code-auditor-mcp 3.5.0 → 3.7.0

package/dist/cli.js

@@ -22,8 +22,8 @@ import { CodeIndexDB } from './codeIndexDB.js';
 import { getFilesProcessed, getFactsConsumed, isVisitorStatus, isReducerStatus } from './pipeline.js';
 import { createBaselineFromFindings, saveBaseline, loadBaseline, diffBaselines } from './baseline.js';
 import { ALL_ANALYZERS } from './analyzers/ruleRegistry.js';
-import { computeDiffGatingDecision } from './enforcement/gate.js';
-import { computeDiffGate } from './enforcement/diffGate.js';
+import { computeGatingDecision } from './enforcement/gate.js';
+import { DEFAULT_BLOCKING_SEVERITIES } from './config/defaults.js';
 import { rankFilesByPriority, orderFindingsWithinFile } from './nextFile.js';
 import { runNextFile } from './nextFileIncremental.js';
 // Get package.json for version info
@@ -139,6 +139,20 @@ program
         });
         const violations = Object.values(result.analyzerResults).flatMap((r) => r.violations || []);
         const baseline = result.metadata?.baseline;
+        // ── Coverage panel leads the report (Spec 47 R2) ─────────────
+        // A diagnostic report opens with what was measured before it lists any
+        // readings, so a zero-reading report can't be mistaken for a clean tree.
+        const coverage = result.metadata?.coverage;
+        if (coverage && coverage.length > 0) {
+            const covFired = coverage.filter(c => c.state === 'fired').length;
+            const covClean = coverage.filter(c => c.state === 'clean').length;
+            const covUnassessed = coverage.filter(c => c.state === 'unassessed').length;
+            const covNotApplicable = coverage.filter(c => c.state === 'notApplicable').length;
+            const covCannotFire = coverage.filter(c => c.state === 'cannot-fire').length;
+            console.log(chalk.gray(`── Coverage panel ── ${covFired} fired · ${covClean} clean · ` +
+                `${covUnassessed} unassessed · ${covNotApplicable} not-applicable · ` +
+                `${covCannotFire} cannot-fire`));
+        }
         // ── Delta output (Spec 18 R2) ─────────────────────────────────
         if (baseline && !options.full) {
             const newViolations = violations.filter((v) => v.new === true);
@@ -155,7 +169,7 @@ program
                     : '(unchanged)';
             console.log(`\n📊 Delta: +${newViolations.length} new · −${fixedCount} fixed · ${knownCount} known  ${trendIcon} ${trendLabel}`);
             if (newViolations.length > 0) {
-                console.log(chalk.gray(`\n── New Findings (${newViolations.length}) ──────────────────────────`));
+                console.log(chalk.gray(`\n── New readings (${newViolations.length}) ──────────────────────────`));
                 for (const v of newViolations) {
                     const icon = v.severity === 'critical' ? '🔴' :
                         v.severity === 'warning' ? '🟡' : '🔵';
@@ -163,9 +177,9 @@ program
                 }
             }
             else {
-                console.log(chalk.green('\n✓ No new findings since last baseline.'));
+                console.log(chalk.green('\n✓ No new readings since last baseline.'));
                 if (knownCount > 0) {
-                    console.log(chalk.gray(`  ${knownCount} known finding(s) are still open — recorded, not fixed.`));
+                    console.log(chalk.gray(`  ${knownCount} known reading(s) are still open — recorded, not resolved.`));
                 }
             }
             // Debt by analyzer
@@ -195,26 +209,26 @@ program
                 .sort((a, b) => b[1] - a[1])
                 .slice(0, 5);
             for (const [file, count] of topFiles) {
-                console.log(`${file} — ${count} finding${count !== 1 ? 's' : ''}`);
+                console.log(`${file} — ${count} reading${count !== 1 ? 's' : ''}`);
             }
-            console.log(chalk.gray(`\n💡 Run ${chalk.cyan('code-audit --full')} to see all ${currentDebt.toLocaleString()} findings.`));
+            console.log(chalk.gray(`\n💡 Run ${chalk.cyan('code-audit --full')} to see all ${currentDebt.toLocaleString()} readings.`));
         }
         else if (!baseline) {
             // No baseline: current behavior + hint
-            console.log(`\nFound ${result.summary.totalViolations} violations`);
+            console.log(`\nFound ${result.summary.totalViolations} readings`);
             console.log(`Critical: ${result.summary.criticalIssues}`);
             console.log(`Warnings: ${result.summary.warnings}`);
             console.log(`Suggestions: ${result.summary.suggestions}`);
-            console.log(chalk.gray(`\nEvery finding is a defect to resolve — severity ranks urgency, never whether a finding is real.`));
+            console.log(chalk.gray(`\nEvery reading is a measurement, not a verdict — severity is triage, the order to act.`));
             console.log(chalk.gray(`\n💡 Run ${chalk.cyan('code-audit baseline')} to adopt the ratchet and track changes over time.`));
