@integrity-labs/agt-cli 0.28.836 → 0.28.838

package/dist/assets/review/post-review-findings.mjs

@@ -16,8 +16,9 @@
  * That copy is now DOWNSTREAM of this one. Do NOT add an equality sync test:
  * this copy is expected to diverge, and already has — `refuseIdentity()` below
  * makes a write without the VERIFIED review-bot identity impossible here, while
- * the plugin copy stays permissive for the human who runs it. A `--min-severity`
- * floor is the remaining planned divergence (ENG-10001).
+ * the plugin copy stays permissive for the human who runs it. `--min-severity`
+ * (below) is the second such divergence, and for the same reason: a human reads
+ * every finding and decides; an unattended agent posts what it is handed.
  */
 /**
  * post-review-findings — deliver `/s:code-review` and `/s:security-review`
@@ -48,6 +49,7 @@
  *   post-review-findings.mjs --pr 5409 --post
  *   post-review-findings.mjs --pr 5409 --status
  *   post-review-findings.mjs --pr 5409 --resolve <id> --reason "..."
+ *   post-review-findings.mjs --pr 5409 --post --min-severity major --min-severity P2
  */
 
 import { execFileSync } from 'node:child_process';
@@ -91,7 +93,10 @@ export function marker(id) {
 }
 
 export function buildBody(f, id) {
-  const sev = String(f.severity ?? 'minor').toUpperCase();
+  // NOT `?? 'minor'`. That printed a severity nobody assigned, and once a floor
+  // exists it would also make an unlabelled finding filterable — a silent drop
+  // caused entirely by the default. Unrated says what is true.
+  const sev = f.severity ? String(f.severity).toUpperCase() : 'UNRATED';
   const cat = f.category ? ` · ${f.category}` : '';
   return [
     `**${sev}${cat}** — ${f.summary}`,
@@ -104,6 +109,132 @@ export function buildBody(f, id) {
   ].join('\n');
 }
 
