audit-tools 0.28.0

package/dist/audit/adapters/npmAudit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"npmAudit.d.ts","sourceRoot":"","sources":["../../../src/audit/adapters/npmAudit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAG5E,UAAU,YAAY;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,OAAO,GAAG;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9D;AAED,UAAU,YAAY;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;CAChD;AAWD,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,YAAY,GAClB,uBAAuB,CAgBzB"}

package/dist/audit/adapters/npmAudit.js

@@ -0,0 +1,24 @@
+import { normalizeGenericExternalResults } from "./normalizeExternal.js";
+const NPM_SEVERITY_MAP = {
+    critical: "critical",
+    high: "high",
+    moderate: "medium",
+    medium: "medium",
+    low: "low",
+    info: "info",
+};
+export function normalizeNpmAuditJson(input) {
+    return normalizeGenericExternalResults("npm-audit", Object.entries(input.vulnerabilities ?? {}).map(([pkg, vuln], index) => {
+        const severity = NPM_SEVERITY_MAP[vuln.severity ?? ""] ?? "low";
+        return {
+            id: `npm-audit-${index}`,
+            category: "dependency_risk",
+            severity,
+            path: "package.json",
+            summary: `Package ${pkg} has a ${severity} severity vulnerability in range ${vuln.range ?? "unknown"}.`,
+            rule: pkg,
+            raw: vuln,
+        };
+    }));
+}
+//# sourceMappingURL=npmAudit.js.map

package/dist/audit/adapters/npmAudit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"npmAudit.js","sourceRoot":"","sources":["../../../src/audit/adapters/npmAudit.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,+BAA+B,EAAE,MAAM,wBAAwB,CAAC;AAazE,MAAM,gBAAgB,GAA2B;IAC/C,QAAQ,EAAE,UAAU;IACpB,IAAI,EAAE,MAAM;IACZ,QAAQ,EAAE,QAAQ;IAClB,MAAM,EAAE,QAAQ;IAChB,GAAG,EAAE,KAAK;IACV,IAAI,EAAE,MAAM;CACb,CAAC;AAEF,MAAM,UAAU,qBAAqB,CACnC,KAAmB;IAEnB,OAAO,+BAA+B,CACpC,WAAW,EACX,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE;QACrE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,IAAI,KAAK,CAAC;QAChE,OAAO;YACL,EAAE,EAAE,aAAa,KAAK,EAAE;YACxB,QAAQ,EAAE,iBAAiB;YAC3B,QAAQ;YACR,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,WAAW,GAAG,UAAU,QAAQ,oCAAoC,IAAI,CAAC,KAAK,IAAI,SAAS,GAAG;YACvG,IAAI,EAAE,GAAG;YACT,GAAG,EAAE,IAAI;SACV,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;AACJ,CAAC"}

package/dist/audit/adapters/semgrep.d.ts

@@ -0,0 +1,23 @@
+import type { ExternalAnalyzerResults } from "../types/externalAnalyzer.js";
+interface SemgrepJson {
+    results?: Array<{
+        check_id?: string;
+        path?: string;
+        start?: {
+            line?: number;
+        };
+        end?: {
+            line?: number;
+        };
+        extra?: {
+            severity?: string;
+            message?: string;
+            metadata?: {
+                category?: string;
+            };
+        };
+    }>;
+}
+export declare function normalizeSemgrepJson(input: SemgrepJson): ExternalAnalyzerResults;
+export {};
+//# sourceMappingURL=semgrep.d.ts.map

package/dist/audit/adapters/semgrep.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"semgrep.d.ts","sourceRoot":"","sources":["../../../src/audit/adapters/semgrep.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAG5E,UAAU,WAAW;IACnB,OAAO,CAAC,EAAE,KAAK,CAAC;QACd,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE;YAAE,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAC1B,GAAG,CAAC,EAAE;YAAE,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QACxB,KAAK,CAAC,EAAE;YACN,QAAQ,CAAC,EAAE,MAAM,CAAC;YAClB,OAAO,CAAC,EAAE,MAAM,CAAC;YACjB,QAAQ,CAAC,EAAE;gBAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;aAAE,CAAC;SAClC,CAAC;KACH,CAAC,CAAC;CACJ;AA6BD,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,WAAW,GACjB,uBAAuB,CAezB"}

package/dist/audit/adapters/semgrep.js

@@ -0,0 +1,40 @@
+import { normalizeGenericExternalResults } from "./normalizeExternal.js";
+/**
+ * Maps semgrep's native uppercase severity strings to the lowercase enum values
+ * required by ExternalAnalyzerResultsSchema. Case-insensitive lookup so
+ * any casing variant is handled uniformly.
+ *
+ * Semgrep → schema:
+ *   CRITICAL → 'critical'
+ *   ERROR    → 'high'
+ *   WARNING  → 'medium'
+ *   INFO     → 'info'
+ *
+ * Any other / undefined value returns undefined so
+ * normalizeGenericExternalResults can apply its own fallback.
+ */
+function normalizeSemgrepSeverity(raw) {
+    if (raw === undefined)
+        return undefined;
+    switch (raw.toUpperCase()) {
+        case "CRITICAL": return "critical";
+        case "ERROR": return "high";
+        case "WARNING": return "medium";
+        case "INFO": return "info";
+        default: return undefined;
+    }
+}
+export function normalizeSemgrepJson(input) {
+    return normalizeGenericExternalResults("semgrep", (input.results ?? []).map((result) => ({
+        id: result.check_id,
+        category: result.extra?.metadata?.category ?? "security",
+        severity: normalizeSemgrepSeverity(result.extra?.severity),
+        path: result.path,
+        line_start: result.start?.line,
+        line_end: result.end?.line,
+        summary: result.extra?.message,
+        rule: result.check_id,
+        raw: result,
+    })));
+}
+//# sourceMappingURL=semgrep.js.map

