@delegance/claude-autopilot 1.7.1 → 1.8.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@delegance/claude-autopilot",
-  "version": "1.7.1",
+  "version": "1.8.0",
   "type": "module",
   "description": "Claude Code automation pipeline: spec → plan → implement → validate → PR",
   "keywords": [

package/src/adapters/review-engine/claude.ts

@@ -1,8 +1,8 @@
 import Anthropic from '@anthropic-ai/sdk';
-import type { Finding } from '../../core/findings/types.ts';
 import { AutopilotError } from '../../core/errors.ts';
 import type { Capabilities } from '../base.ts';
 import type { ReviewEngine, ReviewInput, ReviewOutput } from './types.ts';
+import { parseReviewOutput } from './parse-output.ts';
 
 const DEFAULT_MODEL = 'claude-opus-4-7';
 const MAX_OUTPUT_TOKENS = 4096;
@@ -90,7 +90,7 @@ export const claudeAdapter: ReviewEngine = {
       : undefined;
 
     return {
-      findings: parseClaudeOutput(rawOutput),
+      findings: parseReviewOutput(rawOutput, 'claude'),
       rawOutput,
       usage: response.usage
         ? { input: response.usage.input_tokens, output: response.usage.output_tokens, costUSD }
@@ -100,28 +100,3 @@ export const claudeAdapter: ReviewEngine = {
 };
 
 export default claudeAdapter;
-
-function parseClaudeOutput(output: string): Finding[] {
-  const findings: Finding[] = [];
-  const regex = /### \[(CRITICAL|WARNING|NOTE)\]\s*(.+?)(?=\n### \[|## Review Summary|$)/gs;
-  let match: RegExpExecArray | null;
-  while ((match = regex.exec(output)) !== null) {
-    const severity = match[1]!.toLowerCase() as Finding['severity'];
-    const body = match[2]!.trim();
-    const titleEnd = body.indexOf('\n');
-    const title = (titleEnd > 0 ? body.slice(0, titleEnd) : body).trim();
-    const suggestion = body.match(/\*\*Suggestion:\*\*\s*(.+)/s)?.[1]?.trim();
-    findings.push({
-      id: `claude-${findings.length}`,
-      source: 'review-engine',
-      severity,
-      category: 'claude-review',
-      file: '<unspecified>',
-      message: title,
-      suggestion,
-      protectedPath: false,
-      createdAt: new Date().toISOString(),
-    });
-  }
-  return findings;
-}

package/src/adapters/review-engine/codex.ts

@@ -1,5 +1,5 @@
 import OpenAI from 'openai';
-import type { Finding } from '../../core/findings/types.ts';
+import { parseReviewOutput } from './parse-output.ts';
 import { AutopilotError } from '../../core/errors.ts';
 import type { Capabilities } from '../base.ts';
 import type { ReviewEngine, ReviewInput, ReviewOutput } from './types.ts';
@@ -74,7 +74,7 @@ export const codexAdapter: ReviewEngine = {
 
     const rawOutput = response.output_text ?? '';
     return {
-      findings: parseCodexOutput(rawOutput),
+      findings: parseReviewOutput(rawOutput, 'codex'),
       rawOutput,
       usage: response.usage ? { input: response.usage.input_tokens, output: response.usage.output_tokens } : undefined,
     };
@@ -82,28 +82,3 @@ export const codexAdapter: ReviewEngine = {
 };
 
 export default codexAdapter;
-
-function parseCodexOutput(output: string): Finding[] {
-  const findings: Finding[] = [];
-  const regex = /### \[(CRITICAL|WARNING|NOTE)\]\s*(.+?)(?=\n### \[|## Review Summary|$)/gs;
-  let match: RegExpExecArray | null;
-  while ((match = regex.exec(output)) !== null) {
-    const severity = match[1]!.toLowerCase() as Finding['severity'];
-    const body = match[2]!.trim();
-    const titleEnd = body.indexOf('\n');
-    const title = (titleEnd > 0 ? body.slice(0, titleEnd) : body).trim();
-    const suggestion = body.match(/\*\*Suggestion:\*\*\s*(.+)/s)?.[1]?.trim();
-    findings.push({
-      id: `codex-${findings.length}`,
-      source: 'review-engine',
-      severity,
-      category: 'codex-review',
-      file: '<unspecified>',
-      message: title,
-      suggestion,
-      protectedPath: false,
-      createdAt: new Date().toISOString(),
-    });
-  }
-  return findings;
-}

