auditor-lambda 0.10.3 → 0.10.8

package/dist/cli/sampleRunCommand.d.ts

@@ -0,0 +1 @@
+export declare function runSample(argv?: string[]): Promise<void>;

package/dist/cli/sampleRunCommand.js

@@ -0,0 +1,93 @@
+import { mkdir } from "node:fs/promises";
+import { buildRepoManifest } from "../extractors/fileInventory.js";
+import { buildFileDisposition } from "../extractors/disposition.js";
+import { buildCriticalFlowManifest } from "../extractors/flows.js";
+import { buildSurfaceManifest } from "../extractors/surfaces.js";
+import { buildUnitManifest } from "../orchestrator/unitBuilder.js";
+import { buildFlowCoverage } from "../orchestrator/flowCoverage.js";
+import { buildRuntimeValidationTasks } from "../orchestrator/runtimeValidation.js";
+import { initializeCoverageFromPlan } from "../orchestrator/planning.js";
+import { writeCoreArtifacts } from "../io/artifacts.js";
+import { buildAuditReportModel, renderAuditReportMarkdown, } from "../reporting/synthesis.js";
+import { deriveAuditState } from "../orchestrator/state.js";
+import { getArtifactsDir } from "./args.js";
+const SAMPLE_REPO_FILES = [
+    { path: "src/api/auth.ts", size_bytes: 1240, hash: "abc123" },
+    { path: "src/lib/session.ts", size_bytes: 980, hash: "def456" },
+    { path: "infra/deploy.yml", size_bytes: 420, hash: "ghi789" },
+    { path: "docs/notes.md", size_bytes: 300, hash: "doc111" },
+];
+export async function runSample(argv = process.argv) {
+    const repoManifest = buildRepoManifest("sample-repo", SAMPLE_REPO_FILES);
+    const disposition = buildFileDisposition(repoManifest);
+    const unitManifest = buildUnitManifest(repoManifest, disposition);
+    const surfaceManifest = buildSurfaceManifest(repoManifest, disposition);
+    const criticalFlows = buildCriticalFlowManifest(repoManifest, surfaceManifest, disposition);
+    const coverage = initializeCoverageFromPlan(repoManifest, unitManifest, disposition);
+    const sampleResults = [
+        {
+            task_id: "src-api:security:src/api/auth.ts:1-100",
+            unit_id: unitManifest.units[0]?.unit_id ?? "sample-unit",
+            pass_id: "pass:security",
+            lens: "security",
+            agent_role: "security-auditor",
+            file_coverage: [{ path: "src/api/auth.ts", total_lines: 100 }],
+            findings: [],
+            notes: ["Sample result ingestion path."],
+            requires_followup: false,
+        },
+    ];
+    const flowCoverage = buildFlowCoverage(criticalFlows, coverage);
+    const runtimeValidationTasks = buildRuntimeValidationTasks({
+        unitManifest,
+        criticalFlows,
+        flowCoverage,
+        command: ["npm", "test"],
+    });
+    const runtimeValidationReport = {
+        results: runtimeValidationTasks.tasks.map((task) => ({
+            task_id: task.id,
+            status: "confirmed",
+            summary: "Sample runtime validation completed.",
+            evidence: [],
+            notes: [],
+        })),
+    };
+    const auditReport = renderAuditReportMarkdown(buildAuditReportModel({
+        results: sampleResults,
+        unitManifest,
+        criticalFlows,
+        coverageMatrix: coverage,
+        runtimeValidationReport,
+    }));
+    const auditState = deriveAuditState({
+        repo_manifest: repoManifest,
+        file_disposition: disposition,
+        unit_manifest: unitManifest,
+        surface_manifest: surfaceManifest,
+        critical_flows: criticalFlows,
+        flow_coverage: flowCoverage,
+        coverage_matrix: coverage,
+        runtime_validation_tasks: runtimeValidationTasks,
+        runtime_validation_report: runtimeValidationReport,
+        audit_results: sampleResults,
+        audit_report: auditReport,
+    });
+    const artifactsDir = getArtifactsDir(argv);
+    await mkdir(artifactsDir, { recursive: true });
+    await writeCoreArtifacts(artifactsDir, {
+        repo_manifest: repoManifest,
+        file_disposition: disposition,
+        unit_manifest: unitManifest,
+        surface_manifest: surfaceManifest,
+        critical_flows: criticalFlows,
+        flow_coverage: flowCoverage,
+        coverage_matrix: coverage,
+        runtime_validation_tasks: runtimeValidationTasks,
+        runtime_validation_report: runtimeValidationReport,
+        audit_results: sampleResults,
+        audit_report: auditReport,
+        audit_state: auditState,
+    });
+    console.log(JSON.stringify({ audit_state: auditState, artifacts_dir: artifactsDir }, null, 2));
+}

