audit-tools 0.30.0 → 0.30.1

package/dist/shared/reporting/auditDeliverable.js

@@ -0,0 +1,85 @@
+// Shared audit-deliverable emitter: build the canonical `audit-findings.json`
+// machine contract + its `audit-report.md` human render from a Finding[] set.
+//
+// Single-sourced here (in `audit-tools/shared`) so BOTH halves of the pipeline
+// emit an identical, re-consumable pair. The autonomous remediator uses it to
+// re-emit the findings it left LIVE (never auto-fixed, never durably rejected)
+// as a standard deliverable pair that round-trips straight back through the
+// remediator's `defaultInputCandidates` (`audit-findings.json` preferred over
+// `audit-report.md`) on the next nightly run — no special leftover format, no
+// durable rejection state.
+import { AUDIT_FINDINGS_CONTRACT_VERSION } from "../validation/findingsReport.js";
+import { renderFindingBlockLines } from "./findingDisplay.js";
+const SEVERITY_KEYS = ["critical", "high", "medium", "low", "info"];
+function severityBreakdown(findings) {
+    const out = {};
+    for (const key of SEVERITY_KEYS)
+        out[key] = 0;
+    for (const f of findings)
+        out[f.severity] = (out[f.severity] ?? 0) + 1;
+    return out;
+}
+function lensBreakdown(findings) {
+    const out = {};
+    for (const f of findings)
+        out[f.lens] = (out[f.lens] ?? 0) + 1;
+    return out;
+}
+/**
+ * Build the canonical `audit-findings.json` machine contract over `findings`.
+ * The summary is derived deterministically; no work-blocks are emitted (the
+ * deliverable is a flat, re-consumable finding set). Stamped with the same
+ * `contract_version` the auditor emits, so `validateAuditFindingsReport` accepts
+ * it and the remediator's structured fast-path consumes it losslessly.
+ */
+export function buildAuditFindingsDeliverable(findings) {
+    const summary = {
+        finding_count: findings.length,
+        work_block_count: 0,
+        severity_breakdown: severityBreakdown(findings),
+        audited_file_count: 0,
+        excluded_file_count: 0,
+        runtime_validation_status_breakdown: {},
+        lens_breakdown: lensBreakdown(findings),
+    };
+    return {
+        contract_version: AUDIT_FINDINGS_CONTRACT_VERSION,
+        summary,
+        findings: [...findings],
+        work_blocks: [],
+    };
+}
+/**
+ * Render the `audit-report.md` human deliverable for `findings` using the ONE
+ * shared finding renderer (parity with the auditor's report). `title` and
+ * `intro` let the caller frame the deliverable (e.g. "leftovers from an
+ * autonomous run").
+ */
+export function renderAuditDeliverableMarkdown(findings, options = {}) {
+    const lines = [`# ${options.title ?? "Audit Report"}`, ""];
+    if (options.intro) {
+        lines.push(options.intro, "");
+    }
+    if (findings.length === 0) {
+        lines.push("No findings.", "");
+        return lines.join("\n");
+    }
+    lines.push(`## Findings (${findings.length})`, "");
+    for (const finding of findings) {
+        lines.push(...renderFindingBlockLines(finding));
+    }
+    return lines.join("\n");
+}
+/**
+ * Build BOTH halves of the re-consumable audit deliverable pair at once. The
+ * JSON is the source of truth; the markdown is its render. The caller writes
+ * `findings_report` to `audit-findings.json` and `report_markdown` to
+ * `audit-report.md`.
+ */
+export function buildAuditDeliverablePair(findings, options = {}) {
+    return {
+        findings_report: buildAuditFindingsDeliverable(findings),
+        report_markdown: renderAuditDeliverableMarkdown(findings, options),
+    };
+}
+//# sourceMappingURL=auditDeliverable.js.map

