code-auditor-mcp 3.9.0 → 3.9.2

package/dist/cli.js

@@ -13,7 +13,6 @@ import { promises as fs } from 'fs';
 import { createInterface } from 'readline';
 import { fileURLToPath } from 'url';
 import { dirname, isAbsolute, join, relative, resolve } from 'path';
-import { DEFAULT_PORT } from './constants.js';
 import inquirer from 'inquirer';
 import { CodeMapGenerator } from './services/CodeMapGenerator.js';
 import { initParsers } from './languages/index.js';
@@ -23,7 +22,7 @@ import { getFilesProcessed, getFactsConsumed, isVisitorStatus, isReducerStatus }
 import { createBaselineFromFindings, saveBaseline, loadBaseline, diffBaselines } from './baseline.js';
 import { ALL_ANALYZERS } from './analyzers/ruleRegistry.js';
 import { computeGatingDecision } from './enforcement/gate.js';
-import { DEFAULT_BLOCKING_SEVERITIES } from './config/defaults.js';
+import { BLOCKING_SEVERITIES } from './types.js';
 import { rankFilesByPriority, orderFindingsWithinFile } from './nextFile.js';
 import { runNextFile } from './nextFileIncremental.js';
 import { describeSqliteBackend } from './sqlite/driver.js';
@@ -114,7 +113,7 @@ program
     try {
         await initParsers();
         // Validate --fail-on severity
-        const validSeverities = ['critical', 'warning', 'suggestion'];
+        const validSeverities = ['critical', 'severe', 'high'];
         const failOnSeverity = options.failOn;
         if (failOnSeverity && !validSeverities.includes(failOnSeverity)) {
             console.error(chalk.red(`Invalid --fail-on severity: "${failOnSeverity}". Must be one of: ${validSeverities.join(', ')}`));
@@ -173,7 +172,7 @@ program
                 console.log(chalk.gray(`\n── New readings (${newViolations.length}) ──────────────────────────`));
                 for (const v of newViolations) {
                     const icon = v.severity === 'critical' ? '🔴' :
-                        v.severity === 'warning' ? '🟡' : '🔵';
+                        v.severity === 'severe' ? '🟠' : '🟡';
                     console.log(`${icon} ${chalk.bold(v.file)}${v.line ? `:${v.line}` : ''} [${v.severity}] ${v.message}`);
                 }
             }
@@ -218,18 +217,18 @@ program
             // No baseline: current behavior + hint
             console.log(`\nFound ${result.summary.totalViolations} readings`);
             console.log(`Critical: ${result.summary.criticalIssues}`);
-            console.log(`Warnings: ${result.summary.warnings}`);
-            console.log(`Suggestions: ${result.summary.suggestions}`);
-            console.log(chalk.gray(`\nEvery reading is a measurement, not a verdict — severity is triage, the order to act.`));
+            console.log(`Severe: ${result.summary.severe}`);
+            console.log(`High: ${result.summary.high}`);
+            console.log(chalk.gray(`\nEvery reading is a defect — severity is urgency, the order to act.`));
             console.log(chalk.gray(`\n💡 Run ${chalk.cyan('code-audit baseline')} to adopt the ratchet and track changes over time.`));
         }
         else {
             // --full with baseline: full itemized inventory (current behavior)
             console.log(`\nFound ${result.summary.totalViolations} readings`);
             console.log(`Critical: ${result.summary.criticalIssues}`);
-            console.log(`Warnings: ${result.summary.warnings}`);
-            console.log(`Suggestions: ${result.summary.suggestions}`);
-            console.log(chalk.gray(`\nEvery reading is a measurement, not a verdict — severity is triage, the order to act.`));
+            console.log(`Severe: ${result.summary.severe}`);
+            console.log(`High: ${result.summary.high}`);
+            console.log(chalk.gray(`\nEvery reading is a defect — severity is urgency, the order to act.`));
         }
         // Spec 44 R4 — file accounting: analyzed/dropped totals + optional breakdown.
         printFileAccounting(result, !!options.explainSkipped);
@@ -319,11 +318,12 @@ program
             }
         }
         // Spec-20 R4: built-in profile visibility — silent behavior changes
-        // are never acceptable. Notify when scripts-and-tests capped findings.
