auditor-lambda 0.1.0 → 0.2.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (87) hide show
  1. package/README.md +2 -1
  2. package/audit-code-wrapper-lib.mjs +205 -187
  3. package/dist/adapters/eslint.js +4 -2
  4. package/dist/adapters/npmAudit.js +1 -1
  5. package/dist/cli.js +296 -12
  6. package/dist/coverage.d.ts +0 -1
  7. package/dist/coverage.js +3 -34
  8. package/dist/extractors/bucketing.js +14 -35
  9. package/dist/extractors/disposition.js +8 -9
  10. package/dist/extractors/flows.js +14 -23
  11. package/dist/extractors/pathPatterns.d.ts +19 -0
  12. package/dist/extractors/pathPatterns.js +87 -0
  13. package/dist/extractors/surfaces.js +2 -7
  14. package/dist/io/artifacts.d.ts +23 -1
  15. package/dist/io/artifacts.js +3 -1
  16. package/dist/io/runArtifacts.js +1 -1
  17. package/dist/orchestrator/advance.js +1 -1
  18. package/dist/orchestrator/flowPlanning.d.ts +1 -1
  19. package/dist/orchestrator/flowPlanning.js +21 -28
  20. package/dist/orchestrator/internalExecutors.js +4 -7
  21. package/dist/orchestrator/planning.js +12 -20
  22. package/dist/orchestrator/resultIngestion.js +3 -2
  23. package/dist/orchestrator/runtimeValidation.js +5 -0
  24. package/dist/orchestrator/syntaxResolutionExecutor.js +10 -2
  25. package/dist/orchestrator/taskBuilder.d.ts +7 -2
  26. package/dist/orchestrator/taskBuilder.js +47 -52
  27. package/dist/prompts/renderWorkerPrompt.js +33 -0
  28. package/dist/providers/claudeCodeProvider.js +5 -0
  29. package/dist/providers/constants.d.ts +1 -0
  30. package/dist/providers/constants.js +1 -0
  31. package/dist/providers/index.js +9 -2
  32. package/dist/providers/spawnLoggedCommand.js +4 -0
  33. package/dist/reporting/mergeFindings.js +0 -7
  34. package/dist/reporting/rootCause.d.ts +0 -1
  35. package/dist/reporting/rootCause.js +0 -6
  36. package/dist/reporting/synthesis.js +18 -0
  37. package/dist/supervisor/operatorHandoff.d.ts +2 -0
  38. package/dist/supervisor/operatorHandoff.js +21 -9
  39. package/dist/supervisor/runLedger.js +6 -3
  40. package/dist/supervisor/sessionConfig.js +1 -0
  41. package/dist/types/flowCoverage.d.ts +1 -1
  42. package/dist/types/runLedger.d.ts +1 -1
  43. package/dist/types/runtimeValidation.d.ts +2 -1
  44. package/dist/types/sessionConfig.d.ts +2 -0
  45. package/dist/types/surfaces.d.ts +2 -1
  46. package/dist/types/workerSession.d.ts +4 -0
  47. package/dist/types.d.ts +0 -2
  48. package/dist/validation/auditResults.d.ts +11 -0
  49. package/dist/validation/auditResults.js +118 -0
  50. package/docs/agent-integrations.md +61 -56
  51. package/docs/agent-roles.md +69 -69
  52. package/docs/architecture.md +90 -90
  53. package/docs/artifacts.md +69 -69
  54. package/docs/bootstrap-install.md +1 -1
  55. package/docs/model-selection.md +86 -86
  56. package/docs/next-steps.md +11 -9
  57. package/docs/packaging.md +3 -3
  58. package/docs/pipeline.md +152 -152
  59. package/docs/production-readiness.md +6 -5
  60. package/docs/repo-layout.md +18 -18
  61. package/docs/run-flow.md +5 -5
  62. package/docs/session-config.md +216 -210
  63. package/docs/supervisor.md +70 -70
  64. package/docs/windows-setup.md +139 -139
  65. package/package.json +56 -56
  66. package/schemas/audit-code-v1alpha1.schema.json +80 -76
  67. package/schemas/audit_result.schema.json +54 -48
  68. package/schemas/audit_state.schema.json +2 -2
  69. package/schemas/audit_task.schema.json +60 -49
