code-auditor-mcp 3.9.4 → 3.9.9

package/dist/dataPaths.js

@@ -104,6 +104,27 @@ function getFallbackCacheRoot() {
     }
     return path.join(os.homedir(), '.cache', 'code-auditor');
 }
+/**
+ * OS-specific per-user config root for persistent, user-scoped state (the anonymous
+ * install ID and the telemetry opt-in). Deliberately NOT the cache root above: the
+ * cache is wiped by clean installs, and a regenerated install ID would break source
+ * grouping — this state must survive a cache wipe. This is the OS's designated
+ * location for exactly this kind of config, so it adds no new `~/` dotdir.
+ */
+export function getUserConfigRoot() {
+    const xdg = process.env.XDG_CONFIG_HOME?.trim();
+    if (xdg) {
+        return path.join(path.resolve(xdg), 'code-auditor');
+    }
+    if (process.platform === 'darwin') {
+        return path.join(os.homedir(), 'Library', 'Application Support', 'code-auditor');
+    }
+    if (process.platform === 'win32') {
+        const local = process.env.LOCALAPPDATA?.trim();
+        return path.join(local ? path.resolve(local) : os.homedir(), 'code-auditor');
+    }
+    return path.join(os.homedir(), '.config', 'code-auditor');
+}
 /**
  * Resolve symlinks (and other path aliases) so the same physical project
  * hashes identically regardless of how it was spelled. On macOS `/tmp` is a

package/dist/dataPaths.js.map

@@ -1 +1 @@
-{"version":3,"file":"dataPaths.js","sourceRoot":"","sources":["../src/dataPaths.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,yBAAyB,CAAC,WAAoB;IAC5D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,IAAI,EAAE,CAAC;IACtD,IAAI,GAAG,EAAE,CAAC;QACR,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,WAAW,CAAC,WAAW,CAAC,EAAE,UAAU,CAAC,CAAC;QACxF,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACxD,MAAM,WAAW,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;QAC9D,yEAAyE;QACzE,wEAAwE;QACxE,IAAI,WAAW,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,CAAC;YACpD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC,CAAC;QACpE,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACrC,CAAC;IAED,4EAA4E;IAC5E,OAAO,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,EAAE,UAAU,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC,CAAC;AACtF,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,uBAAuB,CAAC,WAAoB;IAC1D,OAAO,IAAI,CAAC,OAAO,CAAC,yBAAyB,CAAC,WAAW,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,uBAAuB,CAAC,WAAmB;IACzD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,EAAE,SAAS,CAAC,CAAC;IACzD,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,gBAAgB,WAAW,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;AACzE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,WAAmB;IACtD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,EAAE,MAAM,CAAC,CAAC;IACtD,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,gBAAgB,WAAW,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;AACxE,CAAC;AAED,8FAA8F;AAC9F,SAAS,kBAAkB,CAAC,KAAa;IACvC,IAAI,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9B,SAAS,CAAC;QACR,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QACjD,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YACrE,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,SAAS,oBAAoB;IAC3B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC;IAC/C,IAAI,GAAG,EAAE,CAAC;QACR,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC;QAC/C,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,OAAO,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,CAAS;IAChC,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;QACzE,2DAA2D;QAC3D,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACzB,CAAC;AACH,CAAC;AAED,oEAAoE;AACpE,SAAS,WAAW,CAAC,IAAY;IAC/B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC3F,CAAC"}
+{"version":3,"file":"dataPaths.js","sourceRoot":"","sources":["../src/dataPaths.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,yBAAyB,CAAC,WAAoB;IAC5D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,IAAI,EAAE,CAAC;IACtD,IAAI,GAAG,EAAE,CAAC;QACR,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,WAAW,CAAC,WAAW,CAAC,EAAE,UAAU,CAAC,CAAC;QACxF,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACxD,MAAM,WAAW,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;QAC9D,yEAAyE;QACzE,wEAAwE;QACxE,IAAI,WAAW,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,CAAC;YACpD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC,CAAC;QACpE,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACrC,CAAC;IAED,4EAA4E;IAC5E,OAAO,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,EAAE,UAAU,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC,CAAC;AACtF,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,uBAAuB,CAAC,WAAoB;IAC1D,OAAO,IAAI,CAAC,OAAO,CAAC,yBAAyB,CAAC,WAAW,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,uBAAuB,CAAC,WAAmB;IACzD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,EAAE,SAAS,CAAC,CAAC;IACzD,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,gBAAgB,WAAW,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;AACzE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,WAAmB;IACtD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,EAAE,MAAM,CAAC,CAAC;IACtD,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,gBAAgB,WAAW,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;AACxE,CAAC;AAED,8FAA8F;AAC9F,SAAS,kBAAkB,CAAC,KAAa;IACvC,IAAI,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9B,SAAS,CAAC;QACR,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QACjD,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YACrE,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,SAAS,oBAAoB;IAC3B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC;IAC/C,IAAI,GAAG,EAAE,CAAC;QACR,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC;QAC/C,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,OAAO,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB;IAC/B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC;IAChD,IAAI,GAAG,EAAE,CAAC;QACR,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,qBAAqB,EAAE,cAAc,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC;QAC/C,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,cAAc,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,CAAS;IAChC,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;QACzE,2DAA2D;QAC3D,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACzB,CAAC;AACH,CAAC;AAED,oEAAoE;AACpE,SAAS,WAAW,CAAC,IAAY;IAC/B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC3F,CAAC"}