package/dist/cli/statusCommand.js

@@ -17,7 +17,7 @@ export async function cmdStatus(argv) {
         }
     }
     if (!auditState) {
-        console.error("No audit_state.json found; no active audit in this artifacts directory.");
+        console.log(JSON.stringify({ status: 'no_active_audit', error: 'No audit_state.json found; no active audit in this artifacts directory.' }, null, 2));
         process.exitCode = 1;
         return;
     }

package/dist/cli/steps.js

@@ -23,9 +23,12 @@ export async function writeCurrentStep(params) {
         repo_root: params.repoRoot,
         artifacts_dir: params.artifactsDir,
         artifact_paths: {
+            // Caller-supplied paths are merged first so the canonical, computed
+            // step/prompt locations always win — a caller (or step config) must not be
+            // able to repoint the host at a different current-step.json / -prompt.md.
+            ...params.artifactPaths,
             current_step: stepPath,
             current_prompt: promptPath,
-            ...params.artifactPaths,
         },
         ...(params.access ? { access: params.access } : {}),
     };

package/dist/cli/submitPacketCommand.js

@@ -4,6 +4,14 @@ import { readJsonFile, writeJsonFile } from "@audit-tools/shared";
 import { validateAuditResults, formatAuditResultIssues } from "../validation/auditResults.js";
 import { DISPATCH_RESULT_MAP_FILENAME, resolveRunScopedArg, loadDispatchResultMap, entriesByTaskId, } from "./dispatch.js";
 import { fromBase64Url, getArtifactsDir, getFlag, readStdinText } from "./args.js";
+function findingKey(f) {
+    return [
+        (f.lens ?? "").trim().toLowerCase(),
+        (f.category ?? "").trim().toLowerCase(),
+        (f.title ?? "").trim().toLowerCase(),
+        f.affected_files?.[0]?.path ?? "",
+    ].join("|");
+}
 export async function cmdSubmitPacket(argv) {
     const runId = resolveRunScopedArg(argv, "--run-id", "--run-id-b64");
     const packetId = resolveRunScopedArg(argv, "--packet-id", "--packet-id-b64");
@@ -107,13 +115,7 @@ export async function cmdSubmitPacket(argv) {
             const existing = JSON.parse(await readFile(other.result_path, "utf8"));
             if (existing?.findings) {
                 for (const f of existing.findings) {
-                    const key = [
-                        (f.lens ?? "").trim().toLowerCase(),
-                        (f.category ?? "").trim().toLowerCase(),
-                        (f.title ?? "").trim().toLowerCase(),
-                        f.affected_files?.[0]?.path ?? "",
-                    ].join("|");
-                    existingFindingKeys.add(key);
+                    existingFindingKeys.add(findingKey(f));
                 }
             }
         }
@@ -122,13 +124,7 @@ export async function cmdSubmitPacket(argv) {
     let dupCount = 0;
     for (const result of payload) {
         for (const f of result.findings ?? []) {
-            const key = [
-                (f.lens ?? "").trim().toLowerCase(),
-                (f.category ?? "").trim().toLowerCase(),
-                (f.title ?? "").trim().toLowerCase(),
-                f.affected_files?.[0]?.path ?? "",
-            ].join("|");
-            if (existingFindingKeys.has(key)) {
+            if (existingFindingKeys.has(findingKey(f))) {
                 dupCount++;
             }
         }
@@ -137,12 +133,17 @@ export async function cmdSubmitPacket(argv) {
         process.stderr.write(`[submit-packet] Warning: ${dupCount} finding(s) appear to duplicate findings from other packets in this run.\n`);
     }
     const entryByTaskId = entriesByTaskId(packetEntries);
+    const submittedAt = new Date().toISOString();
     for (const result of payload) {
         const entry = entryByTaskId.get(result.task_id);
         if (!entry) {
             throw new Error(`Internal error: no result path for accepted task '${result.task_id}'.`);
         }
-        await writeJsonFile(entry.result_path, result);
+        await writeJsonFile(entry.result_path, {
+            ...result,
+            run_id: runId,
+            submitted_at: submittedAt,
+        });
     }
     const findingCount = payload.reduce((sum, result) => sum + result.findings.length, 0);
     console.log(JSON.stringify({

