auditor-lambda 0.3.40 → 0.3.41

package/audit-code-wrapper-lib.mjs

@@ -1,6 +1,7 @@
 import { access, cp, mkdir, open, readFile, readdir, stat, unlink, writeFile } from 'node:fs/promises';
 import { constants } from 'node:fs';
 import { spawn } from 'node:child_process';
+import { createRequire } from 'node:module';
 import { dirname, join, relative, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
@@ -681,7 +682,6 @@ const OPENCODE_AUDIT_BASH_PERMISSION = {
   'git status*': 'allow',
   'git diff*': 'allow',
   'grep *': 'allow',
-  'Select-String *': 'allow',
   'rm *': 'deny',
 };
 
@@ -849,7 +849,6 @@ function assertOpenCodeAuditPermissionConfig(permissionConfig, label) {
     '*audit-code.mjs* worker-run*',
     '*node* *auditor-lambda*dist*index.js* worker-run*',
     'node* .audit-code/install/run-mcp-server.mjs*',
-    'Select-String *',
   ]) {
     if (bash[pattern] !== 'allow') {
       throw new Error(`OpenCode ${label}.bash must allow ${pattern}. Run "audit-code install --host opencode".`);
@@ -1217,6 +1216,21 @@ async function buildClaudeDesktopBundle(root, results) {
   await writeFile(join(bundleRoot, 'audit-code-wrapper-lib.mjs'), await readFile(join(repoRoot, 'audit-code-wrapper-lib.mjs')));
   await writeFile(join(bundleRoot, 'package.json'), await readFile(join(repoRoot, 'package.json')));
 
+  try {
+    const req = createRequire(join(repoRoot, 'package.json'));
+    const sharedEntry = req.resolve('@audit-tools/shared');
+    let sharedRoot = dirname(sharedEntry);
+    while (sharedRoot !== dirname(sharedRoot) && !(await fileExists(join(sharedRoot, 'package.json')))) {
+      sharedRoot = dirname(sharedRoot);
+    }
+    const bundleSharedRoot = join(bundleRoot, 'node_modules', '@audit-tools', 'shared');
+    await mkdir(bundleSharedRoot, { recursive: true });
+    await cp(join(sharedRoot, 'dist'), join(bundleSharedRoot, 'dist'), { recursive: true, force: true });
+    await writeFile(join(bundleSharedRoot, 'package.json'), await readFile(join(sharedRoot, 'package.json')));
+  } catch {
+    // @audit-tools/shared not resolvable — bundle will use runtime resolution
+  }
+
   results.push({ path: bundleRoot, mode: bundleExisted ? 'updated' : 'created' });
 
   const serverEntry = [
@@ -1895,6 +1909,10 @@ function createInstallMcpClient(command, args, options = {}) {
       child.stdin.end();
     }
 
+    if (child.exitCode !== null || child.signalCode !== null) {
+      return;
+    }
+
     await new Promise((resolvePromise) => {
       child.on('exit', () => resolvePromise());
     });

