audit-tools 0.30.60 → 0.31.0

package/README.md

@@ -1,270 +1,135 @@
 # audit-tools
 
-Portable, hybrid code **auditing** + **remediation** orchestrators for arbitrary repositories,
-shipped as one package exposing two CLIs / slash workflows:
+One npm package shipping two independent code tools over a shared library. Each has its
+own CLI and host slash-command, and each is useful on its own:
 
-- **`audit-code`** (`/audit-code`) — audits a codebase one bounded, backend-rendered step at a time
-  and produces a findings report (`audit-findings.json` + `audit-report.md`).
-- **`remediate-code`** (`/remediate-code`) — consumes that report (or free-form feedback) and applies
-  fixes step by step, emitting `remediation-outcomes.json` + `remediation-report.md`.
+- **`audit-code`** (`/audit-code`) — audits a repository/project and produces a findings report.
+- **`remediate-code`** (`/remediate-code`) — implements changes from findings and/or free-form intent.
 
-Both are **conversation-first**: the product is the slash workflow inside a host agent; the CLI is the
-backend/fallback. Each `next-step` call returns one prompt contract (JSON + markdown); the host agent
-executes it and calls back for the next. State persists to an artifact directory, so runs are resumable.
+They **compose but don't depend on each other**: audit-code's findings are clean input to
+remediate-code, but you can run either alone. Audit a repo and stop. Or point remediate-code
+at a plain-English request with no audit in sight — or hand it audit findings *and* extra
+suggestions at the same time.
 
-## Install
-
-```bash
-npm install -g audit-tools
-```
-
-This installs both the `audit-code` and `remediate-code` bins and deploys the host slash-command assets
-(Claude Code, Codex, OpenCode, Antigravity) via the package postinstall.
-
-## Usage
-
-```bash
-audit-code next-step        # advance the audit one step
-remediate-code next-step    # advance a remediation one step
-```
-
-In a host agent, drive the workflow with `/audit-code` then `/remediate-code`.
-
-## Concepts
-
-One pipeline, two halves: audit → findings contract; remediate → consumes + fixes. The JSON contract is
-the source of truth; the markdown is its human render. Neither tool runs to completion in a single call —
-each derives state, does one bounded unit of work, persists, and returns. See `CLAUDE.md` for the full
-design concepts and standing decisions.
-
----
-
-## audit-code
-
-### Canonical Product Route
-
-The primary product is `/audit-code` in conversation.
-
-Normal product usage should:
-
-- use the active conversation model by default
-- use project files and attached repository context by default
-- avoid manual paths, provider flags, and model-selection arguments
-- keep semantic review with the active conversation agent by default
-- advance the audit automatically until it completes or no further automatic progress is possible
-
-### Conversation Setup
-
-The canonical asset for editor and conversation integrations is:
-
-`skills/audit-code/audit-code.prompt.md`
+Each tool writes its results to `.audit-tools/` as a machine contract (JSON) plus a
+human-readable render (markdown):
 
-Packaged installs and repository checkouts both ship that prompt asset.
+| Tool | Machine contract | Human render |
+|---|---|---|
+| audit-code | `audit-findings.json` | `audit-report.md` |
+| remediate-code | `remediation-outcomes.json` | `remediation-report.md` |
 
-The intended user install is one global tool install:
+## Install
 
 ```bash
 npm install -g audit-tools
 ```
 
