auditor-lambda 0.10.3 → 0.10.7

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (183) hide show
  1. package/audit-code-wrapper-build.mjs +198 -0
  2. package/audit-code-wrapper-install-hosts.mjs +1140 -0
  3. package/audit-code-wrapper-io.mjs +155 -0
  4. package/audit-code-wrapper-legacy.mjs +125 -0
  5. package/audit-code-wrapper-lib.mjs +17 -1801
  6. package/audit-code-wrapper-opencode.mjs +256 -0
  7. package/dispatch/merge-results.mjs +5 -3
  8. package/dispatch/validate-result.mjs +2 -2
  9. package/dist/adapters/coverageSummary.js +6 -2
  10. package/dist/adapters/normalizeExternal.js +16 -1
  11. package/dist/adapters/npmAudit.js +20 -9
  12. package/dist/adapters/semgrep.js +26 -1
  13. package/dist/cli/advanceAuditCommand.d.ts +1 -0
  14. package/dist/cli/advanceAuditCommand.js +95 -0
  15. package/dist/cli/args.js +1 -2
  16. package/dist/cli/auditStep.js +2 -2
  17. package/dist/cli/cleanup.d.ts +11 -1
  18. package/dist/cli/cleanup.js +25 -5
  19. package/dist/cli/cleanupCommand.d.ts +1 -0
  20. package/dist/cli/cleanupCommand.js +24 -0
  21. package/dist/cli/dispatch.d.ts +55 -31
  22. package/dist/cli/dispatch.js +298 -241
  23. package/dist/cli/dispatchStatusCommand.d.ts +1 -0
  24. package/dist/cli/dispatchStatusCommand.js +68 -0
  25. package/dist/cli/explainTaskCommand.d.ts +1 -0
  26. package/dist/cli/explainTaskCommand.js +33 -0
  27. package/dist/cli/importExternalAnalyzerCommand.d.ts +1 -0
  28. package/dist/cli/importExternalAnalyzerCommand.js +20 -0
  29. package/dist/cli/ingestResultsCommand.d.ts +1 -0
  30. package/dist/cli/ingestResultsCommand.js +34 -0
  31. package/dist/cli/intakeCommand.d.ts +1 -0
  32. package/dist/cli/intakeCommand.js +17 -0
  33. package/dist/cli/lineIndex.js +19 -12
  34. package/dist/cli/nextStepCommand.d.ts +139 -0
  35. package/dist/cli/nextStepCommand.js +281 -232
  36. package/dist/cli/planCommand.d.ts +1 -0
  37. package/dist/cli/planCommand.js +16 -0
  38. package/dist/cli/prepareDispatchCommand.d.ts +1 -0
  39. package/dist/cli/prepareDispatchCommand.js +25 -0
  40. package/dist/cli/quotaCommand.d.ts +1 -0
  41. package/dist/cli/quotaCommand.js +56 -0
  42. package/dist/cli/requeueCommand.d.ts +1 -0
  43. package/dist/cli/requeueCommand.js +10 -0
  44. package/dist/cli/runToCompletion.js +451 -412
  45. package/dist/cli/sampleRunCommand.d.ts +1 -0
  46. package/dist/cli/sampleRunCommand.js +93 -0
  47. package/dist/cli/statusCommand.js +1 -1
  48. package/dist/cli/steps.js +4 -1
  49. package/dist/cli/submitPacketCommand.js +16 -15
  50. package/dist/cli/synthesizeCommand.d.ts +1 -0
  51. package/dist/cli/synthesizeCommand.js +15 -0
  52. package/dist/cli/updateRuntimeValidationCommand.d.ts +1 -0
  53. package/dist/cli/updateRuntimeValidationCommand.js +16 -0
  54. package/dist/cli/validateCommand.d.ts +1 -0
  55. package/dist/cli/validateCommand.js +41 -0
  56. package/dist/cli/validateResultCommand.d.ts +1 -0
  57. package/dist/cli/validateResultCommand.js +63 -0
  58. package/dist/cli/validateResultsCommand.d.ts +1 -0
  59. package/dist/cli/validateResultsCommand.js +31 -0
  60. package/dist/cli/workerRunCommand.d.ts +15 -1
  61. package/dist/cli/workerRunCommand.js +40 -4
  62. package/dist/cli.d.ts +3 -2
  63. package/dist/cli.js +21 -628
  64. package/dist/coverage.js +7 -3
  65. package/dist/extractors/analyzers/css.js +2 -2
  66. package/dist/extractors/analyzers/html.js +2 -2
  67. package/dist/extractors/analyzers/python.js +2 -2
  68. package/dist/extractors/analyzers/registry.js +17 -36
  69. package/dist/extractors/analyzers/treeSitter.d.ts +10 -1
  70. package/dist/extractors/analyzers/treeSitter.js +28 -6
  71. package/dist/extractors/analyzers/typescript.js +104 -85
  72. package/dist/extractors/browserExtension.js +4 -1
  73. package/dist/extractors/designAssessment.js +21 -21