+/**
+ * The severity floor, and why it does NOT merge the two scales into one order.
+ *
+ * The two producers declare two different vocabularies and neither defines what
+ * its levels mean:
+ *   `/s:code-review`     — "severity": "major|minor"   (commands/code-review.md)
+ *   `/s:security-review` — "severity": "P1|P2|P3"      (commands/security-review.md)
+ *
+ * Measured over the 54 artefacts in `.smithers/review` on 2026-09-07 (39
+ * findings): the code lane emitted major x10 / minor x21, the security lane
+ * emitted P2 x1 / P3 x5, and P0 appears nowhere — in the artefacts, in either
+ * command, or in this tree. The lanes do not share a token.
+ *
+ * So a single merged rank would need a crosswalk (is `major` a P1 or a P2?)
+ * that NOTHING in this repo states. Inventing one is not a tidy-up, it decides
+ * something: place `major` above P2 and `--min-severity major` mutes 100% of
+ * the security lane's observed output — every finding it has ever produced —
+ * while reading like an ordinary noise filter. That is a suppression nobody
+ * chose, invisible on the wire, which is the failure this reviewer exists to
+ * find in other people's code.
+ *
+ * Comparison is therefore SCALE-LOCAL. A floor filters only findings written in
+ * its own vocabulary; anything on the other scale, or on no scale, is posted
+ * and reported. Concretely: `--min-severity major` drops `minor` and leaves
+ * every P-scale finding standing; `--min-severity P2` drops `P3` and leaves
+ * every code finding standing. If the producers ever agree a crosswalk, it
+ * belongs here as one table with that agreement cited — not guessed from the
+ * shape of the words.
+ *
+ * A consequence, and the reason `--min-severity` REPEATS: one value can never
+ * floor both lanes. "Post only the serious ones" against a two-lane producer is
+ * two floors — `--min-severity major --min-severity P2` — so the flag collects
+ * rather than overwrites. Repeating it for the SAME scale is refused instead of
+ * last-winning, on the rule this file already applies to `--status --resolve`:
+ * a flag that is accepted and then ignored is indistinguishable from one that
+ * was honoured.
+ */
+export const SEVERITY_SCALES = {
+  code: { major: 2, minor: 1 },
+  security: { p1: 3, p2: 2, p3: 1 },
+};
+
+/** `{ scale, rank }` for a severity token, or null when it is on no known scale. */
+export function severityRank(value) {
+  if (value === undefined || value === null) return null;
+  const k = String(value).trim().toLowerCase();
+  for (const [scale, table] of Object.entries(SEVERITY_SCALES)) {
+    if (Object.hasOwn(table, k)) return { scale, rank: table[k] };
+  }
+  return null;
+}
+
+/**
+ * Resolve the `--min-severity` argument, or throw.
+ *
+ * Fail-CLOSED here, unlike the fail-open treatment of an unknown finding
+ * severity below, because the two unknowns fail in opposite directions. An
+ * unrecognised FLOOR would compare against nothing and silently filter nothing
+ * — a run that reads exactly like a floor that was honoured and had no work to
+ * do. There is no output that distinguishes them, so it is refused instead.
+ */
+export function parseMinSeverity(value) {
+  const r = severityRank(value);
+  if (r) return { ...r, token: String(value).trim() };
+  const known = Object.values(SEVERITY_SCALES).flatMap((t) => Object.keys(t)).join(', ');
+  throw new Error(
+    `--min-severity "${value}" is not a severity this reviewer knows. Use one of: ${known} ` +
+      '(case-insensitive). Floors are compared within one scale only — see SEVERITY_SCALES.',
+  );
+}
+
+/** Resolve every `--min-severity` into one floor per scale, or throw. */
+export function parseMinSeverityList(values) {
+  const floors = {};
+  for (const v of values) {
+    const f = parseMinSeverity(v);
+    if (floors[f.scale]) {
+      throw new Error(
+        `--min-severity given twice for the ${f.scale} scale ("${floors[f.scale].token}" and "${f.token}"). ` +
+          'Only one can apply, and silently keeping the last is indistinguishable from honouring both. ' +
+          'Pass one floor per scale.',
+      );
+    }
+    floors[f.scale] = f;
+  }
+  return floors;
+}
+
+/**
+ * Split findings into those that clear the floor and those it withholds.
+ *
+ * Everything the floor cannot compare is KEPT, each carrying `_kept` saying why.
+ * Fail-open is the only safe direction: a finding that posts when it need not is
+ * noise a reader can skip, while one withheld by a comparison that never
+ * happened is invisible to everyone, including the agent that produced it.
+ *
+ * `blocking: true` also bypasses the floor. All four findings carrying that
+ * field in the measured set are `false`, so this rule has never yet fired — it
+ * is here because the alternative is a reviewer withholding a finding its own
+ * producer marked as blocking, and the cost of the rule while it lies dormant
+ * is nil.
+ */
+export function applySeverityFloor(findings, floors) {
+  if (!floors || Object.keys(floors).length === 0) return { kept: findings, suppressed: [] };
+  const kept = [];
+  const suppressed = [];
+  for (const f of findings) {
+    if (f.blocking === true) {
+      kept.push({ ...f, _kept: 'marked blocking' });
+      continue;
+    }
+    const r = severityRank(f.severity);
+    const floor = r ? floors[r.scale] : undefined;
+    if (!r) {
+      kept.push({ ...f, _kept: f.severity ? `severity "${f.severity}" is on no known scale` : 'no severity' });
+    } else if (!floor) {
+      kept.push({ ...f, _kept: `no floor given for the ${r.scale} scale` });
+    } else if (r.rank >= floor.rank) {
+      kept.push(f);
+    } else {
+      suppressed.push(f);
+    }
+  }
+  return { kept, suppressed };
+}
+
 /** Thin `gh` wrapper. `input` is piped to stdin, for endpoints taking a body. */
 let AUTH_TOKEN = null;
 
@@ -383,6 +514,9 @@ export function parseArgs(argv) {
     else if (k === '--dir') a.dir = argv[++i];
     else if (k === '--resolve') a.resolve = argv[++i];
     else if (k === '--reason') a.reason = argv[++i];
+    // Collects, rather than overwrites — see SEVERITY_SCALES: one value cannot
+    // floor both lanes, so repeating the flag is the intended way to floor both.
+    else if (k === '--min-severity') (a.minSeverity ??= []).push(argv[++i]);
   }
   return a;
 }
@@ -460,6 +594,9 @@ export function refuseIdentity({ kind, willWrite }) {
 async function main() {
   const a = parseArgs(process.argv.slice(2));
   if (!a.pr) throw new Error('--pr is required');
+  // Before the identity hop and before the PR is read: an unusable floor should
+  // cost one line of output, not a scan that then cannot be delivered as asked.
+  const floors = a.minSeverity === undefined ? null : parseMinSeverityList(a.minSeverity);
   const repo = a.repo ?? gh(['repo', 'view', '--json', 'nameWithOwner'], {}).nameWithOwner;
   const dir = a.dir ?? REVIEW_DIR;
 
@@ -520,7 +657,8 @@ async function main() {
   }
   // A merged or closed PR takes comments happily and shows them to nobody.
   const head = view.headRefOid;
-  const findings = loadFindings(dir, a.pr, head);
+  const loaded = loadFindings(dir, a.pr, head);
+  const { kept: findings, suppressed } = applySeverityFloor(loaded, floors);
   // --slurp (gh >= 2.44) is REQUIRED with --paginate here: without it gh emits
   // one JSON array PER PAGE, and gh()'s JSON.parse of the concatenation throws
   // `Unexpected token [`. That makes --post fail on exactly the large PRs it is
@@ -541,7 +679,18 @@ async function main() {
   const newInline = inline.filter((f) => !already.has(findingId(f)));
   const newOutside = outside.filter((f) => !already.has(findingId(f)));
 
