auditor-lambda 0.2.14 → 0.2.15

package/dist/extractors/disposition.js

@@ -1,4 +1,4 @@
-import { isNodeModulesOrGit, isBuildOutput, isVendorPath, isBinaryArtifact, isLicensePath, isLockfilePath, isLogPath, isDocPath, isAuditArtifactPath, isGeneratedInstallArtifactPath, normalizeExtractorPath, } from "./pathPatterns.js";
+import { isNodeModulesOrGit, isBuildOutput, isVendorPath, isBinaryArtifact, isLicensePath, isLockfilePath, isLogPath, isDocPath, isAuditArtifactPath, isGeneratedInstallArtifactPath, isExamplesOrFixturesPath, normalizeExtractorPath, } from "./pathPatterns.js";
 function inferDisposition(path) {
     const normalized = normalizeExtractorPath(path);
     if (isNodeModulesOrGit(normalized)) {
@@ -43,6 +43,9 @@ function inferDisposition(path) {
             reason: "Generated install/bootstrap artifact.",
         };
     }
+    if (isExamplesOrFixturesPath(normalized)) {
+        return { path, status: "doc_only", reason: "Examples and fixtures are support artifacts, not auditable code." };
+    }
     return {
         path,
         status: "included",

package/dist/extractors/pathPatterns.d.ts

@@ -5,6 +5,7 @@
  */
 export declare const EXTRACTOR_HEURISTIC_NOTE = "Heuristic path classification normalizes case and path separators, then matches conservative keyword groups; confirm unusual repo layouts manually.";
 export declare function normalizeExtractorPath(path: string): string;
+export declare function pathTokens(normalized: string): string[];
 export declare function isNodeModulesOrGit(normalized: string): boolean;
 export declare function isBuildOutput(normalized: string): boolean;
 export declare function isVendorPath(normalized: string): boolean;
@@ -20,6 +21,7 @@ export declare function isInterfacePath(normalized: string): boolean;
 export declare function isDataLayerPath(normalized: string): boolean;
 export declare function isSecuritySensitivePath(normalized: string): boolean;
 export declare function isConcurrencyPath(normalized: string): boolean;
+export declare function isExamplesOrFixturesPath(normalized: string): boolean;
 export declare function isScriptPath(normalized: string): boolean;
 export declare function isDeploymentConfigPath(normalized: string): boolean;
 export declare function isGeneratedPath(normalized: string): boolean;

package/dist/extractors/pathPatterns.js

@@ -32,11 +32,17 @@ const SECURITY_KEYWORDS = [
 ];
 const CONCURRENCY_KEYWORDS = [
     "queue",
+    "queues",
     "worker",
+    "workers",
     "job",
+    "jobs",
     "cache",
+    "caches",
     "retry",
+    "retries",
     "lock",
+    "locks",
 ];
 const SCRIPT_KEYWORDS = ["script"];
 const DEPLOYMENT_KEYWORDS = [
@@ -75,7 +81,7 @@ function baseName(normalized) {
     const segments = splitSegments(normalized);
     return segments.at(-1) ?? normalized;
 }
-function pathTokens(normalized) {
+export function pathTokens(normalized) {
     return normalized.split(/[^a-z0-9]+/).filter(Boolean);
 }
 function hasToken(normalized, values) {
@@ -131,7 +137,10 @@ export function isSecuritySensitivePath(normalized) {
     return includesAny(normalized, SECURITY_KEYWORDS);
 }
 export function isConcurrencyPath(normalized) {
-    return includesAny(normalized, CONCURRENCY_KEYWORDS);
+    return hasToken(normalized, CONCURRENCY_KEYWORDS);
+}
+export function isExamplesOrFixturesPath(normalized) {
+    return hasSegment(normalized, "examples") || hasSegment(normalized, "fixtures");
 }
 export function isScriptPath(normalized) {
     return (includesAny(normalized, SCRIPT_KEYWORDS) ||

