code-auditor-mcp 3.4.18 → 3.6.0

package/dist/cli.js

@@ -7,6 +7,7 @@ import './native-bootstrap.js';
 import { Command } from 'commander';
 import chalk from 'chalk';
 import { createAuditRunner } from './auditRunner.js';
+import { runAuditDispatch } from './auditRouter.js';
 import { readFileSync } from 'fs';
 import { promises as fs } from 'fs';
 import { createInterface } from 'readline';
@@ -20,8 +21,11 @@ import { queryParser } from './search/QueryParser.js';
 import { CodeIndexDB } from './codeIndexDB.js';
 import { getFilesProcessed, getFactsConsumed, isVisitorStatus, isReducerStatus } from './pipeline.js';
 import { createBaselineFromFindings, saveBaseline, loadBaseline, diffBaselines } from './baseline.js';
-import { computeDiffGatingDecision } from './enforcement/gate.js';
-import { computeDiffGate } from './enforcement/diffGate.js';
+import { ALL_ANALYZERS } from './analyzers/ruleRegistry.js';
+import { computeGatingDecision } from './enforcement/gate.js';
+import { DEFAULT_BLOCKING_SEVERITIES } from './config/defaults.js';
+import { rankFilesByPriority, orderFindingsWithinFile } from './nextFile.js';
+import { runNextFile } from './nextFileIncremental.js';
 // Get package.json for version info
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
@@ -127,13 +131,12 @@ program
                 }
             }
         }
-        const runner = createAuditRunner({
+        const result = await runAuditDispatch({
             projectRoot: options.path,
             configName: options.config,
             outputDirectory: options.output,
             presets: presetIds
         });
-        const result = await runner.run();
         const violations = Object.values(result.analyzerResults).flatMap((r) => r.violations || []);
         const baseline = result.metadata?.baseline;
         // ── Delta output (Spec 18 R2) ─────────────────────────────────
@@ -202,6 +205,7 @@ program
             console.log(`Critical: ${result.summary.criticalIssues}`);
             console.log(`Warnings: ${result.summary.warnings}`);
             console.log(`Suggestions: ${result.summary.suggestions}`);
+            console.log(chalk.gray(`\nEvery finding is a defect to resolve — severity ranks urgency, never whether a finding is real.`));
             console.log(chalk.gray(`\n💡 Run ${chalk.cyan('code-audit baseline')} to adopt the ratchet and track changes over time.`));
         }
         else {
@@ -210,6 +214,7 @@ program
             console.log(`Critical: ${result.summary.criticalIssues}`);
             console.log(`Warnings: ${result.summary.warnings}`);
             console.log(`Suggestions: ${result.summary.suggestions}`);
+            console.log(chalk.gray(`\nEvery finding is a defect to resolve — severity ranks urgency, never whether a finding is real.`));
         }
         // Spec 44 R4 — file accounting: analyzed/dropped totals + optional breakdown.
         printFileAccounting(result, !!options.explainSkipped);
@@ -236,26 +241,6 @@ program
             const parts = skippedExtensions.map(s => `${s.ext} (${s.count})`);
             console.log(`  ${parts.join(', ')}`);
         }
-        // Spec 36 R7 — suppressions are reported: how many exist, where, and how
-        // many are unnecessary (or reasonless). Both are errors, surfaced here.
-        const suppressions = result.metadata?.suppressions;
-        if (suppressions) {
-            console.log(chalk.gray(`\n── Suppressions ──────────────────────────────`));
-            console.log(`  ${suppressions.total} directive${suppressions.total !== 1 ? 's' : ''}, ` +
-                `${suppressions.suppressed} finding${suppressions.suppressed !== 1 ? 's' : ''} suppressed`);
-            if (suppressions.unnecessary.length > 0) {
-                console.error(chalk.red(`  ❌ ${suppressions.unnecessary.length} unnecessary (finding no longer fires):`));
-                for (const d of suppressions.unnecessary) {
-                    console.error(`    ${d.rule} @ ${d.file}:${d.line}`);
-                }
-            }
-            if (suppressions.reasonless.length > 0) {
-                console.error(chalk.red(`  ❌ ${suppressions.reasonless.length} missing a required reason:`));
-                for (const d of suppressions.reasonless) {
-                    console.error(`    ${d.rule} @ ${d.file}:${d.line}`);
-                }
-            }
-        }
         // Per-analyzer activity (read from result data, not serialized summary)
         // — surfaces zero-scan failures that would otherwise be invisible.
