auditor-lambda 0.3.4 → 0.3.6

package/audit-code-wrapper-lib.mjs

@@ -260,9 +260,11 @@ function printHelp({ usageName, preferredEntrypoint }) {
     '- validate checks the current artifact bundle plus session-config/provider readiness and exits non-zero when issues exist',
     '- validate-results --results FILE validates AuditResult payloads against the active task manifest without ingesting them',
     '- explain-task <task_id> prints the resolved file coverage and current status for a task id',
-    '- prepare-dispatch --run-id <id> [--artifacts-dir <dir>] creates per-task prompt files and dispatch-plan.json for parallel subagent dispatch',
-    '- merge-and-ingest --run-id <id> [--root <dir>] [--artifacts-dir <dir>] merges per-task results and ingests them into the coverage matrix',
+    '- prepare-dispatch --run-id <id> [--artifacts-dir <dir>] creates packet prompt files and a slim dispatch-plan.json for parallel subagent dispatch',
+    '- submit-packet --run-id <id> --packet-id <id> [--artifacts-dir <dir>] validates AuditResult[] from stdin and writes only backend-assigned result files',
+    '- merge-and-ingest --run-id <id> [--root <dir>] [--artifacts-dir <dir>] merges assigned packet results and ingests them into the coverage matrix',
     '- validate-result --run-id <id> --task-id <id> [--artifacts-dir <dir>] validates a single task result against the schema and line counts',
+    '  generated packet prompts may use --run-id-b64, --task-id-b64, and --artifacts-dir-b64 to avoid shell-sensitive raw ids',
     '',
     'Primary usage:',
     '- from the repository root, run the wrapper with no arguments',
@@ -405,6 +407,42 @@ async function writeGeneratedJson(targetPath, value) {
   };
 }
 
+async function readJsonObjectIfExists(targetPath, description) {
+  if (!(await fileExists(targetPath))) {
+    return {};
+  }
+
+  let parsed;
+  try {
+    parsed = JSON.parse(await readFile(targetPath, 'utf8'));
+  } catch (error) {
+    throw new Error(
+      `${description} exists but is not valid JSON: ${error instanceof Error ? error.message : String(error)}`,
+    );
+  }
+
+  if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+    throw new Error(`${description} must be a JSON object when it already exists.`);
+  }
+
+  return parsed;
+}
+
+async function writeMergedGeneratedJson(targetPath, description, buildValue) {
+  const existed = await fileExists(targetPath);
+  const existing = await readJsonObjectIfExists(targetPath, description);
+  await mkdir(dirname(targetPath), { recursive: true });
+  await writeFile(
+    targetPath,
+    JSON.stringify(buildValue(existing), null, 2) + '\n',
+    'utf8',
+  );
+  return {
+    path: targetPath,
+    mode: existed ? 'updated' : 'created',
+  };
+}
+
 async function writeGeneratedBinary(targetPath, content) {
   const existed = await fileExists(targetPath);
   await mkdir(dirname(targetPath), { recursive: true });
@@ -479,70 +517,99 @@ function renderCodexAutomationRecipe() {
 