-That makes `audit-code` available on `PATH`. During package install, the package
-also writes user-level command/skill assets for hosts we can seed safely, including
-the Claude command file, the global Codex skill bundle with `audit-code` display
-metadata, and the global OpenCode slash command entry in
-`~/.config/opencode/opencode.json`.
-
-After that, invoke `/audit-code` in a supported host. The prompt self-bootstraps
-the current repository by running:
-
-```bash
-audit-code ensure --quiet
-```
-
-That command writes or refreshes the repo-local assets only when they are missing
-or stale, then normal audit execution continues without manual paths, provider
-flags, or model-selection arguments.
-
-The explicit repair and compatibility setup path remains:
-
-```bash
-audit-code install
-```
-
-That bootstraps repo-local supporting surfaces for the hosts we can automate today, including:
-
-- Codex `AGENTS.md` fallback guidance for the global skill surface
-- Claude Desktop local MCP bundle artifacts and project template guidance
-- OpenCode `opencode.json` with auditor agent and permission wiring; the `/audit-code` command stays in the global npm-installed OpenCode config
-- VS Code prompt, custom agent, Copilot instructions, and `.vscode/mcp.json`
-- Antigravity planning-mode guidance plus the shared repo-local MCP launcher
+This puts both `audit-code` and `remediate-code` on your `PATH` and, via the package
+postinstall, deploys slash-command assets for supported hosts (Claude Code, Codex,
+OpenCode, VS Code, Antigravity).
 
-`audit-code ensure` refreshes those files automatically when the packaged prompt
-or skill changes. Use `audit-code install` or `audit-code ensure --force` when
-you intentionally want to rewrite every generated host surface on demand.
-
-After bootstrap, you can smoke-test the generated host assets and launcher from the repository root:
-
-```bash
-audit-code verify-install
-```
+## Usage
 
-After that, open a supported conversation surface in the repository and invoke `/audit-code`.
+The tools are meant to be run as slash-commands inside a host agent. Just invoke the command —
+no manual path, provider, or model flags. The agent works its way through the whole workflow
+on its own, running against your active conversation model, and only stops to ask you when it
+needs a real decision (scope, ambiguous intent, whether to open a PR, and the like).
 
-If a host still needs manual prompt import after bootstrap, open:
+**Audit a code base:**
 
 ```text
-.audit-code/install/GETTING-STARTED.md
-```
-
-That repo-local guide now includes dedicated quick-start sections for Codex, Claude Desktop, OpenCode, VS Code, and Antigravity, plus the installed canonical prompt asset path for prompt-import fallback flows.
-
-For narrower compatibility, `audit-code install-host --host copilot` still exists.
-
-For hosts that still need manual import after bootstrap, or for environments with no repo-local install surface, after installing the package or checking out the repository, use:
-
-```bash
-audit-code prompt-path
+/audit-code
 ```
 
-Import the reported file into your editor or conversation environment's custom prompt configuration, then invoke `/audit-code` in conversation.
+You'll confirm scope and which lenses to apply (security, correctness, reliability,
+data-integrity, etc.), then it runs to completion and leaves `audit-findings.json` +
+`audit-report.md` in `.audit-tools/`.
 