         if (!options.json) {
@@ -283,13 +268,21 @@ program
                 const clean = coverage.filter(c => c.state === 'clean');
                 const unassessed = coverage.filter(c => c.state === 'unassessed');
                 const notApplicable = coverage.filter(c => c.state === 'notApplicable');
+                const cannotFire = coverage.filter(c => c.state === 'cannot-fire');
                 const firedCount = fired.reduce((s, c) => s + c.count, 0);
                 console.log(chalk.gray(`\n── Coverage ─────────────────────────────────`));
                 console.log(`  ${fired.length} fired (${firedCount.toLocaleString()} violations), ` +
                     `${clean.length} clean, ` +
                     `${unassessed.length} unassessed, ` +
-                    `${notApplicable.length} notApplicable ` +
+                    `${notApplicable.length} notApplicable, ` +
+                    `${cannotFire.length} cannot-fire ` +
                     `(${coverage.length} rules registered)`);
+                if (cannotFire.length > 0) {
+                    console.log(chalk.yellow(`  ── Cannot Fire (broken in the tool) ──`));
+                    for (const c of cannotFire) {
+                        console.log(`    ${c.ruleId}: ${c.reason ?? 'unknown'}`);
+                    }
+                }
                 if (notApplicable.length > 0) {
                     console.log(chalk.gray(`  ── Not Applicable ──`));
                     for (const c of notApplicable) {
@@ -434,6 +427,16 @@ program
         const result = await runner.run();
         // Collect all violations
         const violations = Object.values(result.analyzerResults).flatMap((r) => r.violations || []);
+        // Blocking gate decision (Spec 45 R1/R2/R4), computed once so the
+        // agent-facing before/after count (Spec 45 A2) and the exit code agree on
+        // the same number. Every registered rule participates (R1); severity
+        // decides (R2); enforcement is not diff-scoped (R4). No rule is removed
+        // from the gate for speed (Spec 45 A1).
+        const configuredGateSeverities = result.metadata.configUsed?.gateSeverities;
+        const blockingSeverities = new Set(Array.isArray(configuredGateSeverities) && configuredGateSeverities.length > 0
+            ? configuredGateSeverities
+            : DEFAULT_BLOCKING_SEVERITIES);
+        const { blocking, resolutionGaps } = computeGatingDecision(violations, blockingSeverities);
         // JSON output
         if (options.format === 'sarif') {
             const { generateSARIFReport } = await import('./reporting/sarifReportGenerator.js');
@@ -473,15 +476,17 @@ program
             process.stdout.write(JSON.stringify(jsonOutput, null, 2) + '\n');
         }
         else if (!options.quiet || violations.length > 0) {
-            // Console output — Spec 36 R3: agent-facing output emits findings,
-            // never an aggregate total. The hook and the `changed` command are the
-            // agent's surface; a finding total is exactly the representation the
-            // consumer routes around. Findings only, each with file:line.
