	process.exit(1);
 }
 
-const vulnerabilities = data.metadata?.vulnerabilities ?? {};
-const info = vulnerabilities.info ?? 0;
-const low = vulnerabilities.low ?? 0;
-const moderate = vulnerabilities.moderate ?? 0;
-const high = vulnerabilities.high ?? 0;
-const critical = vulnerabilities.critical ?? 0;
-const total = vulnerabilities.total ?? info + low + moderate + high + critical;
-
-writeSummary([
-	"## Security Audit",
-	"",
-	`| Severity  | Count |`,
-	`|-----------|-------|`,
-	`| Critical  | ${critical} |`,
-	`| High      | ${high} |`,
-	`| Moderate  | ${moderate} |`,
-	`| Low       | ${low} |`,
-	`| Info      | ${info} |`,
-	`| **Total** | **${total}** |`,
-]);
+const parsed = parseAudit(data);
+process.stdout.write(formatLog(parsed));
+writeSummary(formatMarkdown(parsed));

package/src/audit/upsert-clickup.mjs

@@ -0,0 +1,117 @@
+/**
+ * Upsert a ClickUp task with the current npm audit report.
+ *
+ * Env: CLICKUP_API_KEY (required), CLICKUP_LIST_ID (default Decohere list).
+ */
+import { existsSync, readFileSync } from "node:fs";
+import { formatMarkdown, parseAudit } from "./format.mjs";
+
+const auditFilePath = process.argv[2] ?? "npm-audit.json";
+const TASK_NAME = "chore(security): npm audit findings";
+const LIST_ID = process.env.CLICKUP_LIST_ID ?? "901220171084";
+const API = "https://api.clickup.com/api/v2";
+
+function runUrl() {
+	if (
+		process.env.GITHUB_SERVER_URL &&
+		process.env.GITHUB_REPOSITORY &&
+		process.env.GITHUB_RUN_ID
+	) {
+		return `${process.env.GITHUB_SERVER_URL}/${process.env.GITHUB_REPOSITORY}/actions/runs/${process.env.GITHUB_RUN_ID}`;
+	}
+	return "(run URL unavailable)";
+}
+
+async function clickup(method, path, body) {
+	const key = process.env.CLICKUP_API_KEY;
+	if (key == null || key.length === 0) {
+		throw new Error("Missing CLICKUP_API_KEY");
+	}
+	const response = await fetch(`${API}${path}`, {
+		method,
+		headers: {
+			Authorization: key,
+			"Content-Type": "application/json",
+		},
+		body: body == null ? undefined : JSON.stringify(body),
+	});
+	const text = await response.text();
+	if (!response.ok) {
+		throw new Error(
+			`ClickUp ${method} ${path} failed (${response.status}): ${text.slice(0, 500)}`,
+		);
+	}
+	return text.length === 0 ? undefined : JSON.parse(text);
+}
+
+async function findTaskByName(name) {
+	for (let page = 0; page < 10; page++) {
+		const qs = new URLSearchParams({
+			include_closed: "true",
+			subtasks: "false",
+			page: String(page),
+		});
+		const data = await clickup("GET", `/list/${LIST_ID}/task?${qs}`);
+		const tasks = Array.isArray(data) ? data : (data?.tasks ?? []);
+		const match = tasks.find((t) => t.name === name);
+		if (match) return match;
+		if (tasks.length < 100) break;
+	}
+	return null;
+}
+
+async function firstOpenStatus() {
+	const list = await clickup("GET", `/list/${LIST_ID}`);
+	return (list.statuses ?? []).find((s) => s.type === "open")?.status;
+}
+
+function buildDescription(parsed) {
+	const sha = process.env.GITHUB_SHA ? process.env.GITHUB_SHA.slice(0, 12) : "unknown";
+	return [
+		formatMarkdown(parsed).trim(),
+		"",
+		`- Commit: \`${sha}\``,
+		`- Workflow run: ${runUrl()}`,
+		"",
+		"Updated by the nightly npm-audit workflow. PR CI still gates high/critical.",
+	].join("\n");
+}
+
+if (!existsSync(auditFilePath)) {
+	console.log(`No audit file at ${auditFilePath}; skipping ClickUp upsert.`);
+	process.exit(0);
+}
+
+const parsed = parseAudit(JSON.parse(readFileSync(auditFilePath, "utf8")));
+const existing = await findTaskByName(TASK_NAME);
+
+if (parsed.total === 0) {
+	if (existing) {
+		await clickup("PUT", `/task/${existing.id}`, {
+			markdown_description: buildDescription(parsed),
+		});
+		console.log(`Cleared findings on ClickUp task ${existing.id}`);
+	} else {
+		console.log("No vulnerabilities and no existing ClickUp task; nothing to upsert.");
+	}
+	process.exit(0);
+}
+
+const payload = {
+	name: TASK_NAME,
+	markdown_description: buildDescription(parsed),
+	custom_item_id: 1004,
+};
+
+if (existing) {
+	const update = { markdown_description: payload.markdown_description };
+	if (existing.closed || existing.status?.type === "closed") {
+		const status = await firstOpenStatus();
+		if (status) update.status = status;
+	}
+	await clickup("PUT", `/task/${existing.id}`, update);
+	console.log(`Updated ClickUp task ${existing.id} (${existing.url ?? ""})`);
+} else {
+	const created = await clickup("POST", `/list/${LIST_ID}/task`, payload);
+	console.log(`Created ClickUp task ${created.id} ${created.url ?? ""}`);
+}