package/src/adapters/review-engine/gemini.ts

@@ -1,5 +1,5 @@
 import { GoogleGenerativeAI } from '@google/generative-ai';
-import type { Finding } from '../../core/findings/types.ts';
+import { parseReviewOutput } from './parse-output.ts';
 import { AutopilotError } from '../../core/errors.ts';
 import type { Capabilities } from '../base.ts';
 import type { ReviewEngine, ReviewInput, ReviewOutput } from './types.ts';
@@ -95,7 +95,7 @@ export const geminiAdapter: ReviewEngine = {
       : undefined;
 
     return {
-      findings: parseGeminiOutput(rawOutput),
+      findings: parseReviewOutput(rawOutput, 'gemini'),
       rawOutput,
       usage: usage
         ? { input: usage.promptTokenCount, output: usage.candidatesTokenCount, costUSD }
@@ -105,28 +105,3 @@ export const geminiAdapter: ReviewEngine = {
 };
 
 export default geminiAdapter;
-
-function parseGeminiOutput(output: string): Finding[] {
-  const findings: Finding[] = [];
-  const regex = /### \[(CRITICAL|WARNING|NOTE)\]\s*(.+?)(?=\n### \[|## Review Summary|$)/gs;
-  let match: RegExpExecArray | null;
-  while ((match = regex.exec(output)) !== null) {
-    const severity = match[1]!.toLowerCase() as Finding['severity'];
-    const body = match[2]!.trim();
-    const titleEnd = body.indexOf('\n');
-    const title = (titleEnd > 0 ? body.slice(0, titleEnd) : body).trim();
-    const suggestion = body.match(/\*\*Suggestion:\*\*\s*(.+)/s)?.[1]?.trim();
-    findings.push({
-      id: `gemini-${findings.length}`,
-      source: 'review-engine',
-      severity,
-      category: 'gemini-review',
-      file: '<unspecified>',
-      message: title,
-      suggestion,
-      protectedPath: false,
-      createdAt: new Date().toISOString(),
-    });
-  }
-  return findings;
-}

package/src/adapters/review-engine/openai-compatible.ts

@@ -1,5 +1,5 @@
 import OpenAI from 'openai';
-import type { Finding } from '../../core/findings/types.ts';
+import { parseReviewOutput } from './parse-output.ts';
 import { AutopilotError } from '../../core/errors.ts';
 import type { Capabilities } from '../base.ts';
 import type { ReviewEngine, ReviewInput, ReviewOutput } from './types.ts';
@@ -90,7 +90,7 @@ export const openaiCompatibleAdapter: ReviewEngine = {
 
     const rawOutput = response.choices[0]?.message.content ?? '';
     return {
-      findings: parseOutput(rawOutput),
+      findings: parseReviewOutput(rawOutput, 'openai-compatible'),
       rawOutput,
       usage: response.usage
         ? { input: response.usage.prompt_tokens, output: response.usage.completion_tokens }
@@ -100,28 +100,3 @@ export const openaiCompatibleAdapter: ReviewEngine = {
 };
 
 export default openaiCompatibleAdapter;
-
-function parseOutput(output: string): Finding[] {
-  const findings: Finding[] = [];
-  const regex = /### \[(CRITICAL|WARNING|NOTE)\]\s*(.+?)(?=\n### \[|## Review Summary|$)/gs;
-  let match: RegExpExecArray | null;
-  while ((match = regex.exec(output)) !== null) {
-    const severity = match[1]!.toLowerCase() as Finding['severity'];
-    const body = match[2]!.trim();
-    const titleEnd = body.indexOf('\n');
-    const title = (titleEnd > 0 ? body.slice(0, titleEnd) : body).trim();
-    const suggestion = body.match(/\*\*Suggestion:\*\*\s*(.+)/s)?.[1]?.trim();
-    findings.push({
-      id: `openai-compatible-${findings.length}`,
-      source: 'review-engine',
-      severity,
-      category: 'openai-compatible-review',
-      file: '<unspecified>',
-      message: title,
-      suggestion,
-      protectedPath: false,
-      createdAt: new Date().toISOString(),
-    });
-  }
-  return findings;
-}