 function renderOpenCodeProjectConfig(root) {
   const launcher = replaceBackslashes(toRepoRelativePath(root, join(root, '.audit-code', 'install', MCP_LAUNCHER_FILENAME)));
-  return JSON.stringify(
-    {
-      $schema: 'https://opencode.ai/config.json',
-      mcp: {
-        auditor: {
-          type: 'local',
-          command: ['node', launcher],
-          enabled: true,
-          timeout: 10000,
-        },
+  return {
+    $schema: 'https://opencode.ai/config.json',
+    mcp: {
+      auditor: {
+        type: 'local',
+        command: ['node', launcher],
+        enabled: true,
+        timeout: 10000,
       },
-      permission: {
-        read: 'allow',
-        glob: 'allow',
-        grep: 'allow',
-        edit: 'ask',
-        bash: {
-          '*': 'ask',
-          'git status*': 'allow',
-          'git diff*': 'allow',
-          'grep *': 'allow',
-          'rm *': 'deny',
-        },
+    },
+    permission: {
+      read: 'allow',
+      glob: 'allow',
+      grep: 'allow',
+      edit: 'ask',
+      bash: {
+        '*': 'ask',
+        'git status*': 'allow',
+        'git diff*': 'allow',
+        'grep *': 'allow',
+        'rm *': 'deny',
       },
-      agent: {
-        auditor: {
-          description:
-            'Read-heavy audit orchestration agent for the /audit-code workflow.',
-          tools: {
-            'auditor*': true,
-          },
-          permission: {
-            edit: 'ask',
-            bash: {
-              '*': 'ask',
-              'git status*': 'allow',
-              'git diff*': 'allow',
-              'grep *': 'allow',
-              'rm *': 'deny',
-            },
-            question: 'allow',
+    },
+    agent: {
+      auditor: {
+        description:
+          'Read-heavy audit orchestration agent for the /audit-code workflow.',
+        tools: {
+          'auditor*': true,
+        },
+        permission: {
+          edit: 'ask',
+          bash: {
+            '*': 'ask',
+            'git status*': 'allow',
+            'git diff*': 'allow',
+            'grep *': 'allow',
+            'rm *': 'deny',
           },
+          question: 'allow',
         },
       },
     },
-    null,
-    2,
-  ) + '\n';
+  };
 }
 
 function renderVSCodeMcpConfig() {
-  return JSON.stringify(
-    {
-      servers: {
-        auditor: {
-          type: 'stdio',
-          command: 'node',
-          args: ['${workspaceFolder}/.audit-code/install/run-mcp-server.mjs'],
-        },
+  return {
+    servers: {
+      auditor: {
+        type: 'stdio',
+        command: 'node',
+        args: ['${workspaceFolder}/.audit-code/install/run-mcp-server.mjs'],
       },
     },
-    null,
-    2,
-  ) + '\n';
+  };
+}
+
+function objectValue(value) {
+  return value && typeof value === 'object' && !Array.isArray(value)
+    ? value
+    : {};
+}
+
+function buildMergedOpenCodeProjectConfig(existing, root) {
+  const generated = renderOpenCodeProjectConfig(root);
+  return {
+    ...existing,
+    $schema: existing.$schema ?? generated.$schema,
+    mcp: {
+      ...objectValue(existing.mcp),
+      auditor: generated.mcp.auditor,
+    },
+    permission:
+      existing.permission && typeof existing.permission === 'object' && !Array.isArray(existing.permission)
+        ? existing.permission
+        : generated.permission,
+    agent: {
+      ...objectValue(existing.agent),
+      auditor: generated.agent.auditor,
+    },
+  };
+}
+
+function buildMergedVSCodeMcpConfig(existing) {
+  const generated = renderVSCodeMcpConfig();
+  return {
+    ...existing,
+    servers: {
+      ...objectValue(existing.servers),
+      auditor: generated.servers.auditor,
+    },
+  };
 }
 
 function renderClaudeDesktopProjectTemplate() {
@@ -930,116 +997,203 @@ async function buildClaudeDesktopBundle(root, results) {
   };
 }
 
