auditor-lambda 0.3.37 → 0.3.39

package/dist/quota/scheduler.js

@@ -7,7 +7,7 @@ function sumTopN(sorted, n) {
     return sum;
 }
 export function scheduleWave(options) {
-    const { providerName, sessionConfig, hostModel, requestedConcurrency, estimatedSlotTokens, estimatedPacketTokens = 0, quotaStateEntry = null, hostConcurrencyLimit = null, quotaSourceSnapshot = null, } = options;
+    const { providerName, sessionConfig, hostModel, requestedConcurrency, estimatedSlotTokens, estimatedPacketTokens = 0, quotaStateEntry = null, hostConcurrencyLimit = null, quotaSourceSnapshot = null, discoveredLimits = null, } = options;
     // Descending sort so sumTopN picks the largest slots
     const slotsSorted = estimatedSlotTokens
         ? [...estimatedSlotTokens].sort((a, b) => b - a)
@@ -44,6 +44,12 @@ export function scheduleWave(options) {
     const safetyMargin = quota.safety_margin ?? 0.8;
     const halfLifeHours = quota.empirical_half_life_hours ?? 24;
     const { limits, source, confidence } = resolveLimits({ providerName, sessionConfig, hostModel });
+    // Fill null RPM/TPM from discovered limits (provider query or header extraction)
+    if (discoveredLimits) {
+        limits.requests_per_minute ??= discoveredLimits.requests_per_minute ?? null;
+        limits.input_tokens_per_minute ??= discoveredLimits.input_tokens_per_minute ?? null;
+        limits.output_tokens_per_minute ??= discoveredLimits.output_tokens_per_minute ?? null;
+    }
     let waveSize = requestedConcurrency;
     let cooldownUntil = null;
     // Respect an active cooldown period
@@ -93,6 +99,17 @@ export function scheduleWave(options) {
             else if (typeof fallbackCap === "number" && Number.isFinite(fallbackCap)) {
                 waveSize = Math.min(waveSize, Math.max(1, Math.floor(fallbackCap)));
             }
+            // First-contact cap: when no learned history, no configured fallback, AND
+            // no RPM/TPM limits from any source, apply a conservative ceiling.
+            // This triggers only for unconfigured local providers (fallbackCap is
+            // undefined). Hosted providers default to 1 via unknown_hosted_concurrency,
+            // and "unlimited" is an explicit opt-out.
+            if (fallbackCap == null &&
+                limits.requests_per_minute == null &&
+                limits.input_tokens_per_minute == null) {
+                const firstContactCap = quota.first_contact_concurrency ?? 3;
+                waveSize = Math.min(waveSize, Math.max(1, firstContactCap));
+            }
         }
     }
     // Apply real-time quota source data if available

package/dist/reporting/mergeFindings.d.ts

@@ -1,4 +1,5 @@
 import type { AuditResult, Finding } from "../types.js";
+import type { DesignAssessment } from "../types/designAssessment.js";
 import type { ExternalAnalyzerResults } from "../types/externalAnalyzer.js";
 import type { RuntimeValidationReport } from "../types/runtimeValidation.js";
-export declare function mergeFindings(results: AuditResult[], runtimeReport?: RuntimeValidationReport, externalAnalyzerResults?: ExternalAnalyzerResults): Finding[];
+export declare function mergeFindings(results: AuditResult[], runtimeReport?: RuntimeValidationReport, externalAnalyzerResults?: ExternalAnalyzerResults, designAssessment?: DesignAssessment): Finding[];

package/dist/reporting/mergeFindings.js

@@ -236,8 +236,20 @@ function relevantExternalEvidence(finding, results) {
         .filter((item) => findingPaths.has(item.path))
         .map((item) => `external:${results.tool}:${item.path}:${item.summary}`);
 }
-export function mergeFindings(results, runtimeReport, externalAnalyzerResults) {
+export function mergeFindings(results, runtimeReport, externalAnalyzerResults, designAssessment) {
     const merged = new Map();
+    const allDesignFindings = [
+        ...(designAssessment?.findings ?? []),
+        ...(designAssessment?.review_findings ?? []),
+    ];
+    for (const finding of allDesignFindings) {
+        const key = findingKey(finding);
+        merged.set(key, {
+            ...finding,
+            affected_files: [...finding.affected_files],
+            evidence: [...(finding.evidence ?? [])],
+        });
+    }
     for (const result of results) {
         for (const finding of result.findings) {
             const key = findingKey(finding);

package/dist/reporting/synthesis.d.ts

@@ -1,4 +1,5 @@
 import type { AuditResult, CoverageMatrix, Finding, UnitManifest } from "../types.js";
+import type { DesignAssessment } from "../types/designAssessment.js";
 import type { ExternalAnalyzerResults } from "../types/externalAnalyzer.js";
 import type { CriticalFlowManifest } from "../types/flows.js";
 import type { GraphBundle } from "../types/graph.js";
@@ -25,5 +26,6 @@ export declare function buildAuditReportModel(params: {
     coverageMatrix?: CoverageMatrix;
     runtimeValidationReport?: RuntimeValidationReport;
     externalAnalyzerResults?: ExternalAnalyzerResults;
+    designAssessment?: DesignAssessment;
 }): AuditReportModel;
 export declare function renderAuditReportMarkdown(model: AuditReportModel): string;

package/dist/reporting/synthesis.js

@@ -32,7 +32,7 @@ function formatSeverityList(summary) {
     return parts.length > 0 ? parts.join(", ") : "none";
 }
 export function buildAuditReportModel(params) {
-    const findings = mergeFindings(params.results, params.runtimeValidationReport, params.externalAnalyzerResults);
+    const findings = mergeFindings(params.results, params.runtimeValidationReport, params.externalAnalyzerResults, params.designAssessment);
     const workBlocks = buildWorkBlocks({
         findings,
         unitManifest: params.unitManifest,

package/dist/types/designAssessment.d.ts

@@ -0,0 +1,7 @@
+import type { Finding } from "../types.js";
+export interface DesignAssessment {
+    generated_at: string;
+    findings: Finding[];
+    review_findings?: Finding[];
+    reviewed?: boolean;
+}

package/dist/types/designAssessment.js

@@ -0,0 +1 @@
+export {};

package/dist/types/sessionConfig.d.ts

@@ -46,6 +46,9 @@ export interface QuotaConfig {
     empirical_half_life_hours?: number;
     /** Allow the scheduler to try concurrency maxSafe+1 after consecutive successes (default: true). */
     ramp_up_enabled?: boolean;
+    /** Conservative concurrency cap for the first wave when no learned history
+     *  and no discovered RPM/TPM limits exist (default: 3). */
+    first_contact_concurrency?: number;
     /** Hard host ceiling for simultaneously active conversation subagents. */
     host_active_subagent_limit?: number;
     /** Per-model overrides keyed by "provider/model". */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "auditor-lambda",
-  "version": "0.3.37",
+  "version": "0.3.39",
   "private": false,
   "description": "Portable hybrid code-auditing framework for arbitrary repositories.",
   "type": "module",