  70. package/schemas/blind_spot_register.schema.json +13 -3
  71. package/schemas/coverage_matrix.schema.json +14 -17
  72. package/schemas/critical_flows.schema.json +6 -3
  73. package/schemas/external_analyzer_results.schema.json +10 -4
  74. package/schemas/file_disposition.schema.json +33 -33
  75. package/schemas/finding.schema.json +86 -62
  76. package/schemas/flow_coverage.schema.json +53 -44
  77. package/schemas/graph_bundle.schema.json +12 -6
  78. package/schemas/merged_findings.schema.json +7 -2
  79. package/schemas/risk_register.schema.json +5 -1
  80. package/schemas/root_cause_clusters.schema.json +2 -5
  81. package/schemas/runtime_validation_report.schema.json +34 -34
  82. package/schemas/runtime_validation_tasks.schema.json +4 -1
  83. package/schemas/surface_manifest.schema.json +4 -1
  84. package/schemas/synthesis_report.schema.json +61 -61
  85. package/schemas/unit_manifest.schema.json +10 -3
  86. package/skills/audit-code/SKILL.md +37 -37
  87. package/skills/audit-code/audit-code.prompt.md +54 -54
@@ -5,142 +5,142 @@ This document covers Windows setup for the backend fallback `audit-code` wrapper
5
5
  The canonical product route is still `/audit-code` in conversation.
6
6
 
7
7
  ## Simplest path
8
-
9
- From the target repository root in PowerShell:
10
-
11
- ```powershell
12
- audit-code
13
- ```
14
-
15
- This is the lowest-friction path.
16
-
17
- Use it with the default backend:
18
-
19
- ```json
20
- {
21
- "provider": "local-subprocess",
22
- "ui_mode": "visible"
23
- }
24
- ```
25
-
26
- ## Claude Code on Windows
27
-
28
- If `claude` is on `PATH`, use:
29
-
30
- ```json
31
- {
32
- "provider": "claude-code",
33
- "ui_mode": "visible",
34
- "claude_code": {
35
- "command": "claude",
36
- "extra_args": []
37
- }
38
- }
39
- ```
40
-
41
- If you want to force a model:
42
-
43
- ```json
44
- {
45
- "provider": "claude-code",
46
- "ui_mode": "visible",
47
- "claude_code": {
48
- "command": "claude",
49
- "extra_args": ["--model", "sonnet"]
50
- }
51
- }
52
- ```
53
-
54
- ## OpenCode on Windows
55
-
56
- If `opencode` is on `PATH`, use:
57
-
58
- ```json
59
- {
60
- "provider": "opencode",
61
- "ui_mode": "visible",
62
- "opencode": {
63
- "command": "opencode",
64
- "extra_args": []
65
- }
66
- }
67
- ```
68
-
69
- If you want to force a provider/model pair:
70
-
71
- ```json
72
- {
73
- "provider": "opencode",
74
- "ui_mode": "visible",
75
- "opencode": {
76
- "command": "opencode",
77
- "extra_args": ["--model", "anthropic/claude-sonnet-4.5"]
78
- }
79
- }
80
- ```
81
-
82
- ## Generic PowerShell bridge
83
-
84
- When you need a provider-neutral launcher from Windows, use a PowerShell template bridge.
85
-
86
- Example:
87
-
88
- ```json
89
- {
90
- "provider": "subprocess-template",
91
- "ui_mode": "visible",
92
- "subprocess_template": {
93
- "command_template": [
94
- "pwsh",
95
- "-NoProfile",
96
- "-ExecutionPolicy",
97
- "Bypass",
98
- "-Command",
99
- "& { {workerCommandShell} }"
100
- ]
101
- }
102
- }
103
- ```
104
-
105
- If `pwsh` is not installed, replace it with `powershell`.
106
-
107
- ## VS Code on Windows
108
-
109
- The simplest VS Code path is still the integrated terminal.
110
-
111
- Open the target repository in VS Code and run:
112
-
113
- ```powershell
114
- audit-code
115
- ```
116
-
117
- Use a `vscode-task` template only if you specifically need a task-oriented launcher boundary.