package/dist/cli/synthesizeCommand.d.ts

@@ -0,0 +1 @@
+export declare function cmdSynthesize(argv: string[]): Promise<void>;

package/dist/cli/synthesizeCommand.js

@@ -0,0 +1,15 @@
+import { runAuditStep } from "./auditStep.js";
+import { getArtifactsDir, getRootDir } from "./args.js";
+export async function cmdSynthesize(argv) {
+    const artifactsDir = getArtifactsDir(argv);
+    const result = await runAuditStep({
+        root: getRootDir(argv),
+        artifactsDir,
+        preferredExecutor: "synthesis_executor",
+    });
+    console.log(JSON.stringify({
+        artifacts_dir: artifactsDir,
+        selected_executor: result.selected_executor,
+        progress_summary: result.progress_summary,
+    }, null, 2));
+}

package/dist/cli/updateRuntimeValidationCommand.d.ts

@@ -0,0 +1 @@
+export declare function cmdUpdateRuntimeValidation(argv: string[]): Promise<void>;

package/dist/cli/updateRuntimeValidationCommand.js

@@ -0,0 +1,16 @@
+import { runAuditStep } from "./auditStep.js";
+import { getArtifactsDir, getFlag, getRootDir } from "./args.js";
+export async function cmdUpdateRuntimeValidation(argv) {
+    const artifactsDir = getArtifactsDir(argv);
+    const result = await runAuditStep({
+        root: getRootDir(argv),
+        artifactsDir,
+        preferredExecutor: "runtime_validation_update_executor",
+        runtimeUpdatesPath: getFlag(argv, "--updates"),
+    });
+    console.log(JSON.stringify({
+        artifacts_dir: artifactsDir,
+        selected_executor: result.selected_executor,
+        progress_summary: result.progress_summary,
+    }, null, 2));
+}

package/dist/cli/validateCommand.d.ts

@@ -0,0 +1 @@
+export declare function cmdValidate(argv: string[]): Promise<void>;