package/dist/dismissals.d.ts

@@ -0,0 +1,59 @@
+import type { AuditResult, Violation } from './types.js';
+/** One dismissed finding. `reason` is the product — a dismissal without one is a suppression. */
+export interface DismissalEntry {
+    /** SHA-256 fingerprint of [analyzer, rule, file, symbol] — the scoping key. */
+    fingerprint: string;
+    /** Canonical rule ID, for grouping/readability (R4) and the telemetry payload (R2). */
+    rule: string;
+    /** File path at dismissal time, for readability (the fingerprint is the identity). */
+    file: string;
+    /** Canonical symbol at dismissal time, for readability. */
+    symbol: string;
+    /** Why this finding was dismissed — REQUIRED. The reason is the product. */
+    reason: string;
+    /** ISO-8601 timestamp of the dismissal. */
+    dismissedAt: string;
+    /** Tool version (package.json) at dismissal time. */
+    toolVersion: string;
+}
+/** The committed dismissals file. */
+export interface DismissalsFile {
+    schemaVersion: 1;
+    entries: DismissalEntry[];
+}
+/** Result of matching a run's findings against the dismissals file. */
+export interface DismissalMatch {
+    /** Findings whose fingerprint is dismissed — they never gate. */
+    dismissed: Violation[];
+    /** Findings with no matching dismissal — they gate normally. */
+    active: Violation[];
+}
+/**
+ * Load the dismissals file from the project root. Returns `null` when absent.
+ *
+ * When the file exists but is structurally invalid (wrong schema version, or an
+ * entry missing a non-empty `fingerprint`/`reason`), a config error is reported
+ * to stderr and `null` is returned — the run proceeds with zero dismissals
+ * rather than silently honouring a malformed suppression list.
+ */
+export declare function loadDismissals(projectRoot: string): DismissalsFile | null;
+/** Write the dismissals file to the project root (committed, reviewable in a diff). */
+export declare function saveDismissals(projectRoot: string, dismissals: DismissalsFile): void;
+/** Build a dismissal entry from a live violation and a required reason. */
+export declare function buildDismissalEntry(violation: Violation, reason: string, toolVersion: string): DismissalEntry;
+/**
+ * Add (or replace) a dismissal entry, keyed by fingerprint. Idempotent: re-
+ * dismissing an already-dismissed finding updates its reason and timestamp.
+ */
+export declare function upsertDismissal(projectRoot: string, entry: DismissalEntry): DismissalsFile;
+/**
+ * Partition a run's findings into dismissed vs active by fingerprint.
+ */
+export declare function matchDismissals(violations: Violation[], dismissals: DismissalsFile): DismissalMatch;
+/**
+ * Apply dismissals to a completed audit result: mark dismissed findings so the
+ * gate skips them, and record the dismissed count in the summary (never subtracted
+ * from `totalViolations`).
+ */
+export declare function applyDismissals(result: AuditResult, projectRoot: string): void;
+//# sourceMappingURL=dismissals.d.ts.map

