@delegance/claude-autopilot 5.0.0-alpha.5 → 5.0.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +20 -0
- package/README.md +46 -9
- package/dist/presets/go/rules/go-sql-injection.d.ts +4 -0
- package/dist/presets/go/rules/go-sql-injection.d.ts.map +1 -0
- package/dist/presets/nextjs-supabase/rules/supabase-rls-bypass.d.ts +4 -0
- package/dist/presets/nextjs-supabase/rules/supabase-rls-bypass.d.ts.map +1 -0
- package/dist/presets/python-fastapi/rules/fastapi-missing-auth.d.ts +4 -0
- package/dist/presets/python-fastapi/rules/fastapi-missing-auth.d.ts.map +1 -0
- package/dist/presets/rails-postgres/rules/rails-sql-injection.d.ts +4 -0
- package/dist/presets/rails-postgres/rules/rails-sql-injection.d.ts.map +1 -0
- package/dist/presets/t3/rules/t3-server-only.d.ts +4 -0
- package/dist/presets/t3/rules/t3-server-only.d.ts.map +1 -0
- package/dist/src/adapters/base.d.ts +11 -0
- package/dist/src/adapters/base.d.ts.map +1 -0
- package/dist/src/adapters/council/claude.d.ts +3 -0
- package/dist/src/adapters/council/claude.d.ts.map +1 -0
- package/dist/src/adapters/council/openai.d.ts +3 -0
- package/dist/src/adapters/council/openai.d.ts.map +1 -0
- package/dist/src/adapters/council/types.d.ts +5 -0
- package/dist/src/adapters/council/types.d.ts.map +1 -0
- package/dist/src/adapters/loader.d.ts +11 -0
- package/dist/src/adapters/loader.d.ts.map +1 -0
- package/dist/src/adapters/migration-runner/supabase.d.ts +4 -0
- package/dist/src/adapters/migration-runner/supabase.d.ts.map +1 -0
- package/dist/src/adapters/migration-runner/types.d.ts +31 -0
- package/dist/src/adapters/migration-runner/types.d.ts.map +1 -0
- package/dist/src/adapters/review-bot-parser/cursor.d.ts +3 -0
- package/dist/src/adapters/review-bot-parser/cursor.d.ts.map +1 -0
- package/dist/src/adapters/review-bot-parser/declarative-base.d.ts +13 -0
- package/dist/src/adapters/review-bot-parser/declarative-base.d.ts.map +1 -0
- package/dist/src/adapters/review-bot-parser/types.d.ts +9 -0
- package/dist/src/adapters/review-bot-parser/types.d.ts.map +1 -0
- package/dist/src/adapters/review-engine/auto.d.ts +4 -0
- package/dist/src/adapters/review-engine/auto.d.ts.map +1 -0
- package/dist/src/adapters/review-engine/claude.d.ts +4 -0
- package/dist/src/adapters/review-engine/claude.d.ts.map +1 -0
- package/dist/src/adapters/review-engine/codex.d.ts +4 -0
- package/dist/src/adapters/review-engine/codex.d.ts.map +1 -0
- package/dist/src/adapters/review-engine/gemini.d.ts +4 -0
- package/dist/src/adapters/review-engine/gemini.d.ts.map +1 -0
- package/dist/src/adapters/review-engine/openai-compatible.d.ts +4 -0
- package/dist/src/adapters/review-engine/openai-compatible.d.ts.map +1 -0
- package/dist/src/adapters/review-engine/parse-output.d.ts +13 -0
- package/dist/src/adapters/review-engine/parse-output.d.ts.map +1 -0
- package/dist/src/adapters/review-engine/prompt-builder.d.ts +4 -0
- package/dist/src/adapters/review-engine/prompt-builder.d.ts.map +1 -0
- package/dist/src/adapters/review-engine/types.d.ts +28 -0
- package/dist/src/adapters/review-engine/types.d.ts.map +1 -0
- package/dist/src/adapters/vcs-host/commit-status.d.ts +12 -0
- package/dist/src/adapters/vcs-host/commit-status.d.ts.map +1 -0
- package/dist/src/adapters/vcs-host/github.d.ts +4 -0
- package/dist/src/adapters/vcs-host/github.d.ts.map +1 -0
- package/dist/src/adapters/vcs-host/types.d.ts +42 -0
- package/dist/src/adapters/vcs-host/types.d.ts.map +1 -0
- package/dist/src/cli/_pkg-root.d.ts +47 -0
- package/dist/src/cli/_pkg-root.d.ts.map +1 -0
- package/dist/src/cli/autoregress-bridge.d.ts +3 -0
- package/dist/src/cli/autoregress-bridge.d.ts.map +1 -0
- package/dist/src/cli/baseline.d.ts +7 -0
- package/dist/src/cli/baseline.d.ts.map +1 -0
- package/dist/src/cli/ci.d.ts +23 -0
- package/dist/src/cli/ci.d.ts.map +1 -0
- package/dist/src/cli/costs.d.ts +2 -0
- package/dist/src/cli/costs.d.ts.map +1 -0
- package/dist/src/cli/council.d.ts +8 -0
- package/dist/src/cli/council.d.ts.map +1 -0
- package/dist/src/cli/detector.d.ts +8 -0
- package/dist/src/cli/detector.d.ts.map +1 -0
- package/dist/src/cli/explain.d.ts +8 -0
- package/dist/src/cli/explain.d.ts.map +1 -0
- package/dist/src/cli/fix.d.ts +10 -0
- package/dist/src/cli/fix.d.ts.map +1 -0
- package/dist/src/cli/hook.d.ts +9 -0
- package/dist/src/cli/hook.d.ts.map +1 -0
- package/dist/src/cli/ignore-helper.d.ts +7 -0
- package/dist/src/cli/ignore-helper.d.ts.map +1 -0
- package/dist/src/cli/index.d.ts +3 -0
- package/dist/src/cli/index.d.ts.map +1 -0
- package/dist/src/cli/lsp.d.ts +29 -0
- package/dist/src/cli/lsp.d.ts.map +1 -0
- package/dist/src/cli/mcp.d.ts +5 -0
- package/dist/src/cli/mcp.d.ts.map +1 -0
- package/dist/src/cli/migrate-v4.d.ts +28 -0
- package/dist/src/cli/migrate-v4.d.ts.map +1 -0
- package/dist/src/cli/pr-comment.d.ts +13 -0
- package/dist/src/cli/pr-comment.d.ts.map +1 -0
- package/dist/src/cli/pr-desc.d.ts +31 -0
- package/dist/src/cli/pr-desc.d.ts.map +1 -0
- package/dist/src/cli/pr-review-comments.d.ts +12 -0
- package/dist/src/cli/pr-review-comments.d.ts.map +1 -0
- package/dist/src/cli/pr.d.ts +9 -0
- package/dist/src/cli/pr.d.ts.map +1 -0
- package/dist/src/cli/preflight.d.ts +8 -0
- package/dist/src/cli/preflight.d.ts.map +1 -0
- package/dist/src/cli/report.d.ts +7 -0
- package/dist/src/cli/report.d.ts.map +1 -0
