audit-tools 0.29.4 → 0.30.1

package/dist/shared/reporting/auditDeliverable.js

@@ -0,0 +1,85 @@
+// Shared audit-deliverable emitter: build the canonical `audit-findings.json`
+// machine contract + its `audit-report.md` human render from a Finding[] set.
+//
+// Single-sourced here (in `audit-tools/shared`) so BOTH halves of the pipeline
+// emit an identical, re-consumable pair. The autonomous remediator uses it to
+// re-emit the findings it left LIVE (never auto-fixed, never durably rejected)
+// as a standard deliverable pair that round-trips straight back through the
+// remediator's `defaultInputCandidates` (`audit-findings.json` preferred over
+// `audit-report.md`) on the next nightly run — no special leftover format, no
+// durable rejection state.
+import { AUDIT_FINDINGS_CONTRACT_VERSION } from "../validation/findingsReport.js";
+import { renderFindingBlockLines } from "./findingDisplay.js";
+const SEVERITY_KEYS = ["critical", "high", "medium", "low", "info"];
+function severityBreakdown(findings) {
+    const out = {};
+    for (const key of SEVERITY_KEYS)
+        out[key] = 0;
+    for (const f of findings)
+        out[f.severity] = (out[f.severity] ?? 0) + 1;
+    return out;
+}
+function lensBreakdown(findings) {
+    const out = {};
+    for (const f of findings)
+        out[f.lens] = (out[f.lens] ?? 0) + 1;
+    return out;
+}
+/**
+ * Build the canonical `audit-findings.json` machine contract over `findings`.
+ * The summary is derived deterministically; no work-blocks are emitted (the
+ * deliverable is a flat, re-consumable finding set). Stamped with the same
+ * `contract_version` the auditor emits, so `validateAuditFindingsReport` accepts
+ * it and the remediator's structured fast-path consumes it losslessly.
+ */
+export function buildAuditFindingsDeliverable(findings) {
+    const summary = {
+        finding_count: findings.length,
+        work_block_count: 0,
+        severity_breakdown: severityBreakdown(findings),
+        audited_file_count: 0,
+        excluded_file_count: 0,
+        runtime_validation_status_breakdown: {},
+        lens_breakdown: lensBreakdown(findings),
+    };
+    return {
+        contract_version: AUDIT_FINDINGS_CONTRACT_VERSION,
+        summary,
+        findings: [...findings],
+        work_blocks: [],
+    };
+}
+/**
+ * Render the `audit-report.md` human deliverable for `findings` using the ONE
+ * shared finding renderer (parity with the auditor's report). `title` and
+ * `intro` let the caller frame the deliverable (e.g. "leftovers from an
+ * autonomous run").
+ */
+export function renderAuditDeliverableMarkdown(findings, options = {}) {
+    const lines = [`# ${options.title ?? "Audit Report"}`, ""];
+    if (options.intro) {
+        lines.push(options.intro, "");
+    }
+    if (findings.length === 0) {
+        lines.push("No findings.", "");
+        return lines.join("\n");
+    }
+    lines.push(`## Findings (${findings.length})`, "");
+    for (const finding of findings) {
+        lines.push(...renderFindingBlockLines(finding));
+    }
+    return lines.join("\n");
+}
+/**
+ * Build BOTH halves of the re-consumable audit deliverable pair at once. The
+ * JSON is the source of truth; the markdown is its render. The caller writes
+ * `findings_report` to `audit-findings.json` and `report_markdown` to
+ * `audit-report.md`.
+ */
+export function buildAuditDeliverablePair(findings, options = {}) {
+    return {
+        findings_report: buildAuditFindingsDeliverable(findings),
+        report_markdown: renderAuditDeliverableMarkdown(findings, options),
+    };
+}
+//# sourceMappingURL=auditDeliverable.js.map