package/dist/cli/args.d.ts

@@ -0,0 +1,59 @@
+import type { SessionConfig } from "@audit-tools/shared";
+export type UiMode = "visible" | "headless";
+export declare const DIRECT_CLI_DEFAULTS: {
+    rootDir: string;
+    artifactsDir: string;
+    maxRuns: number;
+    agentBatchSize: number;
+    parallelWorkers: number;
+    timeoutMs: number;
+    uiMode: UiMode;
+};
+export declare function getFlag(argv: string[], name: string, fallback?: string): string | undefined;
+export declare function hasFlag(argv: string[], name: string): boolean;
+export declare function getOptionalBooleanFlag(argv: string[], name: string): boolean | undefined;
+export declare function optionalBooleanEnv(value: string | undefined): boolean | undefined;
+export declare function resolveHostDispatchCapability(options: {
+    explicit?: boolean;
+    sessionConfig: SessionConfig;
+    env?: NodeJS.ProcessEnv;
+}): boolean;
+export declare function toBase64Url(value: string): string;
+export declare function fromBase64Url(value: string): string;
+export declare function digestId(value: string): string;
+export declare function safeArtifactStem(value: string): string;
+export declare function artifactNameForId(value: string, extension: string): string;
+export declare function quoteCommandArg(value: string): string;
+export declare function renderCommand(argv: string[]): string;
+export declare function summarizeLaunchExit(result: {
+    accepted?: boolean;
+    exitCode?: number | null;
+    signal?: string | null;
+    command?: string;
+    stdoutPath?: string;
+    stderrPath?: string;
+    error?: string;
+}): string | null;
+export declare function taskResultPath(taskResultsDir: string, taskId: string): string;
+export declare function packetPromptPath(taskResultsDir: string, packetId: string): string;
+export declare function readStdinText(): Promise<string>;
+export declare function normalizePositiveInteger(value: unknown): number | undefined;
+export declare function parsePositiveIntegerFlag(argv: string[], name: string): number | undefined;
+export declare function getArtifactsDir(argv: string[]): string;
+export declare function getRootDir(argv: string[]): string;
+export declare function warnIfNotGitRepo(root: string): void;
+export declare function getBatchResultsDir(argv: string[]): string | undefined;
+export declare function getMaxRuns(argv: string[]): number;
+export declare function getAgentBatchSize(argv: string[], sessionConfig: SessionConfig): number;
+export declare function getParallelWorkers(argv: string[], sessionConfig: SessionConfig): number;
+export declare function getTimeoutMs(argv: string[], sessionConfig: SessionConfig): number;
+export declare function getExplicitProvider(argv: string[]): string | undefined;
+export declare function getHostModel(argv: string[]): string | null;
+export declare function getHostMaxActiveSubagents(argv: string[]): number | null;
+export declare function getQuotaProbeMode(argv: string[], sessionConfig: SessionConfig): "auto" | "never" | "force";
+export declare function resolveRunProviderName(argv: string[], sessionConfig: SessionConfig): string;
+export declare function chunkArray<T>(arr: T[], size: number): T[][];
+export declare function getUiMode(argv: string[], fallback?: UiMode): UiMode;
+export declare function looksLikeCliFlag(value: string | undefined): boolean;
+export declare function countLines(path: string): Promise<number>;
+export declare function listBatchResultFiles(batchDir: string): Promise<string[]>;