- package/dist/src/cli/run.d.ts +23 -0
- package/dist/src/cli/run.d.ts.map +1 -0
- package/dist/src/cli/scan.d.ts +11 -0
- package/dist/src/cli/scan.d.ts.map +1 -0
- package/dist/src/cli/setup.d.ts +9 -0
- package/dist/src/cli/setup.d.ts.map +1 -0
- package/dist/src/cli/test-gen.d.ts +10 -0
- package/dist/src/cli/test-gen.d.ts.map +1 -0
- package/dist/src/cli/triage.d.ts +5 -0
- package/dist/src/cli/triage.d.ts.map +1 -0
- package/dist/src/cli/watch.d.ts +18 -0
- package/dist/src/cli/watch.d.ts.map +1 -0
- package/dist/src/cli/worker.d.ts +5 -0
- package/dist/src/cli/worker.d.ts.map +1 -0
- package/dist/src/core/cache/cached-engine.d.ts +8 -0
- package/dist/src/core/cache/cached-engine.d.ts.map +1 -0
- package/dist/src/core/cache/review-cache.d.ts +21 -0
- package/dist/src/core/cache/review-cache.d.ts.map +1 -0
- package/dist/src/core/chunking/index.d.ts +18 -0
- package/dist/src/core/chunking/index.d.ts.map +1 -0
- package/dist/src/core/chunking/risk-ranker.d.ts +10 -0
- package/dist/src/core/chunking/risk-ranker.d.ts.map +1 -0
- package/dist/src/core/config/loader.d.ts +3 -0
- package/dist/src/core/config/loader.d.ts.map +1 -0
- package/dist/src/core/config/preset-resolver.d.ts +9 -0
- package/dist/src/core/config/preset-resolver.d.ts.map +1 -0
- package/dist/src/core/config/schema.d.ts +342 -0
- package/dist/src/core/config/schema.d.ts.map +1 -0
- package/dist/src/core/config/types.d.ts +115 -0
- package/dist/src/core/config/types.d.ts.map +1 -0
- package/dist/src/core/council/config.d.ts +3 -0
- package/dist/src/core/council/config.d.ts.map +1 -0
- package/dist/src/core/council/context.d.ts +2 -0
- package/dist/src/core/council/context.d.ts.map +1 -0
- package/dist/src/core/council/runner.d.ts +4 -0
- package/dist/src/core/council/runner.d.ts.map +1 -0
- package/dist/src/core/council/types.d.ts +36 -0
- package/dist/src/core/council/types.d.ts.map +1 -0
- package/dist/src/core/detect/git-context.d.ts +12 -0
- package/dist/src/core/detect/git-context.d.ts.map +1 -0
- package/dist/src/core/detect/llm-key.d.ts +38 -0
- package/dist/src/core/detect/llm-key.d.ts.map +1 -0
- package/dist/src/core/detect/protected-paths.d.ts +6 -0
- package/dist/src/core/detect/protected-paths.d.ts.map +1 -0
- package/dist/src/core/detect/provider-usage.d.ts +17 -0
- package/dist/src/core/detect/provider-usage.d.ts.map +1 -0
- package/dist/src/core/detect/stack.d.ts +6 -0
- package/dist/src/core/detect/stack.d.ts.map +1 -0
- package/dist/src/core/detect/workspaces.d.ts +11 -0
- package/dist/src/core/detect/workspaces.d.ts.map +1 -0
- package/dist/src/core/errors.d.ts +17 -0
- package/dist/src/core/errors.d.ts.map +1 -0
- package/dist/src/core/findings/dedup.d.ts +4 -0
- package/dist/src/core/findings/dedup.d.ts.map +1 -0
- package/dist/src/core/findings/types.d.ts +33 -0
- package/dist/src/core/findings/types.d.ts.map +1 -0
- package/dist/src/core/fix/generator.d.ts +17 -0
- package/dist/src/core/fix/generator.d.ts.map +1 -0
- package/dist/src/core/git/diff-hunks.d.ts +22 -0
- package/dist/src/core/git/diff-hunks.d.ts.map +1 -0
- package/dist/src/core/git/touched-files.d.ts +11 -0
- package/dist/src/core/git/touched-files.d.ts.map +1 -0
- package/dist/src/core/ignore/index.d.ts +11 -0
- package/dist/src/core/ignore/index.d.ts.map +1 -0
- package/dist/src/core/index.d.ts +2 -0
- package/dist/src/core/index.d.ts.map +1 -0
- package/dist/src/core/logging/ndjson-writer.d.ts +16 -0
- package/dist/src/core/logging/ndjson-writer.d.ts.map +1 -0
- package/dist/src/core/logging/redaction.d.ts +4 -0
- package/dist/src/core/logging/redaction.d.ts.map +1 -0
- package/dist/src/core/mcp/concurrency.d.ts +2 -0
- package/dist/src/core/mcp/concurrency.d.ts.map +1 -0
- package/dist/src/core/mcp/handlers/fix-finding.d.ts +17 -0
- package/dist/src/core/mcp/handlers/fix-finding.d.ts.map +1 -0
- package/dist/src/core/mcp/handlers/get-capabilities.d.ts +14 -0
- package/dist/src/core/mcp/handlers/get-capabilities.d.ts.map +1 -0
- package/dist/src/core/mcp/handlers/get-findings.d.ts +13 -0
- package/dist/src/core/mcp/handlers/get-findings.d.ts.map +1 -0
- package/dist/src/core/mcp/handlers/review-diff.d.ts +18 -0
- package/dist/src/core/mcp/handlers/review-diff.d.ts.map +1 -0
- package/dist/src/core/mcp/handlers/scan-files.d.ts +15 -0
- package/dist/src/core/mcp/handlers/scan-files.d.ts.map +1 -0
- package/dist/src/core/mcp/handlers/validate-fix.d.ts +12 -0
- package/dist/src/core/mcp/handlers/validate-fix.d.ts.map +1 -0
- package/dist/src/core/mcp/run-store.d.ts +12 -0
- package/dist/src/core/mcp/run-store.d.ts.map +1 -0
- package/dist/src/core/mcp/workspace.d.ts +3 -0
- package/dist/src/core/mcp/workspace.d.ts.map +1 -0
- package/dist/src/core/persist/baseline.d.ts +39 -0
- package/dist/src/core/persist/baseline.d.ts.map +1 -0
- package/dist/src/core/persist/cost-log.d.ts +11 -0
- package/dist/src/core/persist/cost-log.d.ts.map +1 -0
- package/dist/src/core/persist/findings-cache.d.ts +9 -0
- package/dist/src/core/persist/findings-cache.d.ts.map +1 -0
- package/dist/src/core/persist/triage.d.ts +30 -0
- package/dist/src/core/persist/triage.d.ts.map +1 -0
- package/dist/src/core/phases/static-rules.d.ts +24 -0
- package/dist/src/core/phases/static-rules.d.ts.map +1 -0
- package/dist/src/core/phases/tests.d.ts +15 -0
- package/dist/src/core/phases/tests.d.ts.map +1 -0
