@mmnto/cli 1.115.0 → 1.117.0

package/dist/parsers/triage-severity-mapper.test.js

@@ -46,6 +46,63 @@ describe('mapToTriageCategory', () => {
         const finding = makeFinding({ body: 'Trailing whitespace on line 42' });
         expect(mapToTriageCategory(finding)).toBe('nit');
     });
+    it('the NITS bucket ignores keywords inside word context (mmnto-ai/totem#2626 falsification rounds)', () => {
+        // ghcq's stock closing boilerplate contains "defi-nit-ions"; a bare
+        // substring match routed 5 of the 7 in-org ghcq findings to NITS. With no
+        // other keyword hit, both bodies fall to the architecture default —
+        // pinned exactly, not merely not-nit.
+        const ghcqBoilerplate = makeFinding({
+            tool: 'ghcq',
+            body: '## Unused variable\n\nNo imports, new methods, or new definitions are needed.',
+        });
+        expect(mapToTriageCategory(ghcqBoilerplate)).toBe('architecture');
+        // "u-nit test" is the same containment class for every bot.
+        const unitTest = makeFinding({ body: 'Missing unit test for the new branch' });
+        expect(mapToTriageCategory(unitTest)).toBe('architecture');
+        // snake_case identifiers are word context too — `_` is in the blocked
+        // class (round-3 catch: "is_minor_bump" bucketed to nit).
+        expect(mapToTriageCategory(makeFinding({ body: 'the is_minor_bump flag is never read' }))).toBe('architecture');
+        // Non-ASCII letters are word context. Both normalization forms are pinned
+        // (round-3 catch: an NFC-only fixture hid the decomposed-form leak — the
+        // combining mark U+0308 is neither letter nor number, so \p{M} must be in
+        // the blocked class; GitHub does not normalize comment bodies). These two
+        // fixture bodies are built via fromCharCode so their source form is
+        // deterministic — an editor normalizing a literal NFD body would silently
+        // re-hide the leak.
+        const nfcBody = String.fromCharCode(0x00fc) + 'nit coverage discussion';
+        expect(mapToTriageCategory(makeFinding({ body: nfcBody }))).toBe('architecture');
+        const nfdBody = 'u' + String.fromCharCode(0x0308) + 'nit coverage discussion';
+        expect(mapToTriageCategory(makeFinding({ body: nfdBody }))).toBe('architecture');
+        // Boundary-anchored NIT keywords still match when legitimately present,
+        // including CodeRabbit's real severity markup, which keeps a space or
+        // emoji before the token (parse-nits.ts `\s*`).
+        expect(mapToTriageCategory(makeFinding({ body: 'nit: prefer const here' }))).toBe('nit');
+        expect(mapToTriageCategory(makeFinding({ body: 'de quality_ | _🟡 minor_ | _⚡ quick' }))).toBe('nit');
+        // Inflections keep matching under the open trail.
+        expect(mapToTriageCategory(makeFinding({ body: 'two typos in this paragraph' }))).toBe('nit');
+    });
+    it('security/architecture/convention keep substring semantics — stems, inflections, negations (rounds 2–3 regression guards)', () => {
+        // The security list deliberately carries stems ('sanitiz', 'authenticat');
+        // round 2 proved a trailing \b killed every inflection, and round 3 proved
+        // a leading boundary killed the negation class — substring keeps both.
+        expect(mapToTriageCategory(makeFinding({ body: 'Please sanitize the user input' }))).toBe('security');
+        expect(mapToTriageCategory(makeFinding({ body: 'unsanitized input reaches the sink' }))).toBe('security');
+        expect(mapToTriageCategory(makeFinding({ body: 'unauthorized access is possible' }))).toBe('security');
+        expect(mapToTriageCategory(makeFinding({ body: 'authentication bypass possible' }))).toBe('security');
+        // Non-vacuous inflection guard: the body carries a nit-decoy ('Consider')
+        // AND a 'minor' severity, so if 'race condition' stops matching inside
+        // 'race conditions' the result is 'nit' (keyword path) or 'convention'
+        // (severity fallback) — observable either way; only a real architecture
+        // keyword hit yields the expected value. (Round-4 catch: with the default
+        // 'info' severity, the all-predicates-off mutant fell through to the
+        // architecture default and still passed.)