package/src/audit/upsert-issue.mjs

@@ -2,6 +2,7 @@ import { spawnSync } from "node:child_process";
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import os from "node:os";
 import path from "node:path";
+import { formatMarkdown, parseAudit } from "./format.mjs";
 
 const auditFilePath = process.argv[2] ?? "npm-audit.json";
 const ISSUE_TITLE = "security(ci): npm audit vulnerabilities detected";
@@ -14,40 +15,15 @@ function runGh(args) {
 	return result.stdout;
 }
 
-function readAuditSummary(filePath) {
-	const data = JSON.parse(readFileSync(filePath, "utf8"));
-	const vulnerabilities = data.metadata?.vulnerabilities ?? {};
-	const info = vulnerabilities.info ?? 0;
-	const low = vulnerabilities.low ?? 0;
-	const moderate = vulnerabilities.moderate ?? 0;
-	const high = vulnerabilities.high ?? 0;
-	const critical = vulnerabilities.critical ?? 0;
-	const total = vulnerabilities.total ?? info + low + moderate + high + critical;
-	return { total, critical, high, moderate, low, info };
-}
-
-function buildBody(summary) {
-	const runUrl =
-		process.env.GITHUB_SERVER_URL && process.env.GITHUB_REPOSITORY && process.env.GITHUB_RUN_ID
-			? `${process.env.GITHUB_SERVER_URL}/${process.env.GITHUB_REPOSITORY}/actions/runs/${process.env.GITHUB_RUN_ID}`
-			: "(run URL unavailable)";
-	const sha = process.env.GITHUB_SHA ? process.env.GITHUB_SHA.slice(0, 12) : "unknown";
-
-	return [
-		"## npm audit detected vulnerabilities",
-		"",
-		`- Total: ${summary.total}`,
-		`- Critical: ${summary.critical}`,
-		`- High: ${summary.high}`,
-		`- Moderate: ${summary.moderate}`,
-		`- Low: ${summary.low}`,
-		`- Info: ${summary.info}`,
-		"",
-		`- Commit: ${sha}`,
-		`- Workflow run: ${runUrl}`,
-		"",
-		"This issue is managed by CI and will be updated on subsequent main-branch runs while vulnerabilities remain.",
-	].join("\n");
+function runUrl() {
+	if (
+		process.env.GITHUB_SERVER_URL &&
+		process.env.GITHUB_REPOSITORY &&
+		process.env.GITHUB_RUN_ID
+	) {
+		return `${process.env.GITHUB_SERVER_URL}/${process.env.GITHUB_REPOSITORY}/actions/runs/${process.env.GITHUB_RUN_ID}`;
+	}
+	return "(run URL unavailable)";
 }
 