         }
         else {
             // --full with baseline: full itemized inventory (current behavior)
-            console.log(`\nFound ${result.summary.totalViolations} violations`);
+            console.log(`\nFound ${result.summary.totalViolations} readings`);
             console.log(`Critical: ${result.summary.criticalIssues}`);
             console.log(`Warnings: ${result.summary.warnings}`);
             console.log(`Suggestions: ${result.summary.suggestions}`);
-            console.log(chalk.gray(`\nEvery finding is a defect to resolve — severity ranks urgency, never whether a finding is real.`));
+            console.log(chalk.gray(`\nEvery reading is a measurement, not a verdict — severity is triage, the order to act.`));
         }
         // Spec 44 R4 — file accounting: analyzed/dropped totals + optional breakdown.
         printFileAccounting(result, !!options.explainSkipped);
@@ -241,26 +255,6 @@ program
             const parts = skippedExtensions.map(s => `${s.ext} (${s.count})`);
             console.log(`  ${parts.join(', ')}`);
         }
-        // Spec 36 R7 — suppressions are reported: how many exist, where, and how
-        // many are unnecessary (or reasonless). Both are errors, surfaced here.
-        const suppressions = result.metadata?.suppressions;
-        if (suppressions) {
-            console.log(chalk.gray(`\n── Suppressions ──────────────────────────────`));
-            console.log(`  ${suppressions.total} directive${suppressions.total !== 1 ? 's' : ''}, ` +
-                `${suppressions.suppressed} finding${suppressions.suppressed !== 1 ? 's' : ''} suppressed`);
-            if (suppressions.unnecessary.length > 0) {
-                console.error(chalk.red(`  ❌ ${suppressions.unnecessary.length} unnecessary (finding no longer fires):`));
-                for (const d of suppressions.unnecessary) {
-                    console.error(`    ${d.rule} @ ${d.file}:${d.line}`);
-                }
-            }
-            if (suppressions.reasonless.length > 0) {
-                console.error(chalk.red(`  ❌ ${suppressions.reasonless.length} missing a required reason:`));
-                for (const d of suppressions.reasonless) {
-                    console.error(`    ${d.rule} @ ${d.file}:${d.line}`);
-                }
-            }
-        }
         // Per-analyzer activity (read from result data, not serialized summary)
         // — surfaces zero-scan failures that would otherwise be invisible.
         if (!options.json) {
@@ -316,7 +310,7 @@ program
                     }
                 }
                 if (unassessed.length > 0) {
-                    console.log(chalk.gray(`  ── Unassessed (zero findings, applicability unknown) ──`));
+                    console.log(chalk.gray(`  ── Unassessed (zero readings, applicability unknown) ──`));
                     for (const c of unassessed) {
                         console.log(`    ${c.ruleId} (0)`);
                     }
@@ -328,7 +322,7 @@ program
         const builtinCapped = Object.values(result.analyzerResults)
             .reduce((count, ar) => count + ar.violations.filter(v => v.profile === 'scripts-and-tests').length, 0);
         if (builtinCapped > 0) {
-            console.log(chalk.blue(`\nℹ️  ${builtinCapped.toLocaleString()} findings capped by built-in profile "scripts-and-tests" (scripts/tests/fixtures → suggestion).`));
+            console.log(chalk.blue(`\nℹ️  ${builtinCapped.toLocaleString()} readings capped by built-in profile "scripts-and-tests" (scripts/tests/fixtures → suggestion).`));
             console.log(chalk.gray(`   Set ${chalk.cyan('"builtin": false')} in .codeauditor.json to disable.`));
         }
         // Generate formatted report if --format is specified
@@ -353,7 +347,7 @@ program
             const currentDebt = violations.filter((v) => v.new || v.new === false).length;
             const snapshotDebt = baseline.previousKnownCount ?? 0;
             if (currentDebt > snapshotDebt) {
-                console.error(chalk.red(`Debt regression: ${currentDebt - snapshotDebt} findings added without re-baselining.`));
+                console.error(chalk.red(`Debt regression: ${currentDebt - snapshotDebt} readings added without re-baselining.`));
                 process.exit(2);
             }
         }
@@ -447,6 +441,16 @@ program
         const result = await runner.run();
         // Collect all violations
         const violations = Object.values(result.analyzerResults).flatMap((r) => r.violations || []);
+        // Blocking gate decision (Spec 45 R1/R2/R4), computed once so the
+        // agent-facing before/after count (Spec 45 A2) and the exit code agree on
+        // the same number. Every registered rule participates (R1); severity
+        // decides (R2); enforcement is not diff-scoped (R4). No rule is removed
+        // from the gate for speed (Spec 45 A1).