+            // Console output — Spec 45 A2: agent-facing output emits counts (per
+            // analyzer/rule/severity, plus the before/after gate figure) alongside
+            // findings. The hook and the `changed` command are the agent's surface.
             console.log(chalk.blue('🔍 Diff-Scoped Code Audit'));
             console.log(chalk.gray('══════════════════════════════════════════════════'));
             printFileAccounting(result, !!options.explainSkipped);
             if (violations.length > 0) {
-                console.log(chalk.gray('\n── Violations ────────────────────────────────────'));
+                console.log('');
+                printCountSummary(violations);
+                console.log(chalk.bold(`gate before/after: ${violations.length} → ${blocking.length} blocking`));
+                console.log(chalk.gray('── Violations ────────────────────────────────────'));
                 for (const v of violations) {
                     const icon = v.severity === 'critical' ? '🔴' :
                         v.severity === 'warning' ? '🟡' : '🔵';
@@ -510,34 +515,23 @@ program
                 }
             }
             else {
-                lines.push('  (no gating rules recorded)');
+                lines.push('  (no rules recorded)');
             }
             process.stderr.write(lines.join('\n') + '\n');
         }
-        // Binary gate (Spec 36 R2/R4/R6): exit 2 when a gating finding is present.
-        // The `changed` command is the edit-boundary gate, so it compares against
-        // the file's prior state (git HEAD) via the touched-line diff gate (R2),
-        // NOT against a stored baseline. Gate-excluded files and non-gating rules
-        // never block. Severity does NOT factor in (R4). A gating rule that cannot
-        // name a next action for an occurrence emits non-blocking and the gap is
-        // recorded (R6), surfaced below to stderr.
+        // Blocking gate (Spec 45 R1/R2/R4): exit 2 when a finding at a blocking
+        // severity is present. Every registered rule participates (R1); severity
+        // decides (R2); enforcement is not diff-scoped (R4) — a pre-existing
+        // finding in the audited file blocks exactly like a new one. Gate-excluded
+        // files never block. A rule that cannot name a next action still blocks;
+        // the missing action is recorded below (R1). The decision is computed
+        // above so the before/after count and the exit code share one number.
         {
-            const analyzedFiles = result.metadata?.analyzedFiles;
-            // The `changed` command is always scoped, so the runner records the
-            // analyzed file list. If it is somehow absent we still derive the gate
-            // from the files that actually produced findings rather than falling
-            // back to the baseline gate — a silent soft-fail is the one outcome R1
-            // forbids.
-            const gateFiles = analyzedFiles && analyzedFiles.length > 0
-                ? analyzedFiles
-                : [...new Set(violations.map((v) => v.file).filter(Boolean))];
-            const diffGate = computeDiffGate(options.path, gateFiles);
-            const { blocking, resolutionGaps } = computeDiffGatingDecision(violations, diffGate);
             if (resolutionGaps.length > 0) {
-                // Spec 36 R6 — a gating rule that could not name an action is a defect
-                // in the rule. Record it loudly so it cannot route around as a count.
+                // Spec 45 R1 — a rule that could not name an action is a defect in the
+                // rule. Record it loudly so it cannot route around as a count.
                 const lines = [
-                    '⚠️  resolution gap — gating rule produced no next action for these occurrences (Spec 36 R6):',
+                    '⚠️  resolution gap — rule produced no next action for these occurrences (Spec 45 R1):',
                     ...resolutionGaps.map((g) => `  - ${g.rule} @ ${g.file}${g.line ? `:${g.line}` : ''}`),
                 ];
                 process.stderr.write(lines.join('\n') + '\n');
@@ -545,28 +539,6 @@ program
             if (blocking.length > 0) {
                 process.exit(2);
             }
-            // Spec 36 R7 — an unnecessary or reasonless suppression is itself an
-            // error. It is reported loudly and fails the write, exactly like an
-            // unused `@ts-expect-error`. A suppression that outlives its finding is
-            // a baseline entry with better branding unless it errors here.