- package/dist/src/core/pipeline/review-phase.d.ts +27 -0
- package/dist/src/core/pipeline/review-phase.d.ts.map +1 -0
- package/dist/src/core/pipeline/run.d.ts +27 -0
- package/dist/src/core/pipeline/run.d.ts.map +1 -0
- package/dist/src/core/runtime/idempotency.d.ts +2 -0
- package/dist/src/core/runtime/idempotency.d.ts.map +1 -0
- package/dist/src/core/runtime/lock.d.ts +5 -0
- package/dist/src/core/runtime/lock.d.ts.map +1 -0
- package/dist/src/core/runtime/state.d.ts +39 -0
- package/dist/src/core/runtime/state.d.ts.map +1 -0
- package/dist/src/core/schema-alignment/detector.d.ts +3 -0
- package/dist/src/core/schema-alignment/detector.d.ts.map +1 -0
- package/dist/src/core/schema-alignment/extractor/index.d.ts +3 -0
- package/dist/src/core/schema-alignment/extractor/index.d.ts.map +1 -0
- package/dist/src/core/schema-alignment/extractor/prisma.d.ts +3 -0
- package/dist/src/core/schema-alignment/extractor/prisma.d.ts.map +1 -0
- package/dist/src/core/schema-alignment/extractor/sql.d.ts +3 -0
- package/dist/src/core/schema-alignment/extractor/sql.d.ts.map +1 -0
- package/dist/src/core/schema-alignment/llm-check.d.ts +4 -0
- package/dist/src/core/schema-alignment/llm-check.d.ts.map +1 -0
- package/dist/src/core/schema-alignment/scanner.d.ts +3 -0
- package/dist/src/core/schema-alignment/scanner.d.ts.map +1 -0
- package/dist/src/core/schema-alignment/types.d.ts +38 -0
- package/dist/src/core/schema-alignment/types.d.ts.map +1 -0
- package/dist/src/core/shell.d.ts +15 -0
- package/dist/src/core/shell.d.ts.map +1 -0
- package/dist/src/core/static-rules/registry.d.ts +5 -0
- package/dist/src/core/static-rules/registry.d.ts.map +1 -0
- package/dist/src/core/static-rules/rules/brand-tokens.d.ts +3 -0
- package/dist/src/core/static-rules/rules/brand-tokens.d.ts.map +1 -0
- package/dist/src/core/static-rules/rules/console-log.d.ts +3 -0
- package/dist/src/core/static-rules/rules/console-log.d.ts.map +1 -0
- package/dist/src/core/static-rules/rules/hardcoded-secrets.d.ts +3 -0
- package/dist/src/core/static-rules/rules/hardcoded-secrets.d.ts.map +1 -0
- package/dist/src/core/static-rules/rules/insecure-redirect.d.ts +3 -0
- package/dist/src/core/static-rules/rules/insecure-redirect.d.ts.map +1 -0
- package/dist/src/core/static-rules/rules/large-file.d.ts +3 -0
- package/dist/src/core/static-rules/rules/large-file.d.ts.map +1 -0
- package/dist/src/core/static-rules/rules/missing-auth.d.ts +3 -0
- package/dist/src/core/static-rules/rules/missing-auth.d.ts.map +1 -0
- package/dist/src/core/static-rules/rules/missing-tests.d.ts +3 -0
- package/dist/src/core/static-rules/rules/missing-tests.d.ts.map +1 -0
- package/dist/src/core/static-rules/rules/npm-audit.d.ts +3 -0
- package/dist/src/core/static-rules/rules/npm-audit.d.ts.map +1 -0
- package/dist/src/core/static-rules/rules/package-lock-sync.d.ts +3 -0
- package/dist/src/core/static-rules/rules/package-lock-sync.d.ts.map +1 -0
- package/dist/src/core/static-rules/rules/schema-alignment.d.ts +3 -0
- package/dist/src/core/static-rules/rules/schema-alignment.d.ts.map +1 -0
- package/dist/src/core/static-rules/rules/sql-injection.d.ts +3 -0
- package/dist/src/core/static-rules/rules/sql-injection.d.ts.map +1 -0
- package/dist/src/core/static-rules/rules/ssrf.d.ts +3 -0
- package/dist/src/core/static-rules/rules/ssrf.d.ts.map +1 -0
- package/dist/src/core/static-rules/rules/todo-fixme.d.ts +3 -0
- package/dist/src/core/static-rules/rules/todo-fixme.d.ts.map +1 -0
- package/dist/src/core/static-rules/tailwind-extractor.d.ts +7 -0
- package/dist/src/core/static-rules/tailwind-extractor.d.ts.map +1 -0
- package/dist/src/core/test-gen/coverage-analyzer.d.ts +7 -0
- package/dist/src/core/test-gen/coverage-analyzer.d.ts.map +1 -0
- package/dist/src/core/test-gen/framework-detector.d.ts +3 -0
- package/dist/src/core/test-gen/framework-detector.d.ts.map +1 -0
- package/dist/src/core/test-gen/test-writer.d.ts +4 -0
- package/dist/src/core/test-gen/test-writer.d.ts.map +1 -0
- package/dist/src/core/ui/design-context-loader.d.ts +7 -0
- package/dist/src/core/ui/design-context-loader.d.ts.map +1 -0
- package/dist/src/core/worker/client.d.ts +23 -0
- package/dist/src/core/worker/client.d.ts.map +1 -0
- package/dist/src/core/worker/lockfile.d.ts +12 -0
- package/dist/src/core/worker/lockfile.d.ts.map +1 -0
- package/dist/src/core/worker/server.d.ts +17 -0
- package/dist/src/core/worker/server.d.ts.map +1 -0
- package/dist/src/formatters/github-annotations.d.ts +5 -0
- package/dist/src/formatters/github-annotations.d.ts.map +1 -0
- package/dist/src/formatters/index.d.ts +4 -0
- package/dist/src/formatters/index.d.ts.map +1 -0
- package/dist/src/formatters/junit.d.ts +5 -0
- package/dist/src/formatters/junit.d.ts.map +1 -0
- package/dist/src/formatters/sarif.d.ts +56 -0
- package/dist/src/formatters/sarif.d.ts.map +1 -0
- package/dist/src/index.d.ts +4 -0
- package/dist/src/index.d.ts.map +1 -0
- package/package.json +4 -4
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,25 @@
|
|
|
1
1
|
# Changelog
|
|
2
2
|
|
|
3
|
+
## [5.0.0] — 2026-04-27
|
|
4
|
+
|
|
5
|
+
First GA release after a five-alpha soak cycle. Promotes `5.0.0-alpha.5` to GA unchanged on the code side; the only diff is the version bump, README rebranding away from `@alpha` channel guidance, and a new "Reproducing the benchmark" section.