package/dist/shared/reporting/auditDeliverable.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auditDeliverable.js","sourceRoot":"","sources":["../../../src/shared/reporting/auditDeliverable.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,8EAA8E;AAC9E,EAAE;AACF,+EAA+E;AAC/E,8EAA8E;AAC9E,+EAA+E;AAC/E,4EAA4E;AAC5E,8EAA8E;AAC9E,8EAA8E;AAC9E,2BAA2B;AAQ3B,OAAO,EAAE,+BAA+B,EAAE,MAAM,iCAAiC,CAAC;AAClF,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAE9D,MAAM,aAAa,GAAsB,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;AAEvF,SAAS,iBAAiB,CAAC,QAA4B;IACrD,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,GAAG,IAAI,aAAa;QAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC9C,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACvE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,aAAa,CAAC,QAA4B;IACjD,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IAC/D,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,6BAA6B,CAC3C,QAA4B;IAE5B,MAAM,OAAO,GAAyB;QACpC,aAAa,EAAE,QAAQ,CAAC,MAAM;QAC9B,gBAAgB,EAAE,CAAC;QACnB,kBAAkB,EAAE,iBAAiB,CAAC,QAAQ,CAAC;QAC/C,kBAAkB,EAAE,CAAC;QACrB,mBAAmB,EAAE,CAAC;QACtB,mCAAmC,EAAE,EAAE;QACvC,cAAc,EAAE,aAAa,CAAC,QAAQ,CAAC;KACxC,CAAC;IACF,OAAO;QACL,gBAAgB,EAAE,+BAA+B;QACjD,OAAO;QACP,QAAQ,EAAE,CAAC,GAAG,QAAQ,CAAC;QACvB,WAAW,EAAE,EAAE;KAChB,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,8BAA8B,CAC5C,QAA4B,EAC5B,UAA8C,EAAE;IAEhD,MAAM,KAAK,GAAa,CAAC,KAAK,OAAO,CAAC,KAAK,IAAI,cAAc,EAAE,EAAE,EAAE,CAAC,CAAC;IACrE,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAChC,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;QAC/B,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,gBAAgB,QAAQ,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC,CAAC;IACnD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AASD;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CACvC,QAA4B,EAC5B,UAA8C,EAAE;IAEhD,OAAO;QACL,eAAe,EAAE,6BAA6B,CAAC,QAAQ,CAAC;QACxD,eAAe,EAAE,8BAA8B,CAAC,QAAQ,EAAE,OAAO,CAAC;KACnE,CAAC;AACJ,CAAC"}