 function findExistingIssueNumber() {
@@ -70,13 +46,22 @@ if (!existsSync(auditFilePath)) {
 	process.exit(0);
 }
 
-const summary = readAuditSummary(auditFilePath);
-if (summary.total === 0) {
+const parsed = parseAudit(JSON.parse(readFileSync(auditFilePath, "utf8")));
+if (parsed.total === 0) {
 	console.log("No vulnerabilities found; skipping issue create/update.");
 	process.exit(0);
 }
 
-const body = buildBody(summary);
+const sha = process.env.GITHUB_SHA ? process.env.GITHUB_SHA.slice(0, 12) : "unknown";
+const body = [
+	formatMarkdown(parsed).trim(),
+	"",
+	`- Commit: \`${sha}\``,
+	`- Workflow run: ${runUrl()}`,
+	"",
+	"This issue is managed by CI and will be updated on subsequent main-branch runs while vulnerabilities remain.",
+].join("\n");
+
 const tempFile = path.join(os.tmpdir(), `npm-audit-issue-${Date.now()}.md`);
 writeFileSync(tempFile, body, "utf8");
 

package/src/bench/bench.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 /**
- * bench.mjs — run the forgev2 benchmark and compare against the last saved baseline.
+ * bench.mjs — run the forge benchmark and compare against the last saved baseline.
  *
  * Usage:
  *   node bench.mjs              — run and compare, do not save
@@ -34,7 +34,7 @@ const HISTORY_FILE = join(
 	"projects/ci-tools/dist/ci/bench/bench-history.json",
 );
 const VITEST_BIN = join(WORKSPACE_ROOT, "node_modules/.bin/vitest");
-const BENCH_FILE = "projects/foundry/e2e/build.benchmark.bench.ts";
+const BENCH_FILE = "projects/terminal/e2e/build.benchmark.bench.ts";
 const CONFIG = join(WORKSPACE_ROOT, "vitest.e2e.config.ts");
 const TRACE_LOG_DIR = join(WORKSPACE_ROOT, ".decohere", "logs");
 const MAX_RUNS = 10;

package/src/bench/trace.mjs

@@ -7,7 +7,7 @@ import { join } from "node:path";
 const WORKSPACE_ROOT = process.cwd();
 const VITEST_BIN = join(WORKSPACE_ROOT, "node_modules/.bin/vitest");
 const CONFIG = join(WORKSPACE_ROOT, "vitest.e2e.config.ts");
-const TRACE_SPEC = "projects/foundry/e2e/build.trace.e2e.spec.ts";
+const TRACE_SPEC = "projects/terminal/e2e/build.trace.e2e.spec.ts";
 const TRACE_LOG_DIR = join(WORKSPACE_ROOT, ".decohere", "logs");
 
 function truthy(value, defaultValue = false) {

package/src/pages/restore-bench-history.mjs

@@ -3,9 +3,8 @@
 // Restore benchmark history from Pages, or initialize empty if not found
 
 import { execSync } from "node:child_process";
-import { existsSync, writeFileSync } from "node:fs";
+import { writeFileSync } from "node:fs";
 import { mkdir } from "node:fs/promises";
-import { dirname } from "node:path";
 
 const HISTORY_DIR = "projects/ci-tools/dist/ci/bench";
 const HISTORY_FILE = `${HISTORY_DIR}/bench-history.json`;

package/src/release/push-prerelease-commit.mjs

@@ -1,14 +1,23 @@
 #!/usr/bin/env node
 /**
- * Push prerelease version commit before publish
- * Validates working tree and pushes new prerelease commit to remote
+ * Publish prerelease version commit via PR
+ * Validates working tree, pushes prerelease commit to a release branch,
+ * and creates/updates a PR targeting the protected base branch.
  */
 
 import { execSync } from "node:child_process";
 