118
-
119
- Example:
120
-
121
- ```json
122
- {
123
- "provider": "vscode-task",
124
- "ui_mode": "visible",
125
- "vscode_task": {
126
- "command_template": [
127
- "pwsh",
128
- "-NoProfile",
129
- "-ExecutionPolicy",
130
- "Bypass",
131
- "-Command",
132
- "& { {workerCommandShell} }"
133
- ]
134
- }
135
- }
136
- ```
137
-
138
- ## Antigravity on Windows
139
-
140
- There is no dedicated Antigravity provider adapter in this repository today.
141
-
142
- The recommended practical path is:
143
-
144
- - run `audit-code` from an Antigravity terminal
145
- - use `local-subprocess` first
146
- - move to `subprocess-template` only if a launcher bridge is actually needed
8
+
9
+ From the target repository root in PowerShell:
10
+
11
+ ```powershell
12
+ audit-code
13
+ ```
14
+
15
+ This is the lowest-friction path.
16
+
17
+ Use it with the default backend:
18
+
19
+ ```json
20
+ {
21
+ "provider": "local-subprocess",
22
+ "ui_mode": "visible"
23
+ }
24
+ ```
25
+
26
+ ## Claude Code on Windows
27
+
28
+ If `claude` is on `PATH`, use:
29
+
30
+ ```json
31
+ {
32
+ "provider": "claude-code",
33
+ "ui_mode": "visible",
34
+ "claude_code": {
35
+ "command": "claude",
36
+ "extra_args": []
37
+ }
38
+ }
39
+ ```
40
+
41
+ If you want to force a model:
42
+
43
+ ```json
44
+ {
45
+ "provider": "claude-code",
46
+ "ui_mode": "visible",
47
+ "claude_code": {
48
+ "command": "claude",
49
+ "extra_args": ["--model", "sonnet"]
50
+ }
51
+ }
52
+ ```
53
+
54
+ ## OpenCode on Windows
55
+
56
+ If `opencode` is on `PATH`, use:
57
+
58
+ ```json
59
+ {
60
+ "provider": "opencode",
61
+ "ui_mode": "visible",
62
+ "opencode": {
63
+ "command": "opencode",
64
+ "extra_args": []
65
+ }
66
+ }
67
+ ```
68
+
69
+ If you want to force a provider/model pair:
70
+
71
+ ```json
72
+ {
73
+ "provider": "opencode",
74
+ "ui_mode": "visible",
75
+ "opencode": {
76
+ "command": "opencode",
77
+ "extra_args": ["--model", "anthropic/claude-sonnet-4.5"]
78
+ }
79
+ }
80
+ ```
81
+
82
+ ## Generic PowerShell bridge
83
+
84
+ When you need a provider-neutral launcher from Windows, use a PowerShell template bridge.
85
+
86
+ Example:
87
+
88
+ ```json
89
+ {
90
+ "provider": "subprocess-template",
91
+ "ui_mode": "visible",
92
+ "subprocess_template": {
93
+ "command_template": [
94
+ "pwsh",
95
+ "-NoProfile",
96
+ "-ExecutionPolicy",
97
+ "Bypass",
98
+ "-Command",
99
+ "& { {workerCommandShell} }"
100
+ ]
101
+ }
102
+ }
103
+ ```
104
+
105
+ If `pwsh` is not installed, replace it with `powershell`.
106
+
107
+ ## VS Code on Windows
108
+
109
+ The simplest VS Code path is still the integrated terminal.
110
+
111
+ Open the target repository in VS Code and run:
112
+
113
+ ```powershell
114
+ audit-code
115
+ ```
116
+
117
+ Use a `vscode-task` template only if you specifically need a task-oriented launcher boundary.
118
+
119
+ Example:
120
+
121
+ ```json
122
+ {
123
+ "provider": "vscode-task",
124
+ "ui_mode": "visible",
125
+ "vscode_task": {
126
+ "command_template": [
127
+ "pwsh",
128
+ "-NoProfile",
129
+ "-ExecutionPolicy",
130
+ "Bypass",
131
+ "-Command",
132
+ "& { {workerCommandShell} }"
133
+ ]
134
+ }
135
+ }
136
+ ```
137
+
138
+ ## Antigravity on Windows
139
+
140
+ There is no dedicated Antigravity provider adapter in this repository today.