|
|
6
|
+
|
|
7
|
+
### Added
|
|
8
|
+
- **README hero benchmark.** Documented 13/13 on the seeded Next.js fixture with Claude Opus at $0.21 / 38s. Includes a "Reproducing the benchmark" section at the bottom with the full procedure, the categories measured, and explicit non-claims (e.g. doesn't measure false-positive rate on clean repos).
|
|
9
|
+
- README install instructions now use bare `npm install -g @delegance/claude-autopilot` (no `@alpha` pin) — assumes the `latest` dist-tag has advanced to 5.0.0.
|
|
10
|
+
|
|
11
|
+
### Changed
|
|
12
|
+
- Migration guide install snippets drop the `@alpha` pin and the alpha-cycle warning.
|
|
13
|
+
- Removed the alpha-era CLI note from the README ("Alpha.1 CLI note: subcommands are flat …" → just "CLI note").
|
|
14
|
+
|
|
15
|
+
### Manual GA steps (for the publisher)
|
|
16
|
+
After this lands and `v5.0.0` is tagged + auto-published:
|
|
17
|
+
|
|
18
|
+
1. `cd packages/guardrail-tombstone && npm publish` — publishes `@delegance/guardrail@5.0.0` thin wrapper.
|
|
19
|
+
2. `npm dist-tag add @delegance/claude-autopilot@5.0.0 latest` — moves `latest` from the legacy 2.5.0 to GA.
|
|
20
|
+
3. `npm deprecate @delegance/claude-autopilot@"<5.0.0" "Pre-rename — use 5.x"` — flags the orphaned 1.0.0-rc.1 / 2.x / 5.0.0-alpha.* releases.
|
|
21
|
+
4. `npm deprecate @delegance/guardrail@"<5.0.0" "Renamed — use @delegance/claude-autopilot"` — tells v4 users to migrate (the `5.0.0` tombstone forwards their existing CLI usage transparently).
|
|
22
|
+
|
|
3
23
|
## [5.0.0-alpha.5] — 2026-04-27
|
|
4
24
|
|
|
5
25
|
Second hotfix from the soak. Alpha.4 fixed `init`'s preset resolution but `scan` / `run` still crashed on compiled output with `Failed to import adapter from .../auto.ts` — the adapter loader and static-rule registry use dynamic-import string literals that tsc's `rewriteRelativeImportExtensions` doesn't touch.
|
package/README.md
CHANGED
|
@@ -15,6 +15,18 @@ claude-autopilot brainstorm "add SSO with SAML for enterprise tenants"
|
|
|
15
15
|
|
|
16
16
|
---
|
|
17
17
|
|
|
18
|
+
## Benchmark
|
|
19
|
+
|
|
20
|
+
On a Next.js fixture seeded with 13 production-realistic bugs covering the categories the README advertises — SQL injection, hardcoded secret, missing auth, IDOR, CORS wildcard, SSRF, open redirect, TOCTOU race, silent error swallow, off-by-one, missing rate limit, console.log in prod, and missing input validation:
|
|
21
|
+
|
|
22
|
+
| Configuration | Bugs caught | Cost | Time |
|
|
23
|
+
|---|---|---|---|
|
|
24
|
+
| **`claude-autopilot scan --all` with Claude Opus** | **13 / 13** | $0.21 | 38 s |
|
|
25
|
+
|
|
26
|
+
Every finding came with a concrete remediation (often a code patch or named library — `Zod` for validation, atomic Postgres updates for TOCTOU, allowlist + DNS resolution for SSRF). [Reproduce the benchmark.](#reproducing-the-benchmark)
|
|
27
|
+
|
|
28
|
+
---
|
|
29
|
+
|
|
18
30
|
## Why this vs the alternatives
|
|
19
31
|
|
|
20
32
|
AI coding tools fall into three buckets. Here's where claude-autopilot sits.
|
|
@@ -39,11 +51,11 @@ The architectural differences that matter most in practice:
|
|
|
39
51
|
## 30-second quickstart
|
|
40
52
|
|
|
41
53
|
```bash
|
|
42
|
-
# Install
|
|
43
|
-
npm install -g @delegance/claude-autopilot
|
|
54
|
+
# Install
|
|
55
|
+
npm install -g @delegance/claude-autopilot
|
|
44
56
|
|
|
45
57
|
# One-shot setup — detects stack, writes config, installs skills, sets hooks
|
|
46
|
-
|
|
58
|
+
claude-autopilot init
|
|
47
59
|
|
|
48
60
|
# Ship a feature end-to-end
|
|
49
61
|
claude-autopilot brainstorm "add rate limiting to the public API"
|
|
@@ -93,16 +105,12 @@ claude-autopilot run --format sarif --output out.sarif
|
|
|
93
105
|
claude-autopilot fix --verify # LLM patch + test gate + revert on fail
|
|
94
106
|
```
|
|
95
107
|
|
|
96
|
-
> **
|
|
108
|
+
> **CLI note:** subcommands are flat (`run`, `scan`, `ci`, `fix`, `baseline`, `explain`, …). The grouped `claude-autopilot review <verb>` form is also accepted as an alias — flat and grouped both work.
|
|
97
109
|
|
|
98
110
|
## Install & requirements
|
|
99
111
|
|
|
100
112
|
```bash
|
|
101
|
-
|
|
102
|
-
npm install -g @delegance/claude-autopilot@alpha
|
|
103
|
-
|
|
104
|
-
# When 5.0.0 GA ships, the `latest` tag will advance and you can drop the @alpha:
|
|
105
|
-
# npm install -g @delegance/claude-autopilot
|
|
113
|
+
npm install -g @delegance/claude-autopilot
|
|
106
114
|
```
|
|
107
115
|
|
|
108
116
|
- Node 22+
|
|
@@ -274,6 +282,35 @@ Four pluggable adapter points:
|
|
|
274
282
|
|
|
275
283
|
**Monorepo:** Auto-detects npm/yarn/pnpm workspaces, Turborepo, and Nx.
|
|
276
284
|
|
|
285
|
+
## Reproducing the benchmark
|
|
286
|
+
|
|
287
|
+
The 13/13 benchmark cited in the [Benchmark](#benchmark) section is reproducible end-to-end. The fixture is a minimal Next.js app that seeds each of the README-advertised bug categories at a specific file:line, then `claude-autopilot scan --all` is run with the `claude` adapter and the result is compared to the seed list.