+        // are never acceptable. Notify when scripts-and-tests excludes findings
+        // from the blocking gate.
         const builtinCapped = Object.values(result.analyzerResults)
             .reduce((count, ar) => count + ar.violations.filter(v => v.profile === 'scripts-and-tests').length, 0);
         if (builtinCapped > 0) {
-            console.log(chalk.blue(`\nℹ️  ${builtinCapped.toLocaleString()} readings capped by built-in profile "scripts-and-tests" (scripts/tests/fixtures → suggestion).`));
+            console.log(chalk.blue(`\nℹ️  ${builtinCapped.toLocaleString()} readings excluded from the blocking gate by built-in profile "scripts-and-tests" (scripts/tests/fixtures).`));
             console.log(chalk.gray(`   Set ${chalk.cyan('"builtin": false')} in .codeauditor.json to disable.`));
         }
         // Generate formatted report if --format is specified
@@ -378,7 +378,7 @@ program
             const evaluableViolations = (baseline && !options.includeBaseline)
                 ? violations.filter((v) => v.new || v.analyzer === 'invariants')
                 : violations;
-            const severityOrder = ['critical', 'warning', 'suggestion'];
+            const severityOrder = ['critical', 'severe', 'high'];
             const failIndex = severityOrder.indexOf(failOnSeverity);
             const hasAtOrAbove = evaluableViolations.some((v) => {
                 const vIndex = severityOrder.indexOf(v.severity);
@@ -466,16 +466,13 @@ program
         }
         // Collect all violations
         const violations = Object.values(result.analyzerResults).flatMap((r) => r.violations || []);
-        // Blocking gate decision (Spec 45 R1/R2/R4), computed once so the
+        // Blocking gate decision (Spec 45 R1/R4, Spec 54 R3), computed once so the
         // agent-facing before/after count (Spec 45 A2) and the exit code agree on
-        // the same number. Every registered rule participates (R1); severity
-        // decides (R2); enforcement is not diff-scoped (R4). No rule is removed
-        // from the gate for speed (Spec 45 A1).
-        const configuredGateSeverities = result.metadata.configUsed?.gateSeverities;
-        const blockingSeverities = new Set(Array.isArray(configuredGateSeverities) && configuredGateSeverities.length > 0
-            ? configuredGateSeverities
-            : DEFAULT_BLOCKING_SEVERITIES);
-        const { blocking, resolutionGaps } = computeGatingDecision(violations, blockingSeverities);
+        // the same number. Every registered rule participates (R1); enforcement is
+        // not diff-scoped (R4). Spec 54: the blocking set is the fixed all-three
+        // {critical, severe, high} — every finding is a defect and every finding
+        // blocks; there is no configurable gate.
+        const { blocking, resolutionGaps } = computeGatingDecision(violations, BLOCKING_SEVERITIES);
         // JSON output
         if (options.format === 'sarif') {
             const { generateSARIFReport } = await import('./reporting/sarifReportGenerator.js');
@@ -528,7 +525,7 @@ program
                 console.log(chalk.gray('── Violations ────────────────────────────────────'));
                 for (const v of violations) {
                     const icon = v.severity === 'critical' ? '🔴' :
-                        v.severity === 'warning' ? '🟡' : '🔵';
+                        v.severity === 'severe' ? '🟠' : '🟡';
                     const statusTag = v.new === false
                         ? chalk.dim(' [known — still open]')
                         : '';
@@ -631,9 +628,8 @@ function printCountSummary(violations) {
 }
 /**
  * Reconstruct a `changed`-compatible result from daemon-served diagnostics so the
- * gate/output logic below stays identical to the in-process path. Gate severities
- * are read from the project config (one JSON file, no parsing) so a custom
- * `gateSeverities` never diverges from what the in-process run would have used.
+ * gate/output logic below stays identical to the in-process path. The blocking
+ * set is the fixed all-three set (Spec 54 R3) — there is no config to read.
  */
 async function buildChangedResultFromDiagnostics(violations, projectRoot) {
     const analyzerResults = {};
@@ -641,23 +637,11 @@ async function buildChangedResultFromDiagnostics(violations, projectRoot) {
         const key = v.analyzer || 'unknown';
         (analyzerResults[key] = analyzerResults[key] || { violations: [] }).violations.push(v);
     }
-    let configUsed;
-    try {
-        const { findConfigFileUp, loadConfig } = await import('./config/configLoader.js');
-        const configPath = await findConfigFileUp(projectRoot);
-        const config = await loadConfig({ configPath: configPath ?? undefined });
-        if (Array.isArray(config.gateSeverities) && config.gateSeverities.length > 0) {
-            configUsed = { gateSeverities: config.gateSeverities };
-        }
-    }
-    catch {
-        // No config — the gate falls back to DEFAULT_BLOCKING_SEVERITIES, matching in-process.
-    }
-    return { analyzerResults, metadata: { configUsed, diagnostics: [] } };
+    return { analyzerResults, metadata: { configUsed: undefined, diagnostics: [] } };
 }
 // Self-audit gate (Spec 33 Item 15 + Spec 44 remediation). Runs the full
 // analyzer pipeline over the tool's own production source and asserts zero
-// *blocking* (critical/warning) findings in the self-audit scope — the same
+// *blocking* (critical/severe/high) findings in the self-audit scope — the same
 // scope + severity contract as scripts/verify-self.mjs, but callable from the
 // shipped CLI so the edit-time plugin hook can enforce it. `verify:self` (the
 // release gate) stays authoritative; this command is its per-edit sibling.