package/dist/cli/validateCommand.js

@@ -0,0 +1,41 @@
+import { loadArtifactBundle } from "../io/artifacts.js";
+import { prefixValidationIssues } from "@audit-tools/shared";
+import { validateArtifactBundle } from "../validation/artifacts.js";
+import { validateConfiguredProviderEnvironment, validateSessionConfig, } from "../validation/sessionConfig.js";
+import { resolveFreshSessionProviderName, } from "../providers/index.js";
+import { getSessionConfigPath, readSessionConfigFile, } from "../supervisor/sessionConfig.js";
+import { getArtifactsDir } from "./args.js";
+export async function cmdValidate(argv) {
+    const artifactsDir = getArtifactsDir(argv);
+    const bundle = await loadArtifactBundle(artifactsDir);
+    const sessionConfigPath = getSessionConfigPath(artifactsDir);
+    const rawSessionConfig = await readSessionConfigFile(artifactsDir);
+    const artifactIssues = validateArtifactBundle(bundle);
+    const sessionConfigIssues = rawSessionConfig === undefined
+        ? []
+        : prefixValidationIssues("session_config", validateSessionConfig(rawSessionConfig));
+    const providerIssues = rawSessionConfig === undefined || sessionConfigIssues.length > 0
+        ? []
+        : prefixValidationIssues("session_config", await validateConfiguredProviderEnvironment(rawSessionConfig));
+    const issues = [
+        ...artifactIssues,
+        ...sessionConfigIssues,
+        ...providerIssues,
+    ];
+    const resolvedProvider = rawSessionConfig === undefined
+        ? "local-subprocess"
+        : sessionConfigIssues.length > 0
+            ? null
+            : resolveFreshSessionProviderName(undefined, rawSessionConfig);
+    console.log(JSON.stringify({
+        artifacts_dir: artifactsDir,
+        session_config_path: sessionConfigPath,
+        session_config_present: rawSessionConfig !== undefined,
+        resolved_provider: resolvedProvider,
+        artifact_issue_count: artifactIssues.length,
+        session_config_issue_count: sessionConfigIssues.length + providerIssues.length,
+        issue_count: issues.length,
+        issues,
+    }, null, 2));
+    process.exitCode = issues.length > 0 ? 1 : 0;
+}

package/dist/cli/validateResultCommand.d.ts

@@ -0,0 +1 @@
+export declare function cmdValidateResult(argv: string[]): Promise<void>;

package/dist/cli/validateResultCommand.js

@@ -0,0 +1,63 @@
+import { readFile } from "node:fs/promises";
+import { join, resolve } from "node:path";
+import { readJsonFile } from "@audit-tools/shared";
+import { validateAuditResults } from "../validation/auditResults.js";
+import { loadDispatchResultMap } from "./dispatch.js";
+import { fromBase64Url, getArtifactsDir, getFlag, taskResultPath } from "./args.js";
+export async function cmdValidateResult(argv) {
+    const rawRunId = getFlag(argv, "--run-id");
+    const runIdB64 = getFlag(argv, "--run-id-b64");
+    const rawTaskId = getFlag(argv, "--task-id");
+    const artifactsDirB64 = getFlag(argv, "--artifacts-dir-b64");
+    const runId = rawRunId ?? (runIdB64 ? fromBase64Url(runIdB64) : undefined);
+    const taskIdB64 = getFlag(argv, "--task-id-b64");
+    const taskId = rawTaskId ?? (taskIdB64 ? fromBase64Url(taskIdB64) : undefined);
+    const artifactsDir = artifactsDirB64
+        ? resolve(fromBase64Url(artifactsDirB64))
+        : getArtifactsDir(argv);
+    if (!runId || !taskId) {
+        throw new Error("validate-result requires --run-id and --task-id (or --run-id-b64/--task-id-b64)");
+    }
+    const runDir = join(artifactsDir, "runs", runId);
+    const taskResultsDir = join(runDir, "task-results");
+    const resultMap = await loadDispatchResultMap(runDir);
+    const resultPath = resultMap?.entries.find((entry) => entry.task_id === taskId)?.result_path ??
+        taskResultPath(taskResultsDir, taskId);
+    const tasksPath = join(runDir, "pending-audit-tasks.json");
+    let raw;
+    try {
+        raw = await readFile(resultPath, "utf8");
+    }
+    catch {
+        console.error(`File not found: ${resultPath}`);
+        process.exitCode = 1;
+        return;
+    }
+    let obj;
+    try {
+        obj = JSON.parse(raw);
+    }
+    catch (e) {
+        console.error(`Invalid JSON: ${e.message}`);
+        process.exitCode = 1;
+        return;
+    }
+    let allTasks = [];
+    try {
+        allTasks = await readJsonFile(tasksPath);
+    }
+    catch { /* may not exist */ }
+    const matchingTasks = allTasks.filter(t => t.task_id === taskId);
+    const lineIndex = matchingTasks[0]?.file_line_counts ?? {};
+    const issues = validateAuditResults([obj], matchingTasks, { lineIndex });
+    const errors = issues.filter(i => i.severity === "error");
+    if (errors.length === 0) {
+        console.log(`✓ valid: ${taskId}`);
+    }
+    else {
+        console.error(`✗ invalid: ${taskId}`);
+        for (const e of errors)
+            console.error(`  ${e.path}: ${e.message}`);
+        process.exitCode = 1;
+    }
+}