package/dist/dismissals.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dismissals.d.ts","sourceRoot":"","sources":["../src/dismissals.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAIzD,iGAAiG;AACjG,MAAM,WAAW,cAAc;IAC7B,+EAA+E;IAC/E,WAAW,EAAE,MAAM,CAAC;IACpB,uFAAuF;IACvF,IAAI,EAAE,MAAM,CAAC;IACb,sFAAsF;IACtF,IAAI,EAAE,MAAM,CAAC;IACb,2DAA2D;IAC3D,MAAM,EAAE,MAAM,CAAC;IACf,4EAA4E;IAC5E,MAAM,EAAE,MAAM,CAAC;IACf,2CAA2C;IAC3C,WAAW,EAAE,MAAM,CAAC;IACpB,qDAAqD;IACrD,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,qCAAqC;AACrC,MAAM,WAAW,cAAc;IAC7B,aAAa,EAAE,CAAC,CAAC;IACjB,OAAO,EAAE,cAAc,EAAE,CAAC;CAC3B;AAED,uEAAuE;AACvE,MAAM,WAAW,cAAc;IAC7B,iEAAiE;IACjE,SAAS,EAAE,SAAS,EAAE,CAAC;IACvB,gEAAgE;IAChE,MAAM,EAAE,SAAS,EAAE,CAAC;CACrB;AASD;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAyBzE;AAED,uFAAuF;AACvF,wBAAgB,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,cAAc,GAAG,IAAI,CAGpF;AAID,2EAA2E;AAC3E,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,cAAc,CAW7G;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,GAAG,cAAc,CAU1F;AAID;;GAEG;AACH,wBAAgB,eAAe,CAC7B,UAAU,EAAE,SAAS,EAAE,EACvB,UAAU,EAAE,cAAc,GACzB,cAAc,CAchB;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,CAY9E"}