-            const suppressions = result.metadata?.suppressions;
-            if (suppressions && (suppressions.unnecessary.length > 0 || suppressions.reasonless.length > 0)) {
-                const lines = [];
-                if (suppressions.reasonless.length > 0) {
-                    lines.push('❌ suppression missing a required reason (Spec 36 R7):');
-                    for (const d of suppressions.reasonless) {
-                        lines.push(`  - ${d.rule} @ ${d.file}:${d.line}`);
-                    }
-                }
-                if (suppressions.unnecessary.length > 0) {
-                    lines.push('❌ unnecessary suppression — the finding no longer fires (Spec 36 R7):');
-                    for (const d of suppressions.unnecessary) {
-                        lines.push(`  - ${d.rule} @ ${d.file}:${d.line}`);
-                    }
-                }
-                process.stderr.write(lines.join('\n') + '\n');
-                process.exit(2);
-            }
         }
         // Exit code based on --no-fail-on-zero-files (default-on in v3.4.8)
         // Any enabled analyzer matching zero source files is a failure — a >50%
@@ -586,6 +558,258 @@ program
         process.exit(1);
     }
 });
+// Spec 45 A2 — counts are emitted where useful (per analyzer, per rule, per
+// severity), on agent-facing surfaces as well as human ones. This reverts Spec
+// 36 R3's "no bare counts": an agent now sees the shape of what fired instead
+// of a single aggregate it could route around. The `before/after` gate figure
+// is Spec 45 R1's "report count before/after".
+function summarizeFindings(violations) {
+    const bySeverity = new Map();
+    const byAnalyzer = new Map();
+    const byRule = new Map();
+    for (const v of violations) {
+        const severity = v.severity ?? 'unknown';
+        bySeverity.set(severity, (bySeverity.get(severity) ?? 0) + 1);
+        const analyzer = v.analyzer ?? 'unknown';
+        byAnalyzer.set(analyzer, (byAnalyzer.get(analyzer) ?? 0) + 1);
+        const rule = v.rule || v.type || 'unknown';
+        byRule.set(rule, (byRule.get(rule) ?? 0) + 1);
+    }
+    return { bySeverity, byAnalyzer, byRule };
+}
+function groupedCounts(map, sep = ', ') {
+    return [...map.entries()]
+        .sort((a, b) => b[1] - a[1] || a[0].localeCompare(b[0]))
+        .map(([k, n]) => `${k} ${n}`)
+        .join(sep);
+}
+function printCountSummary(violations) {
+    const { bySeverity, byAnalyzer, byRule } = summarizeFindings(violations);
+    console.log(chalk.gray('── Findings ────────────────────────────────────'));
+    console.log(`${violations.length} total · ${groupedCounts(bySeverity, ' · ')}`);
+    console.log(`by analyzer: ${groupedCounts(byAnalyzer)}`);
+    console.log(`by rule: ${groupedCounts(byRule)}`);
+}
+// Self-audit gate (Spec 33 Item 15 + Spec 44 remediation). Runs the full
+// analyzer pipeline over the tool's own production source and asserts zero
+// *blocking* (critical/warning) findings in the self-audit scope — the same
+// scope + severity contract as scripts/verify-self.mjs, but callable from the
+// shipped CLI so the edit-time plugin hook can enforce it. `verify:self` (the
+// release gate) stays authoritative; this command is its per-edit sibling.
+//
+// Scope semantics: a file is a self-audit target iff its path is under
+// `analyzers/` or `languages/` (relative to the project's `src/`) and is not a
+// test/spec/fixture or the declarative `ruleRegistry.ts` data table. Mirroring
+// verify-self.mjs keeps the two gates from drifting.
+function selfAuditScopePath(file) {
+    const idx = file.lastIndexOf('/src/');
+    if (idx === -1)
+        return null;
+    return file.slice(idx + '/src/'.length);
+}
+function isSelfAuditInScope(file) {
+    const rel = selfAuditScopePath(file);
+    if (!rel)
+        return false;
+    if (!(rel.startsWith('analyzers/') || rel.startsWith('languages/')))
+        return false;
+    if (/(__tests__|\.test\.|\.spec\.|fixtures)/.test(rel))
+        return false;
+    if (rel === 'analyzers/ruleRegistry.ts')
+        return false;
+    return true;
+}
+program
+    .command('self-audit [paths...]')