+function run(command) {
+	return execSync(command, { encoding: "utf8" }).trim();
+}
+
+function runInherit(command, env) {
+	execSync(command, { stdio: "inherit", env });
+}
+
 try {
 	// Check if working tree is dirty
-	const status = execSync("git status --porcelain", { encoding: "utf8" });
+	const status = run("git status --porcelain");
 	if (status.trim().length > 0) {
 		console.error(
 			"::error::Working tree is dirty after version/dependency sync; refusing to publish with uncommitted changes.",
@@ -17,25 +26,58 @@ try {
 		process.exit(1);
 	}
 
-	// Compare HEAD with origin
-	const head = execSync("git rev-parse HEAD", { encoding: "utf8" }).trim();
-	const branch =
-		process.env.GITHUB_REF_NAME ||
-		execSync("git rev-parse --abbrev-ref HEAD", {
-			encoding: "utf8",
-		}).trim();
+	// Compare HEAD with origin and create a PR branch targeting an explicit base branch.
+	const head = run("git rev-parse HEAD");
+	const sourceBranch = process.env.GITHUB_REF_NAME || run("git rev-parse --abbrev-ref HEAD");
+	const channel = process.env.RELEASE_CHANNEL ?? "beta";
+	const baseBranch = process.env.RELEASE_BASE_BRANCH || sourceBranch;
+	const releasePrBranch = `release/${channel}-${sourceBranch}-to-${baseBranch}`;
+	const token = process.env.GITHUB_TOKEN ?? process.env.GH_TOKEN;
 
 	try {
-		const origin = execSync(`git rev-parse origin/${branch}`, { encoding: "utf8" }).trim();
+		const origin = run(`git rev-parse origin/${sourceBranch}`);
 
 		if (head !== origin) {
-			console.log(`Pushing prerelease version commit to origin/${branch}`);
-			execSync(`git push origin HEAD:${branch}`, { stdio: "inherit" });
+			console.log(
+				`Publishing release commit via PR branch origin/${releasePrBranch} (base: origin/${baseBranch})`,
+			);
+			runInherit(`git push origin HEAD:${releasePrBranch} --force`, process.env);
+
+			if (token == null || token.length === 0) {
+				throw new Error("Missing GITHUB_TOKEN/GH_TOKEN for PR upsert");
+			}
+
+			const version = process.env.RELEASE_VERSION ?? "(unknown)";
+			const ownerRepo = run("git config --get remote.origin.url")
+				.replace(/^.*github\.com[:/]/, "")
+				.replace(/\.git$/, "");
+
+			runInherit(
+				[
+					"node projects/ci-tools/src/github/create-or-update-pr.mjs",
+					`--title "chore(release): ${channel} ${version}"`,
+					`--base "${baseBranch}"`,
+					`--head "${releasePrBranch}"`,
+					`--body "Automated ${channel} version bump and dependency sync.\\n\\n- Channel: ${channel}\\n- Version: ${version}\\n- Source branch: ${sourceBranch}\\n- Base branch: ${baseBranch}\\n- Source commit: ${head}\\n\\nGenerated by pull-request workflow."`,
+					`--owner "${ownerRepo.split("/")[0]}"`,
+					`--repo "${ownerRepo.split("/")[1]}"`,
+				].join(" "),
+				{ ...process.env, GITHUB_TOKEN: token },
+			);
 		} else {
 			console.log("No prerelease version commit to push.");
 		}
-	} catch {
-		console.log(`Remote branch origin/${branch} not found, skipping push.`);
+	} catch (err) {
+		const message = err?.message ?? "";
+		if (
+			message.includes(`origin/${sourceBranch}`) &&
+			message.includes("Needed a single revision")
+		) {
+			console.log(`Remote branch origin/${sourceBranch} not found, skipping push.`);
+		} else {
+			console.error("::error::Failed to publish release commit via PR branch.");
+			throw err;
+		}
 	}
 } catch (e) {
 	console.error(`Push failed: ${e.message}`);