package/dist/dismissals.js

@@ -0,0 +1,128 @@
+/**
+ * Spec 57 — Dismissals.
+ *
+ * A dismissal clears exactly one finding, scoped by its fingerprint (rule +
+ * file + symbol, via the shared `buildFingerprintInput`/`fingerprint` tuple the
+ * baseline, SARIF and tasks already use). It is a *decision about specific code*,
+ * not configuration, so it lives in its own committed dotfile — never in
+ * `.codeauditor.json`.
+ *
+ * What distinguishes a dismissal from a baseline (which was repeatedly rejected
+ * because it accumulates and nobody revisits it):
+ *
+ *   - a **written reason is required** (a dismissal without one is a config error),
+ *   - it is **scoped to one finding** (not the rule, not the file), and
+ *   - it is **counted in every report** ("43 findings, 3 dismissed"), never
+ *     silently subtracted from the total.
+ */
+import { readFileSync, writeFileSync, existsSync } from 'node:fs';
+import path from 'node:path';
+import { fingerprint, buildFingerprintInput } from './fingerprint.js';
+import { canonicalRuleId } from './ruleAliases.js';
+import { extractSymbol } from './symbols.js';
+// ── Constants ────────────────────────────────────────────────────────────────
+const DISMISSALS_FILENAME = '.codeauditor.dismissals.json';
+const SCHEMA_VERSION = 1;
+// ── Load / save ──────────────────────────────────────────────────────────────
+/**
+ * Load the dismissals file from the project root. Returns `null` when absent.
+ *
+ * When the file exists but is structurally invalid (wrong schema version, or an
+ * entry missing a non-empty `fingerprint`/`reason`), a config error is reported
+ * to stderr and `null` is returned — the run proceeds with zero dismissals
+ * rather than silently honouring a malformed suppression list.
+ */
+export function loadDismissals(projectRoot) {
+    const filePath = path.join(projectRoot, DISMISSALS_FILENAME);
+    try {
+        if (!existsSync(filePath))
+            return null;
+        const parsed = JSON.parse(readFileSync(filePath, 'utf-8'));
+        if (!parsed || parsed.schemaVersion !== SCHEMA_VERSION || !Array.isArray(parsed.entries)) {
+            console.error(`Dismissals file has an unsupported shape (expected schemaVersion ${SCHEMA_VERSION} with an "entries" array): ${filePath}`);
+            return null;
+        }
+        const invalid = parsed.entries.filter((e) => typeof e.fingerprint !== 'string' || !e.fingerprint || typeof e.reason !== 'string' || !e.reason.trim());
+        if (invalid.length > 0) {
+            console.error(`Dismissals file has ${invalid.length} entry(ies) missing a fingerprint or a non-empty reason ` +
+                `(a dismissal without a reason is a config error, not a suppression): ${filePath}`);
+            return null;
+        }
+        return parsed;
+    }
+    catch {
+        return null;
+    }
+}
+/** Write the dismissals file to the project root (committed, reviewable in a diff). */
+export function saveDismissals(projectRoot, dismissals) {
+    const filePath = path.join(projectRoot, DISMISSALS_FILENAME);
+    writeFileSync(filePath, JSON.stringify(dismissals, null, 2) + '\n', 'utf-8');
+}
+// ── Mutation ─────────────────────────────────────────────────────────────────
+/** Build a dismissal entry from a live violation and a required reason. */
+export function buildDismissalEntry(violation, reason, toolVersion) {
+    const input = buildFingerprintInput(violation);
+    return {
+        fingerprint: fingerprint(input),
+        rule: canonicalRuleId(violation.rule ?? ''),
+        file: violation.file ?? '',
+        symbol: extractSymbol(violation),
+        reason,
+        dismissedAt: new Date().toISOString(),
+        toolVersion,
+    };
+}
+/**
+ * Add (or replace) a dismissal entry, keyed by fingerprint. Idempotent: re-
+ * dismissing an already-dismissed finding updates its reason and timestamp.
+ */
+export function upsertDismissal(projectRoot, entry) {
+    const dismissals = loadDismissals(projectRoot) ?? { schemaVersion: SCHEMA_VERSION, entries: [] };
+    const existing = dismissals.entries.find((e) => e.fingerprint === entry.fingerprint);
+    if (existing) {
+        Object.assign(existing, entry);
+    }
+    else {
+        dismissals.entries.push(entry);
+    }
+    saveDismissals(projectRoot, dismissals);
+    return dismissals;
+}
+// ── Matching ─────────────────────────────────────────────────────────────────
+/**
+ * Partition a run's findings into dismissed vs active by fingerprint.
+ */
+export function matchDismissals(violations, dismissals) {
+    const dismissalMap = new Map();
+    for (const entry of dismissals.entries)
+        dismissalMap.set(entry.fingerprint, entry);
+    const dismissed = [];
+    const active = [];
+    for (const v of violations) {
+        const fp = fingerprint(buildFingerprintInput(v));
+        if (dismissalMap.has(fp))
+            dismissed.push(v);
+        else
+            active.push(v);
+    }
+    return { dismissed, active };
+}
+/**
+ * Apply dismissals to a completed audit result: mark dismissed findings so the
+ * gate skips them, and record the dismissed count in the summary (never subtracted
+ * from `totalViolations`).
+ */
+export function applyDismissals(result, projectRoot) {
+    const dismissals = loadDismissals(projectRoot);
+    result.summary.dismissed = 0;
+    if (!dismissals)
+        return;
+    const violations = Object.values(result.analyzerResults).flatMap((r) => r.violations);
+    const { dismissed } = matchDismissals(violations, dismissals);
+    for (const v of dismissed) {
+        v.dismissed = true;
+    }
+    result.summary.dismissed = dismissed.length;
+}
+//# sourceMappingURL=dismissals.js.map