+    .description('Audit the tool\'s own analyzers/ + languages/ source and fail on blocking findings')
+    .option('--json', 'Output violations as machine-readable JSON to stdout')
+    .option('--stdin', 'Read file paths from stdin (one per line)')
+    .option('-p, --path <projectPath>', 'Project root path', process.cwd())
+    .option('--fail-on <severity>', 'Blocking severity floor: critical, warning, or suggestion', 'warning')
+    .action(async (paths, options) => {
+    try {
+        await initParsers();
+        const validSeverities = ['critical', 'warning', 'suggestion'];
+        const failOnSeverity = options.failOn;
+        if (!validSeverities.includes(failOnSeverity)) {
+            console.error(chalk.red(`Invalid --fail-on severity: "${failOnSeverity}". Must be one of: ${validSeverities.join(', ')}`));
+            process.exit(1);
+        }
+        const fileSet = new Set();
+        if (options.stdin) {
+            const rl = createInterface({
+                input: process.stdin,
+                output: undefined,
+                terminal: false
+            });
+            for await (const line of rl) {
+                const trimmed = line.trim();
+                if (trimmed)
+                    fileSet.add(trimmed);
+            }
+        }
+        for (const p of paths)
+            fileSet.add(p);
+        // No explicit paths → audit the whole `src` tree (mirrors verify:self).
+        if (fileSet.size === 0) {
+            fileSet.add(join(options.path, 'src'));
+        }
+        // Resolve to absolute paths; `createAuditRunner` treats an array scope as
+        // explicit files/globs (directories included) and, for scoped runs, still
+        // loads the full function index so cross-file DRY duplicates are caught.
+        const resolved = [...fileSet].map((f) => isAbsolute(f) ? f : resolve(process.cwd(), f));
+        const scope = resolved;
+        const runner = createAuditRunner({
+            projectRoot: options.path,
+            scope,
+            analyzerConcurrency: 4
+        });
+        const result = await runner.run();
+        const violations = Object.values(result.analyzerResults).flatMap((r) => r.violations || []);
+        const severityOrder = ['critical', 'warning', 'suggestion'];
+        const failIndex = severityOrder.indexOf(failOnSeverity);
+        const blocking = violations.filter((v) => {
+            if (!isSelfAuditInScope(v.file ?? ''))
+                return false;
+            const vIndex = severityOrder.indexOf(v.severity);
+            return vIndex >= 0 && vIndex <= failIndex;
+        });
+        if (options.json) {
+            const projectDir = resolve(options.path || process.cwd());
+            const jsonOutput = blocking.map((v) => {
+                let filePath = v.file || '';
+                if (filePath.startsWith('/') || filePath.startsWith('\\\\')) {
+                    const rel = relative(projectDir, filePath);
+                    if (!rel.startsWith('..') && !isAbsolute(rel))
+                        filePath = rel;
+                }
+                return {
+                    analyzer: v.analyzer || '',
+                    rule: v.rule || v.type || '',
+                    severity: v.severity,
+                    message: v.message,
+                    file: filePath,
+                    line: v.line ?? v.start?.line,
+                    column: v.column ?? v.start?.column ?? 1,
+                    endLine: v.end?.line,
+                    endColumn: v.end?.column,
+                    enclosingSymbol: v.symbol || v.enclosingFunction || '',
+                    suggestion: v.suggestion || '',
+                    details: v.details || ''
+                };
+            });
+            process.stdout.write(JSON.stringify(jsonOutput, null, 2) + '\n');
+        }
+        else if (blocking.length > 0) {
+            // Spec 45 A2 — counts plus findings (per analyzer/rule/severity).