package/src/release/sync-dependencies.mjs

@@ -10,7 +10,7 @@ const DRY_RUN = process.env.DRY_RUN === "true";
 const TERMINAL_CLI = process.env.TERMINAL_CLI || "dist/debug/projects/terminal/src/cli.js";
 const DECOHERE_CONFIG = process.env.DECOHERE_CONFIG || ".decohere.js";
 
-const baseCmd = `node "${TERMINAL_CLI}" --log-level trace --config-file "${DECOHERE_CONFIG}" foundry dependencies --configuration release sync`;
+const baseCmd = `node "${TERMINAL_CLI}" --log-level info --config-file "${DECOHERE_CONFIG}" forge dependencies --configuration release sync`;
 
 try {
 	if (DRY_RUN) {

package/tests/audit/format.test.mjs

@@ -0,0 +1,115 @@
+import { describe, expect, it } from "vitest";
+import {
+	formatLog,
+	formatMarkdown,
+	highCritical,
+	parseAudit,
+} from "../../src/audit/format.mjs";
+
+const fixture = {
+	metadata: {
+		vulnerabilities: { info: 0, low: 1, moderate: 0, high: 1, critical: 0, total: 2 },
+	},
+	advisories: {
+		1: {
+			id: 1,
+			module_name: "nanoid",
+			severity: "high",
+			title: "nanoid: custom generators can loop indefinitely when size is zero",
+			url: "https://github.com/advisories/GHSA-2v37-7h3g-55p8",
+			vulnerable_versions: "<3.3.18",
+			patched_versions: ">=3.3.18",
+			cves: [],
+			findings: [{ version: "3.3.17", paths: [". > vite > postcss > nanoid@3.3.17"] }],
+		},
+		2: {
+			id: 2,
+			module_name: "esbuild",
+			severity: "low",
+			title: "esbuild Windows file read",
+			url: "https://github.com/advisories/GHSA-g7r4-m6w7-qqqr",
+			vulnerable_versions: "<0.28.1",
+			patched_versions: ">=0.28.1",
+			cves: [],
+			findings: [{ version: "0.27.3", paths: [". > vite > esbuild"] }],
+		},
+	},
+};
+
+describe("parseAudit", () => {
+	it("reads severity counts and sorts advisories critical/high first", () => {
+		const parsed = parseAudit(fixture);
+		expect(parsed.total).toBe(2);
+		expect(parsed.high).toBe(1);
+		expect(parsed.low).toBe(1);
+		expect(parsed.advisories.map((a) => a.module)).toEqual(["nanoid", "esbuild"]);
+		expect(parsed.advisories[0]?.severity).toBe("high");
+		expect(parsed.advisories[0]?.ghsa).toBe("GHSA-2v37-7h3g-55p8");
+	});
+});
+
+describe("formatLog", () => {
+	it("prints severity counts and advisory lines including GHSA", () => {
+		const log = formatLog(parseAudit(fixture));
+		expect(log).toContain("high=1");
+		expect(log).toContain("[high] nanoid GHSA-2v37-7h3g-55p8");
+		expect(log).toContain("[low] esbuild");
+	});
+});
+
+describe("formatMarkdown", () => {
+	it("includes a severity table and linked advisories", () => {
+		const md = formatMarkdown(parseAudit(fixture));
+		expect(md).toContain("| High | 1 |");
+		expect(md).toContain("**high** `nanoid`");
+		expect(md).toContain("GHSA-2v37-7h3g-55p8");
+	});
+});
+
+describe("highCritical", () => {
+	it("filters to high and critical only", () => {
+		expect(highCritical(parseAudit(fixture)).map((a) => a.module)).toEqual(["nanoid"]);
+	});
+});
+
+describe("parseAudit npm v2", () => {
+	it("dedupes GHSA rows from package via objects", () => {
+		const v2 = {
+			auditReportVersion: 2,
+			metadata: {
+				vulnerabilities: { info: 0, low: 0, moderate: 0, high: 1, critical: 0, total: 1 },
+			},
+			vulnerabilities: {
+				nanoid: {
+					name: "nanoid",
+					severity: "high",
+					via: [
+						{
+							source: 1103848,
+							name: "nanoid",
+							title: "nanoid infinite loop",
+							url: "https://github.com/advisories/GHSA-2v37-7h3g-55p8",
+							severity: "high",
+							range: "<3.3.18",
+						},
+					],
+					range: "<3.3.18",
+					nodes: ["node_modules/.pnpm/nanoid@3.3.17/node_modules/nanoid"],
+				},
+				postcss: {
+					name: "postcss",
+					severity: "high",
+					via: ["nanoid"],
+					effects: [],
+					range: "*",
+					nodes: ["node_modules/.pnpm/postcss@8.5.26/node_modules/postcss"],
+				},
+			},
+		};
+		const parsed = parseAudit(v2);
+		expect(parsed.advisories).toHaveLength(1);
+		expect(parsed.advisories[0]?.module).toBe("nanoid");
+		expect(parsed.advisories[0]?.ghsa).toBe("GHSA-2v37-7h3g-55p8");
+		expect(parsed.advisories[0]?.vulnerable).toBe("<3.3.18");
+	});
+});