141
+
142
+ The recommended practical path is:
143
+
144
+ - run `audit-code` from an Antigravity terminal
145
+ - use `local-subprocess` first
146
+ - move to `subprocess-template` only if a launcher bridge is actually needed
package/package.json CHANGED
@@ -1,56 +1,56 @@
1
- {
2
- "name": "auditor-lambda",
3
- "version": "0.1.0",
4
- "private": false,
5
- "description": "Portable hybrid code-auditing framework for arbitrary repositories.",
6
- "type": "module",
7
- "bin": {
8
- "audit-code": "audit-code.mjs"
9
- },
10
- "files": [
11
- "dist/**",
12
- "audit-code.mjs",
13
- "audit-code-wrapper-lib.mjs",
14
- "schemas/**",
15
- "skills/audit-code/**",
16
- "README.md",
17
- "docs/**"
18
- ],
19
- "scripts": {
20
- "build": "tsc -p tsconfig.json",
21
- "check": "tsc -p tsconfig.json --noEmit",
22
- "test": "npm run build && node --test tests/*.test.mjs",
23
- "verify:release": "npm run check && npm test && npm run smoke:linked-audit-code && npm run smoke:packaged-audit-code",
24
- "smoke:linked-audit-code": "node scripts/smoke-linked-audit-code.mjs",
25
- "smoke:packaged-audit-code": "node scripts/smoke-packaged-audit-code.mjs",
26
- "prepack": "npm run build",
27
- "prepare": "npm run build",
28
- "prepublishOnly": "npm run verify:release",
29
- "start": "node dist/index.js",
30
- "audit-code": "node audit-code.mjs",
31
- "sample-run": "node dist/index.js sample-run"
32
- },
33
- "engines": {
34
- "node": ">=20"
35
- },
36
- "repository": {
37
- "type": "git",
38
- "url": "git+https://github.com/EthanBerlant/auditor-lambda.git"
39
- },
40
- "homepage": "https://github.com/EthanBerlant/auditor-lambda#readme",
41
- "bugs": {
42
- "url": "https://github.com/EthanBerlant/auditor-lambda/issues"
43
- },
44
- "keywords": [
45
- "audit",
46
- "cli",
47
- "code-audit",
48
- "static-analysis",
49
- "orchestration",
50
- "agents"
51
- ],
52
- "devDependencies": {
53
- "@types/node": "^24.3.0",
54
- "typescript": "^5.9.2"
55
- }
56
- }
1
+ {
2
+ "name": "auditor-lambda",
3
+ "version": "0.2.2",
4
+ "private": false,
5
+ "description": "Portable hybrid code-auditing framework for arbitrary repositories.",
6
+ "type": "module",
7
+ "bin": {
8
+ "audit-code": "audit-code.mjs"
9
+ },
10
+ "files": [
11
+ "dist/**",
12
+ "audit-code.mjs",
13
+ "audit-code-wrapper-lib.mjs",
14
+ "schemas/**",
15
+ "skills/audit-code/**",
16
+ "README.md",
17
+ "docs/**"
18
+ ],
19
+ "scripts": {
20
+ "build": "tsc -p tsconfig.json",
21
+ "check": "tsc -p tsconfig.json --noEmit",
22
+ "test": "npm run build && node --test tests/*.test.mjs",
23
+ "verify:release": "npm run check && npm test && npm run smoke:linked-audit-code && npm run smoke:packaged-audit-code",
24
+ "smoke:linked-audit-code": "node scripts/smoke-linked-audit-code.mjs",
25
+ "smoke:packaged-audit-code": "node scripts/smoke-packaged-audit-code.mjs",
26
+ "prepack": "npm run build",
27
+ "prepare": "npm run build",
28
+ "prepublishOnly": "npm run verify:release",
29
+ "start": "node dist/index.js",
30
+ "audit-code": "node audit-code.mjs",
31
+ "sample-run": "node dist/index.js sample-run"
32
+ },
33
+ "engines": {
34
+ "node": ">=20"
35
+ },
36
+ "repository": {
37
+ "type": "git",
38
+ "url": "git+https://github.com/OhOkThisIsFine/auditor-lambda.git"
39
+ },
40
+ "homepage": "https://github.com/OhOkThisIsFine/auditor-lambda#readme",
41
+ "bugs": {
42