package/dist/audit/adapters/semgrep.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"semgrep.js","sourceRoot":"","sources":["../../../src/audit/adapters/semgrep.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,+BAA+B,EAAE,MAAM,wBAAwB,CAAC;AAgBzE;;;;;;;;;;;;;GAaG;AACH,SAAS,wBAAwB,CAC/B,GAAuB;IAEvB,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,QAAQ,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC;QAC1B,KAAK,UAAU,CAAC,CAAC,OAAO,UAAU,CAAC;QACnC,KAAK,OAAO,CAAC,CAAI,OAAO,MAAM,CAAC;QAC/B,KAAK,SAAS,CAAC,CAAE,OAAO,QAAQ,CAAC;QACjC,KAAK,MAAM,CAAC,CAAK,OAAO,MAAM,CAAC;QAC/B,OAAO,CAAC,CAAS,OAAO,SAAS,CAAC;IACpC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,KAAkB;IAElB,OAAO,+BAA+B,CACpC,SAAS,EACT,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACrC,EAAE,EAAE,MAAM,CAAC,QAAQ;QACnB,QAAQ,EAAE,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,IAAI,UAAU;QACxD,QAAQ,EAAE,wBAAwB,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC;QAC1D,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,UAAU,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI;QAC9B,QAAQ,EAAE,MAAM,CAAC,GAAG,EAAE,IAAI;QAC1B,OAAO,EAAE,MAAM,CAAC,KAAK,EAAE,OAAO;QAC9B,IAAI,EAAE,MAAM,CAAC,QAAQ;QACrB,GAAG,EAAE,MAAM;KACZ,CAAC,CAAC,CACJ,CAAC;AACJ,CAAC"}

package/dist/audit/cli/advanceAuditCommand.d.ts

@@ -0,0 +1,2 @@
+export declare function cmdAdvanceAudit(argv: string[]): Promise<void>;
+//# sourceMappingURL=advanceAuditCommand.d.ts.map

package/dist/audit/cli/advanceAuditCommand.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"advanceAuditCommand.d.ts","sourceRoot":"","sources":["../../../src/audit/cli/advanceAuditCommand.ts"],"names":[],"mappings":"AAWA,wBAAsB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAoFnE"}

package/dist/audit/cli/advanceAuditCommand.js

@@ -0,0 +1,95 @@
+import { mkdir } from "node:fs/promises";
+import { promoteFinalAuditReport } from "../io/artifacts.js";
+import { clearDispatchFiles, ensureSupervisorDirs } from "../io/runArtifacts.js";
+import { loadSessionConfig } from "../supervisor/sessionConfig.js";
+import { resolveRunProviderName, getArtifactsDir, getRootDir, warnIfNotGitRepo, getBatchResultsDir, getFlag } from "./args.js";
+import { runAuditStep, ingestBatchAuditResults } from "./auditStep.js";
+import { emitEnvelope } from "./envelope.js";
+import { persistConfigErrorHandoff } from "./reviewRun.js";
+import { cleanupStaleArtifactsDir } from "./cleanup.js";
+export async function cmdAdvanceAudit(argv) {
+    const root = getRootDir(argv);
+    warnIfNotGitRepo(root);
+    const artifactsDir = getArtifactsDir(argv);
+    await cleanupStaleArtifactsDir(artifactsDir);
+    await mkdir(artifactsDir, { recursive: true });
+    await ensureSupervisorDirs(artifactsDir);
+    let sessionConfig;
+    try {
+        sessionConfig = await loadSessionConfig(artifactsDir);
+    }
+    catch (error) {
+        await persistConfigErrorHandoff({
+            root,
+            artifactsDir,
+            progressSummary: error instanceof Error ? error.message : String(error),
+        });
+        throw error;
+    }
+    const providerName = resolveRunProviderName(argv, sessionConfig);
+    const batchResultsDir = getBatchResultsDir(argv);
+    if (batchResultsDir && getFlag(argv, "--results")) {
+        throw new Error("Use either --results <file> or --batch-results <dir>, not both.");
+    }
+    if (batchResultsDir) {
+        const result = await ingestBatchAuditResults({
+            root,
+            artifactsDir,
+            batchDir: batchResultsDir,
+        });
+        if (result.selected_executor !== "agent") {
+            await clearDispatchFiles(artifactsDir);
+        }
+        await emitEnvelope({
+            root,
+            artifactsDir,
+            bundle: result.bundle,
+            audit_state: result.audit_state,
+            selected_obligation: result.selected_obligation,
+            selected_executor: result.selected_executor,
+            progress_made: result.progress_made,
+            artifacts_written: result.artifacts_written,
+            progress_summary: result.progress_summary,
+            next_likely_step: result.next_likely_step,
+            providerName,
+        });
+        if (result.audit_state.status === "complete") {
+            await promoteFinalAuditReport({ artifactsDir });
+        }
+        return;
+    }
+    const externalAnalyzerPath = getFlag(argv, "--external-analyzer-results");
+    const result = await runAuditStep({
+        root,
+        artifactsDir,
+        preferredExecutor: getFlag(argv, "--preferred-executor") ??
+            (externalAnalyzerPath ? "external_analyzer_import_executor" : undefined),
+        auditResultsPath: getFlag(argv, "--results"),
+        runtimeUpdatesPath: getFlag(argv, "--updates"),
+        externalAnalyzerPath,
+        analyzers: sessionConfig.analyzers,
+        graphLlmEdgeReasoning: sessionConfig.graph?.llm_edge_reasoning,
+        since: getFlag(argv, "--since"),
+        runLog: sessionConfig.observability?.run_log,
+    });
+    if (result.selected_executor !== "agent") {
+        await clearDispatchFiles(artifactsDir);
+    }
+    await emitEnvelope({
+        root,
+        artifactsDir,
+        bundle: result.updated_bundle,
+        audit_state: result.audit_state,
+        selected_obligation: result.selected_obligation,
+        selected_executor: result.selected_executor,
+        progress_made: result.progress_made,
+        artifacts_written: result.artifacts_written,
+        progress_summary: result.progress_summary,
+        next_likely_step: result.next_likely_step,
+        providerName,
+    });
+    if (result.audit_state.status === "complete") {
+        await promoteFinalAuditReport({ artifactsDir });
+    }
+}
+//# sourceMappingURL=advanceAuditCommand.js.map