package/dist/shared/types/graph.d.ts

@@ -36,6 +36,84 @@ export declare const RouteEdgeSchema: z.ZodObject<{
     method?: string | undefined;
 }>;
 export type RouteEdge = z.infer<typeof RouteEdgeSchema>;
+/**
+ * Per-node structural measure (one of complexity / duplication). `value` is the
+ * raw metric, `measure` names the concrete algorithm used (so consumers never
+ * guess units), and `reach` records the scope of source the measure actually
+ * covered — currently only `'js-ts-effective'` (computed over JS/TS source).
+ */
+export declare const NodeMetricSchema: z.ZodObject<{
+    value: z.ZodNumber;
+    measure: z.ZodString;
+    reach: z.ZodLiteral<"js-ts-effective">;
+}, "strict", z.ZodTypeAny, {
+    value: number;
+    measure: string;
+    reach: "js-ts-effective";
+}, {
+    value: number;
+    measure: string;
+    reach: "js-ts-effective";
+}>;
+export type NodeMetric = z.infer<typeof NodeMetricSchema>;
+/**
+ * Optional per-node (repo-path keyed) structural metrics computed at graph-build
+ * time, where the file source is available. Absent for non-js/ts files (never
+ * zero-filled). Each metric is independently optional. Declared as an explicit
+ * optional Zod field (not a catchall) so a `.strict()` bundle WITHOUT
+ * `node_metrics` still parses, while an unknown sibling key is rejected.
+ */
+export declare const NodeMetricsSchema: z.ZodRecord<z.ZodString, z.ZodObject<{
+    complexity: z.ZodOptional<z.ZodObject<{
+        value: z.ZodNumber;
+        measure: z.ZodString;
+        reach: z.ZodLiteral<"js-ts-effective">;
+    }, "strict", z.ZodTypeAny, {
+        value: number;
+        measure: string;
+        reach: "js-ts-effective";
+    }, {
+        value: number;
+        measure: string;
+        reach: "js-ts-effective";
+    }>>;
+    duplication: z.ZodOptional<z.ZodObject<{
+        value: z.ZodNumber;
+        measure: z.ZodString;
+        reach: z.ZodLiteral<"js-ts-effective">;
+    }, "strict", z.ZodTypeAny, {
+        value: number;
+        measure: string;
+        reach: "js-ts-effective";
+    }, {
+        value: number;
+        measure: string;
+        reach: "js-ts-effective";
+    }>>;
+}, "strict", z.ZodTypeAny, {
+    complexity?: {
+        value: number;
+        measure: string;
+        reach: "js-ts-effective";
+    } | undefined;
+    duplication?: {
+        value: number;
+        measure: string;
+        reach: "js-ts-effective";
+    } | undefined;
+}, {
+    complexity?: {
+        value: number;
+        measure: string;
+        reach: "js-ts-effective";
+    } | undefined;
+    duplication?: {
+        value: number;
+        measure: string;
+        reach: "js-ts-effective";
+    } | undefined;
+}>>;
+export type NodeMetrics = z.infer<typeof NodeMetricsSchema>;
 export declare const GraphBundleSchema: z.ZodObject<{
     graphs: z.ZodObject<{
         imports: z.ZodOptional<z.ZodArray<z.ZodObject<{
@@ -284,6 +362,61 @@ export declare const GraphBundleSchema: z.ZodObject<{
      * the deterministic regex floor was used). See Phase 5 analyzer seam.
      */
     analyzers_used: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    /**
+     * Optional per-node structural metrics (complexity / duplication) computed at
+     * graph-build time over js/ts source. Explicit optional field so legacy
+     * bundles without it still parse under `.strict()`.
+     */
+    node_metrics: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        complexity: z.ZodOptional<z.ZodObject<{
+            value: z.ZodNumber;
+            measure: z.ZodString;
+            reach: z.ZodLiteral<"js-ts-effective">;
+        }, "strict", z.ZodTypeAny, {
+            value: number;
+            measure: string;
+            reach: "js-ts-effective";
+        }, {
+            value: number;
+            measure: string;
+            reach: "js-ts-effective";
+        }>>;
+        duplication: z.ZodOptional<z.ZodObject<{
+            value: z.ZodNumber;
+            measure: z.ZodString;
+            reach: z.ZodLiteral<"js-ts-effective">;
+        }, "strict", z.ZodTypeAny, {
+            value: number;
+            measure: string;
+            reach: "js-ts-effective";
+        }, {
+            value: number;
+            measure: string;
+            reach: "js-ts-effective";
+        }>>;
+    }, "strict", z.ZodTypeAny, {
+        complexity?: {
+            value: number;
+            measure: string;
+            reach: "js-ts-effective";
+        } | undefined;
+        duplication?: {
+            value: number;
+            measure: string;
+            reach: "js-ts-effective";
+        } | undefined;
+    }, {
+        complexity?: {
+            value: number;
+            measure: string;
+            reach: "js-ts-effective";
+        } | undefined;
+        duplication?: {
+            value: number;
+            measure: string;
+            reach: "js-ts-effective";
+        } | undefined;
+    }>>>;
 }, "strict", z.ZodTypeAny, {
     graphs: {
         imports?: {
@@ -319,6 +452,18 @@ export declare const GraphBundleSchema: z.ZodObject<{
         [k: string]: unknown;
     };
     analyzers_used?: string[] | undefined;
+    node_metrics?: Record<string, {
+        complexity?: {
+            value: number;
+            measure: string;
+            reach: "js-ts-effective";
+        } | undefined;
+        duplication?: {
+            value: number;
+            measure: string;
+            reach: "js-ts-effective";
+        } | undefined;
+    }> | undefined;
 }, {
     graphs: {
         imports?: {
@@ -354,6 +499,18 @@ export declare const GraphBundleSchema: z.ZodObject<{
         [k: string]: unknown;
     };
     analyzers_used?: string[] | undefined;
+    node_metrics?: Record<string, {
+        complexity?: {
+            value: number;
+            measure: string;
+            reach: "js-ts-effective";
+        } | undefined;
+        duplication?: {
+            value: number;
+            measure: string;
+            reach: "js-ts-effective";
+        } | undefined;
+    }> | undefined;
 }>;
 export type GraphBundle = z.infer<typeof GraphBundleSchema>;
 //# sourceMappingURL=graph.d.ts.map