-### Repo-Local Backend Fallback
-
-The CLI in this repository is backend infrastructure and a repo-local fallback surface.
-
-The conversation step engine used by `/audit-code` — the single execution loop —
-runs from the target repository root:
-
-```bash
-audit-code next-step
-```
-
-Repository-local equivalent:
-
-```bash
-node /path/to/audit-tools/audit-code.mjs next-step
-```
-
-This advances deterministic audit state one bounded step, writes
-`.audit-tools/audit/steps/current-step.json` and
-`.audit-tools/audit/steps/current-prompt.md`, auto-builds `dist/` if it is
-missing, and creates the artifacts directory automatically. Hosts follow only
-the returned step prompt, then call `next-step` again. A bare `audit-code`
-invocation prints usage; there is no implicit batch loop.
-
-Explicit root override still exists for callers running from outside the target repository:
-
-```bash
-audit-code next-step --root /path/to/repo
-```
-
-### Backend Provider Modes
-
-If `provider` is omitted, the backend defaults to the safest mode:
-
-```json
-{
-  "provider": "local-subprocess"
-}
-```
-
-If you want best-effort cross-editor or provider routing, opt into:
-
-```json
-{
-  "provider": "auto",
-  "ui_mode": "visible"
-}
-```
-
-Optional backend config: `.audit-tools/audit/session-config.json`
-
-### Key Docs
-
-- `docs/audit-pkg/product.md`
-- `docs/audit-pkg/operator-guide.md`
-- `docs/audit-pkg/contracts.md`
-- `docs/audit-pkg/release.md`
-- `docs/audit-pkg/development.md`
-- `skills/audit-code/SKILL.md`
-
----
-
-## remediate-code
-
-Conversation-first remediation orchestrator. Accepts `audit-findings.json` (the deterministic machine
-contract from audit-code), an `audit-report.md` or other feedback document, or conversational feedback —
-then advances through one backend-rendered step prompt at a time.
-
-### Primary Usage
-
-```bash
-npm install -g audit-tools
-```
-
-Then start from a conversation:
+**Remediate issues or implement changes:**
 
 ```text
 /remediate-code path/to/audit-findings.json
-```
-
-You can also start with free-form feedback:
+/remediate-code split the auth module and make session refresh easier to test
+/remediate-code path/to/audit-findings.json — and prioritize the error-handling issues
+```
+
+It plans the changes, implements and verifies them, and lands the result — a commit by
+default, or a PR / publish if you ask. You confirm scope and the closing action up front and
+review a summary before anything is committed.
+
+### What to expect
+
+- **It drives itself.** A single slash-command runs the full workflow; it pauses only for
+  clarifications, not to hand each step back to you.
+- **Runs are resumable.** State persists to `.audit-tools/` in the target repo, so an
+  interrupted run picks up where it left off.
+- **Work runs in parallel** where it safely can, even allowing for coordination between
+  different IDEs, different providers, CLIs, local models, etc.
+- **Effort scales to the work.** Trivial work gets light review; risky or complex work
+  gets deeper scrutiny.
+
+### The pipelines, step by step
+
+**audit-code:**
+
+1. **Confirm providers** — discovers the LLMs available in your session and confirms which to use.
+2. **Understand the repo** — deterministically maps files, public surfaces, the dependency
+   graph, critical flows, and a risk register; runs available static analyzers and auto-fixes.
+3. **Confirm intent** — you review the scope and pick the review lenses.
+4. **Review the design** — two parallel passes: a contract pass (invariants, boundaries,
+   obligations) and a conceptual pass (philosophy, alternatives, better directions).
+5. **Plan** — turns the risk register into bounded, prioritized review tasks.
+6. **Review in parallel** — dispatches the review tasks to your LLMs, routing riskier work to
+   more capable models, and deep-dives selectively.
+7. **Synthesize** — consolidates everything into `audit-findings.json` + `audit-report.md`,
+   then layers on a narrative (themes, executive summary, top risks).
+
+**remediate-code:**
+
+1. **Confirm providers** — same session-level provider check as audit-code.
+2. **Intake** — reads the findings and/or free-form intent, validates the input, and drafts a
+   summary with any open questions.
+3. **Confirm intent** — you confirm scope, answer open questions, and set the closing action
+   (commit, push, open PR, publish, or halt).
+4. **Design the change** — decomposes the work into modules, drafts a contract per module in
+   parallel, detects and reconciles seams (where one module's output must match another's
+   input), then derives obligations and a test plan. Riskier changes get an independent
+   critic-and-judge pass.
+5. **Preview the risk** — shows the classified risk, file list, and commit message before
+   anything runs.
+6. **Implement in parallel** — executes the changes in isolated worktrees, running tests and
+   verifying each unit; failures are triaged and retried or blocked.
+7. **Close** — runs the closing action and writes `remediation-outcomes.json` +
+   `remediation-report.md`.
+
+### CLI (backend / fallback)
+
+The slash-commands are the product; the same engines are also directly runnable:
 
-```text
-/remediate-code clean up the auth flow and make the session refresh behavior easier to test
+```bash
+audit-code next-step        # advance an audit one step
+remediate-code next-step    # advance a remediation one step
 ```
 