package/dist/cli/args.js

@@ -0,0 +1,244 @@
+import { existsSync } from "node:fs";
+import { createReadStream } from "node:fs";
+import { readdir } from "node:fs/promises";
+import { Buffer } from "node:buffer";
+import { createHash } from "node:crypto";
+import { join, resolve } from "node:path";
+import { resolveFreshSessionProviderName } from "../providers/index.js";
+export const DIRECT_CLI_DEFAULTS = {
+    rootDir: ".",
+    artifactsDir: ".artifacts",
+    maxRuns: 1000,
+    agentBatchSize: 6,
+    parallelWorkers: 1,
+    timeoutMs: 30 * 60 * 1000, // 30 minutes
+    uiMode: "headless",
+};
+function isLongFlagToken(value) {
+    return typeof value === "string" && value.startsWith("--");
+}
+export function getFlag(argv, name, fallback) {
+    const index = argv.indexOf(name);
+    if (index < 0)
+        return fallback;
+    const candidate = argv[index + 1];
+    if (!candidate || isLongFlagToken(candidate))
+        return fallback;
+    return candidate;
+}
+export function hasFlag(argv, name) {
+    return argv.includes(name);
+}
+export function getOptionalBooleanFlag(argv, name) {
+    const raw = getFlag(argv, name);
+    if (raw === undefined) {
+        return undefined;
+    }
+    if (raw === "true") {
+        return true;
+    }
+    if (raw === "false") {
+        return false;
+    }
+    throw new Error(`${name} must be either true or false.`);
+}
+export function optionalBooleanEnv(value) {
+    if (value === "true")
+        return true;
+    if (value === "false")
+        return false;
+    return undefined;
+}
+export function resolveHostDispatchCapability(options) {
+    if (options.explicit !== undefined) {
+        return options.explicit;
+    }
+    if (options.sessionConfig.host_can_dispatch_subagents !== undefined) {
+        return options.sessionConfig.host_can_dispatch_subagents;
+    }
+    return optionalBooleanEnv((options.env ?? process.env).AUDIT_CODE_HOST_CAN_DISPATCH) ?? true;
+}
+export function toBase64Url(value) {
+    return Buffer.from(value, "utf8").toString("base64url");
+}
+export function fromBase64Url(value) {
+    return Buffer.from(value, "base64url").toString("utf8");
+}
+export function digestId(value) {
+    return createHash("sha256").update(value).digest("hex").slice(0, 12);
+}
+export function safeArtifactStem(value) {
+    const sanitized = value
+        .replace(/[^a-zA-Z0-9_-]+/g, "_")
+        .replace(/^_+|_+$/g, "")
+        .slice(0, 80);
+    return sanitized.length > 0 ? sanitized : "artifact";
+}
+export function artifactNameForId(value, extension) {
+    return `${safeArtifactStem(value)}_${digestId(value)}.${extension}`;
+}
+export function quoteCommandArg(value) {
+    return /[\s"]/u.test(value) ? `"${value.replace(/"/g, '\\"')}"` : value;
+}
+export function renderCommand(argv) {
+    return argv.map((item) => quoteCommandArg(item)).join(" ");
+}
+export function summarizeLaunchExit(result) {
+    if (result.accepted !== false && !result.error) {
+        return null;
+    }
+    const parts = [
+        result.signal
+            ? `signal ${result.signal}`
+            : `exit code ${result.exitCode ?? "unknown"}`,
+        result.command ? `command: ${result.command}` : null,
+        result.stdoutPath ? `stdout: ${result.stdoutPath}` : null,
+        result.stderrPath ? `stderr: ${result.stderrPath}` : null,
+        result.error ?? null,
+    ].filter((part) => Boolean(part));
+    return parts.join("; ");
+}
+export function taskResultPath(taskResultsDir, taskId) {
+    return join(taskResultsDir, artifactNameForId(taskId, "json"));
+}
+export function packetPromptPath(taskResultsDir, packetId) {
+    return join(taskResultsDir, artifactNameForId(packetId, "prompt.md"));
+}
+export async function readStdinText() {
+    if (process.stdin.isTTY) {
+        return "";
+    }
+    return await new Promise((resolveInput, reject) => {
+        let input = "";
+        process.stdin.setEncoding("utf8");
+        process.stdin.on("data", (chunk) => {
+            input += chunk;
+        });
+        process.stdin.on("end", () => resolveInput(input));
+        process.stdin.on("error", reject);
+    });
+}
+function resolveFlagPath(argv, name, fallback) {
+    return resolve(getFlag(argv, name, fallback));
+}
+export function normalizePositiveInteger(value) {
+    if (typeof value !== "number" || !Number.isFinite(value) || value <= 0) {
+        return undefined;
+    }