package/dist/shared/reporting/auditDeliverable.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auditDeliverable.js","sourceRoot":"","sources":["../../../src/shared/reporting/auditDeliverable.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,8EAA8E;AAC9E,EAAE;AACF,+EAA+E;AAC/E,8EAA8E;AAC9E,+EAA+E;AAC/E,4EAA4E;AAC5E,8EAA8E;AAC9E,8EAA8E;AAC9E,2BAA2B;AAQ3B,OAAO,EAAE,+BAA+B,EAAE,MAAM,iCAAiC,CAAC;AAClF,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAE9D,MAAM,aAAa,GAAsB,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;AAEvF,SAAS,iBAAiB,CAAC,QAA4B;IACrD,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,GAAG,IAAI,aAAa;QAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC9C,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACvE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,aAAa,CAAC,QAA4B;IACjD,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IAC/D,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,6BAA6B,CAC3C,QAA4B;IAE5B,MAAM,OAAO,GAAyB;QACpC,aAAa,EAAE,QAAQ,CAAC,MAAM;QAC9B,gBAAgB,EAAE,CAAC;QACnB,kBAAkB,EAAE,iBAAiB,CAAC,QAAQ,CAAC;QAC/C,kBAAkB,EAAE,CAAC;QACrB,mBAAmB,EAAE,CAAC;QACtB,mCAAmC,EAAE,EAAE;QACvC,cAAc,EAAE,aAAa,CAAC,QAAQ,CAAC;KACxC,CAAC;IACF,OAAO;QACL,gBAAgB,EAAE,+BAA+B;QACjD,OAAO;QACP,QAAQ,EAAE,CAAC,GAAG,QAAQ,CAAC;QACvB,WAAW,EAAE,EAAE;KAChB,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,8BAA8B,CAC5C,QAA4B,EAC5B,UAA8C,EAAE;IAEhD,MAAM,KAAK,GAAa,CAAC,KAAK,OAAO,CAAC,KAAK,IAAI,cAAc,EAAE,EAAE,EAAE,CAAC,CAAC;IACrE,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAChC,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;QAC/B,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,gBAAgB,QAAQ,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC,CAAC;IACnD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AASD;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CACvC,QAA4B,EAC5B,UAA8C,EAAE;IAEhD,OAAO;QACL,eAAe,EAAE,6BAA6B,CAAC,QAAQ,CAAC;QACxD,eAAe,EAAE,8BAA8B,CAAC,QAAQ,EAAE,OAAO,CAAC;KACnE,CAAC;AACJ,CAAC"}

package/dist/shared/types/sessionConfig.d.ts

@@ -318,6 +318,19 @@ export interface SessionConfig {
     timeout_ms?: number;
     ui_mode?: SessionUiMode;
     host_can_dispatch_subagents?: boolean;
+    /**
+     * Run unattended (nightly autonomous pipeline). Host-agnostic — ONE flag
+     * drives the whole path, with no cloud/local fork. When set, the
+     * review-approval gate does NOT halt for a human: it auto-approves only the
+     * findings whose ambiguity tier is "safe" AND whose change-kind is positively
+     * on the fail-closed non-destructiveness ALLOWLIST (additive / localized /
+     * reversible — see src/remediate/review/autonomousGate.ts). Every other
+     * finding is left LIVE and re-emitted as a re-consumable audit deliverable
+     * pair (audit-findings.json + audit-report.md); leftovers are NEVER durably
+     * rejected, so the next nightly run re-evaluates them fresh. Ambiguity-only:
+     * there is NO cost / severity / run-budget gate.
+     */
+    autonomous_mode?: boolean;
     subprocess_template?: SubprocessTemplateConfig;
     claude_code?: ClaudeCodeConfig;
     codex?: CodexConfig;