@@ -690,11 +674,11 @@ program
     .option('--json', 'Output violations as machine-readable JSON to stdout')
     .option('--stdin', 'Read file paths from stdin (one per line)')
     .option('-p, --path <projectPath>', 'Project root path', process.cwd())
-    .option('--fail-on <severity>', 'Blocking severity floor: critical, warning, or suggestion', 'warning')
+    .option('--fail-on <severity>', 'Blocking severity floor: critical, severe, or high', 'high')
     .action(async (paths, options) => {
     try {
         await initParsers();
-        const validSeverities = ['critical', 'warning', 'suggestion'];
+        const validSeverities = ['critical', 'severe', 'high'];
         const failOnSeverity = options.failOn;
         if (!validSeverities.includes(failOnSeverity)) {
             console.error(chalk.red(`Invalid --fail-on severity: "${failOnSeverity}". Must be one of: ${validSeverities.join(', ')}`));
@@ -731,7 +715,7 @@ program
         });
         const result = await runner.run();
         const violations = Object.values(result.analyzerResults).flatMap((r) => r.violations || []);
-        const severityOrder = ['critical', 'warning', 'suggestion'];
+        const severityOrder = ['critical', 'severe', 'high'];
         const failIndex = severityOrder.indexOf(failOnSeverity);
         const blocking = violations.filter((v) => {
             if (!isSelfAuditInScope(v.file ?? ''))
@@ -771,7 +755,7 @@ program
             printCountSummary(blocking);
             for (const v of blocking) {
                 const icon = v.severity === 'critical' ? '🔴' :
-                    v.severity === 'warning' ? '🟡' : '🔵';
+                    v.severity === 'severe' ? '🟠' : '🟡';
                 console.log(`${icon} ${v.file}${v.line ? `:${v.line}` : ''} [${v.severity}] ${v.message}`);
             }
         }
@@ -848,7 +832,7 @@ function printNextFile(violations, summary, projectDir, json) {
         return;
     }
     const top = ranked[0];
-    // Every issue on the file, ordered critical → warning → suggestion.
+    // Every issue on the file, ordered critical → severe → high.
     const ordered = orderFindingsWithinFile(top.violations);
     const relativize = (filePath) => {
         if (!filePath)
@@ -892,7 +876,7 @@ function printNextFile(violations, summary, projectDir, json) {
         console.log(chalk.gray(`${ranked.length - 1} more file(s) with readings · ${violations.length - top.count} remaining reading(s)`));
         console.log(chalk.gray('\n── Readings ────────────────────────────────────────'));
         for (const v of ordered) {
-            const icon = v.severity === 'critical' ? '🔴' : v.severity === 'warning' ? '🟡' : '🔵';
+            const icon = v.severity === 'critical' ? '🔴' : v.severity === 'severe' ? '🟠' : '🟡';
             console.log(`${icon} ${chalk.bold(relativize(v.file || ''))}${v.line ? `:${v.line}` : ''} [${v.severity}] ${v.rule} — ${v.message}`);
         }
     }
@@ -983,19 +967,6 @@ program
         process.exit(1);
     }
 });
-// Start server command (placeholder - will be implemented later)
-program
-    .command('start')
-    .description('Start the MCP server')
-    .option('-p, --port <port>', 'Server port', String(DEFAULT_PORT))
-    .option('-m, --mcp-mode', 'Start in MCP stdio mode')
-    .option('-r, --rest-api', 'Enable REST API endpoints')
-    .option('-i, --index <path>', 'Path to index on startup')
-    .action(async (options) => {
-    console.log(chalk.yellow('Server start will be implemented in a future task'));
-    console.log('Options:', options);
-    // TODO: Implement server start
-});
 // Index command
 const indexCmd = program
     .command('index')
@@ -1205,7 +1176,7 @@ configCmd
                     console.log(chalk.blue(`\n${rules.length} rule(s) in ${configPath}`));
                     console.log(chalk.gray('──────────────────────────────────────────'));
                     for (const r of rules) {
-                        const sevIcon = r.severity === 'critical' ? '🔴' : r.severity === 'warning' ? '🟡' : '🔵';
+                        const sevIcon = r.severity === 'critical' ? '🔴' : r.severity === 'severe' ? '🟠' : '🟡';
                         console.log(`${sevIcon} ${chalk.bold(r.id)}  [${r.kind}] ${chalk.dim(r.severity)}`);
                         if (r.message)
                             console.log(`   ${r.message}`);
@@ -1565,15 +1536,6 @@ program
         process.exit(1);
     }
 });
-// Test command (placeholder - will be implemented later)