-function buildHostCatalog({ root, host, assets }) {
-  const entries = {
-    codex: {
-      host: 'codex',
-      label: 'Codex',
-      support_level: 'supported',
-      setup_kind: 'skills+mcp+instructions',
-      summary:
-        'Use the generated Codex skill bundle, AGENTS instructions, and shared MCP launcher so Codex can drive the backend through native tools instead of raw shell commands.',
-      primary_path: assets.codexSkillPath,
-      supporting_paths: [
-        assets.agentsInstructionsPath,
-        assets.codexMcpSetupPath,
-        assets.codexAutomationRecipePath,
-      ].filter(Boolean),
-      steps: [
-        'Open this repository in Codex.',
-        'Ensure Codex can access the repo-local auditor MCP server using the generated setup guide.',
-        'Ask Codex to use the auditor MCP tools to start or continue `/audit-code`.',
-      ],
+const INSTALL_PROFILE_FLAGS = [
+  'writeVSCode',
+  'writeCopilotInstructions',
+  'writeOpenCode',
+  'writeCodex',
+  'writeClaudeDesktop',
+  'writeAntigravity',
+  'writeAgents',
+];
+
+const INSTALL_HOST_ORDER = [
+  'codex',
+  'claude-desktop',
+  'opencode',
+  'vscode',
+  'antigravity',
+];
+
+const INSTALL_HOST_DEFINITIONS = {
+  codex: {
+    host: 'codex',
+    label: 'Codex',
+    support_level: 'supported',
+    setup_kind: 'skills+mcp+instructions',
+    summary:
+      'Use the generated Codex skill bundle, AGENTS instructions, and shared MCP launcher so Codex can drive the backend through native tools instead of raw shell commands.',
+    primary_path_key: 'codexSkillPath',
+    supporting_path_keys: [
+      'agentsInstructionsPath',
+      'codexMcpSetupPath',
+      'codexAutomationRecipePath',
+    ],
+    steps: [
+      'Open this repository in Codex.',
+      'Ensure Codex can access the repo-local auditor MCP server using the generated setup guide.',
+      'Ask Codex to use the auditor MCP tools to start or continue `/audit-code`.',
+    ],
+    profile: {
+      writeCodex: true,
+      writeAgents: true,
     },
-    'claude-desktop': {
-      host: 'claude-desktop',
-      label: 'Claude Desktop',
-      support_level: 'supported',
-      setup_kind: 'local-mcp-bundle',
-      summary:
-        'Install the generated local MCP bundle in Claude Desktop, then use the project template and prompt asset as supporting context.',
-      primary_path: assets.claudeDesktopDxtPath,
-      supporting_paths: [
-        assets.claudeDesktopMcpbPath,
-        assets.claudeDesktopProjectTemplatePath,
-        assets.claudeDesktopRemoteConnectorPath,
-        assets.installedPromptPath,
-      ].filter(Boolean),
-      steps: [
-        'Open Claude Desktop Settings and install the generated `.dxt` bundle.',
-        'Configure the repository root when prompted so the bundle can launch the local auditor MCP server.',
-        'Use the project template and prompt asset to kick off `/audit-code` in conversation.',
-      ],
+  },
+  'claude-desktop': {
+    host: 'claude-desktop',
+    label: 'Claude Desktop',
+    support_level: 'supported',
+    setup_kind: 'local-mcp-bundle',
+    summary:
+      'Install the generated local MCP bundle in Claude Desktop, then use the project template and prompt asset as supporting context.',
+    primary_path_key: 'claudeDesktopDxtPath',
+    supporting_path_keys: [
+      'claudeDesktopMcpbPath',
+      'claudeDesktopProjectTemplatePath',
+      'claudeDesktopRemoteConnectorPath',
+      'installedPromptPath',
+    ],
+    steps: [
+      'Open Claude Desktop Settings and install the generated `.dxt` bundle.',
+      'Configure the repository root when prompted so the bundle can launch the local auditor MCP server.',
+      'Use the project template and prompt asset to kick off `/audit-code` in conversation.',
+    ],
+    profile: {
+      writeClaudeDesktop: true,
     },
-    opencode: {
-      host: 'opencode',
-      label: 'OpenCode',
-      support_level: 'supported',
-      setup_kind: 'command+agent+mcp',
-      summary:
-        'Use the generated OpenCode command and project config so `/audit-code` and the local auditor MCP server are available together.',
-      primary_path: assets.opencodeCommandPath,
-      supporting_paths: [
-        assets.opencodeConfigPath,
-        assets.opencodeSkillPath,
-        assets.agentsInstructionsPath,
-        assets.mcpLauncherPath,
-      ].filter(Boolean),
-      steps: [
-        'Open this repository in OpenCode.',
-        'Let OpenCode load the generated `opencode.json` so the auditor MCP server is available.',