package/dist/audit/cli/advanceAuditCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"advanceAuditCommand.js","sourceRoot":"","sources":["../../../src/audit/cli/advanceAuditCommand.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAEjF,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,sBAAsB,EAAE,eAAe,EAAE,UAAU,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC/H,OAAO,EAAE,YAAY,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AAExD,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAc;IAClD,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAC9B,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACvB,MAAM,YAAY,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IAC3C,MAAM,wBAAwB,CAAC,YAAY,CAAC,CAAC;IAC7C,MAAM,KAAK,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/C,MAAM,oBAAoB,CAAC,YAAY,CAAC,CAAC;IACzC,IAAI,aAA4B,CAAC;IACjC,IAAI,CAAC;QACH,aAAa,GAAG,MAAM,iBAAiB,CAAC,YAAY,CAAC,CAAC;IACxD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,yBAAyB,CAAC;YAC9B,IAAI;YACJ,YAAY;YACZ,eAAe,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SACxE,CAAC,CAAC;QACH,MAAM,KAAK,CAAC;IACd,CAAC;IACD,MAAM,YAAY,GAAG,sBAAsB,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IACjE,MAAM,eAAe,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACjD,IAAI,eAAe,IAAI,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC;YAC3C,IAAI;YACJ,YAAY;YACZ,QAAQ,EAAE,eAAe;SAC1B,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,iBAAiB,KAAK,OAAO,EAAE,CAAC;YACzC,MAAM,kBAAkB,CAAC,YAAY,CAAC,CAAC;QACzC,CAAC;QACD,MAAM,YAAY,CAAC;YACjB,IAAI;YACJ,YAAY;YACZ,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;YAC/C,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;YAC3C,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;YAC3C,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;YACzC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;YACzC,YAAY;SACb,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YAC7C,MAAM,uBAAuB,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC;QAClD,CAAC;QACD,OAAO;IACT,CAAC;IACD,MAAM,oBAAoB,GAAG,OAAO,CAAC,IAAI,EAAE,6BAA6B,CAAC,CAAC;IAC1E,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC;QAChC,IAAI;QACJ,YAAY;QACZ,iBAAiB,EACf,OAAO,CAAC,IAAI,EAAE,sBAAsB,CAAC;YACrC,CAAC,oBAAoB,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1E,gBAAgB,EAAE,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC;QAC5C,kBAAkB,EAAE,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC;QAC9C,oBAAoB;QACpB,SAAS,EAAE,aAAa,CAAC,SAAS;QAClC,qBAAqB,EAAE,aAAa,CAAC,KAAK,EAAE,kBAAkB;QAC9D,KAAK,EAAE,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC;QAC/B,MAAM,EAAE,aAAa,CAAC,aAAa,EAAE,OAAO;KAC7C,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,iBAAiB,KAAK,OAAO,EAAE,CAAC;QACzC,MAAM,kBAAkB,CAAC,YAAY,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,YAAY,CAAC;QACjB,IAAI;QACJ,YAAY;QACZ,MAAM,EAAE,MAAM,CAAC,cAAc;QAC7B,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;QAC/C,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;QAC3C,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;QAC3C,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,YAAY;KACb,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QAC7C,MAAM,uBAAuB,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC;IAClD,CAAC;AACH,CAAC"}