-program
-    .command('test <tool>')
-    .description('Test connection to AI tool')
-    .action(async (tool) => {
-    console.log(chalk.yellow('Test command will be implemented in a future task'));
-    console.log('Tool:', tool);
-    // TODO: Implement connection testing
-});
 // Code map command
 program
     .command('map')
@@ -1842,7 +1804,7 @@ tasksCmd
     .command('from-audit')
     .description('Populate tasks from audit violations')
     .option('--auditJobId <id>', 'Specific audit result ID')
-    .option('--severities <severities>', 'Comma-separated severities (critical,warning,suggestion)', 'critical,warning')
+    .option('--severities <severities>', 'Comma-separated severities (critical,severe,high)', 'critical,severe,high')
     .option('--json', 'Output as JSON')
     .action(async (options) => {
     try {
@@ -2204,7 +2166,7 @@ function spec41StatusBadge(status) {
 function spec41SeverityColor(severity) {
     if (severity === 'critical')
         return chalk.red;
-    if (severity === 'warning')
+    if (severity === 'severe')
         return chalk.yellow;
     return chalk.gray;
 }
@@ -2272,7 +2234,7 @@ async function runDetachedAudit(options) {
     });
     const defaultsJson = JSON.stringify({
         defaultAnalyzers: DETACHED_DEFAULT_ANALYZERS,
-        defaultMinSeverity: 'suggestion',
+        defaultMinSeverity: 'high',
         defaultGenerateCodeMap: false,
     });
     patchLedgerRun(db.rawDb, job.jobId, { stderrLog: logPath });
@@ -2353,7 +2315,7 @@ program
     .option('--rule <rule>', 'Filter by rule id')
     .option('--analyzer <analyzer>', 'Filter by analyzer')
     .option('--file <file>', 'Filter by file path (substring match)')
-    .option('--severity <severity>', 'Filter by severity (critical|warning|suggestion)')
+    .option('--severity <severity>', 'Filter by severity (critical|severe|high)')
     .option('--state [state]', 'Query coverage by state (fired|clean|notApplicable|cannot-fire|unassessed); omit value for all')
     .option('--count', 'Group findings by analyzer/rule with counts')
     .option('--limit <n>', 'Max findings to return (0 = unbounded)', '50')
@@ -2658,7 +2620,7 @@ function getNamingPattern(caseName) {
 program
     .command('install')
     .description('Install the code-auditor skill for AI coding tools')
-    .option('--agent <agent>', 'Target agent: claude, cursor, codex, gemini, agents, or all', 'all')
+    .option('--agent <agent>', 'Target agent: claude, cursor, codex, gemini, agents, zcode, or all', 'all')
     .option('--scope <scope>', 'Install scope: user (~) or project (.)', 'user')
     .option('--hooks', 'Offer hook wiring (default)', true)
     .option('--no-hooks', 'Skip hook wiring prompt')
@@ -3089,7 +3051,7 @@ program
         console.log('');
         for (const v of sorted) {
             const icon = v.severity === 'critical' ? '🔴' :
-                v.severity === 'warning' ? '🟡' : '🔵';
+                v.severity === 'severe' ? '🟠' : '🟡';
             console.log(`${icon} ${chalk.bold(v.file)}${v.line ? `:${v.line}` : ''} [${v.rule || v.severity}] ${v.message}`);
         }
     }
@@ -3303,7 +3265,7 @@ const SCAFFOLD_CONFIG = {
         {
             id: 'api-routes-naming',
             kind: 'naming',
-            severity: 'warning',
+            severity: 'severe',
             message: 'API route files must export a handler matching the HTTP method.',
             path: 'src/api/**',
             exports: '^(get|post|put|delete|patch)\\b',
@@ -3439,11 +3401,11 @@ async function buildRulesInteractively() {
                 type: 'list',
                 message: 'Severity:',
                 choices: [
-                    { name: chalk.red('Critical — exit code 2, blocks the edit'), value: 'critical' },
-                    { name: chalk.yellow('Warning — must fix; does not block the edit'), value: 'warning' },
-                    { name: chalk.blue('Suggestion — must fix; does not block the edit'), value: 'suggestion' },
+                    { name: chalk.red('Critical — exploitable or broken now'), value: 'critical' },
+                    { name: chalk.yellow('Severe — wrong, and it will surface'), value: 'severe' },
+                    { name: chalk.blue('High — wrong, and it has not bitten yet'), value: 'high' },
                 ],
-                default: 'warning',
+                default: 'high',
             },
             message: {
                 type: 'input',