-The global loader runs `remediate-code ensure --quiet`, then
-`remediate-code next-step`, reads only the returned `prompt_path`, and follows
-that one prompt. Each prompt carries its own allowed commands and stop condition.
-
-### Runtime Artifacts
-
-Active runs use `.audit-tools/remediation/` in the target repository:
-
-- `.audit-tools/remediation/state.json`
-- `.audit-tools/remediation/steps/current-step.json`
-- `.audit-tools/remediation/steps/current-prompt.md`
-
-After close, durable outputs land at `.audit-tools/`:
-
-- `remediation-report.md`
-- `remediation-outcomes.json`
-- `remediation-closing-result.json`
-
-### CLI
-
-| Command | Description |
-| --- | --- |
-| `remediate-code next-step [--input <path>] [--host-can-dispatch-subagents]` | Decide and render exactly one next action |
-| `remediate-code prepare-implement-dispatch --run-id <id>` | Write bounded implementation prompts |
-| `remediate-code merge-implement-results --run-id <id>` | Validate implementation results and update item state |
-| `remediate-code validate-artifacts` | Validate runtime artifacts |
-| `remediate-code ensure [--quiet]` | Repair/check global Claude, Codex, and OpenCode assets |
-
-### Auditor Compatibility
-
-The auditor's canonical `audit-findings.json` is parsed **deterministically** —
-findings, work-block assignments, and synthesis themes are adopted verbatim, with
-no LLM involved. A Markdown `audit-report.md` (or any other free-form or partial
-document) is instead routed through intake synthesis and bounded LLM finding
-extraction, so it cannot silently produce a zero-finding plan.
+Add `--root <repo>` when running from outside the target repository.
 
----
+## Develop
 
-## Build and Test
+TypeScript, Node 20+. From the repo root:
 
 ```bash
-npm install
-npm run build && npm run check
-npm test
-npm run verify:release
+npm install     # always run first in a fresh clone/worktree
+npm run build   # tsc → dist/
+npm run check   # typecheck only
+npm test        # build + test
 ```
 
-When developing from a fresh clone or git worktree, run `npm install` at the repo root
-before build, check, or test workflows. Missing `node_modules` can cause misleading type errors.
+Missing `node_modules` makes `audit-tools/shared` resolve a stale `dist/`, producing
+misleading "no exported member" type errors — so install before build/check/test.
 
-For GitHub Actions publication and npm Trusted Publishing setup, see `docs/audit-pkg/release.md`.
+See [`CLAUDE.md`](CLAUDE.md) for architecture and design decisions, the specs in
+[`spec/`](spec/), and the product/operator/contract guides in `docs/audit-pkg/`.
 
 ## License
 

package/dist/audit/adapters/clippy.d.ts

@@ -0,0 +1,23 @@
+import type { ExternalAnalyzerResults } from "../types/externalAnalyzer.js";
+/**
+ * Parse cargo-clippy's newline-delimited JSON message stream into the generic
+ * item shape. Degrades to `[]` on empty/malformed input; individual unparseable
+ * lines are skipped rather than throwing the whole parse.
+ */
+export declare function parseClippy(stdout: string): Array<{
+    id?: string;
+    category?: string;
+    severity?: string;
+    path?: string;
+    line_start?: number;
+    line_end?: number;
+    summary?: string;
+    rule?: string;
+}>;
+/**
+ * Dedicated severity adapter: route clippy's parsed items through the shared
+ * generic normalizer so its output matches the exact ExternalAnalyzerResults
+ * contract every other analyzer emits.
+ */
+export declare function normalizeClippyJson(stdout: string): ExternalAnalyzerResults;
+//# sourceMappingURL=clippy.d.ts.map