package/dist/audit/cli/args.d.ts

@@ -0,0 +1,95 @@
+import { toPromptPathToken, quotePromptCommandArg, type SessionConfig, type HostModelRosterEntry } from "audit-tools/shared";
+export declare const DIRECT_CLI_DEFAULTS: {
+    rootDir: string;
+    artifactsDir: string;
+    timeoutMs: number;
+};
+export declare function getFlag(argv: string[], name: string, fallback?: string): string | undefined;
+export declare function hasFlag(argv: string[], name: string): boolean;
+export declare function getOptionalBooleanFlag(argv: string[], name: string): boolean | undefined;
+export declare function optionalBooleanEnv(value: string | undefined): boolean | undefined;
+export declare function resolveHostDispatchCapability(options: {
+    explicit?: boolean;
+    sessionConfig: SessionConfig;
+    env?: NodeJS.ProcessEnv;
+}): boolean;
+export declare function toBase64Url(value: string): string;
+export declare function fromBase64Url(value: string): string;
+export declare function digestId(value: string): string;
+export declare function safeArtifactStem(value: string): string;
+export declare function artifactNameForId(value: string, extension: string): string;
+export declare const quoteCommandArg: typeof quotePromptCommandArg;
+/**
+ * Normalize a generated command token to POSIX path separators. These command
+ * strings are embedded in step prompts and `allowed_commands` and run by the
+ * host — often through a bash-like shell, which treats `\` as an escape and
+ * silently corrupts Windows absolute paths (`node C:\a\b.mjs` collapses to
+ * `node C:ab.mjs`). Node accepts forward slashes on Windows, and `/` survives
+ * bash, PowerShell, and cmd alike. Only tokens that actually carry a backslash
+ * are touched, and no non-path argument in this CLI contains one, so this is a
+ * targeted normalization rather than a blanket rewrite.
+ */
+export declare const toPosixCommandToken: typeof toPromptPathToken;
+export declare function renderCommand(argv: string[]): string;
+export declare function summarizeLaunchExit(result: {
+    accepted?: boolean;
+    exitCode?: number | null;
+    signal?: string | null;
+    command?: string;
+    stdoutPath?: string;
+    stderrPath?: string;
+    error?: string;
+}): string | null;
+export declare function taskResultPath(taskResultsDir: string, taskId: string): string;
+export declare function isCanonicalResultFilename(filename: string): boolean;
+export declare function packetPromptPath(taskResultsDir: string, packetId: string): string;
+export declare function readStdinText(): Promise<string>;
+export declare function normalizePositiveInteger(value: unknown): number | undefined;
+export declare function parsePositiveIntegerFlag(argv: string[], name: string): number | undefined;
+export declare function getRootDir(argv: string[]): string;
+/**
+ * Resolve the artifacts dir. An explicit `--artifacts-dir` is honored verbatim
+ * (resolved against CWD). With NO `--artifacts-dir`, the default rebases onto
+ * `--root` via the shared `auditArtifactsDir()` helper — so `--root <X>` lands
+ * the default under `<X>/.audit-tools/audit`. Previously the default resolved
+ * the `.audit-tools/audit` literal against CWD independently of `--root`, so a
+ * bare `--root <X>` silently ignored `<X>` (the latent bug fixed here).
+ */
+export declare function getArtifactsDir(argv: string[]): string;
+export declare function warnIfNotGitRepo(root: string): void;
+export declare function getBatchResultsDir(argv: string[]): string | undefined;
+export declare function getTimeoutMs(argv: string[], sessionConfig: SessionConfig): number;
+export declare function getExplicitProvider(argv: string[]): string | undefined;
+export declare function getHostModel(argv: string[]): string | null;
+export declare function getHostMaxActiveSubagents(argv: string[]): number | null;
+/**
+ * Context window (input tokens) the host reports for the model it will dispatch
+ * subagents to — the dispatch-time capability handshake. Outranks the static
+ * model table when sizing packets, so the partition fills the real model's
+ * window instead of the conservative 32k default.
+ */
+export declare function getHostContextTokens(argv: string[]): number | null;
+/** Output-token cap the host reports for its dispatch model (handshake). */
+export declare function getHostOutputTokens(argv: string[]): number | null;
+/**
+ * Ordered model roster the host reports at the dispatch handshake
+ * (`--host-models`, JSON array, lowest rank first) — the multi-rank
+ * generalization of the scalar `--host-context-tokens`/`--host-output-tokens`
+ * pair. `rank` values are RELATIVE labels (`small`/`standard`/`deep`) aligned
+ * with `model_hint.tier`; windows are discovered, never guessed, and the host
+ * never names a model. Malformed input throws (shared parser) so a mistyped
+ * handshake fails loudly instead of silently downgrading to the floor.
+ */
+export declare function getHostModelRoster(argv: string[]): HostModelRosterEntry[] | null;
+/**
+ * Opaque model identity the host reports for its dispatch model
+ * (`--host-model-id`). Used ONLY as a quota-key segment so quota learning keys
+ * on `provider/<id>` instead of `provider/*` when no model name is resolvable —
+ * never a window authority, never matched against a name table.
+ */
+export declare function getHostModelId(argv: string[]): string | null;
+export declare function resolveRunProviderName(argv: string[], sessionConfig: SessionConfig): string;
+export declare function looksLikeCliFlag(value: string | undefined): boolean;
+export declare function countLines(path: string): Promise<number>;
+export declare function listBatchResultFiles(batchDir: string): Promise<string[]>;
+//# sourceMappingURL=args.d.ts.map