+        const configuredGateSeverities = result.metadata.configUsed?.gateSeverities;
+        const blockingSeverities = new Set(Array.isArray(configuredGateSeverities) && configuredGateSeverities.length > 0
+            ? configuredGateSeverities
+            : DEFAULT_BLOCKING_SEVERITIES);
+        const { blocking, resolutionGaps } = computeGatingDecision(violations, blockingSeverities);
         // JSON output
         if (options.format === 'sarif') {
             const { generateSARIFReport } = await import('./reporting/sarifReportGenerator.js');
@@ -486,15 +490,17 @@ program
             process.stdout.write(JSON.stringify(jsonOutput, null, 2) + '\n');
         }
         else if (!options.quiet || violations.length > 0) {
-            // Console output — Spec 36 R3: agent-facing output emits findings,
-            // never an aggregate total. The hook and the `changed` command are the
-            // agent's surface; a finding total is exactly the representation the
-            // consumer routes around. Findings only, each with file:line.
+            // Console output — Spec 45 A2: agent-facing output emits counts (per
+            // analyzer/rule/severity, plus the before/after gate figure) alongside
+            // findings. The hook and the `changed` command are the agent's surface.
             console.log(chalk.blue('🔍 Diff-Scoped Code Audit'));
             console.log(chalk.gray('══════════════════════════════════════════════════'));
             printFileAccounting(result, !!options.explainSkipped);
             if (violations.length > 0) {
-                console.log(chalk.gray('\n── Violations ────────────────────────────────────'));
+                console.log('');
+                printCountSummary(violations);
+                console.log(chalk.bold(`gate before/after: ${violations.length} → ${blocking.length} blocking`));
+                console.log(chalk.gray('── Violations ────────────────────────────────────'));
                 for (const v of violations) {
                     const icon = v.severity === 'critical' ? '🔴' :
                         v.severity === 'warning' ? '🟡' : '🔵';
@@ -505,7 +511,7 @@ program
                 }
             }
             else {
-                console.log(chalk.green('\n✓ No findings.'));
+                console.log(chalk.green('\n✓ No readings.'));
             }
         }
         // Spec 38 R2/R3 — per-rule timing + gate wall-clock, opt-in by env var.
@@ -523,34 +529,23 @@ program
                 }
             }
             else {
-                lines.push('  (no gating rules recorded)');
+                lines.push('  (no rules recorded)');
             }
             process.stderr.write(lines.join('\n') + '\n');
         }
-        // Binary gate (Spec 36 R2/R4/R6): exit 2 when a gating finding is present.
-        // The `changed` command is the edit-boundary gate, so it compares against
-        // the file's prior state (git HEAD) via the touched-line diff gate (R2),
-        // NOT against a stored baseline. Gate-excluded files and non-gating rules
-        // never block. Severity does NOT factor in (R4). A gating rule that cannot
-        // name a next action for an occurrence emits non-blocking and the gap is
-        // recorded (R6), surfaced below to stderr.
+        // Blocking gate (Spec 45 R1/R2/R4): exit 2 when a finding at a blocking
+        // severity is present. Every registered rule participates (R1); severity
+        // decides (R2); enforcement is not diff-scoped (R4) — a pre-existing
+        // finding in the audited file blocks exactly like a new one. Gate-excluded
+        // files never block. A rule that cannot name a next action still blocks;
+        // the missing action is recorded below (R1). The decision is computed
+        // above so the before/after count and the exit code share one number.