package/dist/dismissals.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dismissals.js","sourceRoot":"","sources":["../src/dismissals.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAClE,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAqC7C,gFAAgF;AAEhF,MAAM,mBAAmB,GAAG,8BAA8B,CAAC;AAC3D,MAAM,cAAc,GAAG,CAAC,CAAC;AAEzB,gFAAgF;AAEhF;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,WAAmB;IAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC;IAC7D,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QACvC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,aAAa,KAAK,cAAc,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YACzF,OAAO,CAAC,KAAK,CACX,oEAAoE,cAAc,8BAA8B,QAAQ,EAAE,CAC3H,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CACnC,CAAC,CAAM,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,WAAW,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CACpH,CAAC;QACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO,CAAC,KAAK,CACX,uBAAuB,OAAO,CAAC,MAAM,0DAA0D;gBAC7F,wEAAwE,QAAQ,EAAE,CACrF,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,MAAwB,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,cAAc,CAAC,WAAmB,EAAE,UAA0B;IAC5E,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC;IAC7D,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;AAC/E,CAAC;AAED,gFAAgF;AAEhF,2EAA2E;AAC3E,MAAM,UAAU,mBAAmB,CAAC,SAAoB,EAAE,MAAc,EAAE,WAAmB;IAC3F,MAAM,KAAK,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC;IAC/C,OAAO;QACL,WAAW,EAAE,WAAW,CAAC,KAAK,CAAC;QAC/B,IAAI,EAAE,eAAe,CAAC,SAAS,CAAC,IAAI,IAAI,EAAE,CAAC;QAC3C,IAAI,EAAE,SAAS,CAAC,IAAI,IAAI,EAAE;QAC1B,MAAM,EAAE,aAAa,CAAC,SAAS,CAAC;QAChC,MAAM;QACN,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACrC,WAAW;KACZ,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,WAAmB,EAAE,KAAqB;IACxE,MAAM,UAAU,GAAG,cAAc,CAAC,WAAW,CAAC,IAAI,EAAE,aAAa,EAAE,cAAmB,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACtG,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CAAC,CAAC;IACrF,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACjC,CAAC;SAAM,CAAC;QACN,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;IACD,cAAc,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IACxC,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,gFAAgF;AAEhF;;GAEG;AACH,MAAM,UAAU,eAAe,CAC7B,UAAuB,EACvB,UAA0B;IAE1B,MAAM,YAAY,GAAG,IAAI,GAAG,EAA0B,CAAC;IACvD,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,OAAO;QAAE,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IAEnF,MAAM,SAAS,GAAgB,EAAE,CAAC;IAClC,MAAM,MAAM,GAAgB,EAAE,CAAC;IAE/B,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,MAAM,EAAE,GAAG,WAAW,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC;QACjD,IAAI,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;;YACvC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACtB,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;AAC/B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,MAAmB,EAAE,WAAmB;IACtE,MAAM,UAAU,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;IAC/C,MAAM,CAAC,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC,UAAU;QAAE,OAAO;IAExB,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IACtF,MAAM,EAAE,SAAS,EAAE,GAAG,eAAe,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IAE9D,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QACzB,CAAe,CAAC,SAAS,GAAG,IAAI,CAAC;IACpC,CAAC;IACD,MAAM,CAAC,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC;AAC9C,CAAC"}

package/dist/enforcement/gate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gate.d.ts","sourceRoot":"","sources":["../../src/enforcement/gate.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAEvD,6EAA6E;AAC7E,MAAM,WAAW,aAAa;IAC5B,+DAA+D;IAC/D,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,4EAA4E;IAC5E,MAAM,EAAE,eAAe,CAAC;CACzB;AAED,MAAM,WAAW,cAAc;IAC7B,0EAA0E;IAC1E,QAAQ,EAAE,SAAS,EAAE,CAAC;IACtB;;;;OAIG;IACH,cAAc,EAAE,aAAa,EAAE,CAAC;CACjC;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,SAAS,EAAE,EACvB,kBAAkB,EAAE,WAAW,CAAC,QAAQ,CAAC,GACxC,cAAc,CA0BhB"}
+{"version":3,"file":"gate.d.ts","sourceRoot":"","sources":["../../src/enforcement/gate.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAEvD,6EAA6E;AAC7E,MAAM,WAAW,aAAa;IAC5B,+DAA+D;IAC/D,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,4EAA4E;IAC5E,MAAM,EAAE,eAAe,CAAC;CACzB;AAED,MAAM,WAAW,cAAc;IAC7B,0EAA0E;IAC1E,QAAQ,EAAE,SAAS,EAAE,CAAC;IACtB;;;;OAIG;IACH,cAAc,EAAE,aAAa,EAAE,CAAC;CACjC;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,SAAS,EAAE,EACvB,kBAAkB,EAAE,WAAW,CAAC,QAAQ,CAAC,GACxC,cAAc,CA8BhB"}