package/dist/shared/types/graph.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"graph.d.ts","sourceRoot":"","sources":["../../../src/shared/types/graph.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;EASjB,CAAC;AACZ,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD,eAAO,MAAM,eAAe;;;;;;;;;;;;EAMjB,CAAC;AACZ,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAW1B;;;;OAIG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAGI,CAAC;AACZ,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC"}
+{"version":3,"file":"graph.d.ts","sourceRoot":"","sources":["../../../src/shared/types/graph.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;EASjB,CAAC;AACZ,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD,eAAO,MAAM,eAAe;;;;;;;;;;;;EAMjB,CAAC;AACZ,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;EAMlB,CAAC;AACZ,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE1D;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAQ7B,CAAC;AACF,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAW1B;;;;OAIG;;IAEH;;;;OAIG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAGI,CAAC;AACZ,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC"}

package/dist/shared/types/graph.js

@@ -16,6 +16,32 @@ export const RouteEdgeSchema = z
     method: z.string().optional(),
 })
     .strict();
+/**
+ * Per-node structural measure (one of complexity / duplication). `value` is the
+ * raw metric, `measure` names the concrete algorithm used (so consumers never
+ * guess units), and `reach` records the scope of source the measure actually
+ * covered — currently only `'js-ts-effective'` (computed over JS/TS source).
+ */
+export const NodeMetricSchema = z
+    .object({
+    value: z.number(),
+    measure: z.string(),
+    reach: z.literal("js-ts-effective"),
+})
+    .strict();
+/**
+ * Optional per-node (repo-path keyed) structural metrics computed at graph-build
+ * time, where the file source is available. Absent for non-js/ts files (never
+ * zero-filled). Each metric is independently optional. Declared as an explicit
+ * optional Zod field (not a catchall) so a `.strict()` bundle WITHOUT
+ * `node_metrics` still parses, while an unknown sibling key is rejected.
+ */
+export const NodeMetricsSchema = z.record(z.string(), z
+    .object({
+    complexity: NodeMetricSchema.optional(),
+    duplication: NodeMetricSchema.optional(),
+})
+    .strict());
 export const GraphBundleSchema = z
     .object({
     graphs: z
@@ -33,6 +59,12 @@ export const GraphBundleSchema = z
      * the deterministic regex floor was used). See Phase 5 analyzer seam.
      */
     analyzers_used: z.array(z.string()).optional(),
+    /**
+     * Optional per-node structural metrics (complexity / duplication) computed at
+     * graph-build time over js/ts source. Explicit optional field so legacy
+     * bundles without it still parse under `.strict()`.
+     */
+    node_metrics: NodeMetricsSchema.optional(),
 })
     .strict();
 //# sourceMappingURL=graph.js.map

package/dist/shared/types/graph.js.map

@@ -1 +1 @@
-{"version":3,"file":"graph.js","sourceRoot":"","sources":["../../../src/shared/types/graph.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC;KAC7B,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC/C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC;KAC7B,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACN,MAAM,EAAE,CAAC;SACN,MAAM,CAAC;QACN,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE;QAC5C,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE;QAC1C,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE;QAC/C,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE;KAC5C,CAAC;QACF,oEAAoE;SACnE,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IACxB;;;;OAIG;IACH,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC/C,CAAC;KACD,MAAM,EAAE,CAAC"}
+{"version":3,"file":"graph.js","sourceRoot":"","sources":["../../../src/shared/types/graph.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC;KAC7B,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC/C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC;KAC7B,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC9B,MAAM,CAAC;IACN,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC;CACpC,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CACvC,CAAC,CAAC,MAAM,EAAE,EACV,CAAC;KACE,MAAM,CAAC;IACN,UAAU,EAAE,gBAAgB,CAAC,QAAQ,EAAE;IACvC,WAAW,EAAE,gBAAgB,CAAC,QAAQ,EAAE;CACzC,CAAC;KACD,MAAM,EAAE,CACZ,CAAC;AAGF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACN,MAAM,EAAE,CAAC;SACN,MAAM,CAAC;QACN,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE;QAC5C,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE;QAC1C,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE;QAC/C,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE;KAC5C,CAAC;QACF,oEAAoE;SACnE,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IACxB;;;;OAIG;IACH,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC9C;;;;OAIG;IACH,YAAY,EAAE,iBAAiB,CAAC,QAAQ,EAAE;CAC3C,CAAC;KACD,MAAM,EAAE,CAAC"}