-        'Invoke `/audit-code` and keep the audit loop on the auditor MCP tools.',
-      ],
+  },
+  opencode: {
+    host: 'opencode',
+    label: 'OpenCode',
+    support_level: 'supported',
+    setup_kind: 'command+agent+mcp',
+    summary:
+      'Use the generated OpenCode command and project config so `/audit-code` and the local auditor MCP server are available together.',
+    primary_path_key: 'opencodeCommandPath',
+    supporting_path_keys: [
+      'opencodeConfigPath',
+      'opencodeSkillPath',
+      'agentsInstructionsPath',
+      'mcpLauncherPath',
+    ],
+    steps: [
+      'Open this repository in OpenCode.',
+      'Let OpenCode load the generated `opencode.json` so the auditor MCP server is available.',
+      'Invoke `/audit-code` and keep the audit loop on the auditor MCP tools.',
+    ],
+    profile: {
+      writeOpenCode: true,
+      writeAgents: true,
     },
-    vscode: {
-      host: 'vscode',
-      label: 'VS Code',
-      support_level: 'supported',
-      setup_kind: 'prompt+agent+mcp',
-      summary:
-        'Use the generated prompt file, custom agent, and workspace MCP configuration for the cleanest VS Code integration.',
-      primary_path: assets.vscodePromptPath,
-      supporting_paths: [
-        assets.vscodeAgentPath,
-        assets.vscodeMcpConfigPath,
-        assets.copilotInstructionsPath,
-      ].filter(Boolean),
-      steps: [
-        'Open this repository in VS Code with Copilot.',
-        'Allow VS Code to discover the workspace MCP server from `.vscode/mcp.json`.',
-        'Invoke `/audit-code` in chat and use the custom auditor agent when you want the dedicated orchestration persona.',
-      ],
+  },
+  vscode: {
+    host: 'vscode',
+    label: 'VS Code',
+    support_level: 'supported',
+    setup_kind: 'prompt+agent+mcp',
+    summary:
+      'Use the generated prompt file, custom agent, and workspace MCP configuration for the cleanest VS Code integration.',
+    primary_path_key: 'vscodePromptPath',
+    supporting_path_keys: [
+      'vscodeAgentPath',
+      'vscodeMcpConfigPath',
+      'copilotInstructionsPath',
+    ],
+    steps: [
+      'Open this repository in VS Code with Copilot.',
+      'Allow VS Code to discover the workspace MCP server from `.vscode/mcp.json`.',
+      'Invoke `/audit-code` in chat and use the custom auditor agent when you want the dedicated orchestration persona.',
+    ],
+    profile: {
+      writeVSCode: true,
+      writeCopilotInstructions: true,
     },
-    antigravity: {
-      host: 'antigravity',
-      label: 'Antigravity',
-      support_level: 'guided',
-      setup_kind: 'planning-guide+mcp-ready',
-      summary:
-        'Start in Planning mode with the generated guide and AGENTS instructions, then use the shared MCP launcher once Antigravity is ready to call structured tools.',
-      primary_path: assets.antigravityPlanningGuidePath,
-      supporting_paths: [
-        assets.agentsInstructionsPath,
-        assets.mcpLauncherPath,
-        assets.installedPromptPath,
-      ].filter(Boolean),
-      steps: [
-        'Open this repository in Antigravity Planning mode.',
-        'Load the generated planning guide and AGENTS instructions before starting the audit.',
-        'Use the shared auditor MCP server when Antigravity needs structured audit state instead of free-form shell guesses.',
-      ],
+  },
+  antigravity: {
+    host: 'antigravity',
+    label: 'Antigravity',
+    support_level: 'guided',
+    setup_kind: 'planning-guide+mcp-ready',
+    summary:
+      'Start in Planning mode with the generated guide and AGENTS instructions, then use the shared MCP launcher once Antigravity is ready to call structured tools.',
+    primary_path_key: 'antigravityPlanningGuidePath',
+    supporting_path_keys: [
+      'agentsInstructionsPath',
+      'mcpLauncherPath',
+      'installedPromptPath',
+    ],
+    steps: [
+      'Open this repository in Antigravity Planning mode.',
+      'Load the generated planning guide and AGENTS instructions before starting the audit.',
+      'Use the shared auditor MCP server when Antigravity needs structured audit state instead of free-form shell guesses.',
+    ],
+    profile: {
+      writeAntigravity: true,
+      writeAgents: true,
     },
-  };
+  },
+};
+
+function supportedInstallHostsMessage() {
+  return ['all', 'copilot', ...INSTALL_HOST_ORDER].join(', ');
+}
+
+function getInstallHostKeys(host) {
+  if (host === 'all') {
+    return INSTALL_HOST_ORDER;
+  }
+
+  if (host === 'copilot') {
+    return ['vscode'];
+  }
 