package/dist/audit/adapters/clippy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clippy.d.ts","sourceRoot":"","sources":["../../../src/audit/adapters/clippy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAoD5E;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,CAAC;IACjD,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC,CAoDD;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,uBAAuB,CAE3E"}

package/dist/audit/adapters/clippy.js

@@ -0,0 +1,78 @@
+import { normalizeGenericExternalResults } from "./normalizeExternal.js";
+function mapClippySeverity(level) {
+    switch (level?.toLowerCase()) {
+        case "error":
+            return "high";
+        case "warning":
+            return "medium";
+        default:
+            return "low";
+    }
+}
+function primarySpan(spans) {
+    if (!Array.isArray(spans) || spans.length === 0)
+        return undefined;
+    return spans.find((s) => s && s.is_primary) ?? spans[0];
+}
+/**
+ * Parse cargo-clippy's newline-delimited JSON message stream into the generic
+ * item shape. Degrades to `[]` on empty/malformed input; individual unparseable
+ * lines are skipped rather than throwing the whole parse.
+ */
+export function parseClippy(stdout) {
+    if (!stdout || stdout.trim().length === 0)
+        return [];
+    const items = [];
+    for (const rawLine of stdout.split(/\r?\n/)) {
+        const line = rawLine.trim();
+        if (line.length === 0)
+            continue;
+        let parsed;
+        try {
+            parsed = JSON.parse(line);
+        }
+        catch {
+            continue;
+        }
+        if (!parsed || parsed.reason !== "compiler-message" || !parsed.message)
+            continue;
+        const message = parsed.message;
+        const level = typeof message.level === "string" ? message.level : undefined;
+        // Skip non-diagnostic levels (note/help attached separately have no primary
+        // span of interest); only surface error/warning diagnostics.
+        if (level !== "error" && level !== "warning")
+            continue;
+        const span = primarySpan(message.spans);
+        const path = typeof span?.file_name === "string" ? span.file_name : "";
+        if (!path)
+            continue;
+        const lineStart = typeof span?.line_start === "number" ? span.line_start : undefined;
+        const lineEnd = typeof span?.line_end === "number" ? span.line_end : undefined;
+        const rule = message.code && typeof message.code.code === "string" && message.code.code.length > 0
+            ? message.code.code
+            : "clippy";
+        const summary = typeof message.message === "string" && message.message.trim().length > 0
+            ? message.message
+            : rule;
+        items.push({
+            id: `clippy:${rule}:${path}:${lineStart ?? 0}`,
+            category: "correctness",
+            severity: mapClippySeverity(level),
+            path,
+            line_start: lineStart,
+            line_end: lineEnd,
+            summary,
+            rule,
+        });
+    }
+    return items;
+}
+/**
+ * Dedicated severity adapter: route clippy's parsed items through the shared
+ * generic normalizer so its output matches the exact ExternalAnalyzerResults
+ * contract every other analyzer emits.
+ */
+export function normalizeClippyJson(stdout) {
+    return normalizeGenericExternalResults("clippy", parseClippy(stdout));
+}
+//# sourceMappingURL=clippy.js.map