|
|
288
|
+
|
|
289
|
+
```bash
|
|
290
|
+
# 1. Install the CLI
|
|
291
|
+
npm install -g @delegance/claude-autopilot
|
|
292
|
+
|
|
293
|
+
# 2. Seed the fixture (one file per bug category)
|
|
294
|
+
SEED=$(mktemp -d) && cd $SEED && npm init -y >/dev/null
|
|
295
|
+
mkdir -p app/api/{users,coupons,profile,redirect,proxy} lib
|
|
296
|
+
|
|
297
|
+
# (Add the 13 seeded files — the canonical fixture lives at
|
|
298
|
+
# https://github.com/axledbetter/claude-autopilot/tree/master/tests/v4-compat/fixtures/13-bugs)
|
|
299
|
+
|
|
300
|
+
# 3. Init + scan
|
|
301
|
+
claude-autopilot init --preset nextjs-supabase
|
|
302
|
+
ANTHROPIC_API_KEY=sk-ant-... claude-autopilot scan --all
|
|
303
|
+
```
|
|
304
|
+
|
|
305
|
+
**What "13 of 13" means:** the scan output flags each category as a distinct critical or warning finding with file path, line, and concrete remediation. We count one hit per seed regardless of severity bucket. The categories are: SQL injection, hardcoded secret, missing auth, IDOR, CORS wildcard, SSRF, open redirect, TOCTOU race, silent error swallow, off-by-one, missing rate limit, console.log in prod, missing input validation.
|
|
306
|
+
|
|
307
|
+
**What this doesn't measure:**
|
|
308
|
+
- False positive rate on a clean repo (separate test, expected ~3 findings on real production code per the cold-start eval)
|
|
309
|
+
- Detection rate with cheaper models — this is Claude Opus. Sonnet typically catches 11/13. Llama 3.3 70B (via Groq) caught 8/13 in independent testing
|
|
310
|
+
- Bugs the scan missed: there are none in the 13-category set we measure, but real production bugs are not always in this set
|
|
311
|
+
|
|
312
|
+
We do not claim 13/13 reflects every real-world repo — it's a reproducible upper bound on a fixture that exercises the categories we explicitly target.
|
|
313
|
+
|
|
277
314
|
## License
|
|
278
315
|
|
|
279
316
|
MIT
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"go-sql-injection.d.ts","sourceRoot":"","sources":["../../../../presets/go/rules/go-sql-injection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0CAA0C,CAAC;AAU3E,eAAO,MAAM,kBAAkB,EAAE,UAoDhC,CAAC;AAEF,eAAe,kBAAkB,CAAC"}
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"supabase-rls-bypass.d.ts","sourceRoot":"","sources":["../../../../presets/nextjs-supabase/rules/supabase-rls-bypass.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0CAA0C,CAAC;AAE3E,eAAO,MAAM,qBAAqB,EAAE,UAgCnC,CAAC;AAEF,eAAe,qBAAqB,CAAC"}
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"fastapi-missing-auth.d.ts","sourceRoot":"","sources":["../../../../presets/python-fastapi/rules/fastapi-missing-auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0CAA0C,CAAC;AAQ3E,eAAO,MAAM,sBAAsB,EAAE,UAuCpC,CAAC;AAEF,eAAe,sBAAsB,CAAC"}
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"rails-sql-injection.d.ts","sourceRoot":"","sources":["../../../../presets/rails-postgres/rules/rails-sql-injection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0CAA0C,CAAC;AAO3E,eAAO,MAAM,qBAAqB,EAAE,UAgCnC,CAAC;AAEF,eAAe,qBAAqB,CAAC"}
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"t3-server-only.d.ts","sourceRoot":"","sources":["../../../../presets/t3/rules/t3-server-only.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0CAA0C,CAAC;AAI3E,eAAO,MAAM,gBAAgB,EAAE,UA4B9B,CAAC;AAEF,eAAe,gBAAgB,CAAC"}
|
|
@@ -0,0 +1,11 @@
|
|
|
1
|
+
export interface AdapterBase {
|
|
2
|
+
name: string;
|
|
3
|
+
apiVersion: string;
|
|
4
|
+
getCapabilities(): Capabilities;
|
|
5
|
+
}
|
|
6
|
+
export interface Capabilities {
|
|
7
|
+
[feature: string]: boolean | number | string;
|
|
8
|
+
}
|
|
9
|
+
export declare const CORE_ADAPTER_API_VERSION_MAJOR = 1;
|
|
10
|
+
export declare function checkApiVersionCompatibility(adapterApiVersion: string): boolean;
|
|
11
|
+
//# sourceMappingURL=base.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../../src/adapters/base.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,IAAI,YAAY,CAAC;CACjC;AAED,MAAM,WAAW,YAAY;IAC3B,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC;CAC9C;AAED,eAAO,MAAM,8BAA8B,IAAI,CAAC;AAEhD,wBAAgB,4BAA4B,CAAC,iBAAiB,EAAE,MAAM,GAAG,OAAO,CAI/E"}
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"claude.d.ts","sourceRoot":"","sources":["../../../../src/adapters/council/claude.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAKjD,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,cAAc,CAgCrF"}
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"openai.d.ts","sourceRoot":"","sources":["../../../../src/adapters/council/openai.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAKjD,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,cAAc,CA+BrF"}
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/adapters/council/types.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC3D"}
|
|
@@ -0,0 +1,11 @@
|
|
|
1
|
+
import { type AdapterBase } from './base.ts';
|
|
2
|
+
export type IntegrationPoint = 'review-engine' | 'vcs-host' | 'migration-runner' | 'review-bot-parser';
|
|
3
|
+
export interface LoadAdapterOptions {
|
|
4
|
+
point: IntegrationPoint;
|
|
5
|
+
ref: string;
|
|
6
|
+
options?: Record<string, unknown>;
|
|
7
|
+
/** Allow loading adapters from arbitrary local paths. Off by default for security. */
|
|
8
|
+
unsafeAllowLocalAdapters?: boolean;
|
|
9
|
+
}
|
|
10
|
+
export declare function loadAdapter<T extends AdapterBase>(options: LoadAdapterOptions): Promise<T>;
|
|
11
|
+
//# sourceMappingURL=loader.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../../src/adapters/loader.ts"],"names":[],"mappings":"AAEA,OAAO,EAAgC,KAAK,WAAW,EAAE,MAAM,WAAW,CAAC;AAG3E,MAAM,MAAM,gBAAgB,GAAG,eAAe,GAAG,UAAU,GAAG,kBAAkB,GAAG,mBAAmB,CAAC;AAEvG,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,gBAAgB,CAAC;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,sFAAsF;IACtF,wBAAwB,CAAC,EAAE,OAAO,CAAC;CACpC;AA0BD,wBAAsB,WAAW,CAAC,CAAC,SAAS,WAAW,EAAE,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,CAAC,CAAC,CAmDhG"}