package/tests/lib/lcov.test.mjs

@@ -5,11 +5,11 @@ import {
 	parseLcovFiles,
 } from "../../src/lib/lcov.mjs";
 
-const sampleLcov = `SF:projects/foundry/src/index.ts
+const sampleLcov = `SF:projects/forge/src/index.ts
 LF:10
 LH:9
 end_of_record
-SF:projects/foundry/src/build/index.ts
+SF:projects/forge/src/build/index.ts
 LF:20
 LH:15
 end_of_record
@@ -32,7 +32,7 @@ end_of_record
 
 describe("getProjectFromPath", () => {
 	it("extracts project name from projects/ path", () => {
-		expect(getProjectFromPath("projects/foundry/src/index.ts")).toBe("foundry");
+		expect(getProjectFromPath("projects/forge/src/index.ts")).toBe("forge");
 	});
 
 	it("returns undefined for unrecognized paths", () => {
@@ -43,16 +43,16 @@ describe("getProjectFromPath", () => {
 describe("parseLcovByProject", () => {
 	it("groups files by project and sums coverage", () => {
 		const result = parseLcovByProject(sampleLcov);
-		expect(result.get("foundry")).toBeDefined();
-		expect(result.get("foundry").totalLines).toBe(30);
-		expect(result.get("foundry").coveredLines).toBe(24);
+		expect(result.get("forge")).toBeDefined();
+		expect(result.get("forge").totalLines).toBe(30);
+		expect(result.get("forge").coveredLines).toBe(24);
 		expect(result.get("nexus")).toBeDefined();
 		expect(result.get("nexus").totalLines).toBe(5);
 		expect(result.get("nexus").coveredLines).toBe(5);
 	});
 
 	it("ignores records with LF:0", () => {
-		const lcov = `SF:projects/foundry/src/empty.ts\nLF:0\nLH:0\nend_of_record\n`;
+		const lcov = `SF:projects/forge/src/empty.ts\nLF:0\nLH:0\nend_of_record\n`;
 		const result = parseLcovByProject(lcov);
 		expect(result.size).toBe(0);
 	});