package/dist/audit/adapters/clippy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"clippy.js","sourceRoot":"","sources":["../../../src/audit/adapters/clippy.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,+BAA+B,EAAE,MAAM,wBAAwB,CAAC;AAmCzE,SAAS,iBAAiB,CAAC,KAAyB;IAClD,QAAQ,KAAK,EAAE,WAAW,EAAE,EAAE,CAAC;QAC7B,KAAK,OAAO;YACV,OAAO,MAAM,CAAC;QAChB,KAAK,SAAS;YACZ,OAAO,QAAQ,CAAC;QAClB;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,KAA+B;IAClD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAClE,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,MAAc;IAUxC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrD,MAAM,KAAK,GASN,EAAE,CAAC;IACR,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAChC,IAAI,MAAuB,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAoB,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,kBAAkB,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,SAAS;QACjF,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC/B,MAAM,KAAK,GAAG,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5E,4EAA4E;QAC5E,6DAA6D;QAC7D,IAAI,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QACvD,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,OAAO,IAAI,EAAE,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,SAAS,GAAG,OAAO,IAAI,EAAE,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;QACrF,MAAM,OAAO,GAAG,OAAO,IAAI,EAAE,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/E,MAAM,IAAI,GACR,OAAO,CAAC,IAAI,IAAI,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;YACnF,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI;YACnB,CAAC,CAAC,QAAQ,CAAC;QACf,MAAM,OAAO,GACX,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;YACtE,CAAC,CAAC,OAAO,CAAC,OAAO;YACjB,CAAC,CAAC,IAAI,CAAC;QACX,KAAK,CAAC,IAAI,CAAC;YACT,EAAE,EAAE,UAAU,IAAI,IAAI,IAAI,IAAI,SAAS,IAAI,CAAC,EAAE;YAC9C,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,iBAAiB,CAAC,KAAK,CAAC;YAClC,IAAI;YACJ,UAAU,EAAE,SAAS;YACrB,QAAQ,EAAE,OAAO;YACjB,OAAO;YACP,IAAI;SACL,CAAC,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAc;IAChD,OAAO,+BAA+B,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;AACxE,CAAC"}

package/dist/audit/adapters/rubocop.d.ts

@@ -0,0 +1,22 @@
+import type { ExternalAnalyzerResults } from "../types/externalAnalyzer.js";
+/**
+ * Parse rubocop's `--format json` stdout into the generic item shape. Degrades
+ * to `[]` on empty/malformed input or a missing `files` array.
+ */
+export declare function parseRubocop(stdout: string): Array<{
+    id?: string;
+    category?: string;
+    severity?: string;
+    path?: string;
+    line_start?: number;
+    line_end?: number;
+    summary?: string;
+    rule?: string;
+}>;
+/**
+ * Dedicated severity adapter: route rubocop's parsed items through the shared
+ * generic normalizer so its output matches the exact ExternalAnalyzerResults
+ * contract every other analyzer emits.
+ */
+export declare function normalizeRubocopJson(stdout: string): ExternalAnalyzerResults;
+//# sourceMappingURL=rubocop.d.ts.map

package/dist/audit/adapters/rubocop.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rubocop.d.ts","sourceRoot":"","sources":["../../../src/audit/adapters/rubocop.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAgD5E;;;GAGG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,CAAC;IAClD,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC,CAsDD;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,uBAAuB,CAE5E"}

package/dist/audit/adapters/rubocop.js

@@ -0,0 +1,72 @@
+import { normalizeGenericExternalResults } from "./normalizeExternal.js";
+function mapRubocopSeverity(severity) {
+    switch (severity?.toLowerCase()) {
+        case "fatal":
+        case "error":
+            return "high";
+        case "warning":
+            return "medium";
+        default:
+            return "low";
+    }
+}
+/**
+ * Parse rubocop's `--format json` stdout into the generic item shape. Degrades
+ * to `[]` on empty/malformed input or a missing `files` array.
+ */
+export function parseRubocop(stdout) {
+    let payload;
+    try {
+        payload = JSON.parse(stdout || "{}");
+    }
+    catch {
+        return [];
+    }
+    const files = Array.isArray(payload.files) ? payload.files : [];
+    const items = [];
+    for (const file of files) {
+        if (!file || typeof file !== "object")
+            continue;
+        const path = typeof file.path === "string" ? file.path : "";
+        if (!path)
+            continue;
+        const offenses = Array.isArray(file.offenses) ? file.offenses : [];
+        for (const offense of offenses) {
+            if (!offense || typeof offense !== "object")
+                continue;
+            const location = offense.location ?? {};
+            const lineStart = typeof location.start_line === "number"
+                ? location.start_line
+                : typeof location.line === "number"
+                    ? location.line
+                    : undefined;
+            const lineEnd = typeof location.last_line === "number" ? location.last_line : undefined;
+            const rule = typeof offense.cop_name === "string" && offense.cop_name.length > 0
+                ? offense.cop_name
+                : "rubocop";
+            const summary = typeof offense.message === "string" && offense.message.trim().length > 0
+                ? offense.message
+                : rule;
+            items.push({
+                id: `rubocop:${rule}:${path}:${lineStart ?? 0}`,
+                category: "maintainability",
+                severity: mapRubocopSeverity(offense.severity),
+                path,
+                line_start: lineStart,
+                line_end: lineEnd,
+                summary,
+                rule,
+            });
+        }
+    }
+    return items;
+}
+/**
+ * Dedicated severity adapter: route rubocop's parsed items through the shared
+ * generic normalizer so its output matches the exact ExternalAnalyzerResults
+ * contract every other analyzer emits.
+ */
+export function normalizeRubocopJson(stdout) {
+    return normalizeGenericExternalResults("rubocop", parseRubocop(stdout));
+}
+//# sourceMappingURL=rubocop.js.map