-  console.log(`PR #${a.pr} @ ${head.slice(0, 9)} — ${findings.length} finding(s) loaded`);
+  console.log(`PR #${a.pr} @ ${head.slice(0, 9)} — ${loaded.length} finding(s) loaded`);
+  if (floors) {
+    const unfiltered = findings.filter((f) => f._kept);
+    const label = Object.values(floors).map((f) => `${f.token} (${f.scale})`).join(', ');
+    console.log(
+      `  severity floor:    ${label} — ${suppressed.length} withheld, ${unfiltered.length} kept unfiltered`,
+    );
+    // A withheld finding exists nowhere else once this process exits, so it is
+    // named here rather than counted. A count alone cannot be checked.
+    for (const f of suppressed) console.log(`  [withheld] ${f.severity} ${f.file}  ${findingId(f)}  ${f.summary.slice(0, 60)}`);
+    for (const f of unfiltered) console.log(`  [kept]     ${f.severity ?? '-'} ${f.file}  ${findingId(f)}  (${f._kept})`);
+  }
   console.log(`  inline-anchorable: ${inline.length}   outside-diff: ${outside.length}`);
   console.log(`  already posted:    ${inline.length + outside.length - newInline.length - newOutside.length}`);
   console.log(`  would post now:    ${newInline.length} inline + ${newOutside.length} in the body\n`);

package/dist/bin/agt.js

@@ -40,7 +40,7 @@ import {
   success,
   table,
   warn
-} from "../chunk-E6B43IJZ.js";
+} from "../chunk-MZNTGZA7.js";
 import {
   getProjectDir,
   isSessionResumeDisabled,
@@ -5467,7 +5467,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync11, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.836" : "dev";
+var cliVersion = true ? "0.28.838" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6658,7 +6658,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.836" : "dev";
+var cliVersion2 = true ? "0.28.838" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-E6B43IJZ.js → chunk-MZNTGZA7.js}

@@ -451,7 +451,7 @@ function orderTitlesForDescription(entries) {
 // ../../packages/core/dist/provisioning/frameworks/claudecode/index.js
 import { readFileSync as readFileSync4, writeFileSync as writeFileSync4, mkdirSync as mkdirSync3, existsSync as existsSync4, chmodSync as chmodSync4, readdirSync, rmSync as rmSync2, copyFileSync, lstatSync, realpathSync, symlinkSync, readlinkSync, renameSync as renameSync4, opendirSync } from "fs";
 import { join as join3, relative, dirname as dirname3 } from "path";
-import { homedir as homedir3 } from "os";
+import { homedir as homedir3, tmpdir } from "os";
 import { execFile } from "child_process";
 
 // ../../packages/core/dist/integrations/xurl-config.js
@@ -1864,6 +1864,34 @@ function sweepScratchDir(codeName, now = Date.now()) {
   }
   return removed;
 }
+var STRANDED_ARTEFACT_TMP_PREFIXES = [
+  "augmented-artefact-",
+  "augmented-artefact-source-"
+];
+function sweepStrandedArtefactTmpDirs(now = Date.now()) {
+  const root = tmpdir();
+  let entries;
+  try {
+    entries = readdirSync(root);
+  } catch {
+    return 0;
+  }
+  const cutoff = now - SCRATCH_RETENTION_DAYS * 24 * 60 * 60 * 1e3;
+  let removed = 0;
+  for (const entry of entries) {
+    if (!STRANDED_ARTEFACT_TMP_PREFIXES.some((prefix) => entry.startsWith(prefix)))
+      continue;
+    const full = join3(root, entry);
+    try {
+      if (isFreshWithin(full, cutoff))
+        continue;
+      rmSync2(full, { recursive: true, force: true });
+      removed += 1;
+    } catch {
+    }
+  }
+  return removed;
+}
 var SCRATCH_SCAN_ENTRY_BUDGET = 5e3;
 function isFreshWithin(path, cutoff) {
   let budget = SCRATCH_SCAN_ENTRY_BUDGET;
@@ -2051,6 +2079,7 @@ function deployArtifactsToProject(codeName, provisionDir) {
     mkdirSync3(getScratchDir(codeName), { recursive: true });
     mkdirSync3(getAgentTmpDir(codeName), { recursive: true });
     sweepScratchDir(codeName);
+    sweepStrandedArtefactTmpDirs();
   } catch (err) {
     process.stderr.write(`[scratch] [ensure-or-sweep-failed] agent=${codeName} error=${err.message}
 `);
@@ -6537,7 +6566,7 @@ function exchangeFailureKind(err) {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.836" : "dev";
+var agtCliVersion = true ? "0.28.838" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -10895,4 +10924,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-E6B43IJZ.js.map
+//# sourceMappingURL=chunk-MZNTGZA7.js.map