  74. package/dist/extractors/fsIntake.js +34 -10
  75. package/dist/extractors/graph.js +17 -7
  76. package/dist/extractors/graphManifestEdges/cargo.d.ts +4 -0
  77. package/dist/extractors/graphManifestEdges/cargo.js +107 -0
  78. package/dist/extractors/graphManifestEdges/go.d.ts +5 -0
  79. package/dist/extractors/graphManifestEdges/go.js +151 -0
  80. package/dist/extractors/graphManifestEdges/index.d.ts +8 -0
  81. package/dist/extractors/graphManifestEdges/index.js +11 -0
  82. package/dist/extractors/graphManifestEdges/jsonc.d.ts +3 -0
  83. package/dist/extractors/graphManifestEdges/jsonc.js +97 -0
  84. package/dist/extractors/graphManifestEdges/maven.d.ts +3 -0
  85. package/dist/extractors/graphManifestEdges/maven.js +73 -0
  86. package/dist/extractors/graphManifestEdges/packageJson.d.ts +19 -0
  87. package/dist/extractors/graphManifestEdges/packageJson.js +204 -0
  88. package/dist/extractors/graphManifestEdges/pnpm.d.ts +2 -0
  89. package/dist/extractors/graphManifestEdges/pnpm.js +42 -0
  90. package/dist/extractors/graphManifestEdges/pyproject.d.ts +3 -0
  91. package/dist/extractors/graphManifestEdges/pyproject.js +83 -0
  92. package/dist/extractors/graphManifestEdges/toml.d.ts +4 -0
  93. package/dist/extractors/graphManifestEdges/toml.js +68 -0
  94. package/dist/extractors/graphManifestEdges/typescript.d.ts +3 -0
  95. package/dist/extractors/graphManifestEdges/typescript.js +56 -0
  96. package/dist/extractors/graphManifestEdges/workspace.d.ts +10 -0
  97. package/dist/extractors/graphManifestEdges/workspace.js +72 -0
  98. package/dist/extractors/graphManifestEdges/yaml.d.ts +3 -0
  99. package/dist/extractors/graphManifestEdges/yaml.js +59 -0
  100. package/dist/extractors/graphManifestEdges/yamlPaths.d.ts +4 -0
  101. package/dist/extractors/graphManifestEdges/yamlPaths.js +89 -0
  102. package/dist/extractors/graphPythonImports.js +4 -20
  103. package/dist/extractors/pathPatterns.js +3 -13
  104. package/dist/io/artifacts.d.ts +1 -1
  105. package/dist/io/artifacts.js +4 -1
  106. package/dist/io/runArtifacts.d.ts +8 -2
  107. package/dist/io/runArtifacts.js +103 -69
  108. package/dist/io/toolingManifest.js +2 -1
  109. package/dist/orchestrator/advance.js +36 -0
  110. package/dist/orchestrator/artifactFreshness.d.ts +1 -1
  111. package/dist/orchestrator/artifactFreshness.js +1 -1
  112. package/dist/orchestrator/artifactMetadata.js +5 -5
  113. package/dist/orchestrator/auditTaskUtils.d.ts +4 -0
  114. package/dist/orchestrator/auditTaskUtils.js +8 -12
  115. package/dist/orchestrator/autoFixExecutor.js +40 -26
  116. package/dist/orchestrator/dependencyMap.js +1 -1
  117. package/dist/orchestrator/executorResult.d.ts +33 -0
  118. package/dist/orchestrator/executors.d.ts +7 -0
  119. package/dist/orchestrator/executors.js +24 -0
  120. package/dist/orchestrator/fileAnchors.js +42 -29
  121. package/dist/orchestrator/fileIntegrity.js +6 -1
  122. package/dist/orchestrator/flowCoverage.js +1 -2
  123. package/dist/orchestrator/flowPlanning.js +8 -4
  124. package/dist/orchestrator/graphEnrichmentExecutor.js +67 -45
  125. package/dist/orchestrator/ingestionExecutors.js +9 -1
  126. package/dist/orchestrator/intakeExecutors.d.ts +0 -4
  127. package/dist/orchestrator/intakeExecutors.js +24 -14
  128. package/dist/orchestrator/localCommands.d.ts +1 -0
  129. package/dist/orchestrator/localCommands.js +10 -17
  130. package/dist/orchestrator/nextStep.js +3 -1
  131. package/dist/orchestrator/requeueCommand.js +4 -0
  132. package/dist/orchestrator/reviewPacketGraph.js +50 -18
  133. package/dist/orchestrator/reviewPackets.js +10 -8
  134. package/dist/orchestrator/runtimeCommand.js +35 -7
  135. package/dist/orchestrator/runtimeValidationUpdate.js +6 -0