package/dist/audit/cli/args.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"args.d.ts","sourceRoot":"","sources":["../../../src/audit/cli/args.ts"],"names":[],"mappings":"AAKA,OAAO,EAEL,iBAAiB,EACjB,qBAAqB,EAGrB,KAAK,aAAa,EAClB,KAAK,oBAAoB,EAC1B,MAAM,oBAAoB,CAAC;AAG5B,eAAO,MAAM,mBAAmB;;;;CAQ/B,CAAC;AAMF,wBAAgB,OAAO,CACrB,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,EAAE,MAAM,EACZ,QAAQ,CAAC,EAAE,MAAM,GAChB,MAAM,GAAG,SAAS,CAMpB;AAED,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAE7D;AAED,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,EAAE,MAAM,GACX,OAAO,GAAG,SAAS,CAYrB;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,CAIjF;AAED,wBAAgB,6BAA6B,CAAC,OAAO,EAAE;IACrD,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,aAAa,EAAE,aAAa,CAAC;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB,GAAG,OAAO,CAUV;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE9C;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAMtD;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAE1E;AAED,eAAO,MAAM,eAAe,8BAAwB,CAAC;AAErD;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB,0BAAoB,CAAC;AAErD,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CAEpD;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE;IAC1C,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GAAG,MAAM,GAAG,IAAI,CAchB;AAED,wBAAgB,cAAc,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAE7E;AAUD,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEnE;AAED,wBAAgB,gBAAgB,CAAC,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEjF;AAED,wBAAsB,aAAa,IAAI,OAAO,CAAC,MAAM,CAAC,CAarD;AAUD,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAK3E;AAED,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,EAAE,MAAM,GACX,MAAM,GAAG,SAAS,CAMpB;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CAEjD;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CAMtD;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAOnD;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAGrE;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,aAAa,EAAE,aAAa,GAAG,MAAM,CAMjF;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAEtE;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,IAAI,CAE1D;AAED,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,IAAI,CAEvE;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,IAAI,CAElE;AAED,4EAA4E;AAC5E,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,IAAI,CAEjE;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,EAAE,GACb,oBAAoB,EAAE,GAAG,IAAI,CAG/B;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,IAAI,CAG5D;AAED,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,MAAM,EAAE,EACd,aAAa,EAAE,aAAa,GAC3B,MAAM,CAKR;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAEnE;AAED,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAoB9D;AAED,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAY9E"}