+    return Math.floor(value);
+}
+export function parsePositiveIntegerFlag(argv, name) {
+    const raw = getFlag(argv, name);
+    if (raw === undefined) {
+        return undefined;
+    }
+    return normalizePositiveInteger(Number(raw));
+}
+export function getArtifactsDir(argv) {
+    return resolveFlagPath(argv, "--artifacts-dir", DIRECT_CLI_DEFAULTS.artifactsDir);
+}
+export function getRootDir(argv) {
+    return resolveFlagPath(argv, "--root", DIRECT_CLI_DEFAULTS.rootDir);
+}
+export function warnIfNotGitRepo(root) {
+    const gitEntry = join(root, ".git");
+    if (!existsSync(gitEntry)) {
+        console.warn(`Warning: target directory '${root}' does not appear to be a git repository. Diff-based signals will be unavailable.`);
+    }
+}
+export function getBatchResultsDir(argv) {
+    const value = getFlag(argv, "--batch-results");
+    return value ? resolve(value) : undefined;
+}
+export function getMaxRuns(argv) {
+    return parsePositiveIntegerFlag(argv, "--max-runs") ?? DIRECT_CLI_DEFAULTS.maxRuns;
+}
+export function getAgentBatchSize(argv, sessionConfig) {
+    return (parsePositiveIntegerFlag(argv, "--agent-batch-size") ??
+        normalizePositiveInteger(sessionConfig.agent_task_batch_size) ??
+        DIRECT_CLI_DEFAULTS.agentBatchSize);
+}
+export function getParallelWorkers(argv, sessionConfig) {
+    return (parsePositiveIntegerFlag(argv, "--parallel") ??
+        normalizePositiveInteger(sessionConfig.parallel_workers) ??
+        DIRECT_CLI_DEFAULTS.parallelWorkers);
+}
+export function getTimeoutMs(argv, sessionConfig) {
+    return (parsePositiveIntegerFlag(argv, "--timeout") ??
+        normalizePositiveInteger(sessionConfig.timeout_ms) ??
+        DIRECT_CLI_DEFAULTS.timeoutMs);
+}
+export function getExplicitProvider(argv) {
+    return getFlag(argv, "--provider");
+}
+export function getHostModel(argv) {
+    return getFlag(argv, "--host-model") ?? null;
+}
+export function getHostMaxActiveSubagents(argv) {
+    return parsePositiveIntegerFlag(argv, "--host-max-active-subagents") ?? null;
+}
+export function getQuotaProbeMode(argv, sessionConfig) {
+    const raw = getFlag(argv, "--quota-probe") ?? sessionConfig.quota?.probe ?? "auto";
+    if (raw === "auto" || raw === "never" || raw === "force")
+        return raw;
+    return "auto";
+}
+export function resolveRunProviderName(argv, sessionConfig) {
+    return resolveFreshSessionProviderName(getExplicitProvider(argv), sessionConfig);
+}
+export function chunkArray(arr, size) {
+    const chunkSize = normalizePositiveInteger(size);
+    if (chunkSize === undefined) {
+        throw new Error("chunkArray size must be a positive integer.");
+    }
+    const chunks = [];
+    for (let i = 0; i < arr.length; i += chunkSize) {
+        chunks.push(arr.slice(i, i + chunkSize));
+    }
+    return chunks;
+}
+export function getUiMode(argv, fallback = DIRECT_CLI_DEFAULTS.uiMode) {
+    const raw = getFlag(argv, "--ui");
+    if (raw === "visible")
+        return "visible";
+    if (raw === "headless")
+        return "headless";
+    return fallback;
+}
+export function looksLikeCliFlag(value) {
+    return isLongFlagToken(value);
+}
+export async function countLines(path) {
+    return new Promise((resolve, reject) => {
+        let lines = 0;
+        let byteCount = 0;
+        let lastByte = -1;
+        const stream = createReadStream(path);
+        stream.on("data", (chunk) => {
+            const buffer = typeof chunk === "string" ? Buffer.from(chunk) : chunk;
+            byteCount += buffer.length;
+            for (let i = 0; i < buffer.length; ++i) {
+                if (buffer[i] === 10)
+                    lines++;
+                lastByte = buffer[i];
+            }
+        });
+        stream.on("end", () => {
+            if (byteCount === 0)
+                return resolve(0);
+            resolve(lastByte !== 10 ? lines + 1 : lines);
+        });
+        stream.on("error", reject);
+    });
+}
+export async function listBatchResultFiles(batchDir) {
+    const entries = await readdir(batchDir, { withFileTypes: true });
+    const files = entries
+        .filter((entry) => entry.isFile() && entry.name.toLowerCase().endsWith(".json"))
+        .map((entry) => join(batchDir, entry.name))
+        .sort((a, b) => a.localeCompare(b));
+    if (files.length === 0) {
+        throw new Error(`No JSON audit result files found in ${batchDir}.`);
+    }
+    return files;
+}