+            console.log(chalk.red('\nSelf-audit blocking findings:'));
+            printCountSummary(blocking);
+            for (const v of blocking) {
+                const icon = v.severity === 'critical' ? '🔴' :
+                    v.severity === 'warning' ? '🟡' : '🔵';
+                console.log(`${icon} ${v.file}${v.line ? `:${v.line}` : ''} [${v.severity}] ${v.message}`);
+            }
+        }
+        else {
+            console.log(chalk.green('\n✓ Self-audit clean — zero blocking findings in scope.'));
+        }
+        if (blocking.length > 0)
+            process.exit(2);
+    }
+    catch (error) {
+        console.error(chalk.red('Error:'), error);
+        process.exit(1);
+    }
+});
+// Next-file command: the refactoring loop's single entry point. The first call
+// seeds a full audit into a snapshot (file → content hash + findings); each
+// subsequent call diffs, re-audits only what changed, merges per-analyzer, and
+// returns the head file with every finding on it. A consuming LLM calls it,
+// fixes the returned file, and calls it again — if the file is still in bad
+// shape it comes back, otherwise the next-worst file surfaces. The queue is
+// derived from the snapshot each invocation, so there is no cursor to corrupt
+// and no decline action: removing a finding means editing the rules, not
+// skipping the file.
+program
+    .command('next-file')
+    .description('Audit and return the highest-priority file with findings (file-by-file refactor loop)')
+    .option('-p, --path <projectPath>', 'Project root path', process.cwd())
+    .option('-c, --config <config>', 'Configuration name')
+    .option('--json', 'Output a single JSON object (or {done:true}) to stdout')
+    .action(async (options) => {
+    try {
+        await initParsers();
+        const { violations, summary } = await runNextFile({
+            projectRoot: options.path,
+            configName: options.config,
+        });
+        // Rank files worst-first from the (incrementally-merged) violation set.
+        const ranked = rankFilesByPriority(violations);
+        if (ranked.length === 0) {
+            if (options.json) {
+                process.stdout.write(JSON.stringify({ done: true, summary }, null, 2) + '\n');
+            }
+            else {
+                console.log(chalk.green('\n✓ No findings — nothing left to refactor.'));
+            }
+            return;
+        }
+        const top = ranked[0];
+        // Every issue on the file, ordered critical → warning → suggestion.
+        const ordered = orderFindingsWithinFile(top.violations);
+        const projectDir = resolve(options.path || process.cwd());
+        const relativize = (filePath) => {
+            if (!filePath)
+                return '';
+            if (filePath.startsWith('/') || filePath.startsWith('\\\\')) {
+                const rel = relative(projectDir, filePath);
+                if (!rel.startsWith('..') && !isAbsolute(rel))
+                    return rel;
+            }
+            return filePath;
+        };
+        if (options.json) {
+            const output = {
+                done: false,
+                file: relativize(top.file),
+                remainingFiles: ranked.length - 1,
+                remainingFindings: violations.length - top.count,
+                summary,
+                findings: ordered.map((v) => ({
+                    analyzer: v.analyzer || '',
+                    rule: v.rule || v.type || '',
+                    severity: v.severity,
+                    message: v.message,
+                    file: relativize(v.file || ''),
+                    line: v.line ?? v.start?.line,
+                    column: v.column ?? v.start?.column ?? 1,
+                    endLine: v.end?.line,
+                    endColumn: v.end?.column,
+                    enclosingSymbol: v.symbol || v.enclosingFunction || '',
+                    suggestion: v.suggestion || '',
+                    details: v.details || '',
+                    ...(v.new !== undefined && { new: v.new }),
+                })),
+            };
+            process.stdout.write(JSON.stringify(output, null, 2) + '\n');
+        }
+        else {
+            console.log(chalk.blue('🔍 Next File to Refactor'));
+            console.log(chalk.gray('══════════════════════════════════════════════════'));
+            console.log(`\n${chalk.bold(relativize(top.file))} — ${top.count} finding(s), highest severity ${top.maxSeverity}`);
+            console.log(chalk.gray(`${ranked.length - 1} more file(s) with findings · ${violations.length - top.count} remaining finding(s)`));
+            console.log(chalk.gray('\n── Findings ────────────────────────────────────────'));
+            for (const v of ordered) {
+                const icon = v.severity === 'critical' ? '🔴' : v.severity === 'warning' ? '🟡' : '🔵';
+                console.log(`${icon} ${chalk.bold(relativize(v.file || ''))}${v.line ? `:${v.line}` : ''} [${v.severity}] ${v.rule} — ${v.message}`);
+            }
+        }
+    }
+    catch (error) {
+        console.error(chalk.red('Error:'), error);
+        process.exit(1);
+    }
+});
 // Baseline command (Spec 18 R1)
 program
     .command('baseline')
@@ -1871,20 +2095,9 @@ ledgerCmd
 // `audit --detach` forks workers/auditJobRunner; `status`/`result`/`jobs` read
 // the persisted ledger. One job model (the ledger run), one write path — these
 // are thin wrappers over ledger.ts + mcpAuditJobs.ts, not a second store.