-  const hostOrder = host === 'all'
-    ? ['codex', 'claude-desktop', 'opencode', 'vscode', 'antigravity']
-    : host === 'copilot'
-      ? ['vscode']
-      : [host];
+  if (INSTALL_HOST_DEFINITIONS[host]) {
+    return [host];
+  }
+
+  throw new Error(
+    `Unsupported host "${host}". Supported hosts: ${supportedInstallHostsMessage()}.`,
+  );
+}
+
+function getInstallProfile(host) {
+  const profile = Object.fromEntries(
+    INSTALL_PROFILE_FLAGS.map((flag) => [flag, false]),
+  );
+
+  for (const hostKey of getInstallHostKeys(host)) {
+    const hostProfile = INSTALL_HOST_DEFINITIONS[hostKey].profile;
+    for (const flag of INSTALL_PROFILE_FLAGS) {
+      profile[flag] = profile[flag] || Boolean(hostProfile[flag]);
+    }
+  }
+
+  return profile;
+}
+
+function buildHostCatalog({ root, host, assets }) {
+  return getInstallHostKeys(host)
+    .map((hostKey) => {
+      const definition = INSTALL_HOST_DEFINITIONS[hostKey];
+      const primaryPath = assets[definition.primary_path_key];
+      if (!primaryPath) {
+        return null;
+      }
 