+ "url": "https://github.com/OhOkThisIsFine/auditor-lambda/issues"
43
+ },
44
+ "keywords": [
45
+ "audit",
46
+ "cli",
47
+ "code-audit",
48
+ "static-analysis",
49
+ "orchestration",
50
+ "agents"
51
+ ],
52
+ "devDependencies": {
53
+ "@types/node": "^24.3.0",
54
+ "typescript": "^5.9.2"
55
+ }
56
+ }
@@ -1,79 +1,81 @@
1
- {
2
- "$schema": "https://json-schema.org/draft/2020-12/schema",
3
- "$id": "https://example.invalid/schemas/audit-code-v1alpha1.schema.json",
4
- "title": "audit-code wrapper output v1alpha1",
5
- "type": "object",
6
- "additionalProperties": false,
7
- "required": [
8
- "contract_version",
9
- "audit_state",
10
- "selected_obligation",
11
- "selected_executor",
12
- "progress_made",
13
- "artifacts_written",
14
- "progress_summary",
15
- "next_likely_step"
16
- ],
17
- "properties": {
18
- "contract_version": {
19
- "const": "audit-code/v1alpha1"
20
- },
21
- "audit_state": {
22
- "type": "object",
23
- "additionalProperties": false,
24
- "required": ["status", "obligations"],
25
- "properties": {
26
- "status": {
27
- "enum": ["not_started", "active", "blocked", "complete"]
28
- },
29
- "last_executor": {
30
- "type": "string"
31
- },
32
- "last_obligation": {
33
- "type": "string"
34
- },
35
- "blockers": {
36
- "type": "array",
37
- "items": {
38
- "type": "string"
39
- }
40
- },
41
- "obligations": {
42
- "type": "array",
43
- "items": {
44
- "type": "object",
45
- "additionalProperties": false,
46
- "required": ["id", "state"],
47
- "properties": {
48
- "id": {
49
- "type": "string"
50
- },
51
- "state": {
52
- "enum": ["missing", "present", "stale", "blocked", "satisfied"]
53
- },
54
- "reason": {
55
- "type": "string"
56
- }
57
- }
58
- }
59
- }
60
- }
61
- },
62
- "selected_obligation": {
63
- "type": ["string", "null"]
64
- },
65
- "selected_executor": {
66
- "type": ["string", "null"]
67
- },
68
- "progress_made": {
69
- "type": "boolean"
70
- },
71
- "artifacts_written": {
72
- "type": "array",
73
- "items": {
74
- "type": "string"
75
- }
76
- },
1
+ {
2
+ "$schema": "https://json-schema.org/draft/2020-12/schema",
3
+ "$id": "https://example.invalid/schemas/audit-code-v1alpha1.schema.json",
4
+ "title": "audit-code wrapper output v1alpha1",
5
+ "type": "object",
6
+ "additionalProperties": false,
7
+ "required": [
8
+ "contract_version",
9
+ "audit_state",
10
+ "selected_obligation",
11
+ "selected_executor",
12
+ "progress_made",
13
+ "artifacts_written",
14
+ "progress_summary",
15
+ "next_likely_step"
16
+ ],
17
+ "properties": {
18
+ "contract_version": {
19
+ "const": "audit-code/v1alpha1"
20
+ },
21
+ "audit_state": {
22
+ "type": "object",
23
+ "additionalProperties": false,
24
+ "required": ["status", "obligations"],
25
+ "properties": {
26
+ "status": {
27
+ "type": "string",
28
+ "enum": ["not_started", "active", "blocked", "complete"]
29
+ },
30
+ "last_executor": {
31
+ "type": "string"
32
+ },
33
+ "last_obligation": {
34
+ "type": "string"
35
+ },
36
+ "blockers": {
37
+ "type": "array",
38
+ "items": {
39
+ "type": "string"
40
+ }
41
+ },
42
+ "obligations": {
43
+ "type": "array",
44
+ "items": {
45
+ "type": "object",
46
+ "additionalProperties": false,
47
+ "required": ["id", "state"],
48
+ "properties": {
49
+ "id": {
50
+ "type": "string"
51
+ },
52
+ "state": {
53
+ "type": "string",
54
+ "enum": ["missing", "present", "stale", "blocked", "satisfied"]