-/** Full analyzer set — matches createAuditRunner's registry, so `--detach` produces
- *  the same per-rule coverage as a synchronous `audit` (73 rows on recall). */
-const DETACHED_DEFAULT_ANALYZERS = [
-    'solid',
-    'dry',
-    'data-access',
-    'react',
-    'documentation',
-    'invariants',
-    'schema',
-    'styles',
-    'conventions',
-    'cross-domain',
-];
+/** Full analyzer set — derives from createAuditRunner's registry so `--detach`
+ *  produces the same per-rule coverage as a synchronous `audit`. */
+const DETACHED_DEFAULT_ANALYZERS = [...ALL_ANALYZERS];
 /** Lease TTL used by read-path reclaim, mirroring mcpAuditJobs.jobLeaseTtlMs. */
 const CLI_JOB_LEASE_TTL_MS = Number(process.env.CODE_AUDITOR_JOB_LEASE_TTL_MS) || 30_000;
 function spec41StatusBadge(status) {
@@ -2054,7 +2267,7 @@ program
     .option('--analyzer <analyzer>', 'Filter by analyzer')
     .option('--file <file>', 'Filter by file path (substring match)')
     .option('--severity <severity>', 'Filter by severity (critical|warning|suggestion)')
-    .option('--state [state]', 'Query coverage by state (fired|clean|notApplicable|unassessed); omit value for all')
+    .option('--state [state]', 'Query coverage by state (fired|clean|notApplicable|cannot-fire|unassessed); omit value for all')
     .option('--count', 'Group findings by analyzer/rule with counts')
     .option('--limit <n>', 'Max findings to return (0 = unbounded)', '50')
     .option('--offset <n>', 'Findings offset', '0')
@@ -2779,20 +2992,18 @@ program
                     line: v.line ?? v.start?.line,
                     message: v.message,
                     resolution: v.resolution ?? null,
-                    suppressed: v.suppressed === true,
-                    ...(v.suppressionReason && { suppressionReason: v.suppressionReason }),
                 };
             });
             process.stdout.write(JSON.stringify(out, null, 2) + '\n');
             return;
         }
-        // Spec 36 R3 — findings, never a total. Each line is a file:line finding;
-        // there is no count anywhere in this output to route around.
+        // Spec 45 A2 — counts plus findings (per analyzer/rule/severity).
+        printCountSummary(sorted);
+        console.log('');
         for (const v of sorted) {
             const icon = v.severity === 'critical' ? '🔴' :
                 v.severity === 'warning' ? '🟡' : '🔵';
-            const suppressed = v.suppressed ? chalk.dim(' [suppressed]') : '';
-            console.log(`${icon} ${chalk.bold(v.file)}${v.line ? `:${v.line}` : ''} [${v.rule || v.severity}] ${v.message}${suppressed}`);
+            console.log(`${icon} ${chalk.bold(v.file)}${v.line ? `:${v.line}` : ''} [${v.rule || v.severity}] ${v.message}`);
         }
     }
     catch (error) {