package/dist/shared/types/sessionConfig.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sessionConfig.d.ts","sourceRoot":"","sources":["../../../src/shared/types/sessionConfig.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,eAAO,MAAM,cAAc,qJAUjB,CAAC;AACX,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAC3D,MAAM,MAAM,oBAAoB,GAAG,OAAO,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;AAEjE,eAAO,MAAM,gBAAgB,kCAAmC,CAAC;AACjE,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9D,MAAM,WAAW,wBAAwB;IACvC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,4BAA4B,CAAC,EAAE,OAAO,CAAC;IACvC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,+EAA+E;IAC/E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,WAAW,GAAG,iBAAiB,GAAG,oBAAoB,CAAC;IACtE,sJAAsJ;IACtJ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,sBAAsB;IACrC,yFAAyF;IACzF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4FAA4F;IAC5F,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iGAAiG;IACjG,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iGAAiG;IACjG,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kDAAkD;IAClD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,gEAAgE;IAChE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8FAA8F;IAC9F,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,8FAA8F;IAC9F,wBAAwB,CAAC,EAAE,OAAO,CAAC;CACpC;AAED,MAAM,WAAW,gBAAgB;IAC/B,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAED,eAAO,MAAM,qBAAqB;;;;;;;;CAQxB,CAAC;AAEX;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,gGAMhC,CAAC;AACX,MAAM,MAAM,0BAA0B,GACpC,CAAC,OAAO,6BAA6B,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjD;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;;;OAKG;IACH,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,iDAAiD;IACjD,QAAQ,EAAE,0BAA0B,CAAC;IACrC,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4FAA4F;IAC5F,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2DAA2D;IAC3D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,uEAAuE;IACvE,KAAK,CAAC,EAAE,gBAAgB,CAAC;CAC1B;AAED,MAAM,WAAW,gBAAgB;IAC/B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,wBAAwB,CAAC,EAAE,MAAM,CAAC;CACnC;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,yBAAyB,CAAC,EAAE,MAAM,GAAG,WAAW,CAAC;IACjD,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CAC3C;AAED,MAAM,WAAW,mBAAmB;IAClC,qEAAqE;IACrE,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,oEAAoE;IACpE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2EAA2E;IAC3E,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,aAAa,CAAC,EAAE,oBAAoB,CAAC;IACrC;;;;;;;;;;OAUG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,WAAW;IAC1B;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,4EAA4E;IAC5E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,iBAAiB,6DAMpB,CAAC;AACX,eAAO,MAAM,qBAAqB,+DAA4B,CAAC;AAC/D,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,MAAM,WAAW,kBAAkB;IACjC;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC;IACtC;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,iBAAiB,CAAC;CACtC;AAED;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,OAAO,EAAE,CAAC;IACrB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,eAAe,EAAE,OAAO,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,2BAA2B,CAAC,EAAE,OAAO,CAAC;IACtC,mBAAmB,CAAC,EAAE,wBAAwB,CAAC;IAC/C,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAC/B,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,iBAAiB,CAAC,EAAE,sBAAsB,CAAC;IAC3C,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAC/B,WAAW,CAAC,EAAE,iBAAiB,CAAC;IAChC;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAC/B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAC/B,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,6EAA6E;IAC7E,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAC5C,kEAAkE;IAClE,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,yEAAyE;IACzE,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,mEAAmE;IACnE,aAAa,CAAC,EAAE,kBAAkB,CAAC;IACnC;;;;;;OAMG;IACH,uBAAuB,CAAC,EAAE,wBAAwB,CAAC;CACpD"}
+{"version":3,"file":"sessionConfig.d.ts","sourceRoot":"","sources":["../../../src/shared/types/sessionConfig.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,eAAO,MAAM,cAAc,qJAUjB,CAAC;AACX,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAC3D,MAAM,MAAM,oBAAoB,GAAG,OAAO,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;AAEjE,eAAO,MAAM,gBAAgB,kCAAmC,CAAC;AACjE,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9D,MAAM,WAAW,wBAAwB;IACvC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,4BAA4B,CAAC,EAAE,OAAO,CAAC;IACvC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,+EAA+E;IAC/E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,WAAW,GAAG,iBAAiB,GAAG,oBAAoB,CAAC;IACtE,sJAAsJ;IACtJ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,sBAAsB;IACrC,yFAAyF;IACzF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4FAA4F;IAC5F,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iGAAiG;IACjG,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iGAAiG;IACjG,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kDAAkD;IAClD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,gEAAgE;IAChE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8FAA8F;IAC9F,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,8FAA8F;IAC9F,wBAAwB,CAAC,EAAE,OAAO,CAAC;CACpC;AAED,MAAM,WAAW,gBAAgB;IAC/B,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAED,eAAO,MAAM,qBAAqB;;;;;;;;CAQxB,CAAC;AAEX;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,gGAMhC,CAAC;AACX,MAAM,MAAM,0BAA0B,GACpC,CAAC,OAAO,6BAA6B,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjD;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;;;OAKG;IACH,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,iDAAiD;IACjD,QAAQ,EAAE,0BAA0B,CAAC;IACrC,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4FAA4F;IAC5F,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2DAA2D;IAC3D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,uEAAuE;IACvE,KAAK,CAAC,EAAE,gBAAgB,CAAC;CAC1B;AAED,MAAM,WAAW,gBAAgB;IAC/B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,wBAAwB,CAAC,EAAE,MAAM,CAAC;CACnC;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,yBAAyB,CAAC,EAAE,MAAM,GAAG,WAAW,CAAC;IACjD,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CAC3C;AAED,MAAM,WAAW,mBAAmB;IAClC,qEAAqE;IACrE,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,oEAAoE;IACpE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2EAA2E;IAC3E,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,aAAa,CAAC,EAAE,oBAAoB,CAAC;IACrC;;;;;;;;;;OAUG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,WAAW;IAC1B;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,4EAA4E;IAC5E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,iBAAiB,6DAMpB,CAAC;AACX,eAAO,MAAM,qBAAqB,+DAA4B,CAAC;AAC/D,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,MAAM,WAAW,kBAAkB;IACjC;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC;IACtC;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,iBAAiB,CAAC;CACtC;AAED;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,OAAO,EAAE,CAAC;IACrB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,eAAe,EAAE,OAAO,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,2BAA2B,CAAC,EAAE,OAAO,CAAC;IACtC;;;;;;;;;;;OAWG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,mBAAmB,CAAC,EAAE,wBAAwB,CAAC;IAC/C,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAC/B,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,iBAAiB,CAAC,EAAE,sBAAsB,CAAC;IAC3C,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAC/B,WAAW,CAAC,EAAE,iBAAiB,CAAC;IAChC;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAC/B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAC/B,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,6EAA6E;IAC7E,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAC5C,kEAAkE;IAClE,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,yEAAyE;IACzE,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,mEAAmE;IACnE,aAAa,CAAC,EAAE,kBAAkB,CAAC;IACnC;;;;;;OAMG;IACH,uBAAuB,CAAC,EAAE,wBAAwB,CAAC;CACpD"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "audit-tools",
-  "version": "0.30.0",
+  "version": "0.30.1",
   "private": false,
   "description": "Portable hybrid code auditing + remediation orchestrators for arbitrary repositories.",
   "type": "module",