+        expect(mapToTriageCategory(makeFinding({ body: 'Consider the race conditions in the write path', severity: 'minor' }))).toBe('architecture');
+        // Architecture/convention leading-openness pinned (round-4 catch: this
+        // guard's title claimed three buckets but only security could fail):
+        // mid-word containments are DELIBERATE matches in these buckets.
+        expect(mapToTriageCategory(makeFinding({ body: 'decoupling the parser from the CLI' }))).toBe('architecture');
+        expect(mapToTriageCategory(makeFinding({ body: 'renaming this helper would read better' }))).toBe('convention');
+    });
     it('falls back to architecture for unknown findings', () => {
         const finding = makeFinding({ body: 'Something unusual happened here' });
         expect(mapToTriageCategory(finding)).toBe('architecture');

package/dist/parsers/triage-severity-mapper.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"triage-severity-mapper.test.js","sourceRoot":"","sources":["../../src/parsers/triage-severity-mapper.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAG9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAElE,wDAAwD;AAExD,SAAS,WAAW,CAAC,YAA2C,EAAE;IAChE,OAAO;QACL,IAAI,EAAE,YAAY;QAClB,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,YAAY;QAClB,IAAI,EAAE,mBAAmB;QACzB,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAED,wDAAwD;AAExD,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,IAAI,EAAE,uCAAuC,EAAE,CAAC,CAAC;QAC/E,MAAM,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,IAAI,EAAE,2CAA2C,EAAE,CAAC,CAAC;QACnF,MAAM,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,IAAI,EAAE,4CAA4C,EAAE,CAAC,CAAC;QACpF,MAAM,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,OAAO,GAAG,WAAW,CAAC;YAC1B,IAAI,EAAE,0DAA0D;SACjE,CAAC,CAAC;QACH,MAAM,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,IAAI,EAAE,6CAA6C,EAAE,CAAC,CAAC;QACrF,MAAM,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,IAAI,EAAE,uCAAuC,EAAE,CAAC,CAAC;QAC/E,MAAM,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;QACrC,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,IAAI,EAAE,qCAAqC,EAAE,CAAC,CAAC;QAC7E,MAAM,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,IAAI,EAAE,gCAAgC,EAAE,CAAC,CAAC;QACxE,MAAM,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,IAAI,EAAE,iCAAiC,EAAE,CAAC,CAAC;QACzE,MAAM,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,IAAI,EAAE,iCAAiC,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC;QAC/F,MAAM,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2EAA2E,EAAE,GAAG,EAAE;QACnF,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,IAAI,EAAE,gCAAgC,EAAE,CAAC,CAAC;QACxE,MAAM,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"triage-severity-mapper.test.js","sourceRoot":"","sources":["../../src/parsers/triage-severity-mapper.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAG9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAElE,wDAAwD;AAExD,SAAS,WAAW,CAAC,YAA2C,EAAE;IAChE,OAAO;QACL,IAAI,EAAE,YAAY;QAClB,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,YAAY;QAClB,IAAI,EAAE,mBAAmB;QACzB,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAED,wDAAwD;AAExD,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,IAAI,EAAE,uCAAuC,EAAE,CAAC,CAAC;QAC/E,MAAM,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,IAAI,EAAE,2CAA2C,EAAE,CAAC,CAAC;QACnF,MAAM,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,IAAI,EAAE,4CAA4C,EAAE,CAAC,CAAC;QACpF,MAAM,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,OAAO,GAAG,WAAW,CAAC;YAC1B,IAAI,EAAE,0DAA0D;SACjE,CAAC,CAAC;QACH,MAAM,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,IAAI,EAAE,6CAA6C,EAAE,CAAC,CAAC;QACrF,MAAM,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,IAAI,EAAE,uCAAuC,EAAE,CAAC,CAAC;QAC/E,MAAM,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