package/dist/shared/types/sessionConfig.d.ts

@@ -318,6 +318,19 @@ export interface SessionConfig {
     timeout_ms?: number;
     ui_mode?: SessionUiMode;
     host_can_dispatch_subagents?: boolean;
+    /**
+     * Run unattended (nightly autonomous pipeline). Host-agnostic — ONE flag
+     * drives the whole path, with no cloud/local fork. When set, the
+     * review-approval gate does NOT halt for a human: it auto-approves only the
+     * findings whose ambiguity tier is "safe" AND whose change-kind is positively
+     * on the fail-closed non-destructiveness ALLOWLIST (additive / localized /
+     * reversible — see src/remediate/review/autonomousGate.ts). Every other
+     * finding is left LIVE and re-emitted as a re-consumable audit deliverable
+     * pair (audit-findings.json + audit-report.md); leftovers are NEVER durably
+     * rejected, so the next nightly run re-evaluates them fresh. Ambiguity-only:
+     * there is NO cost / severity / run-budget gate.
+     */
+    autonomous_mode?: boolean;
     subprocess_template?: SubprocessTemplateConfig;
     claude_code?: ClaudeCodeConfig;
     codex?: CodexConfig;

package/dist/shared/types/sessionConfig.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sessionConfig.d.ts","sourceRoot":"","sources":["../../../src/shared/types/sessionConfig.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,eAAO,MAAM,cAAc,qJAUjB,CAAC;AACX,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAC3D,MAAM,MAAM,oBAAoB,GAAG,OAAO,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;AAEjE,eAAO,MAAM,gBAAgB,kCAAmC,CAAC;AACjE,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9D,MAAM,WAAW,wBAAwB;IACvC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,4BAA4B,CAAC,EAAE,OAAO,CAAC;IACvC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,+EAA+E;IAC/E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,WAAW,GAAG,iBAAiB,GAAG,oBAAoB,CAAC;IACtE,sJAAsJ;IACtJ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,sBAAsB;IACrC,yFAAyF;IACzF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4FAA4F;IAC5F,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iGAAiG;IACjG,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iGAAiG;IACjG,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kDAAkD;IAClD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,gEAAgE;IAChE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8FAA8F;IAC9F,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,8FAA8F;IAC9F,wBAAwB,CAAC,EAAE,OAAO,CAAC;CACpC;AAED,MAAM,WAAW,gBAAgB;IAC/B,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAED,eAAO,MAAM,qBAAqB;;;;;;;;CAQxB,CAAC;AAEX;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,gGAMhC,CAAC;AACX,MAAM,MAAM,0BAA0B,GACpC,CAAC,OAAO,6BAA6B,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjD;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;;;OAKG;IACH,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,iDAAiD;IACjD,QAAQ,EAAE,0BAA0B,CAAC;IACrC,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4FAA4F;IAC5F,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2DAA2D;IAC3D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,uEAAuE;IACvE,KAAK,CAAC,EAAE,gBAAgB,CAAC;CAC1B;AAED,MAAM,WAAW,gBAAgB;IAC/B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,wBAAwB,CAAC,EAAE,MAAM,CAAC;CACnC;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,yBAAyB,CAAC,EAAE,MAAM,GAAG,WAAW,CAAC;IACjD,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CAC3C;AAED,MAAM,WAAW,mBAAmB;IAClC,qEAAqE;IACrE,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,oEAAoE;IACpE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2EAA2E;IAC3E,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,aAAa,CAAC,EAAE,oBAAoB,CAAC;IACrC;;;;;;;;;;OAUG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,WAAW;IAC1B;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,4EAA4E;IAC5E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,iBAAiB,6DAMpB,CAAC;AACX,eAAO,MAAM,qBAAqB,+DAA4B,CAAC;AAC/D,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,MAAM,WAAW,kBAAkB;IACjC;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC;IACtC;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,iBAAiB,CAAC;CACtC;AAED;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,OAAO,EAAE,CAAC;IACrB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,eAAe,EAAE,OAAO,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,2BAA2B,CAAC,EAAE,OAAO,CAAC;IACtC,mBAAmB,CAAC,EAAE,wBAAwB,CAAC;IAC/C,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAC/B,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,iBAAiB,CAAC,EAAE,sBAAsB,CAAC;IAC3C,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAC/B,WAAW,CAAC,EAAE,iBAAiB,CAAC;IAChC;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAC/B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAC/B,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,6EAA6E;IAC7E,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAC5C,kEAAkE;IAClE,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,yEAAyE;IACzE,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,mEAAmE;IACnE,aAAa,CAAC,EAAE,kBAAkB,CAAC;IACnC;;;;;;OAMG;IACH,uBAAuB,CAAC,EAAE,wBAAwB,CAAC;CACpD"}