-  return hostOrder
-    .map((hostKey) => entries[hostKey])
-    .filter((entry) => entry?.primary_path)
+      return {
+        host: definition.host,
+        label: definition.label,
+        support_level: definition.support_level,
+        setup_kind: definition.setup_kind,
+        summary: definition.summary,
+        primary_path: primaryPath,
+        supporting_paths: definition.supporting_path_keys
+          .map((key) => assets[key])
+          .filter(Boolean),
+        steps: definition.steps,
+      };
+    })
+    .filter(Boolean)
     .map((entry) => ({
       ...entry,
       primary_path: entry.primary_path,
@@ -1100,6 +1254,7 @@ function renderInstallGuide({
   lines.push('', 'Backend fallback:');
   lines.push('- from the repository root, run `audit-code` only when you intentionally need the repo-local backend wrapper');
   lines.push('- run `audit-code verify-install` after bootstrap when you want to smoke-test the generated launchers and host configs');
+  lines.push('- rerun `audit-code install` to refresh every generated host surface from the shared prompt, skill, and MCP launcher assets together');
 
   if (host !== 'all') {
     lines.push('');
@@ -1110,85 +1265,6 @@ function renderInstallGuide({
   return lines.join('\n');
 }
 
-function getInstallProfile(host) {
-  switch (host) {
-    case 'all':
-      return {
-        writeVSCode: true,
-        writeCopilotInstructions: true,
-        writeOpenCode: true,
-        writeCodex: true,
-        writeClaudeDesktop: true,
-        writeAntigravity: true,
-        writeAgents: true,
-      };
-    case 'copilot':
-      return {
-        writeVSCode: true,
-        writeCopilotInstructions: true,
-        writeAgents: false,
-        writeOpenCode: false,
-        writeCodex: false,
-        writeClaudeDesktop: false,
-        writeAntigravity: false,
-      };
-    case 'vscode':
-      return {
-        writeVSCode: true,
-        writeCopilotInstructions: true,
-        writeAgents: false,
-        writeOpenCode: false,
-        writeCodex: false,
-        writeClaudeDesktop: false,
-        writeAntigravity: false,
-      };
-    case 'opencode':
-      return {
-        writeVSCode: false,
-        writeCopilotInstructions: false,
-        writeAgents: true,
-        writeOpenCode: true,
-        writeCodex: false,
-        writeClaudeDesktop: false,
-        writeAntigravity: false,
-      };
-    case 'codex':
-      return {
-        writeVSCode: false,
-        writeCopilotInstructions: false,
-        writeAgents: true,
-        writeOpenCode: false,
-        writeCodex: true,
-        writeClaudeDesktop: false,
-        writeAntigravity: false,
-      };
-    case 'claude-desktop':
-      return {
-        writeVSCode: false,
-        writeCopilotInstructions: false,
-        writeAgents: false,
-        writeOpenCode: false,
-        writeCodex: false,
-        writeClaudeDesktop: true,
-        writeAntigravity: false,
-      };
-    case 'antigravity':
-      return {
-        writeVSCode: false,
-        writeCopilotInstructions: false,
-        writeAgents: true,
-        writeOpenCode: false,
-        writeCodex: false,
-        writeClaudeDesktop: false,
-        writeAntigravity: true,
-      };
-    default:
-      throw new Error(
-        `Unsupported host "${host}". Supported hosts: all, copilot, vscode, opencode, codex, claude-desktop, antigravity.`,
-      );
-  }
-}
-
 async function assertDirectoryExists(path, description) {
   let stats;
   try {
@@ -1510,7 +1586,7 @@ async function verifyInstalledBootstrap(argv) {
     (installManifest.hosts ?? []).map((entry) => [entry.host, entry]),
   );
   const selectedHosts = requestedHost && requestedHost !== 'all'
-    ? [requestedHost]
+    ? getInstallHostKeys(requestedHost)
     : [...hostCatalog.keys()];
 
   await collectVerifyCheck(generalChecks, 'install_guide', async () => {
@@ -2054,9 +2130,10 @@ async function installBootstrap(argv) {
       ),
     );
     results.push(
-      await writeGeneratedMarkdown(
+      await writeMergedGeneratedJson(
         assetPaths.opencodeConfigPath,
-        renderOpenCodeProjectConfig(root),
+        'OpenCode project config',
+        (existing) => buildMergedOpenCodeProjectConfig(existing, root),
       ),
     );
   }
@@ -2082,9 +2159,10 @@ async function installBootstrap(argv) {
       ),
     );
     results.push(
-      await writeGeneratedMarkdown(
+      await writeMergedGeneratedJson(
         assetPaths.vscodeMcpConfigPath,
-        renderVSCodeMcpConfig(),
+        'VS Code MCP config',
+        buildMergedVSCodeMcpConfig,
       ),
     );
   }
@@ -2114,6 +2192,7 @@ async function installBootstrap(argv) {
     install_manifest_path: installManifestPath,
     mcp_server_launcher_path: mcpLauncherPath,
     source_prompt_path: resolve(promptAssetPath),
+    source_skill_path: resolve(skillAssetPath),
     asset_paths: assetPaths,
     hosts: hostGuidance,
   };
@@ -2153,6 +2232,7 @@ async function installBootstrap(argv) {
         install_manifest_path: installManifestPath,
         mcp_server_launcher_path: mcpLauncherPath,
         source_prompt_path: resolve(promptAssetPath),
+        source_skill_path: resolve(skillAssetPath),
         files: results,
         slash_command_surfaces: {
           vscode_prompt: assetPaths.vscodePromptPath,
@@ -2281,6 +2361,11 @@ export async function runAuditCodeWrapper({
     return;
   }
 
+  if (argv[0] === 'submit-packet') {
+    await runDistCommand('submit-packet', argv.slice(1));
+    return;
+  }
+
   if (argv[0] === 'merge-and-ingest') {
     await runDistCommand('merge-and-ingest', argv.slice(1), { ensureArtifactsDir: true });
     return;