         {
-            const analyzedFiles = result.metadata?.analyzedFiles;
-            // The `changed` command is always scoped, so the runner records the
-            // analyzed file list. If it is somehow absent we still derive the gate
-            // from the files that actually produced findings rather than falling
-            // back to the baseline gate — a silent soft-fail is the one outcome R1
-            // forbids.
-            const gateFiles = analyzedFiles && analyzedFiles.length > 0
-                ? analyzedFiles
-                : [...new Set(violations.map((v) => v.file).filter(Boolean))];
-            const diffGate = computeDiffGate(options.path, gateFiles);
-            const { blocking, resolutionGaps } = computeDiffGatingDecision(violations, diffGate);
             if (resolutionGaps.length > 0) {
-                // Spec 36 R6 — a gating rule that could not name an action is a defect
-                // in the rule. Record it loudly so it cannot route around as a count.
+                // Spec 45 R1 — a rule that could not name an action is a defect in the
+                // rule. Record it loudly so it cannot route around as a count.
                 const lines = [
-                    '⚠️  resolution gap — gating rule produced no next action for these occurrences (Spec 36 R6):',
+                    '⚠️  resolution gap — rule produced no next action for these occurrences (Spec 45 R1):',
                     ...resolutionGaps.map((g) => `  - ${g.rule} @ ${g.file}${g.line ? `:${g.line}` : ''}`),
                 ];
                 process.stderr.write(lines.join('\n') + '\n');
@@ -558,28 +553,6 @@ program
             if (blocking.length > 0) {
                 process.exit(2);
             }
-            // Spec 36 R7 — an unnecessary or reasonless suppression is itself an
-            // error. It is reported loudly and fails the write, exactly like an
-            // unused `@ts-expect-error`. A suppression that outlives its finding is
-            // a baseline entry with better branding unless it errors here.
-            const suppressions = result.metadata?.suppressions;
-            if (suppressions && (suppressions.unnecessary.length > 0 || suppressions.reasonless.length > 0)) {
-                const lines = [];
-                if (suppressions.reasonless.length > 0) {
-                    lines.push('❌ suppression missing a required reason (Spec 36 R7):');
-                    for (const d of suppressions.reasonless) {
-                        lines.push(`  - ${d.rule} @ ${d.file}:${d.line}`);
-                    }
-                }
-                if (suppressions.unnecessary.length > 0) {
-                    lines.push('❌ unnecessary suppression — the finding no longer fires (Spec 36 R7):');
-                    for (const d of suppressions.unnecessary) {
-                        lines.push(`  - ${d.rule} @ ${d.file}:${d.line}`);
-                    }
-                }
-                process.stderr.write(lines.join('\n') + '\n');
-                process.exit(2);
-            }
         }
         // Exit code based on --no-fail-on-zero-files (default-on in v3.4.8)
         // Any enabled analyzer matching zero source files is a failure — a >50%
@@ -599,6 +572,38 @@ program
         process.exit(1);
     }
 });
+// Spec 45 A2 — counts are emitted where useful (per analyzer, per rule, per
+// severity), on agent-facing surfaces as well as human ones. This reverts Spec
+// 36 R3's "no bare counts": an agent now sees the shape of what fired instead
+// of a single aggregate it could route around. The `before/after` gate figure
+// is Spec 45 R1's "report count before/after".
+function summarizeFindings(violations) {
+    const bySeverity = new Map();
+    const byAnalyzer = new Map();
+    const byRule = new Map();
+    for (const v of violations) {
+        const severity = v.severity ?? 'unknown';
+        bySeverity.set(severity, (bySeverity.get(severity) ?? 0) + 1);
+        const analyzer = v.analyzer ?? 'unknown';
+        byAnalyzer.set(analyzer, (byAnalyzer.get(analyzer) ?? 0) + 1);
+        const rule = v.rule || v.type || 'unknown';
+        byRule.set(rule, (byRule.get(rule) ?? 0) + 1);
+    }
+    return { bySeverity, byAnalyzer, byRule };
+}
+function groupedCounts(map, sep = ', ') {
+    return [...map.entries()]
+        .sort((a, b) => b[1] - a[1] || a[0].localeCompare(b[0]))
+        .map(([k, n]) => `${k} ${n}`)
+        .join(sep);
+}
+function printCountSummary(violations) {
+    const { bySeverity, byAnalyzer, byRule } = summarizeFindings(violations);
+    console.log(chalk.gray('── Findings ────────────────────────────────────'));
+    console.log(`${violations.length} total · ${groupedCounts(bySeverity, ' · ')}`);
+    console.log(`by analyzer: ${groupedCounts(byAnalyzer)}`);
+    console.log(`by rule: ${groupedCounts(byRule)}`);
+}
 // Self-audit gate (Spec 33 Item 15 + Spec 44 remediation). Runs the full
 // analyzer pipeline over the tool's own production source and asserts zero
 // *blocking* (critical/warning) findings in the self-audit scope — the same
@@ -630,7 +635,7 @@ function isSelfAuditInScope(file) {
 }
 program
     .command('self-audit [paths...]')