+{"version":3,"file":"sessionConfig.d.ts","sourceRoot":"","sources":["../../../src/shared/types/sessionConfig.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,eAAO,MAAM,cAAc,qJAUjB,CAAC;AACX,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAC3D,MAAM,MAAM,oBAAoB,GAAG,OAAO,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;AAEjE,eAAO,MAAM,gBAAgB,kCAAmC,CAAC;AACjE,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9D,MAAM,WAAW,wBAAwB;IACvC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,4BAA4B,CAAC,EAAE,OAAO,CAAC;IACvC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,+EAA+E;IAC/E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,WAAW,GAAG,iBAAiB,GAAG,oBAAoB,CAAC;IACtE,sJAAsJ;IACtJ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,sBAAsB;IACrC,yFAAyF;IACzF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4FAA4F;IAC5F,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iGAAiG;IACjG,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iGAAiG;IACjG,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kDAAkD;IAClD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,gEAAgE;IAChE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8FAA8F;IAC9F,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,8FAA8F;IAC9F,wBAAwB,CAAC,EAAE,OAAO,CAAC;CACpC;AAED,MAAM,WAAW,gBAAgB;IAC/B,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAED,eAAO,MAAM,qBAAqB;;;;;;;;CAQxB,CAAC;AAEX;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,gGAMhC,CAAC;AACX,MAAM,MAAM,0BAA0B,GACpC,CAAC,OAAO,6BAA6B,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjD;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;;;OAKG;IACH,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,iDAAiD;IACjD,QAAQ,EAAE,0BAA0B,CAAC;IACrC,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4FAA4F;IAC5F,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2DAA2D;IAC3D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,uEAAuE;IACvE,KAAK,CAAC,EAAE,gBAAgB,CAAC;CAC1B;AAED,MAAM,WAAW,gBAAgB;IAC/B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,wBAAwB,CAAC,EAAE,MAAM,CAAC;CACnC;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,yBAAyB,CAAC,EAAE,MAAM,GAAG,WAAW,CAAC;IACjD,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CAC3C;AAED,MAAM,WAAW,mBAAmB;IAClC,qEAAqE;IACrE,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,oEAAoE;IACpE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2EAA2E;IAC3E,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,aAAa,CAAC,EAAE,oBAAoB,CAAC;IACrC;;;;;;;;;;OAUG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,WAAW;IAC1B;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,4EAA4E;IAC5E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,iBAAiB,6DAMpB,CAAC;AACX,eAAO,MAAM,qBAAqB,+DAA4B,CAAC;AAC/D,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,MAAM,WAAW,kBAAkB;IACjC;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC;IACtC;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,iBAAiB,CAAC;CACtC;AAED;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,OAAO,EAAE,CAAC;IACrB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,eAAe,EAAE,OAAO,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,2BAA2B,CAAC,EAAE,OAAO,CAAC;IACtC;;;;;;;;;;;OAWG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,mBAAmB,CAAC,EAAE,wBAAwB,CAAC;IAC/C,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAC/B,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,iBAAiB,CAAC,EAAE,sBAAsB,CAAC;IAC3C,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAC/B,WAAW,CAAC,EAAE,iBAAiB,CAAC;IAChC;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAC/B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAC/B,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,6EAA6E;IAC7E,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAC5C,kEAAkE;IAClE,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,yEAAyE;IACzE,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,mEAAmE;IACnE,aAAa,CAAC,EAAE,kBAAkB,CAAC;IACnC;;;;;;OAMG;IACH,uBAAuB,CAAC,EAAE,wBAAwB,CAAC;CACpD"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "audit-tools",
-  "version": "0.29.4",
+  "version": "0.30.1",
   "private": false,
   "description": "Portable hybrid code auditing + remediation orchestrators for arbitrary repositories.",
   "type": "module",