package/dist/audit/adapters/rubocop.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rubocop.js","sourceRoot":"","sources":["../../../src/audit/adapters/rubocop.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,+BAA+B,EAAE,MAAM,wBAAwB,CAAC;AAmCzE,SAAS,kBAAkB,CAAC,QAA4B;IACtD,QAAQ,QAAQ,EAAE,WAAW,EAAE,EAAE,CAAC;QAChC,KAAK,OAAO,CAAC;QACb,KAAK,OAAO;YACV,OAAO,MAAM,CAAC;QAChB,KAAK,SAAS;YACZ,OAAO,QAAQ,CAAC;QAClB;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,MAAc;IAUzC,IAAI,OAAoB,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,IAAI,CAAgB,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,MAAM,KAAK,GASN,EAAE,CAAC;IACR,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,SAAS;QAChD,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;gBAAE,SAAS;YACtD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC;YACxC,MAAM,SAAS,GACb,OAAO,QAAQ,CAAC,UAAU,KAAK,QAAQ;gBACrC,CAAC,CAAC,QAAQ,CAAC,UAAU;gBACrB,CAAC,CAAC,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ;oBACjC,CAAC,CAAC,QAAQ,CAAC,IAAI;oBACf,CAAC,CAAC,SAAS,CAAC;YAClB,MAAM,OAAO,GAAG,OAAO,QAAQ,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;YACxF,MAAM,IAAI,GACR,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;gBACjE,CAAC,CAAC,OAAO,CAAC,QAAQ;gBAClB,CAAC,CAAC,SAAS,CAAC;YAChB,MAAM,OAAO,GACX,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;gBACtE,CAAC,CAAC,OAAO,CAAC,OAAO;gBACjB,CAAC,CAAC,IAAI,CAAC;YACX,KAAK,CAAC,IAAI,CAAC;gBACT,EAAE,EAAE,WAAW,IAAI,IAAI,IAAI,IAAI,SAAS,IAAI,CAAC,EAAE;gBAC/C,QAAQ,EAAE,iBAAiB;gBAC3B,QAAQ,EAAE,kBAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC;gBAC9C,IAAI;gBACJ,UAAU,EAAE,SAAS;gBACrB,QAAQ,EAAE,OAAO;gBACjB,OAAO;gBACP,IAAI;aACL,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAc;IACjD,OAAO,+BAA+B,CAAC,SAAS,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;AAC1E,CAAC"}