package/dist/cli/validateResultsCommand.d.ts

@@ -0,0 +1 @@
+export declare function cmdValidateResults(argv: string[]): Promise<void>;

package/dist/cli/validateResultsCommand.js

@@ -0,0 +1,31 @@
+import { readJsonFile } from "@audit-tools/shared";
+import { resolve } from "node:path";
+import { loadArtifactBundle } from "../io/artifacts.js";
+import { validateAuditResults } from "../validation/auditResults.js";
+import { buildLineIndex } from "./lineIndex.js";
+import { getArtifactsDir, getFlag, getRootDir } from "./args.js";
+export async function cmdValidateResults(argv) {
+    const artifactsDir = getArtifactsDir(argv);
+    const resultsPath = getFlag(argv, "--results");
+    if (!resultsPath) {
+        throw new Error("validate-results requires --results <file>");
+    }
+    const bundle = await loadArtifactBundle(artifactsDir);
+    const lineIndex = bundle.repo_manifest
+        ? await buildLineIndex(getRootDir(argv), bundle.repo_manifest)
+        : undefined;
+    const auditResults = await readJsonFile(resultsPath);
+    const issues = validateAuditResults(auditResults, bundle.audit_tasks ?? [], {
+        lineIndex,
+    });
+    const errors = issues.filter((issue) => issue.severity === "error");
+    const warnings = issues.filter((issue) => issue.severity === "warning");
+    console.log(JSON.stringify({
+        artifacts_dir: artifactsDir,
+        results_path: resolve(resultsPath),
+        warning_count: warnings.length,
+        error_count: errors.length,
+        issues,
+    }, null, 2));
+    process.exitCode = errors.length > 0 ? 1 : 0;
+}

package/dist/cli/workerRunCommand.d.ts

@@ -1 +1,15 @@
-export declare function cmdWorkerRun(argv: string[]): Promise<void>;
+import { readJsonFile, writeJsonFile } from "@audit-tools/shared";
+import { runAuditStep } from "./auditStep.js";
+/**
+ * Injectable IO + step seam for cmdWorkerRun. Production uses the real
+ * @audit-tools/shared helpers and runAuditStep; tests override individual
+ * members to drive failure paths (e.g. a writeJsonFile that throws on the
+ * first call and succeeds on the fallback) without module-level mocking,
+ * which the project's `node --import tsx/esm --test` runner cannot do.
+ */
+export interface WorkerRunDeps {
+    readJsonFile: typeof readJsonFile;
+    writeJsonFile: typeof writeJsonFile;
+    runAuditStep: typeof runAuditStep;
+}
+export declare function cmdWorkerRun(argv: string[], deps?: WorkerRunDeps): Promise<void>;