package/dist/enforcement/gate.js

@@ -34,6 +34,11 @@ export function computeGatingDecision(violations, blockingSeverities) {
         // A path-profile-excluded file never blocks.
         if (v.gateExcluded)
             continue;
+        // Spec 57 — a dismissed finding never blocks. Dismissal is a recorded
+        // decision about one specific finding, not a narrowing of what is reported:
+        // the finding still appears in every report at its real severity.
+        if (v.dismissed)
+            continue;
         // R2 — only findings at a blocking severity block.
         if (!blockingSeverities.has(v.severity))
             continue;

package/dist/enforcement/gate.js.map

@@ -1 +1 @@
-{"version":3,"file":"gate.js","sourceRoot":"","sources":["../../src/enforcement/gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAwBrE;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CACnC,UAAuB,EACvB,kBAAyC;IAEzC,MAAM,QAAQ,GAAgB,EAAE,CAAC;IACjC,MAAM,cAAc,GAAoB,EAAE,CAAC;IAE3C,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,6CAA6C;QAC7C,IAAI,CAAC,CAAC,YAAY;YAAE,SAAS;QAC7B,mDAAmD;QACnD,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC;YAAE,SAAS;QAElD,MAAM,KAAK,GAAG,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACvC,sEAAsE;QACtE,iEAAiE;QACjE,IAAI,KAAK,EAAE,UAAU,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;YACvC,cAAc,CAAC,IAAI,CAAC;gBAClB,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,MAAM,EAAE,eAAe;aACxB,CAAC,CAAC;QACL,CAAC;QAED,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC;AACtC,CAAC"}
+{"version":3,"file":"gate.js","sourceRoot":"","sources":["../../src/enforcement/gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAwBrE;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CACnC,UAAuB,EACvB,kBAAyC;IAEzC,MAAM,QAAQ,GAAgB,EAAE,CAAC;IACjC,MAAM,cAAc,GAAoB,EAAE,CAAC;IAE3C,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,6CAA6C;QAC7C,IAAI,CAAC,CAAC,YAAY;YAAE,SAAS;QAC7B,sEAAsE;QACtE,4EAA4E;QAC5E,kEAAkE;QAClE,IAAI,CAAC,CAAC,SAAS;YAAE,SAAS;QAC1B,mDAAmD;QACnD,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC;YAAE,SAAS;QAElD,MAAM,KAAK,GAAG,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACvC,sEAAsE;QACtE,iEAAiE;QACjE,IAAI,KAAK,EAAE,UAAU,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;YACvC,cAAc,CAAC,IAAI,CAAC;gBAClB,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,MAAM,EAAE,eAAe;aACxB,CAAC,CAAC;QACL,CAAC;QAED,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC;AACtC,CAAC"}