package/dist/audit/cli/args.js

@@ -0,0 +1,274 @@
+import { existsSync, createReadStream } from "node:fs";
+import { readdir } from "node:fs/promises";
+import { Buffer } from "node:buffer";
+import { createHash } from "node:crypto";
+import { join, resolve } from "node:path";
+import { renderPromptCommand, toPromptPathToken, quotePromptCommandArg, parseHostModelRoster, auditArtifactsDir, } from "audit-tools/shared";
+import { resolveFreshSessionProviderName } from "../providers/index.js";
+export const DIRECT_CLI_DEFAULTS = {
+    rootDir: ".",
+    // Sentinel marking "no explicit --artifacts-dir". When this is the resolved
+    // value, getArtifactsDir rebases the default onto --root via the shared
+    // auditArtifactsDir() helper rather than resolving the literal against CWD —
+    // so `--root <X>` with no --artifacts-dir lands under <X>/.audit-tools/audit.
+    artifactsDir: ".audit-tools/audit",
+    timeoutMs: 30 * 60 * 1000, // 30 minutes
+};
+function isLongFlagToken(value) {
+    return typeof value === "string" && value.startsWith("--");
+}
+export function getFlag(argv, name, fallback) {
+    const index = argv.indexOf(name);
+    if (index < 0)
+        return fallback;
+    const candidate = argv[index + 1];
+    if (!candidate || isLongFlagToken(candidate))
+        return fallback;
+    return candidate;
+}
+export function hasFlag(argv, name) {
+    return argv.includes(name);
+}
+export function getOptionalBooleanFlag(argv, name) {
+    const raw = getFlag(argv, name);
+    if (raw === undefined) {
+        return undefined;
+    }
+    if (raw === "true") {
+        return true;
+    }
+    if (raw === "false") {
+        return false;
+    }
+    throw new Error(`${name} must be either true or false.`);
+}
+export function optionalBooleanEnv(value) {
+    if (value === "true")
+        return true;
+    if (value === "false")
+        return false;
+    return undefined;
+}
+export function resolveHostDispatchCapability(options) {
+    if (options.explicit !== undefined) {
+        return options.explicit;
+    }
+    if (options.sessionConfig.host_can_dispatch_subagents !== undefined) {
+        return options.sessionConfig.host_can_dispatch_subagents;
+    }
+    return optionalBooleanEnv((options.env ?? process.env).AUDIT_CODE_HOST_CAN_DISPATCH) ?? true;
+}
+export function toBase64Url(value) {
+    return Buffer.from(value, "utf8").toString("base64url");
+}
+export function fromBase64Url(value) {
+    return Buffer.from(value, "base64url").toString("utf8");
+}
+export function digestId(value) {
+    return createHash("sha256").update(value).digest("hex").slice(0, 12);
+}
+export function safeArtifactStem(value) {
+    const sanitized = value
+        .replace(/[^a-zA-Z0-9_-]+/g, "_")
+        .replace(/^_+|_+$/g, "")
+        .slice(0, 80);
+    return sanitized.length > 0 ? sanitized : "artifact";
+}
+export function artifactNameForId(value, extension) {
+    return `${safeArtifactStem(value)}_${digestId(value)}.${extension}`;
+}
+export const quoteCommandArg = quotePromptCommandArg;
+/**
+ * Normalize a generated command token to POSIX path separators. These command
+ * strings are embedded in step prompts and `allowed_commands` and run by the
+ * host — often through a bash-like shell, which treats `\` as an escape and
+ * silently corrupts Windows absolute paths (`node C:\a\b.mjs` collapses to
+ * `node C:ab.mjs`). Node accepts forward slashes on Windows, and `/` survives
+ * bash, PowerShell, and cmd alike. Only tokens that actually carry a backslash
+ * are touched, and no non-path argument in this CLI contains one, so this is a
+ * targeted normalization rather than a blanket rewrite.
+ */
+export const toPosixCommandToken = toPromptPathToken;
+export function renderCommand(argv) {
+    return renderPromptCommand(argv);
+}
+export function summarizeLaunchExit(result) {
+    if (result.accepted !== false && !result.error) {
+        return null;
+    }
+    const parts = [
+        result.signal
+            ? `signal ${result.signal}`
+            : `exit code ${result.exitCode ?? "unknown"}`,
+        result.command ? `command: ${result.command}` : null,
+        result.stdoutPath ? `stdout: ${result.stdoutPath}` : null,
+        result.stderrPath ? `stderr: ${result.stderrPath}` : null,
+        result.error ?? null,
+    ].filter((part) => Boolean(part));
+    return parts.join("; ");
+}
+export function taskResultPath(taskResultsDir, taskId) {
+    return join(taskResultsDir, artifactNameForId(taskId, "json"));
+}
+// Canonical result filenames produced by artifactNameForId: a stem, "_", a
+// 12-hex sha256 digest, then ".json" — optionally with one extra suffix segment
+// before ".json" (the host writes packet results as "<stem>_<digest>.inline-result.json").
+const CANONICAL_RESULT_FILENAME = /_[0-9a-f]{12}(\.[a-z0-9-]+)?\.json$/i;
+// True when `filename` matches the canonical result naming above. Lets
+// merge-and-ingest tell legitimate packet / prior-round results apart from
+// genuinely stray files (e.g. packet-23-results.json) left in task-results/.
+export function isCanonicalResultFilename(filename) {
+    return CANONICAL_RESULT_FILENAME.test(filename);
+}
+export function packetPromptPath(taskResultsDir, packetId) {
+    return join(taskResultsDir, artifactNameForId(packetId, "prompt.md"));
+}
+export async function readStdinText() {
+    if (process.stdin.isTTY) {
+        return "";
+    }
+    return await new Promise((resolveInput, reject) => {
+        let input = "";
+        process.stdin.setEncoding("utf8");
+        process.stdin.on("data", (chunk) => {
+            input += chunk;
+        });
+        process.stdin.on("end", () => resolveInput(input));
+        process.stdin.on("error", reject);
+    });
+}
+function resolveFlagPath(argv, name, fallback) {
+    return resolve(getFlag(argv, name, fallback));
+}
+export function normalizePositiveInteger(value) {
+    if (typeof value !== "number" || !Number.isFinite(value) || value <= 0) {
+        return undefined;
+    }
+    return Math.floor(value);
+}
+export function parsePositiveIntegerFlag(argv, name) {
+    const raw = getFlag(argv, name);
+    if (raw === undefined) {
+        return undefined;
+    }
+    return normalizePositiveInteger(Number(raw));
+}
+export function getRootDir(argv) {
+    return resolveFlagPath(argv, "--root", DIRECT_CLI_DEFAULTS.rootDir);
+}
+/**
+ * Resolve the artifacts dir. An explicit `--artifacts-dir` is honored verbatim
+ * (resolved against CWD). With NO `--artifacts-dir`, the default rebases onto
+ * `--root` via the shared `auditArtifactsDir()` helper — so `--root <X>` lands
+ * the default under `<X>/.audit-tools/audit`. Previously the default resolved
+ * the `.audit-tools/audit` literal against CWD independently of `--root`, so a
+ * bare `--root <X>` silently ignored `<X>` (the latent bug fixed here).
+ */
+export function getArtifactsDir(argv) {
+    const explicit = getFlag(argv, "--artifacts-dir");
+    if (explicit !== undefined) {
+        return resolve(explicit);
+    }
+    return auditArtifactsDir(getRootDir(argv));
+}
+export function warnIfNotGitRepo(root) {
+    const gitEntry = join(root, ".git");
+    if (!existsSync(gitEntry)) {
+        console.warn(`Warning: target directory '${root}' does not appear to be a git repository. Diff-based signals will be unavailable.`);
+    }
+}
+export function getBatchResultsDir(argv) {
+    const value = getFlag(argv, "--batch-results");
+    return value ? resolve(value) : undefined;
+}
+export function getTimeoutMs(argv, sessionConfig) {
+    return (parsePositiveIntegerFlag(argv, "--timeout") ??
+        normalizePositiveInteger(sessionConfig.timeout_ms) ??
+        DIRECT_CLI_DEFAULTS.timeoutMs);
+}
+export function getExplicitProvider(argv) {
+    return getFlag(argv, "--provider");
+}
+export function getHostModel(argv) {
+    return getFlag(argv, "--host-model") ?? null;
+}
+export function getHostMaxActiveSubagents(argv) {
+    return parsePositiveIntegerFlag(argv, "--host-max-active-subagents") ?? null;
+}
+/**
+ * Context window (input tokens) the host reports for the model it will dispatch
+ * subagents to — the dispatch-time capability handshake. Outranks the static
+ * model table when sizing packets, so the partition fills the real model's
+ * window instead of the conservative 32k default.
+ */
+export function getHostContextTokens(argv) {
+    return parsePositiveIntegerFlag(argv, "--host-context-tokens") ?? null;
+}
+/** Output-token cap the host reports for its dispatch model (handshake). */
+export function getHostOutputTokens(argv) {
+    return parsePositiveIntegerFlag(argv, "--host-output-tokens") ?? null;
+}
+/**
+ * Ordered model roster the host reports at the dispatch handshake
+ * (`--host-models`, JSON array, lowest rank first) — the multi-rank
+ * generalization of the scalar `--host-context-tokens`/`--host-output-tokens`
+ * pair. `rank` values are RELATIVE labels (`small`/`standard`/`deep`) aligned
+ * with `model_hint.tier`; windows are discovered, never guessed, and the host
+ * never names a model. Malformed input throws (shared parser) so a mistyped
+ * handshake fails loudly instead of silently downgrading to the floor.
+ */
+export function getHostModelRoster(argv) {
+    const raw = getFlag(argv, "--host-models");
+    return raw ? parseHostModelRoster(raw) : null;
+}
+/**
+ * Opaque model identity the host reports for its dispatch model
+ * (`--host-model-id`). Used ONLY as a quota-key segment so quota learning keys
+ * on `provider/<id>` instead of `provider/*` when no model name is resolvable —
+ * never a window authority, never matched against a name table.
+ */
+export function getHostModelId(argv) {
+    const value = getFlag(argv, "--host-model-id");
+    return value && value.trim().length > 0 ? value.trim() : null;
+}
+export function resolveRunProviderName(argv, sessionConfig) {
+    return resolveFreshSessionProviderName(getExplicitProvider(argv), sessionConfig);
+}
+export function looksLikeCliFlag(value) {
+    return isLongFlagToken(value);
+}
+export async function countLines(path) {
+    return new Promise((resolve, reject) => {
+        let lines = 0;
+        let byteCount = 0;
+        let lastByte = -1;
+        const stream = createReadStream(path);
+        stream.on("data", (chunk) => {
+            const buffer = typeof chunk === "string" ? Buffer.from(chunk) : chunk;
+            byteCount += buffer.length;
+            for (let i = 0; i < buffer.length; ++i) {
+                if (buffer[i] === 10)
+                    lines++;
+                lastByte = buffer[i];
+            }
+        });
+        stream.on("end", () => {
+            if (byteCount === 0)
+                return resolve(0);
+            resolve(lastByte !== 10 ? lines + 1 : lines);
+        });
+        stream.on("error", reject);
+    });
+}
+export async function listBatchResultFiles(batchDir) {
+    const entries = await readdir(batchDir, { withFileTypes: true });
+    const files = entries
+        .filter((entry) => entry.isFile() && entry.name.toLowerCase().endsWith(".json"))
+        .map((entry) => join(batchDir, entry.name))
+        .sort((a, b) => a.localeCompare(b));
+    if (files.length === 0) {
+        throw new Error(`No JSON audit result files found in ${batchDir}.`);
+    }
+    return files;
+}
+//# sourceMappingURL=args.js.map