  136. package/dist/orchestrator/selectiveDeepening/highRiskClean.js +3 -2
  137. package/dist/orchestrator/selectiveDeepening/lensVerification.js +44 -18
  138. package/dist/orchestrator/staleness.js +3 -3
  139. package/dist/orchestrator/state.js +1 -1
  140. package/dist/orchestrator/syntaxResolutionExecutor.js +17 -24
  141. package/dist/orchestrator/synthesisExecutors.js +1 -0
  142. package/dist/orchestrator/taskBuilder.js +5 -4
  143. package/dist/providers/claudeCodeProvider.js +4 -1
  144. package/dist/providers/opencodeProvider.js +4 -1
  145. package/dist/quota/discoveredLimits.js +3 -3
  146. package/dist/quota/headerExtraction.js +5 -2
  147. package/dist/quota/headerExtractors/claudeCodeHeaderExtractor.js +3 -0
  148. package/dist/quota/headerExtractors/index.js +3 -3
  149. package/dist/quota/index.d.ts +3 -1
  150. package/dist/quota/index.js +3 -0
  151. package/dist/reporting/findingRanks.d.ts +3 -0
  152. package/dist/reporting/findingRanks.js +24 -0
  153. package/dist/reporting/mergeFindings.js +1 -24
  154. package/dist/reporting/synthesis.d.ts +3 -1
  155. package/dist/reporting/synthesis.js +30 -6
  156. package/dist/reporting/synthesisNarrativePrompt.js +3 -0
  157. package/dist/reporting/workBlocks.js +1 -14
  158. package/dist/supervisor/operatorHandoff.js +2 -6
  159. package/dist/supervisor/runLedger.js +30 -41
  160. package/dist/types/activeDispatch.d.ts +31 -0
  161. package/dist/types/activeDispatch.js +2 -0
  162. package/dist/types.d.ts +21 -4
  163. package/dist/types.js +24 -16
  164. package/dist/validation/artifacts.js +3 -0
  165. package/dist/validation/auditResults.js +8 -2
  166. package/package.json +2 -2
  167. package/schemas/audit_findings.schema.json +5 -1
  168. package/schemas/audit_plan_metrics.schema.json +1 -1
  169. package/schemas/audit_result.schema.json +5 -6
  170. package/schemas/audit_task.schema.json +1 -4
  171. package/schemas/blind_spot_register.schema.json +1 -1
  172. package/schemas/coverage_matrix.schema.json +2 -8
  173. package/schemas/finding.schema.json +1 -16
  174. package/schemas/flow_coverage.schema.json +2 -8
  175. package/schemas/graph_bundle.schema.json +31 -0
  176. package/schemas/lens.schema.json +7 -0
  177. package/schemas/review_packets.schema.json +6 -17
  178. package/schemas/step_contract.schema.json +8 -2
  179. package/schemas/unit_manifest.schema.json +1 -4
  180. package/scripts/postinstall.mjs +3 -1
  181. package/skills/audit-code/audit-code.prompt.md +2 -3
  182. package/dist/extractors/graphManifestEdges.d.ts +0 -12
  183. package/dist/extractors/graphManifestEdges.js +0 -1135
@@ -1,6 +1,8 @@
1
1
  import type { ProviderRateLimits, SessionConfig, DispatchModelHint } from "@audit-tools/shared";
2
+ import type { DispatchResultMapEntry, DispatchResultMap } from "../types/activeDispatch.js";
2
3
  import type { ArtifactBundle } from "../io/artifacts.js";
3
4
  import type { AuditTask } from "../types.js";
5
+ import { buildReviewPackets } from "../orchestrator/reviewPackets.js";
4
6
  export declare const LARGE_FILE_PACKET_TARGET_LINES = 2500;
5
7
  export declare const SMALL_MODEL_HINT_MAX_LINES = 500;
6
8
  export declare const SMALL_MODEL_HINT_MAX_ESTIMATED_TOKENS = 3000;
@@ -15,37 +17,8 @@ export interface DispatchComplexity {
15
17
  tags: string[];
16
18
  large_file_mode: boolean;
17
19
  }
18
- export declare const DISPATCH_RESULT_MAP_FILENAME = "dispatch-result-map.json";
19
- export declare const ACTIVE_DISPATCH_FILENAME = "active-dispatch.json";
20
- export interface ActiveDispatchState {
21
- run_id: string;
22
- created_at: string;
23
- /** Emitted packets only (after canary/budget filtering). */
24
- packet_count: number;
25
- /** Tasks remaining this round (not-yet-done), not just emitted-packet tasks. */
26
- task_count: number;
27