package/dist/installConfig.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Spec 57 — anonymous install ID + telemetry opt-in, persisted at the user level.
+ *
+ * The install ID is a random value generated locally (never derived from the
+ * machine, the user, the project, or anything else) and sent with each telemetry
+ * submission so submissions can be grouped by source. It lives in the OS config
+ * dir (see `getUserConfigRoot`), NOT the cache dir — a cache wipe must not
+ * regenerate it, or source grouping breaks.
+ *
+ * The opt-in is a one-time decision recorded here (default OFF), toggled by the
+ * `telemetry` MCP tool. It is *not* a default and *not* a per-invocation flag.
+ */
+/** Privacy statement shared by the tool, SKILL, and docs. */
+export declare const PRIVACY_MESSAGE = "Data is anonymous, and the ID is generated locally to avoid tracking anything personal.";
+/**
+ * The default ingest endpoint (the operator's service). Shipped so opt-in is a
+ * one-step toggle with a known destination; overridable at enable time and via
+ * the CLI `--telemetry-endpoint` flag. It is a default, not a contract — a
+ * domain can be pointed at the service later by changing this one value.
+ */
+export declare const DEFAULT_TELEMETRY_ENDPOINT = "https://code-auditor-dismissals.ben-a-hammond.workers.dev/ingest";
+/** Resolve the effective endpoint: an explicit non-blank value wins, else the shipped default. */
+export declare function resolveTelemetryEndpoint(input?: string): string;
+export interface TelemetryOptIn {
+    enabled: boolean;
+    endpoint: string;
+}
+/** Resolve the user config dir (overridable for tests). */
+export declare function configDir(dir?: string): string;
+/**
+ * Return the anonymous install ID, generating and persisting it on first use.
+ * Random and carrying nothing. Never throws — a config read/write failure falls
+ * back to a fresh random UUID so telemetry can never block on local config I/O.
+ */
+export declare function getInstallId(dir?: string): string;
+/** Read the telemetry opt-in. Any read failure is fail-closed (off, no endpoint). */
+export declare function getTelemetryOptIn(dir?: string): TelemetryOptIn;
+/** Persist the telemetry opt-in. Throws on write failure (an explicit user action). */
+export declare function setTelemetryOptIn(optIn: TelemetryOptIn, dir?: string): void;
+//# sourceMappingURL=installConfig.d.ts.map

package/dist/installConfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"installConfig.d.ts","sourceRoot":"","sources":["../src/installConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAOH,6DAA6D;AAC7D,eAAO,MAAM,eAAe,4FAC+D,CAAC;AAE5F;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,qEAC6B,CAAC;AAErE,kGAAkG;AAClG,wBAAgB,wBAAwB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAG/D;AAKD,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,2DAA2D;AAC3D,wBAAgB,SAAS,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAE9C;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAejD;AAED,qFAAqF;AACrF,wBAAgB,iBAAiB,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,cAAc,CAa9D;AAED,uFAAuF;AACvF,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,cAAc,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAS3E"}