55
+ },
56
+ "reason": {
57
+ "type": "string"
58
+ }
59
+ }
60
+ }
61
+ }
62
+ }
63
+ },
64
+ "selected_obligation": {
65
+ "type": ["string", "null"]
66
+ },
67
+ "selected_executor": {
68
+ "type": ["string", "null"]
69
+ },
70
+ "progress_made": {
71
+ "type": "boolean"
72
+ },
73
+ "artifacts_written": {
74
+ "type": "array",
75
+ "items": {
76
+ "type": "string"
77
+ }
78
+ },
77
79
  "progress_summary": {
78
80
  "type": "string"
79
81
  },
@@ -97,6 +99,7 @@
97
99
  ],
98
100
  "properties": {
99
101
  "status": {
102
+ "type": "string",
100
103
  "enum": ["not_started", "active", "blocked", "complete"]
101
104
  },
102
105
  "repo_root": {
@@ -125,6 +128,7 @@
125
128
  "required": ["flag", "suggested_path", "description"],
126
129
  "properties": {
127
130
  "flag": {
131
+ "type": "string",
128
132
  "enum": [
129
133
  "--results",
130
134
  "--updates",
@@ -1,48 +1,54 @@
1
- {
2
- "$schema": "https://json-schema.org/draft/2020-12/schema",
3
- "$id": "audit_result.schema.json",
4
- "title": "Audit Result",
5
- "type": "object",
6
- "required": [
7
- "task_id",
8
- "unit_id",
9
- "pass_id",
10
- "lens",
11
- "reviewed_ranges",
12
- "findings"
13
- ],
14
- "properties": {
15
- "task_id": { "type": "string" },
16
- "unit_id": { "type": "string" },
17
- "pass_id": { "type": "string" },
18
- "lens": { "type": "string" },
19
- "agent_role": { "type": "string" },
20
- "reviewed_ranges": {
21
- "type": "array",
22
- "items": {
23
- "type": "object",
24
- "required": ["path", "start", "end"],
25
- "properties": {
26
- "path": { "type": "string" },
27
- "start": { "type": "integer" },
28
- "end": { "type": "integer" }
29
- },
30
- "additionalProperties": false
31
- }
32
- },
33
- "findings": {
34
- "type": "array",
35
- "items": { "$ref": "finding.schema.json" }
36
- },
37
- "notes": {
38
- "type": "array",
39
- "items": { "type": "string" }
40
- },
41
- "requires_followup": { "type": "boolean" },
42
- "followup_tasks": {
43
- "type": "array",
44
- "items": { "type": "string" }
45
- }
46
- },
47
- "additionalProperties": true
48
- }
1
+ {
2
+ "$schema": "https://json-schema.org/draft/2020-12/schema",
3
+ "$id": "audit_result.schema.json",
4
+ "title": "Audit Result",
5
+ "type": "object",
6
+ "required": [
7
+ "task_id",
8
+ "unit_id",
9
+ "pass_id",
10
+ "lens",
11
+ "reviewed_ranges",
12
+ "findings"
13
+ ],
14
+ "$defs": {
15
+ "Finding": {
16
+ "$ref": "finding.schema.json"
17
+ }
18
+ },
19
+ "properties": {
20
+ "task_id": { "type": "string" },
21
+ "unit_id": { "type": "string" },
22
+ "pass_id": { "type": "string" },
23
+ "lens": { "type": "string" },
24
+ "agent_role": { "type": "string" },
25
+ "reviewed_ranges": {
26
+ "type": "array",
27
+ "minItems": 1,
28
+ "items": {
29
+ "type": "object",
30
+ "required": ["path", "start", "end"],
31
+ "properties": {
32
+ "path": { "type": "string" },
33
+ "start": { "type": "integer" },
34
+ "end": { "type": "integer" }
35
+ },
36
+ "additionalProperties": false
37
+ }
38
+ },
39
+ "findings": {
40
+ "type": "array",
41
+ "items": { "$ref": "#/$defs/Finding" }
42
+ },
43
+ "notes": {
44
+ "type": "array",
45
+ "items": { "type": "string" }
46
+ },
47
+ "requires_followup": { "type": "boolean" },
48
+ "followup_tasks": {
49
+ "type": "array",
50
+ "items": { "type": "string" }
51
+ }
52
+ },
53
+ "additionalProperties": false
54
+ }