;QACrC,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,IAAI,EAAE,qCAAqC,EAAE,CAAC,CAAC;QAC7E,MAAM,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,IAAI,EAAE,gCAAgC,EAAE,CAAC,CAAC;QACxE,MAAM,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iGAAiG,EAAE,GAAG,EAAE;QACzG,oEAAoE;QACpE,0EAA0E;QAC1E,oEAAoE;QACpE,sCAAsC;QACtC,MAAM,eAAe,GAAG,WAAW,CAAC;YAClC,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,+EAA+E;SACtF,CAAC,CAAC;QACH,MAAM,CAAC,mBAAmB,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAClE,4DAA4D;QAC5D,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,IAAI,EAAE,sCAAsC,EAAE,CAAC,CAAC;QAC/E,MAAM,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC3D,sEAAsE;QACtE,0DAA0D;QAC1D,MAAM,CAAC,mBAAmB,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,sCAAsC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAC7F,cAAc,CACf,CAAC;QACF,0EAA0E;QAC1E,yEAAyE;QACzE,0EAA0E;QAC1E,0EAA0E;QAC1E,oEAAoE;QACpE,0EAA0E;QAC1E,oBAAoB;QACpB,MAAM,OAAO,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,yBAAyB,CAAC;QACxE,MAAM,CAAC,mBAAmB,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACjF,MAAM,OAAO,GAAG,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,yBAAyB,CAAC;QAC9E,MAAM,CAAC,mBAAmB,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACjF,wEAAwE;QACxE,sEAAsE;QACtE,gDAAgD;QAChD,MAAM,CAAC,mBAAmB,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzF,MAAM,CAAC,mBAAmB,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,qCAAqC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAC5F,KAAK,CACN,CAAC;QACF,kDAAkD;QAClD,MAAM,CAAC,mBAAmB,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0HAA0H,EAAE,GAAG,EAAE;QAClI,2EAA2E;QAC3E,2EAA2E;QAC3E,uEAAuE;QACvE,MAAM,CAAC,mBAAmB,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,gCAAgC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CACvF,UAAU,CACX,CAAC;QACF,MAAM,CAAC,mBAAmB,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,oCAAoC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAC3F,UAAU,CACX,CAAC;QACF,MAAM,CAAC,mBAAmB,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,iCAAiC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CACxF,UAAU,CACX,CAAC;QACF,MAAM,CAAC,mBAAmB,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,gCAAgC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CACvF,UAAU,CACX,CAAC;QACF,0EAA0E;QAC1E,uEAAuE;QACvE,uEAAuE;QACvE,wEAAwE;QACxE,0EAA0E;QAC1E,qEAAqE;QACrE,0CAA0C;QAC1C,MAAM,CACJ,mBAAmB,CACjB,WAAW,CAAC,EAAE,IAAI,EAAE,gDAAgD,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAC3F,CACF,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACvB,uEAAuE;QACvE,qEAAqE;QACrE,iEAAiE;QACjE,MAAM,CAAC,mBAAmB,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,oCAAoC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAC3F,cAAc,CACf,CAAC;QACF,MAAM,CACJ,mBAAmB,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,wCAAwC,EAAE,CAAC,CAAC,CACrF,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,IAAI,EAAE,iCAAiC,EAAE,CAAC,CAAC;QACzE,MAAM,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,IAAI,EAAE,iCAAiC,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC;QAC/F,MAAM,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2EAA2E,EAAE,GAAG,EAAE;QACnF,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,IAAI,EAAE,gCAAgC,EAAE,CAAC,CAAC;QACxE,MAAM,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mmnto/cli",
-  "version": "1.115.0",
+  "version": "1.117.0",
   "description": "Totem: local-first toolkit that keeps AI-agent work queryable, enforceable, and derivable as plain files in your codebase",
   "type": "module",
   "engines": {
@@ -28,7 +28,7 @@
     "smol-toml": "^1.6.1",
     "yaml": "^2.4.0",
     "zod": "^3.24.0",
-    "@mmnto/totem": "1.115.0"
+    "@mmnto/totem": "1.117.0"
   },
   "devDependencies": {
     "@anthropic-ai/sdk": "^0.98.0",