package/dist/audit/cli/args.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"args.js","sourceRoot":"","sources":["../../../src/audit/cli/args.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AACvD,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAY,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,qBAAqB,EACrB,oBAAoB,EACpB,iBAAiB,GAGlB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,+BAA+B,EAAE,MAAM,uBAAuB,CAAC;AAExE,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,OAAO,EAAE,GAAG;IACZ,4EAA4E;IAC5E,wEAAwE;IACxE,6EAA6E;IAC7E,8EAA8E;IAC9E,YAAY,EAAE,oBAAoB;IAClC,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,aAAa;CACzC,CAAC;AAEF,SAAS,eAAe,CAAC,KAAyB;IAChD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,OAAO,CACrB,IAAc,EACd,IAAY,EACZ,QAAiB;IAEjB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC/B,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IAClC,IAAI,CAAC,SAAS,IAAI,eAAe,CAAC,SAAS,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC9D,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,IAAc,EAAE,IAAY;IAClD,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,IAAc,EACd,IAAY;IAEZ,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAChC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;QACpB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,gCAAgC,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAyB;IAC1D,IAAI,KAAK,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAClC,IAAI,KAAK,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IACpC,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,OAI7C;IACC,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO,OAAO,CAAC,QAAQ,CAAC;IAC1B,CAAC;IACD,IAAI,OAAO,CAAC,aAAa,CAAC,2BAA2B,KAAK,SAAS,EAAE,CAAC;QACpE,OAAO,OAAO,CAAC,aAAa,CAAC,2BAA2B,CAAC;IAC3D,CAAC;IACD,OAAO,kBAAkB,CACvB,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,4BAA4B,CAC1D,IAAI,IAAI,CAAC;AACZ,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,KAAa;IACpC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACvE,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,MAAM,SAAS,GAAG,KAAK;SACpB,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC;SAChC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAChB,OAAO,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAa,EAAE,SAAiB;IAChE,OAAO,GAAG,gBAAgB,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,SAAS,EAAE,CAAC;AACtE,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAG,qBAAqB,CAAC;AAErD;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AAErD,MAAM,UAAU,aAAa,CAAC,IAAc;IAC1C,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAQnC;IACC,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAC/C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,KAAK,GAAG;QACZ,MAAM,CAAC,MAAM;YACX,CAAC,CAAC,UAAU,MAAM,CAAC,MAAM,EAAE;YAC3B,CAAC,CAAC,aAAa,MAAM,CAAC,QAAQ,IAAI,SAAS,EAAE;QAC/C,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI;QACpD,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI;QACzD,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI;QACzD,MAAM,CAAC,KAAK,IAAI,IAAI;KACrB,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAClD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,cAAsB,EAAE,MAAc;IACnE,OAAO,IAAI,CAAC,cAAc,EAAE,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,2EAA2E;AAC3E,gFAAgF;AAChF,2FAA2F;AAC3F,MAAM,yBAAyB,GAAG,sCAAsC,CAAC;AAEzE,uEAAuE;AACvE,2EAA2E;AAC3E,6EAA6E;AAC7E,MAAM,UAAU,yBAAyB,CAAC,QAAgB;IACxD,OAAO,yBAAyB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,cAAsB,EAAE,QAAgB;IACvE,OAAO,IAAI,CAAC,cAAc,EAAE,iBAAiB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACxB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,MAAM,IAAI,OAAO,CAAC,CAAC,YAAY,EAAE,MAAM,EAAE,EAAE;QAChD,IAAI,KAAK,GAAG,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAClC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;YACjC,KAAK,IAAI,KAAK,CAAC;QACjB,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;QACnD,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,eAAe,CACtB,IAAc,EACd,IAAY,EACZ,QAAgB;IAEhB,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAW,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QACvE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,IAAc,EACd,IAAY;IAEZ,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAChC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,wBAAwB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAc;IACvC,OAAO,eAAe,CAAC,IAAI,EAAE,QAAQ,EAAE,mBAAmB,CAAC,OAAO,CAAC,CAAC;AACtE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,IAAc;IAC5C,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;IAClD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,iBAAiB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,IAAI,CACV,8BAA8B,IAAI,mFAAmF,CACtH,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAc;IAC/C,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;IAC/C,OAAO,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAc,EAAE,aAA4B;IACvE,OAAO,CACL,wBAAwB,CAAC,IAAI,EAAE,WAAW,CAAC;QAC3C,wBAAwB,CAAC,aAAa,CAAC,UAAU,CAAC;QAClD,mBAAmB,CAAC,SAAS,CAC9B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAc;IAChD,OAAO,OAAO,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAc;IACzC,OAAO,OAAO,CAAC,IAAI,EAAE,cAAc,CAAC,IAAI,IAAI,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,IAAc;IACtD,OAAO,wBAAwB,CAAC,IAAI,EAAE,6BAA6B,CAAC,IAAI,IAAI,CAAC;AAC/E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAc;IACjD,OAAO,wBAAwB,CAAC,IAAI,EAAE,uBAAuB,CAAC,IAAI,IAAI,CAAC;AACzE,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,mBAAmB,CAAC,IAAc;IAChD,OAAO,wBAAwB,CAAC,IAAI,EAAE,sBAAsB,CAAC,IAAI,IAAI,CAAC;AACxE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAAc;IAEd,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;IAC3C,OAAO,GAAG,CAAC,CAAC,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAChD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,IAAc;IAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;IAC/C,OAAO,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,IAAc,EACd,aAA4B;IAE5B,OAAO,+BAA+B,CACpC,mBAAmB,CAAC,IAAI,CAAC,EACzB,aAAa,CACd,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAyB;IACxD,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAY;IAC3C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,IAAI,QAAQ,GAAG,CAAC,CAAC,CAAC;QAClB,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACtC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAsB,EAAE,EAAE;YAC3C,MAAM,MAAM,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;YACtE,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC;YAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;gBACvC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE;oBAAE,KAAK,EAAE,CAAC;gBAC9B,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;YACvB,CAAC;QACH,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACpB,IAAI,SAAS,KAAK,CAAC;gBAAE,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;YACvC,OAAO,CAAC,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,QAAgB;IACzD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACjE,MAAM,KAAK,GAAG,OAAO;SAClB,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;SAC/E,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;SAC1C,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IAEtC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,uCAAuC,QAAQ,GAAG,CAAC,CAAC;IACtE,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/audit/cli/auditStep.d.ts