package/src/adapters/review-engine/parse-output.ts

@@ -0,0 +1,48 @@
+import type { Finding } from '../../core/findings/types.ts';
+
+// Matches "path/to/file.ts:42", "`path/to/file.ts`", or bare filenames with common extensions
+const FILE_REF = /(?:`([^`]+\.[a-z]{1,6})`|(\b[\w./\-]+\.[a-z]{1,6})(?::(\d+))?)/;
+
+function extractFileRef(text: string): { file: string; line?: number } {
+  const m = text.match(FILE_REF);
+  if (!m) return { file: '<unspecified>' };
+  const raw = (m[1] ?? m[2])!;
+  // Skip version strings (v1.2.3) and bare dotfile extensions with no path separator
+  if (/^v?\d/.test(raw) || (!raw.includes('/') && raw.startsWith('.') && raw.split('.').length === 2)) {
+    return { file: '<unspecified>' };
+  }
+  const line = m[3] ? parseInt(m[3], 10) : undefined;
+  return { file: raw, line };
+}
+
+/**
+ * Parses the structured [CRITICAL|WARNING|NOTE] markdown format
+ * produced by all review engine adapters. Extracts file:line references
+ * from the finding body when present.
+ */
+export function parseReviewOutput(output: string, idPrefix: string): Finding[] {
+  const findings: Finding[] = [];
+  const regex = /### \[(CRITICAL|WARNING|NOTE)\]\s*(.+?)(?=\n### \[|## Review Summary|$)/gs;
+  let match: RegExpExecArray | null;
+  while ((match = regex.exec(output)) !== null) {
+    const severity = match[1]!.toLowerCase() as Finding['severity'];
+    const body = match[2]!.trim();
+    const titleEnd = body.indexOf('\n');
+    const title = (titleEnd > 0 ? body.slice(0, titleEnd) : body).trim();
+    const suggestion = body.match(/\*\*Suggestion:\*\*\s*(.+)/s)?.[1]?.trim();
+    const { file, line } = extractFileRef(body);
+    findings.push({
+      id: `${idPrefix}-${findings.length}`,
+      source: 'review-engine',
+      severity,
+      category: 'review-engine',
+      file,
+      line,
+      message: title,
+      suggestion,
+      protectedPath: false,
+      createdAt: new Date().toISOString(),
+    });
+  }
+  return findings;
+}

package/src/core/static-rules/rules/hardcoded-secrets.ts

@@ -4,7 +4,7 @@ import type { Finding } from '../../findings/types.ts';
 
 const SECRET_PATTERNS: { regex: RegExp; label: string }[] = [
   { regex: /\bAKIA[0-9A-Z]{16}\b/, label: 'AWS Access Key ID' },
-  { regex: /(?:password|passwd|pwd)\s*[:=]\s*['"][^'"]{6,}['"]/, label: 'Hardcoded password' },
+  { regex: /(?:^|[^a-z])(?:password|passwd|pwd)\s*[:=]\s*['"](?!\/)[^'"]{6,}['"]/, label: 'Hardcoded password' },
   { regex: /(?:api_key|apikey|api-key)\s*[:=]\s*['"][^'"]{8,}['"]/, label: 'Hardcoded API key' },
   { regex: /(?:secret|secret_key|secretkey)\s*[:=]\s*['"][^'"]{8,}['"]/, label: 'Hardcoded secret' },
   { regex: /(?:access_token|accesstoken)\s*[:=]\s*['"][^'"]{8,}['"]/, label: 'Hardcoded access token' },