package/schemas/audit_result.schema.json

@@ -100,7 +100,8 @@
               "operability",
               "config_deployment",
               "observability"
-            ]
+            ],
+            "description": "Optional: when omitted, the tool defaults it from the enclosing AuditResult.lens before validation. Supply it only to override the result lens for a cross-lens finding."
           },
           "summary": {
             "type": "string"
@@ -306,7 +307,6 @@
           "category",
           "severity",
           "confidence",
-          "lens",
           "summary",
           "affected_files",
           "evidence"

package/schemas/audit_results.schema.json

@@ -102,7 +102,8 @@
                 "operability",
                 "config_deployment",
                 "observability"
-              ]
+              ],
+              "description": "Optional: when omitted, the tool defaults it from the enclosing AuditResult.lens before validation. Supply it only to override the result lens for a cross-lens finding."
             },
             "summary": {
               "type": "string"
@@ -308,7 +309,6 @@
             "category",
             "severity",
             "confidence",
-            "lens",
             "summary",
             "affected_files",
             "evidence"

package/schemas/finding.schema.json

@@ -46,7 +46,8 @@
         "operability",
         "config_deployment",
         "observability"
-      ]
+      ],
+      "description": "Optional: when omitted, the tool defaults it from the enclosing AuditResult.lens before validation. Supply it only to override the result lens for a cross-lens finding."
     },
     "summary": {
       "type": "string"
@@ -252,7 +253,6 @@
     "category",
     "severity",
     "confidence",
-    "lens",
     "summary",
     "affected_files",
     "evidence"

package/scripts/postinstall.mjs

@@ -21,4 +21,68 @@ for (const script of ["./audit/postinstall.mjs", "./remediate/postinstall.mjs"])
     failed = true;
   }
 }
+
+// Manage the consuming repo's .gitignore for the artifacts audit-tools emits
+// (always-ignore build/install assets + friction sidecar; visibility-conditional
+// ignore of deliverables + meta-audit reflections). This is best-effort and must
+// NEVER fail the install: the helper degrades on any error, and we wrap the whole
+// step so a missing shared dist (fresh `npm ci`) or a detection hiccup is a warn,
+// not a non-zero exit.
+await manageArtifactGitignore();
+
 process.exit(failed ? 1 : 0);
+
+async function manageArtifactGitignore() {
+  try {
+    const shared = await import("audit-tools/shared");
+    if (typeof shared.ensureArtifactGitignore !== "function") {
+      return; // shared dist not built yet (fresh npm ci) — skip silently.
+    }
+
+    // The consuming repo root: npm sets INIT_CWD to the dir `npm install` ran in.
+    const repoRoot = process.env.INIT_CWD || process.cwd();
+
+    // Explicit operator override always wins. Accept private/public/track/ignore.
+    const override = resolveVisibilityOverride();
+
+    const result = shared.ensureArtifactGitignore({
+      repoRoot,
+      override,
+      runGh: runGhRepoVisibility,
+    });
+    if (result.changed) {
+      console.log(
+        `[audit-tools] postinstall: updated ${result.path} (repo visibility: ${result.visibility}).`,
+      );
+    }
+  } catch (err) {
+    console.warn(
+      `[audit-tools] postinstall: .gitignore management skipped (${err?.message ?? err}).`,
+    );
+  }
+}
+
+// Operator override via env: AUDIT_TOOLS_REPO_VISIBILITY=private|public (also
+// accepts track=private / ignore=public). Anything else => no override.
+function resolveVisibilityOverride() {
+  const raw = (process.env.AUDIT_TOOLS_REPO_VISIBILITY || "").trim().toLowerCase();
+  if (raw === "private" || raw === "track") return "private";
+  if (raw === "public" || raw === "ignore") return "public";
+  return null;
+}
+
+// Probe `gh repo view --json isPrivate`. Returns gh stdout, or null on any
+// failure (gh missing, not a gh-known repo, non-zero exit). Never throws.
+function runGhRepoVisibility(repoRoot) {
+  try {
+    const result = spawnSync("gh", ["repo", "view", "--json", "isPrivate"], {
+      cwd: repoRoot,
+      encoding: "utf8",
+      shell: process.platform === "win32",
+    });
+    if (result.error || (result.status ?? 0) !== 0) return null;
+    return typeof result.stdout === "string" ? result.stdout : null;
+  } catch {
+    return null;
+  }
+}