@@ -0,0 +1,34 @@
+import type { AnalyzerSetting } from "audit-tools/shared";
+import type { ExternalAnalyzerResults } from "../types/externalAnalyzer.js";
+export declare function runAuditStep(options: {
+    root: string;
+    artifactsDir: string;
+    preferredExecutor?: string;
+    auditResultsPath?: string;
+    runtimeUpdatesPath?: string;
+    /** Provide a file path OR an already-parsed object; path is only read when the object is absent. */
+    externalAnalyzerPath?: string;
+    externalAnalyzerData?: ExternalAnalyzerResults;
+    narrativeResultsPath?: string;
+    edgeReasoningResultsPath?: string;
+    analyzers?: Record<string, AnalyzerSetting>;
+    graphLlmEdgeReasoning?: boolean;
+    since?: string;
+    runLog?: boolean;
+}): Promise<import("../orchestrator/advanceTypes.js").AdvanceAuditResult>;
+export declare function ingestBatchAuditResults(options: {
+    root: string;
+    artifactsDir: string;
+    batchDir: string;
+}): Promise<{
+    batchFiles: string[];
+    bundle: import("../io/artifacts.js").ArtifactBundle;
+    audit_state: import("../types/auditState.js").AuditState;
+    selected_obligation: string | null;
+    selected_executor: string;
+    progress_made: boolean;
+    artifacts_written: string[];
+    progress_summary: string;
+    next_likely_step: string | null;
+}>;
+//# sourceMappingURL=auditStep.d.ts.map

package/dist/audit/cli/auditStep.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auditStep.d.ts","sourceRoot":"","sources":["../../../src/audit/cli/auditStep.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,eAAe,EAAsB,MAAM,oBAAoB,CAAC;AAE9E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAwB5E,wBAAsB,YAAY,CAAC,OAAO,EAAE;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,oGAAoG;IACpG,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,oBAAoB,CAAC,EAAE,uBAAuB,CAAC;IAC/C,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAC5C,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB,yEA+GA;AAED,wBAAsB,uBAAuB,CAAC,OAAO,EAAE;IACrD,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;CAClB;;;;;;;;;;GAgDA"}