-    .description('Audit the tool\'s own analyzers/ + languages/ source and fail on blocking findings')
+    .description('Audit the tool\'s own analyzers/ + languages/ source and fail on blocking readings')
     .option('--json', 'Output violations as machine-readable JSON to stdout')
     .option('--stdin', 'Read file paths from stdin (one per line)')
     .option('-p, --path <projectPath>', 'Project root path', process.cwd())
@@ -710,8 +715,9 @@ program
             process.stdout.write(JSON.stringify(jsonOutput, null, 2) + '\n');
         }
         else if (blocking.length > 0) {
-            // Spec 36 R3: emit findings only, never an aggregate total.
-            console.log(chalk.red(`\n${blocking.length} self-audit blocking finding(s):`));
+            // Spec 45 A2 — counts plus findings (per analyzer/rule/severity).
+            console.log(chalk.red('\nSelf-audit blocking readings:'));
+            printCountSummary(blocking);
             for (const v of blocking) {
                 const icon = v.severity === 'critical' ? '🔴' :
                     v.severity === 'warning' ? '🟡' : '🔵';
@@ -719,7 +725,7 @@ program
             }
         }
         else {
-            console.log(chalk.green('\n✓ Self-audit clean — zero blocking findings in scope.'));
+            console.log(chalk.green('\n✓ Self-audit clean — zero blocking readings in scope.'));
         }
         if (blocking.length > 0)
             process.exit(2);
@@ -740,7 +746,7 @@ program
 // skipping the file.
 program
     .command('next-file')
-    .description('Audit and return the highest-priority file with findings (file-by-file refactor loop)')
+    .description('Audit and return the highest-priority file with readings (file-by-file refactor loop)')
     .option('-p, --path <projectPath>', 'Project root path', process.cwd())
     .option('-c, --config <config>', 'Configuration name')
     .option('--json', 'Output a single JSON object (or {done:true}) to stdout')
@@ -758,7 +764,7 @@ program
                 process.stdout.write(JSON.stringify({ done: true, summary }, null, 2) + '\n');
             }
             else {
-                console.log(chalk.green('\n✓ No findings — nothing left to refactor.'));
+                console.log(chalk.green('\n✓ No readings — nothing left to refactor.'));
             }
             return;
         }
@@ -804,9 +810,9 @@ program
         else {
             console.log(chalk.blue('🔍 Next File to Refactor'));
             console.log(chalk.gray('══════════════════════════════════════════════════'));
-            console.log(`\n${chalk.bold(relativize(top.file))} — ${top.count} finding(s), highest severity ${top.maxSeverity}`);
-            console.log(chalk.gray(`${ranked.length - 1} more file(s) with findings · ${violations.length - top.count} remaining finding(s)`));
-            console.log(chalk.gray('\n── Findings ────────────────────────────────────────'));
+            console.log(`\n${chalk.bold(relativize(top.file))} — ${top.count} reading(s), highest severity ${top.maxSeverity}`);
+            console.log(chalk.gray(`${ranked.length - 1} more file(s) with readings · ${violations.length - top.count} remaining reading(s)`));
+            console.log(chalk.gray('\n── Readings ────────────────────────────────────────'));
             for (const v of ordered) {
                 const icon = v.severity === 'critical' ? '🔴' : v.severity === 'warning' ? '🟡' : '🔵';
                 console.log(`${icon} ${chalk.bold(relativize(v.file || ''))}${v.line ? `:${v.line}` : ''} [${v.severity}] ${v.rule} — ${v.message}`);
@@ -821,7 +827,7 @@ program
 // Baseline command (Spec 18 R1)
 program
     .command('baseline')
-    .description('Snapshot current advisory findings as the baseline (excludes invariants)')
+    .description('Snapshot current advisory readings as the baseline (excludes invariants)')