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"supabase.d.ts","sourceRoot":"","sources":["../../../../src/adapters/migration-runner/supabase.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,eAAe,EAAmE,MAAM,YAAY,CAAC;AAEnH,eAAO,MAAM,eAAe,EAAE,eA+C7B,CAAC;AAEF,eAAe,eAAe,CAAC"}
|
|
@@ -0,0 +1,31 @@
|
|
|
1
|
+
import type { AdapterBase } from '../base.ts';
|
|
2
|
+
export type MigrationEnv = 'dev' | 'qa' | 'prod';
|
|
3
|
+
export interface Migration {
|
|
4
|
+
name: string;
|
|
5
|
+
path: string;
|
|
6
|
+
content?: string;
|
|
7
|
+
}
|
|
8
|
+
export interface DryRunResult {
|
|
9
|
+
ok: boolean;
|
|
10
|
+
errors?: string[];
|
|
11
|
+
warnings?: string[];
|
|
12
|
+
}
|
|
13
|
+
export interface ApplyResult {
|
|
14
|
+
ok: boolean;
|
|
15
|
+
appliedSha?: string;
|
|
16
|
+
durationMs?: number;
|
|
17
|
+
errors?: string[];
|
|
18
|
+
}
|
|
19
|
+
export interface LedgerEntry {
|
|
20
|
+
name: string;
|
|
21
|
+
appliedAt: string;
|
|
22
|
+
sha?: string;
|
|
23
|
+
}
|
|
24
|
+
export interface MigrationRunner extends AdapterBase {
|
|
25
|
+
discover(touchedFiles: string[]): Migration[];
|
|
26
|
+
dryRun(migration: Migration): Promise<DryRunResult>;
|
|
27
|
+
apply(migration: Migration, env: MigrationEnv): Promise<ApplyResult>;
|
|
28
|
+
ledger(env: MigrationEnv): Promise<LedgerEntry[]>;
|
|
29
|
+
alreadyApplied(migration: Migration, env: MigrationEnv): Promise<boolean>;
|
|
30
|
+
}
|
|
31
|
+
//# sourceMappingURL=types.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/adapters/migration-runner/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,MAAM,MAAM,YAAY,GAAG,KAAK,GAAG,IAAI,GAAG,MAAM,CAAC;AAEjD,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,OAAO,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,eAAgB,SAAQ,WAAW;IAClD,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC;IAC9C,MAAM,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACpD,KAAK,CAAC,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACrE,MAAM,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAClD,cAAc,CAAC,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC3E"}
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"cursor.d.ts","sourceRoot":"","sources":["../../../../src/adapters/review-bot-parser/cursor.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,aAAa,sCAQxB,CAAC;AAEH,eAAe,aAAa,CAAC"}
|
|
@@ -0,0 +1,13 @@
|
|
|
1
|
+
import type { ReviewBotParser } from './types.ts';
|
|
2
|
+
export interface DeclarativeParserConfig {
|
|
3
|
+
name: string;
|
|
4
|
+
author: string | RegExp;
|
|
5
|
+
severityMap: {
|
|
6
|
+
critical?: RegExp;
|
|
7
|
+
warning?: RegExp;
|
|
8
|
+
note?: RegExp;
|
|
9
|
+
};
|
|
10
|
+
dismissalKeywords: string[];
|
|
11
|
+
}
|
|
12
|
+
export declare function makeDeclarativeParser(config: DeclarativeParserConfig): ReviewBotParser;
|
|
13
|
+
//# sourceMappingURL=declarative-base.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"declarative-base.d.ts","sourceRoot":"","sources":["../../../../src/adapters/review-bot-parser/declarative-base.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,WAAW,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACpE,iBAAiB,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,uBAAuB,GAAG,eAAe,CA0CtF"}
|
|
@@ -0,0 +1,9 @@
|
|
|
1
|
+
import type { AdapterBase } from '../base.ts';
|
|
2
|
+
import type { Finding } from '../../core/findings/types.ts';
|
|
3
|
+
import type { GenericComment, VcsHost } from '../vcs-host/types.ts';
|
|
4
|
+
export interface ReviewBotParser extends AdapterBase {
|
|
5
|
+
detect(comment: GenericComment): boolean;
|
|
6
|
+
fetchFindings(vcs: VcsHost, pr: number | string): Promise<Finding[]>;
|
|
7
|
+
detectDismissal(reply: string): boolean;
|
|
8
|
+
}
|
|
9
|
+
//# sourceMappingURL=types.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/adapters/review-bot-parser/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,8BAA8B,CAAC;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAEpE,MAAM,WAAW,eAAgB,SAAQ,WAAW;IAClD,MAAM,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC;IACzC,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IACrE,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;CACzC"}
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"auto.d.ts","sourceRoot":"","sources":["../../../../src/adapters/review-engine/auto.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAA6B,MAAM,YAAY,CAAC;AAwE1E,eAAO,MAAM,WAAW,EAAE,YAkBzB,CAAC;AAEF,eAAe,WAAW,CAAC"}
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"claude.d.ts","sourceRoot":"","sources":["../../../../src/adapters/review-engine/claude.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAA6B,MAAM,YAAY,CAAC;AAoC1E,eAAO,MAAM,aAAa,EAAE,YA0D3B,CAAC;AAEF,eAAe,aAAa,CAAC"}
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"codex.d.ts","sourceRoot":"","sources":["../../../../src/adapters/review-engine/codex.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,YAAY,EAA6B,MAAM,YAAY,CAAC;AA8B1E,eAAO,MAAM,YAAY,EAAE,YA6C1B,CAAC;AAEF,eAAe,YAAY,CAAC"}
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"gemini.d.ts","sourceRoot":"","sources":["../../../../src/adapters/review-engine/gemini.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,YAAY,EAA6B,MAAM,YAAY,CAAC;AA2C1E,eAAO,MAAM,aAAa,EAAE,YAuD3B,CAAC;AAEF,eAAe,aAAa,CAAC"}
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"openai-compatible.d.ts","sourceRoot":"","sources":["../../../../src/adapters/review-engine/openai-compatible.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,YAAY,EAA6B,MAAM,YAAY,CAAC;AA8B1E,eAAO,MAAM,uBAAuB,EAAE,YA+DrC,CAAC;AAEF,eAAe,uBAAuB,CAAC"}
|
|
@@ -0,0 +1,13 @@
|
|
|
1
|
+
import type { Finding } from '../../core/findings/types.ts';
|
|
2
|
+
/**
|
|
3
|
+
* Parses the structured CRITICAL|WARNING|NOTE markdown format produced by all review
|
|
4
|
+
* engine adapters. Extracts file:line references from the finding body when present.