package/schemas/audit_result.schema.json

@@ -100,7 +100,8 @@
               "operability",
               "config_deployment",
               "observability"
-            ]
+            ],
+            "description": "Optional: when omitted, the tool defaults it from the enclosing AuditResult.lens before validation. Supply it only to override the result lens for a cross-lens finding."
           },
           "summary": {
             "type": "string"
@@ -306,7 +307,6 @@
           "category",
           "severity",
           "confidence",
-          "lens",
           "summary",
           "affected_files",
           "evidence"

package/schemas/audit_results.schema.json

@@ -102,7 +102,8 @@
                 "operability",
                 "config_deployment",
                 "observability"
-              ]
+              ],
+              "description": "Optional: when omitted, the tool defaults it from the enclosing AuditResult.lens before validation. Supply it only to override the result lens for a cross-lens finding."
             },
             "summary": {
               "type": "string"
@@ -308,7 +309,6 @@
             "category",
             "severity",
             "confidence",
-            "lens",
             "summary",
             "affected_files",
             "evidence"

package/schemas/finding.schema.json

@@ -46,7 +46,8 @@
         "operability",
         "config_deployment",
         "observability"
-      ]
+      ],
+      "description": "Optional: when omitted, the tool defaults it from the enclosing AuditResult.lens before validation. Supply it only to override the result lens for a cross-lens finding."
     },
     "summary": {
       "type": "string"
@@ -252,7 +253,6 @@
     "category",
     "severity",
     "confidence",
-    "lens",
     "summary",
     "affected_files",
     "evidence"

package/scripts/postinstall.mjs

@@ -21,4 +21,68 @@ for (const script of ["./audit/postinstall.mjs", "./remediate/postinstall.mjs"])
     failed = true;
   }
 }
+
+// Manage the consuming repo's .gitignore for the artifacts audit-tools emits
+// (always-ignore build/install assets + friction sidecar; visibility-conditional
+// ignore of deliverables + meta-audit reflections). This is best-effort and must
+// NEVER fail the install: the helper degrades on any error, and we wrap the whole
+// step so a missing shared dist (fresh `npm ci`) or a detection hiccup is a warn,
+// not a non-zero exit.
+await manageArtifactGitignore();
+
 process.exit(failed ? 1 : 0);
+
+async function manageArtifactGitignore() {
+  try {
+    const shared = await import("audit-tools/shared");
+    if (typeof shared.ensureArtifactGitignore !== "function") {
+      return; // shared dist not built yet (fresh npm ci) — skip silently.
+    }
+
+    // The consuming repo root: npm sets INIT_CWD to the dir `npm install` ran in.
+    const repoRoot = process.env.INIT_CWD || process.cwd();
+
+    // Explicit operator override always wins. Accept private/public/track/ignore.
+    const override = resolveVisibilityOverride();
+
+    const result = shared.ensureArtifactGitignore({
+      repoRoot,
+      override,
+      runGh: runGhRepoVisibility,
+    });
+    if (result.changed) {
+      console.log(
+        `[audit-tools] postinstall: updated ${result.path} (repo visibility: ${result.visibility}).`,
+      );
+    }
+  } catch (err) {
+    console.warn(
+      `[audit-tools] postinstall: .gitignore management skipped (${err?.message ?? err}).`,
+    );
+  }
+}
+
+// Operator override via env: AUDIT_TOOLS_REPO_VISIBILITY=private|public (also
+// accepts track=private / ignore=public). Anything else => no override.
+function resolveVisibilityOverride() {
+  const raw = (process.env.AUDIT_TOOLS_REPO_VISIBILITY || "").trim().toLowerCase();
+  if (raw === "private" || raw === "track") return "private";
+  if (raw === "public" || raw === "ignore") return "public";
+  return null;
+}
+
+// Probe `gh repo view --json isPrivate`. Returns gh stdout, or null on any
+// failure (gh missing, not a gh-known repo, non-zero exit). Never throws.
+function runGhRepoVisibility(repoRoot) {
+  try {
+    const result = spawnSync("gh", ["repo", "view", "--json", "isPrivate"], {
+      cwd: repoRoot,
+      encoding: "utf8",
+      shell: process.platform === "win32",
+    });
+    if (result.error || (result.status ?? 0) !== 0) return null;
+    return typeof result.stdout === "string" ? result.stdout : null;
+  } catch {
+    return null;
+  }
+}