package/dist/cli/dispatch.d.ts

@@ -0,0 +1,80 @@
+import type { SessionConfig, DispatchModelHint } from "@audit-tools/shared";
+import type { ArtifactBundle } from "../io/artifacts.js";
+import type { AuditTask } from "../types.js";
+export declare const LARGE_FILE_PACKET_TARGET_LINES = 2500;
+export declare const SMALL_MODEL_HINT_MAX_LINES = 500;
+export declare const SMALL_MODEL_HINT_MAX_ESTIMATED_TOKENS = 3000;
+export declare const DEEP_MODEL_HINT_MIN_ESTIMATED_TOKENS = 9000;
+export interface DispatchComplexity {
+    priority: NonNullable<AuditTask["priority"]>;
+    task_count: number;
+    file_count: number;
+    total_lines: number;
+    estimated_tokens: number;
+    lenses: AuditTask["lens"][];
+    tags: string[];
+    large_file_mode: boolean;
+}
+export declare const DISPATCH_RESULT_MAP_FILENAME = "dispatch-result-map.json";
+export declare const ACTIVE_DISPATCH_FILENAME = "active-dispatch.json";
+export interface ActiveDispatchState {
+    run_id: string;
+    created_at: string;
+    packet_count: number;
+    task_count: number;
+    status: "active" | "merged";
+}
+export interface DispatchResultMapEntry {
+    packet_id: string;
+    task_id: string;
+    result_path: string;
+}
+export interface DispatchResultMap {
+    contract_version: "audit-code-dispatch-results/v1alpha1";
+    run_id: string;
+    entries: DispatchResultMapEntry[];
+}
+export interface PrepareDispatchResult {
+    run_id: string;
+    dispatch_plan_path: string;
+    dispatch_quota_path: string | null;
+    packet_count: number;
+    task_count: number;
+    skipped_task_count: number;
+    largest_packet: {
+        packet_id: string;
+        total_lines: number;
+        estimated_tokens: number;
+    } | null;
+    warning_count: number;
+    dispatch_warnings_path: string | null;
+}
+export declare function dispatchResultMapPath(runDir: string): string;
+export declare function resolveRunScopedArg(argv: string[], rawFlag: string, b64Flag: string): string | undefined;
+export declare function loadDispatchResultMap(runDir: string): Promise<DispatchResultMap | null>;
+export declare function entriesByTaskId(entries: DispatchResultMapEntry[]): Map<string, DispatchResultMapEntry>;
+export declare function isIsolatedLargeFilePacket(packet: {
+    file_paths: string[];
+    total_lines: number;
+}): boolean;
+export declare function buildDispatchComplexity(packet: {
+    task_ids: string[];
+    file_paths: string[];
+    total_lines: number;
+    estimated_tokens: number;
+    priority: NonNullable<AuditTask["priority"]>;
+    lenses: AuditTask["lens"][];
+    tags?: string[];
+}, largeFileMode: boolean): DispatchComplexity;
+export declare function buildDispatchModelHint(complexity: DispatchComplexity): DispatchModelHint;
+export declare function withinRoot(root: string, path: string): string;
+export declare function buildPendingAuditTasks(bundle: ArtifactBundle): AuditTask[];
+export declare function prepareDispatchArtifacts(params: {
+    packageRoot: string;
+    runId: string;
+    artifactsDir: string;
+    root?: string;
+    sessionConfig?: SessionConfig;
+    hostModel?: string | null;
+    hostActiveSubagentLimit?: number | null;
+}): Promise<PrepareDispatchResult>;