|
|
5
|
+
*
|
|
6
|
+
* Tolerates common LLM format drift (missing brackets, bold wrappers) because the prompt
|
|
7
|
+
* alone doesn't guarantee literal `### [CRITICAL]` — models routinely emit
|
|
8
|
+
* `### CRITICAL` or `### **CRITICAL**`. A strict parser silently returns zero findings
|
|
9
|
+
* on otherwise-valid output, which is exactly the silent-failure mode this file exists to
|
|
10
|
+
* prevent.
|
|
11
|
+
*/
|
|
12
|
+
export declare function parseReviewOutput(output: string, idPrefix: string): Finding[];
|
|
13
|
+
//# sourceMappingURL=parse-output.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"parse-output.d.ts","sourceRoot":"","sources":["../../../../src/adapters/review-engine/parse-output.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,8BAA8B,CAAC;AA2B5D;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,EAAE,CAoC7E"}
|
|
@@ -0,0 +1,4 @@
|
|
|
1
|
+
import type { ReviewInput } from './types.ts';
|
|
2
|
+
export declare function buildSystemPrompt(input: ReviewInput, template: string): string;
|
|
3
|
+
export declare function classifyError(message: string): 'auth' | 'rate_limit' | 'transient_network';
|
|
4
|
+
//# sourceMappingURL=prompt-builder.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"prompt-builder.d.ts","sourceRoot":"","sources":["../../../../src/adapters/review-engine/prompt-builder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAI9C,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAQ9E;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,YAAY,GAAG,mBAAmB,CAI1F"}
|
|
@@ -0,0 +1,28 @@
|
|
|
1
|
+
import type { AdapterBase } from '../base.ts';
|
|
2
|
+
import type { Finding } from '../../core/findings/types.ts';
|
|
3
|
+
export interface ReviewInput {
|
|
4
|
+
content: string;
|
|
5
|
+
kind: 'spec' | 'pr-diff' | 'file-batch';
|
|
6
|
+
context?: {
|
|
7
|
+
spec?: string;
|
|
8
|
+
plan?: string;
|
|
9
|
+
stack?: string;
|
|
10
|
+
cwd?: string;
|
|
11
|
+
gitSummary?: string;
|
|
12
|
+
designSchema?: string;
|
|
13
|
+
};
|
|
14
|
+
}
|
|
15
|
+
export interface ReviewOutput {
|
|
16
|
+
findings: Finding[];
|
|
17
|
+
rawOutput: string;
|
|
18
|
+
usage?: {
|
|
19
|
+
input: number;
|
|
20
|
+
output: number;
|
|
21
|
+
costUSD?: number;
|
|
22
|
+
};
|
|
23
|
+
}
|
|
24
|
+
export interface ReviewEngine extends AdapterBase {
|
|
25
|
+
review(input: ReviewInput): Promise<ReviewOutput>;
|
|
26
|
+
estimateTokens(content: string): number;
|
|
27
|
+
}
|
|
28
|
+
//# sourceMappingURL=types.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/adapters/review-engine/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,8BAA8B,CAAC;AAE5D,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,YAAY,CAAC;IACxC,OAAO,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACtH;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7D;AAED,MAAM,WAAW,YAAa,SAAQ,WAAW;IAC/C,MAAM,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAClD,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;CACzC"}
|
|
@@ -0,0 +1,12 @@
|
|
|
1
|
+
export type CommitState = 'pending' | 'success' | 'failure' | 'error';
|
|
2
|
+
export interface CommitStatusOptions {
|
|
3
|
+
sha: string;
|
|
4
|
+
state: CommitState;
|
|
5
|
+
description?: string;
|
|
6
|
+
context?: string;
|
|
7
|
+
targetUrl?: string;
|
|
8
|
+
cwd?: string;
|
|
9
|
+
}
|
|
10
|
+
export declare function resolveCommitSha(cwd: string, envSha?: string): string | null;
|
|
11
|
+
export declare function postCommitStatus(opts: CommitStatusOptions): boolean;
|
|
12
|
+
//# sourceMappingURL=commit-status.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"commit-status.d.ts","sourceRoot":"","sources":["../../../../src/adapters/vcs-host/commit-status.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,OAAO,CAAC;AAEtE,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,WAAW,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAMD,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAI5E;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAenE"}
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"github.d.ts","sourceRoot":"","sources":["../../../../src/adapters/vcs-host/github.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAA+D,MAAM,YAAY,CAAC;AAEvG,eAAO,MAAM,aAAa,EAAE,OAqE3B,CAAC;AAEF,eAAe,aAAa,CAAC"}
|
|
@@ -0,0 +1,42 @@
|
|
|
1
|
+
import type { AdapterBase } from '../base.ts';
|
|
2
|
+
export interface GenericComment {
|
|
3
|
+
id: string | number;
|
|
4
|
+
author: string;
|
|
5
|
+
body: string;
|
|
6
|
+
path?: string;
|
|
7
|
+
line?: number;
|
|
8
|
+
url?: string;
|
|
9
|
+
}
|
|
10
|
+
export interface PrMetadata {
|
|
11
|
+
title: string;
|
|
12
|
+
body: string;
|
|
13
|
+
files: string[];
|
|
14
|
+
headSha: string;
|
|
15
|
+
baseRef: string;
|
|
16
|
+
headRef: string;
|
|
17
|
+
}
|
|
18
|
+
export interface CreatePrOptions {
|
|
19
|
+
title: string;
|
|
20
|
+
body: string;
|
|
21
|
+
base: string;
|
|
22
|
+
head: string;
|
|
23
|
+
draft?: boolean;
|
|
24
|
+
idempotencyKey?: string;
|
|
25
|
+
}
|
|
26
|
+
export interface CreatePrResult {
|
|
27
|
+
number: number;
|
|
28
|
+
url: string;
|
|
29
|
+
alreadyExisted: boolean;
|
|
30
|
+
}
|
|
31
|
+
export interface VcsHost extends AdapterBase {
|
|
32
|
+
getPrDiff(pr: number | string): Promise<string>;
|
|
33
|
+
getPrMetadata(pr: number | string): Promise<PrMetadata>;
|
|
34
|
+
postComment(pr: number | string, body: string, idempotencyKey?: string): Promise<void>;
|
|
35
|
+
getReviewComments(pr: number | string): Promise<GenericComment[]>;
|
|
36
|
+
replyToComment(pr: number | string, commentId: string | number, body: string, idempotencyKey?: string): Promise<void>;
|
|
37
|
+
createPr(opts: CreatePrOptions): Promise<CreatePrResult>;
|
|
38
|
+
push(branch: string, opts?: {
|
|
39
|
+
setUpstream?: boolean;
|
|
40
|
+
}): Promise<void>;
|
|
41
|
+
}
|
|
42
|
+
//# sourceMappingURL=types.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/adapters/vcs-host/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,cAAc,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,OAAQ,SAAQ,WAAW;IAC1C,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAChD,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACxD,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvF,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAClE,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtH,QAAQ,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACzD,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACvE"}
|
|
@@ -0,0 +1,47 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Resolves the canonical package root directory from the perspective of any
|
|
3
|
+
* source file in the package. Robust under both source (`src/cli/foo.ts` →
|
|
4
|
+
* `<root>`) and compiled (`dist/src/cli/foo.js` → `<root>`) layouts.