package/dist/orchestrator/unitBuilder.js

@@ -1,5 +1,6 @@
 import { bucketFile } from "../extractors/bucketing.js";
 import { isAuditExcludedStatus } from "../extractors/disposition.js";
+import { pathTokens, normalizeExtractorPath } from "../extractors/pathPatterns.js";
 const LENS_MAP = {
     runtime: ["correctness", "maintainability", "tests"],
     interface: ["correctness", "security", "reliability", "tests"],
@@ -50,13 +51,20 @@ function inferUnitId(path, kind) {
     if ((parts[0] === "tests" || parts[0] === "test") && parts.length >= 2) {
         return `tests-${parts[1]}`.replace(/[^a-zA-Z0-9_-]/g, "-");
     }
-    if (parts.length >= 2) {
+    if (parts.length >= 3) {
         return `${parts[0]}-${parts[1]}`.replace(/[^a-zA-Z0-9_-]/g, "-");
     }
-    if (normalized.includes("docker") ||
+    if (parts.length === 2) {
+        return parts[0].replace(/[^a-zA-Z0-9_-]/g, "-");
+    }
+    if (normalized.endsWith(".json") ||
+        normalized.endsWith(".yaml") ||
         normalized.endsWith(".yml") ||
-        normalized.endsWith(".yaml")) {
-        return "infra-config";
+        normalized.endsWith(".toml") ||
+        normalized.endsWith(".sh") ||
+        normalized.includes("docker") ||
+        normalized.startsWith(".")) {
+        return "root-config";
     }
     return `${kind}-${path.replace(/[^a-zA-Z0-9_-]/g, "-")}`;
 }
@@ -75,6 +83,16 @@ function sortLenses(lenses) {
     const set = new Set(lenses);
     return LENS_ORDER.filter((lens) => set.has(lens));
 }
+function applyExtensionLensGuards(path, lenses) {
+    const n = path.toLowerCase();
+    if (n.endsWith(".schema.json") || n.endsWith(".schema.ts")) {
+        return lenses.filter((l) => l === "data_integrity");
+    }
+    if (n.endsWith(".json") || n.endsWith(".yaml") || n.endsWith(".yml")) {
+        return lenses.filter((l) => l !== "tests" && l !== "performance");
+    }
+    return lenses;
+}
 export function deriveRequiredLensesForPath(path) {
     const assignment = bucketFile(path);
     const required = new Set();
@@ -83,29 +101,25 @@ export function deriveRequiredLensesForPath(path) {
             required.add(lens);
         }
     }
-    return sortLenses(required);
+    return applyExtensionLensGuards(path, sortLenses(required));
 }
 function inferCriticalFlows(files, requiredLenses) {
     const flows = new Set();
-    const combined = files.join(" ").toLowerCase();
-    if (combined.includes("auth") ||
-        combined.includes("session") ||
-        combined.includes("token")) {
+    const tokens = new Set(files.flatMap((f) => pathTokens(normalizeExtractorPath(f))));
+    if (tokens.has("auth") || tokens.has("session") || tokens.has("token")) {
         flows.add("auth-session");
     }
-    if (combined.includes("billing") ||
-        combined.includes("invoice") ||
-        combined.includes("payment")) {
+    if (tokens.has("billing") || tokens.has("invoice") || tokens.has("payment")) {
         flows.add("billing-payment");
     }
-    if (combined.includes("queue") ||
-        combined.includes("worker") ||
-        combined.includes("job") ||
+    if (tokens.has("queue") ||
+        tokens.has("worker") ||
+        tokens.has("job") ||
         requiredLenses.includes("reliability")) {
         flows.add("async-processing");
     }
-    if (combined.includes("deploy") ||
-        combined.includes("docker") ||
+    if (tokens.has("deploy") ||
+        tokens.has("docker") ||
         requiredLenses.includes("config_deployment")) {
         flows.add("deployment-config");
     }

package/dist/prompts/renderWorkerPrompt.js

@@ -26,9 +26,11 @@ export function renderWorkerPrompt(task) {
             "     If the task includes file_line_counts, use those values for file_coverage.total_lines.",
             "     total_lines must match the file's current total line count.",
             "     Each finding must include:",
-            "       id, title, category, severity, confidence, lens, summary, affected_files,",
-            "       evidence (an array of plain strings only, at least one excerpt or line reference from the file you read)",
+            "       id, title, category, severity, confidence, lens, summary",
+            "       affected_files: [{path, line_start?, line_end?, symbol?}] — path is repo-relative, NOT a plain string",
+            "       evidence: array of plain strings only, at least one excerpt or line reference from the file you read",
             "       Example evidence entry: src/foo.ts:42 - variable overwritten before use",
+            "       Example affected_files entry: {\"path\": \"src/foo.ts\", \"line_start\": 42, \"line_end\": 55, \"symbol\": \"myFunction\"}",
             "     Optional finding fields: impact, likelihood, reproduction, systemic, related_findings",
             "     Low-priority tasks still require a real review. Use findings: [] only when you genuinely found nothing notable.",
             task.timeout_ms

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "auditor-lambda",
-  "version": "0.2.14",
+  "version": "0.2.15",
   "private": false,
   "description": "Portable hybrid code-auditing framework for arbitrary repositories.",
   "type": "module",