package/dist/audit/cli/dispatch/packetPrompt.d.ts

@@ -3,6 +3,7 @@ import type { ReviewPacket } from "../../types/reviewPlanning.js";
 import type { ArtifactBundle } from "../../io/artifacts.js";
 import type { ExternalAnalyzerResults } from "../../types/externalAnalyzer.js";
 import { type FileAnchorSummary } from "../../orchestrator/fileAnchors.js";
+import { type KnipGraphIndex } from "../../orchestrator/knipGraphCrosscheck.js";
 /**
  * Encapsulates large-file anchor extraction for a single packet.
  * Appends to the provided warnings array on unavailability or failure.
@@ -26,7 +27,7 @@ export declare function extractPacketAnchor(params: {
 export declare function buildTaskSections(packetTasks: AuditTask[], lensDefs: Record<string, {
     description: string;
     do_not_report: string;
-}>, lineIndex: Record<string, number>, externalAnalyzerResults?: ExternalAnalyzerResults[]): string[];
+}>, lineIndex: Record<string, number>, externalAnalyzerResults?: ExternalAnalyzerResults[], knipGraphIndex?: KnipGraphIndex): string[];
 /**
  * Wraps the array-join block and returns the assembled prompt string.
  * The worker writes its own AuditResult[] JSON array to `result_path` (the same

package/dist/audit/cli/dispatch/packetPrompt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"packetPrompt.d.ts","sourceRoot":"","sources":["../../../../src/audit/cli/dispatch/packetPrompt.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC/E,OAAO,EAGL,KAAK,iBAAiB,EACvB,MAAM,mCAAmC,CAAC;AA0F3C;;;GAGG;AACH,wBAAsB,mBAAmB,CAAC,MAAM,EAAE;IAChD,MAAM,EAAE,YAAY,CAAC;IACrB,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,MAAM,EAAE,cAAc,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACpD,GAAG,OAAO,CAAC;IAAE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,aAAa,EAAE,iBAAiB,GAAG,IAAI,CAAA;CAAE,CAAC,CAgClF;AAgCD;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,WAAW,EAAE,SAAS,EAAE,EACxB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,CAAC,EACxE,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACjC,uBAAuB,CAAC,EAAE,uBAAuB,EAAE,GAClD,MAAM,EAAE,CAkDV;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE;IACxC,MAAM,EAAE,YAAY,CAAC;IACrB,WAAW,EAAE,SAAS,EAAE,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,MAAM,CA0FT;AAED,wBAAgB,qBAAqB,CACnC,aAAa,EAAE,OAAO,EACtB,aAAa,EAAE,iBAAiB,GAAG,IAAI,EACvC,UAAU,EAAE,MAAM,GAAG,IAAI,GACxB,MAAM,EAAE,CAcV"}
+{"version":3,"file":"packetPrompt.d.ts","sourceRoot":"","sources":["../../../../src/audit/cli/dispatch/packetPrompt.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC/E,OAAO,EAGL,KAAK,iBAAiB,EACvB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAEL,KAAK,cAAc,EACpB,MAAM,2CAA2C,CAAC;AA0FnD;;;GAGG;AACH,wBAAsB,mBAAmB,CAAC,MAAM,EAAE;IAChD,MAAM,EAAE,YAAY,CAAC;IACrB,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,MAAM,EAAE,cAAc,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACpD,GAAG,OAAO,CAAC;IAAE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,aAAa,EAAE,iBAAiB,GAAG,IAAI,CAAA;CAAE,CAAC,CAgClF;AAiDD;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,WAAW,EAAE,SAAS,EAAE,EACxB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,CAAC,EACxE,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACjC,uBAAuB,CAAC,EAAE,uBAAuB,EAAE,EACnD,cAAc,CAAC,EAAE,cAAc,GAC9B,MAAM,EAAE,CAsDV;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE;IACxC,MAAM,EAAE,YAAY,CAAC;IACrB,WAAW,EAAE,SAAS,EAAE,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,MAAM,CA0FT;AAED,wBAAgB,qBAAqB,CACnC,aAAa,EAAE,OAAO,EACtB,aAAa,EAAE,iBAAiB,GAAG,IAAI,EACvC,UAAU,EAAE,MAAM,GAAG,IAAI,GACxB,MAAM,EAAE,CAcV"}