|
|
5
|
+
*
|
|
6
|
+
* Background: every site that hardcoded `path.resolve(dirname(fileURLToPath(...)), '..', '..')`
|
|
7
|
+
* worked when called from the source layout but resolved one level shallow under
|
|
8
|
+
* the compiled output (landing in `dist/` instead of the package root). The
|
|
9
|
+
* real-world soak against `npx @delegance/claude-autopilot@alpha init` surfaced
|
|
10
|
+
* this — `init` couldn't find `presets/<name>/guardrail.config.yaml` because it
|
|
11
|
+
* was looking at `dist/presets/...` (which doesn't exist; presets ship at the
|
|
12
|
+
* package root).
|
|
13
|
+
*
|
|
14
|
+
* This helper walks up from the caller's `import.meta.url` looking for the
|
|
15
|
+
* `@delegance/claude-autopilot` package.json. Both source and compiled callers
|
|
16
|
+
* land in the same place.
|
|
17
|
+
*/
|
|
18
|
+
/**
|
|
19
|
+
* Walks up from the caller's location looking for the package.json that
|
|
20
|
+
* declares `name === '@delegance/claude-autopilot'`. Returns the directory
|
|
21
|
+
* containing that package.json, or null if not found within `maxDepth` levels.
|
|
22
|
+
*/
|
|
23
|
+
export declare function findPackageRoot(callerImportMetaUrl: string, maxDepth?: number): string | null;
|
|
24
|
+
/**
|
|
25
|
+
* Throws a clear error if the package root can't be located. Use at sites that
|
|
26
|
+
* absolutely require the root (e.g. preset config lookup).
|
|
27
|
+
*/
|
|
28
|
+
export declare function requirePackageRoot(callerImportMetaUrl: string): string;
|
|
29
|
+
/**
|
|
30
|
+
* Resolve a sibling-module path for dynamic `import()` that works under both
|
|
31
|
+
* source (caller is `.ts`) and compiled (caller is `.js`) layouts.
|
|
32
|
+
*
|
|
33
|
+
* Background: `import('./rules/foo.ts')` and `import('./review-engine/auto.ts')`
|
|
34
|
+
* are dynamic-import string literals — TS's `rewriteRelativeImportExtensions`
|
|
35
|
+
* only rewrites STATIC imports, leaving these string refs as `.ts` post-compile.
|
|
36
|
+
* Under compiled output, the actual module is `.js`, so the import fails with
|
|
37
|
+
* `Failed to import adapter from .../auto.ts`.
|
|
38
|
+
*
|
|
39
|
+
* This helper detects whether the caller is itself compiled (`.js`/`.mjs`) and
|
|
40
|
+
* rewrites the ref's extension to match.
|
|
41
|
+
*
|
|
42
|
+
* @param ref Sibling-module ref ending in `.ts` (e.g. `./review-engine/auto.ts`).
|
|
43
|
+
* @param callerImportMetaUrl Caller's `import.meta.url`.
|
|
44
|
+
* @returns Absolute filesystem path suitable for `import()`.
|
|
45
|
+
*/
|
|
46
|
+
export declare function resolveSiblingModule(ref: string, callerImportMetaUrl: string): string;
|
|
47
|
+
//# sourceMappingURL=_pkg-root.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"_pkg-root.d.ts","sourceRoot":"","sources":["../../../src/cli/_pkg-root.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAQH;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,mBAAmB,EAAE,MAAM,EAAE,QAAQ,SAAK,GAAG,MAAM,GAAG,IAAI,CAiBzF;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,mBAAmB,EAAE,MAAM,GAAG,MAAM,CAStE;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,GAAG,MAAM,CAIrF"}
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"autoregress-bridge.d.ts","sourceRoot":"","sources":["../../../src/cli/autoregress-bridge.ts"],"names":[],"mappings":"AAUA,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAI7D;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CAarD"}
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"baseline.d.ts","sourceRoot":"","sources":["../../../src/cli/baseline.ts"],"names":[],"mappings":"AAcA,MAAM,WAAW,sBAAsB;IACrC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,wBAAsB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,sBAA2B,GAAG,OAAO,CAAC,MAAM,CAAC,CAyFpG"}
|
|
@@ -0,0 +1,23 @@
|
|
|
1
|
+
export interface CiCommandOptions {
|
|
2
|
+
cwd?: string;
|
|
3
|
+
configPath?: string;
|
|
4
|
+
base?: string;
|
|
5
|
+
postComments?: boolean;
|
|
6
|
+
sarifOutput?: string;
|
|
7
|
+
diff?: boolean;
|
|
8
|
+
inlineComments?: boolean;
|
|
9
|
+
newOnly?: boolean;
|
|
10
|
+
failOn?: 'critical' | 'warning' | 'note' | 'none';
|
|
11
|
+
}
|
|
12
|
+
/**
|
|
13
|
+
* `guardrail ci` — opinionated single-command CI entrypoint.
|
|
14
|
+
*
|
|
15
|
+
* Defaults:
|
|
16
|
+
* base GITHUB_BASE_REF → HEAD~1
|
|
17
|
+
* output guardrail.sarif
|
|
18
|
+
* post-comments true
|
|
19
|
+
* fail-on critical (or policy.failOn from config)
|
|
20
|
+
* new-only false (or policy.newOnly from config)
|
|
21
|
+
*/
|
|
22
|
+
export declare function runCi(options?: CiCommandOptions): Promise<number>;
|
|
23
|
+
//# sourceMappingURL=ci.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"ci.d.ts","sourceRoot":"","sources":["../../../src/cli/ci.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,gBAAgB;IAC/B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,UAAU,GAAG,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC;CACnD;AAED;;;;;;;;;GASG;AACH,wBAAsB,KAAK,CAAC,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAAC,MAAM,CAAC,CAoB3E"}
|