package/dist/cli/workerRunCommand.js

@@ -4,7 +4,13 @@ import { runAuditStep } from "./auditStep.js";
 import { buildLineIndexForPaths } from "./lineIndex.js";
 import { WORKER_RESULT_CONTRACT_VERSION, formatAuditResultValidationError } from "./workerResult.js";
 import { getFlag, looksLikeCliFlag } from "./args.js";
-export async function cmdWorkerRun(argv) {
+const defaultWorkerRunDeps = {
+    readJsonFile,
+    writeJsonFile,
+    runAuditStep,
+};
+export async function cmdWorkerRun(argv, deps = defaultWorkerRunDeps) {
+    const { readJsonFile, writeJsonFile, runAuditStep } = deps;
     const taskPath = getFlag(argv, "--task");
     if (!taskPath) {
         throw new Error("worker-run requires --task <path>");
@@ -31,8 +37,16 @@ export async function cmdWorkerRun(argv) {
             const issues = validateAuditResults(auditResults, pendingTasks, {
                 lineIndex: await buildLineIndexForPaths(task.repo_root, pendingTasks.flatMap((item) => item.file_paths)),
             });
-            const errors = issues.filter((issue) => issue.severity === "error");
-            const warnings = issues.filter((issue) => issue.severity === "warning");
+            const errors = [];
+            const warnings = [];
+            for (const issue of issues) {
+                if (issue.severity === "error") {
+                    errors.push(issue);
+                }
+                else {
+                    warnings.push(issue);
+                }
+            }
             if (warnings.length > 0) {
                 process.stderr.write(`audit-results validation: ${warnings.length} warning(s):\n` +
                     formatAuditResultIssues(warnings) +
@@ -80,7 +94,29 @@ export async function cmdWorkerRun(argv) {
             errors: [error instanceof Error ? error.message : String(error)],
         };
     }
-    await writeJsonFile(task.result_path, workerResult);
+    try {
+        await writeJsonFile(task.result_path, workerResult);
+    }
+    catch (writeError) {
+        const writeFailedResult = {
+            contract_version: WORKER_RESULT_CONTRACT_VERSION,
+            run_id: task.run_id,
+            obligation_id: task.obligation_id,
+            status: "failed",
+            progress_made: false,
+            selected_executor: task.preferred_executor,
+            artifacts_written: [],
+            summary: `Worker result could not be persisted to ${task.result_path}: ${writeError instanceof Error ? writeError.message : String(writeError)}`,
+            next_likely_step: task.obligation_id,
+            errors: [writeError instanceof Error ? writeError.message : String(writeError)],
+        };
+        process.stderr.write(`[workerRunCommand] Failed to write result to ${task.result_path}: ${writeError instanceof Error ? writeError.message : String(writeError)}\n`);
+        // Best-effort second attempt with the degraded result.
+        await writeJsonFile(task.result_path, writeFailedResult);
+        console.log(JSON.stringify(writeFailedResult, null, 2));
+        process.exitCode = 1;
+        return;
+    }
     console.log(JSON.stringify(workerResult, null, 2));
     if (workerResult.status === "failed") {
         process.exitCode = 1;

package/dist/cli.d.ts

@@ -1,4 +1,6 @@
-import { getFlag, hasFlag, getArtifactsDir, getRootDir, warnIfNotGitRepo, getBatchResultsDir, getMaxRuns, getAgentBatchSize, getParallelWorkers, getTimeoutMs, chunkArray, getUiMode, looksLikeCliFlag, countLines } from "./cli/args.js";
+import { getFlag, hasFlag, getArtifactsDir, getRootDir, getBatchResultsDir, getMaxRuns, getAgentBatchSize, getParallelWorkers, getTimeoutMs, chunkArray, getUiMode, looksLikeCliFlag, countLines, warnIfNotGitRepo } from "./cli/args.js";
+import { runSample } from "./cli/sampleRunCommand.js";
+export { runSample };
 export declare const cliTestUtils: {
     defaults: {
         rootDir: string;
@@ -24,5 +26,4 @@ export declare const cliTestUtils: {
     countLines: typeof countLines;
     warnIfNotGitRepo: typeof warnIfNotGitRepo;
 };
-export declare function runSample(argv?: string[]): Promise<void>;
 export declare function runCli(argv: string[]): Promise<void>;