     .option('-p, --path <path>', 'Project path', process.cwd())
     .option('--json', 'Output as JSON')
     .action(async (options) => {
@@ -872,7 +878,7 @@ program
             const absorbed = diff?.absorbed ?? newBaseline.entries.length;
             const fixed = diff?.fixed ?? 0;
             const totalKnown = newBaseline.entries.length;
-            console.log(chalk.green(`\n✓ Baseline updated: ${absorbed} finding${absorbed !== 1 ? 's' : ''} absorbed, ${fixed} fixed, ${totalKnown} total known.`));
+            console.log(chalk.green(`\n✓ Baseline updated: ${absorbed} reading${absorbed !== 1 ? 's' : ''} absorbed, ${fixed} fixed, ${totalKnown} total known.`));
             console.log(chalk.gray('Invariants excluded (they always enforce).'));
             if (totalKnown > 0) {
                 console.log(chalk.gray(`\nRun ${chalk.cyan('code-audit')} to see your delta view.`));
@@ -2038,7 +2044,7 @@ ledgerCmd
 });
 ledgerCmd
     .command('trends')
-    .description('Compare consecutive full-audit runs and report new vs fixed findings per rule')
+    .description('Compare consecutive full-audit runs and report new vs fixed readings per rule')
     .option('--since <runId>', 'Only consider runs after this run ID')
     .option('--json', 'Output as JSON')
     .action(async (options) => {
@@ -2956,9 +2962,9 @@ program
 // tracked count, no state that can drift from the code.
 program
     .command('outstanding')
-    .description('List outstanding findings, re-derived from the codebase (never a stored list)')
+    .description('List outstanding readings, re-derived from the codebase (never a stored list)')
     .option('-p, --path <path>', 'Path to audit', process.cwd())
-    .option('--json', 'Output findings as machine-readable JSON')
+    .option('--json', 'Output readings as machine-readable JSON')
     .action(async (options) => {
     try {
         await initParsers();
@@ -3000,20 +3006,18 @@ program
                     line: v.line ?? v.start?.line,
                     message: v.message,
                     resolution: v.resolution ?? null,
-                    suppressed: v.suppressed === true,
-                    ...(v.suppressionReason && { suppressionReason: v.suppressionReason }),
                 };
             });
             process.stdout.write(JSON.stringify(out, null, 2) + '\n');
             return;
         }
-        // Spec 36 R3 — findings, never a total. Each line is a file:line finding;
-        // there is no count anywhere in this output to route around.
+        // Spec 45 A2 — counts plus findings (per analyzer/rule/severity).
+        printCountSummary(sorted);
+        console.log('');
         for (const v of sorted) {
             const icon = v.severity === 'critical' ? '🔴' :
                 v.severity === 'warning' ? '🟡' : '🔵';
-            const suppressed = v.suppressed ? chalk.dim(' [suppressed]') : '';
-            console.log(`${icon} ${chalk.bold(v.file)}${v.line ? `:${v.line}` : ''} [${v.rule || v.severity}] ${v.message}${suppressed}`);
+            console.log(`${icon} ${chalk.bold(v.file)}${v.line ? `:${v.line}` : ''} [${v.rule || v.severity}] ${v.message}`);
         }
     }
     catch (error) {
@@ -3184,7 +3188,7 @@ async function generateConfigurations(options) {
     console.log(chalk.blue('\nNext steps:'));
     console.log(chalk.gray('  1. Edit .codeauditor.json to match your codebase conventions'));
     console.log(chalk.gray('  2. Run ') + chalk.cyan('code-audit') + chalk.gray(' to enforce your rules'));
-    console.log(chalk.gray('  3. Use ') + chalk.cyan('code-audit changed') + chalk.gray(' in your agent hook (gating rules block on new findings)'));
+    console.log(chalk.gray('  3. Use ') + chalk.cyan('code-audit changed') + chalk.gray(' in your agent hook (gating rules block on new readings)'));
 }
 /**
  * Interactive rule builder — walks the user through adding rules one at a time.