- status: "active" | "merged";
28
- /** "canary" on first contact when only the top packet was emitted; "fan_out" otherwise. */
29
- phase: "canary" | "fan_out";
30
- /** packet_id of the emitted canary packet when phase==="canary", else null. */
31
- canary_packet_id: string | null;
32
- /** Total packets that would have been emitted before a budget cap (present only when capped). */
33
- budget_packet_count?: number;
34
- /** packet_ids NOT emitted due to the budget cap. */
35
- deferred_packet_ids?: string[];
36
- /** task_ids NOT emitted due to the budget cap. */
37
- deferred_task_ids?: string[];
38
- }
39
- export interface DispatchResultMapEntry {
40
- packet_id: string;
41
- task_id: string;
42
- result_path: string;
43
- }
44
- export interface DispatchResultMap {
45
- contract_version: "audit-code-dispatch-results/v1alpha1";
46
- run_id: string;
47
- entries: DispatchResultMapEntry[];
48
- }
20
+ export type { ActiveDispatchState, DispatchResultMapEntry, DispatchResultMap, } from "../types/activeDispatch.js";
21
+ export { DISPATCH_RESULT_MAP_FILENAME, ACTIVE_DISPATCH_FILENAME, } from "../types/activeDispatch.js";
49
22
  export declare const DEFAULT_DISPATCH_CONFIRM_THRESHOLD = 10;
50
23
  export interface DispatchFanout {
51
24
  agent_count: number;
@@ -118,6 +91,57 @@ export declare function buildDispatchComplexity(packet: {
118
91
  export declare function buildDispatchModelHint(complexity: DispatchComplexity): DispatchModelHint;
119
92
  export declare function withinRoot(root: string, path: string): string;
120
93
  export declare function buildPendingAuditTasks(bundle: ArtifactBundle): AuditTask[];
94
+ interface FilterPacketsResult {
95
+ emitPackets: ReturnType<typeof buildReviewPackets>;
96
+ deferredPackets: ReturnType<typeof buildReviewPackets>;
97
+ phase: "canary" | "fan_out";
98
+ canaryPacketId: string | null;
99
+ doCanary: boolean;
100
+ /** Total packets after canary filtering, before the budget cap (needed by active-dispatch state). */
101
+ postCanaryCount: number;
102
+ }
103
+ /**
104
+ * Encapsulates the canary and budget-cap filtering logic.
105
+ * Returns the subset of packets to emit this round plus deferred packets and
106
+ * phase metadata.
107
+ */
108
+ export declare function filterPackets(packets: ReturnType<typeof buildReviewPackets>, priorDispatchThisRun: boolean, sessionConfig: SessionConfig): FilterPacketsResult;
109
+ /**
110
+ * Extracts the per-task flatMap that builds task section lines.
111
+ */
112
+ export declare function buildTaskSections(packetTasks: AuditTask[], lensDefs: Record<string, {
113
+ description: string;
114
+ do_not_report: string;
115
+ }>, lineIndex: Record<string, number>): string[];
116
+ /**
117
+ * Wraps the 75-line array-join block and returns the assembled prompt string.
118
+ */
119
+ export declare function buildPacketPrompt(params: {
120
+ packet: ReturnType<typeof buildReviewPackets>[number];
121
+ packetTasks: AuditTask[];
122
+ fileList: string;
123
+ largeFileSection: string[];
124
+ taskSections: string[];
125
+ submitCommand: string;
126
+ }): string;
127
+ /**
128
+ * Extracts the context-budget warning loop.
129
+ * Returns warnings for packets whose estimated token count exceeds the context budget.
130
+ * When confidence is 'low', returns an empty array (limits are unreliable).
131
+ */
132
+ export declare function collectOversizedWarnings(plan: Array<{
133
+ packet_id: string;
134
+ complexity: DispatchComplexity;
135
+ }>, waveSchedule: {
136
+ confidence: string;
137
+ resolved_limits: {
138
+ context_tokens: number;
139
+ output_tokens: number;
140
+ };
141
+ }): Array<{
142
+ code: string;
143
+ message: string;
144
+ }>;
121
145
  export declare function prepareDispatchArtifacts(params: {
122
146
  packageRoot: string;
123
147
  runId: string;