package/dist/installConfig.js

@@ -0,0 +1,84 @@
+/**
+ * Spec 57 — anonymous install ID + telemetry opt-in, persisted at the user level.
+ *
+ * The install ID is a random value generated locally (never derived from the
+ * machine, the user, the project, or anything else) and sent with each telemetry
+ * submission so submissions can be grouped by source. It lives in the OS config
+ * dir (see `getUserConfigRoot`), NOT the cache dir — a cache wipe must not
+ * regenerate it, or source grouping breaks.
+ *
+ * The opt-in is a one-time decision recorded here (default OFF), toggled by the
+ * `telemetry` MCP tool. It is *not* a default and *not* a per-invocation flag.
+ */
+import { readFileSync, writeFileSync, existsSync, mkdirSync } from 'node:fs';
+import path from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { getUserConfigRoot } from './dataPaths.js';
+/** Privacy statement shared by the tool, SKILL, and docs. */
+export const PRIVACY_MESSAGE = 'Data is anonymous, and the ID is generated locally to avoid tracking anything personal.';
+/**
+ * The default ingest endpoint (the operator's service). Shipped so opt-in is a
+ * one-step toggle with a known destination; overridable at enable time and via
+ * the CLI `--telemetry-endpoint` flag. It is a default, not a contract — a
+ * domain can be pointed at the service later by changing this one value.
+ */
+export const DEFAULT_TELEMETRY_ENDPOINT = 'https://code-auditor-dismissals.ben-a-hammond.workers.dev/ingest';
+/** Resolve the effective endpoint: an explicit non-blank value wins, else the shipped default. */
+export function resolveTelemetryEndpoint(input) {
+    const trimmed = (input ?? '').trim();
+    return trimmed || DEFAULT_TELEMETRY_ENDPOINT;
+}
+const INSTALL_ID_FILENAME = 'install-id';
+const TELEMETRY_FILENAME = 'telemetry.json';
+/** Resolve the user config dir (overridable for tests). */
+export function configDir(dir) {
+    return dir ?? getUserConfigRoot();
+}
+/**
+ * Return the anonymous install ID, generating and persisting it on first use.
+ * Random and carrying nothing. Never throws — a config read/write failure falls
+ * back to a fresh random UUID so telemetry can never block on local config I/O.
+ */
+export function getInstallId(dir) {
+    const root = configDir(dir);
+    const filePath = path.join(root, INSTALL_ID_FILENAME);
+    try {
+        if (existsSync(filePath)) {
+            const existing = readFileSync(filePath, 'utf-8').trim();
+            if (existing)
+                return existing;
+        }
+        const id = randomUUID();
+        mkdirSync(root, { recursive: true });
+        writeFileSync(filePath, id + '\n', { mode: 0o600 });
+        return id;
+    }
+    catch {
+        return randomUUID();
+    }
+}
+/** Read the telemetry opt-in. Any read failure is fail-closed (off, no endpoint). */
+export function getTelemetryOptIn(dir) {
+    const root = configDir(dir);
+    const filePath = path.join(root, TELEMETRY_FILENAME);
+    try {
+        if (!existsSync(filePath))
+            return { enabled: false, endpoint: '' };
+        const parsed = JSON.parse(readFileSync(filePath, 'utf-8'));
+        return {
+            enabled: parsed?.enabled === true,
+            endpoint: typeof parsed?.endpoint === 'string' ? parsed.endpoint : '',
+        };
+    }
+    catch {
+        return { enabled: false, endpoint: '' };
+    }
+}
+/** Persist the telemetry opt-in. Throws on write failure (an explicit user action). */
+export function setTelemetryOptIn(optIn, dir) {
+    const root = configDir(dir);
+    const filePath = path.join(root, TELEMETRY_FILENAME);
+    mkdirSync(root, { recursive: true });
+    writeFileSync(filePath, JSON.stringify({ enabled: optIn.enabled === true, endpoint: optIn.endpoint ?? '' }, null, 2) + '\n', { mode: 0o600 });
+}
+//# sourceMappingURL=installConfig.js.map

package/dist/installConfig.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"installConfig.js","sourceRoot":"","sources":["../src/installConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAEnD,6DAA6D;AAC7D,MAAM,CAAC,MAAM,eAAe,GAC1B,yFAAyF,CAAC;AAE5F;;;;;GAKG;AACH,MAAM,CAAC,MAAM,0BAA0B,GACrC,kEAAkE,CAAC;AAErE,kGAAkG;AAClG,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,MAAM,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACrC,OAAO,OAAO,IAAI,0BAA0B,CAAC;AAC/C,CAAC;AAED,MAAM,mBAAmB,GAAG,YAAY,CAAC;AACzC,MAAM,kBAAkB,GAAG,gBAAgB,CAAC;AAO5C,2DAA2D;AAC3D,MAAM,UAAU,SAAS,CAAC,GAAY;IACpC,OAAO,GAAG,IAAI,iBAAiB,EAAE,CAAC;AACpC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,GAAY;IACvC,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;IACtD,IAAI,CAAC;QACH,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzB,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;YACxD,IAAI,QAAQ;gBAAE,OAAO,QAAQ,CAAC;QAChC,CAAC;QACD,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;QACxB,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACrC,aAAa,CAAC,QAAQ,EAAE,EAAE,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACpD,OAAO,EAAE,CAAC;IACZ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,UAAU,EAAE,CAAC;IACtB,CAAC;AACH,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,iBAAiB,CAAC,GAAY;IAC5C,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;IACrD,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QACnE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;QAC3D,OAAO;YACL,OAAO,EAAE,MAAM,EAAE,OAAO,KAAK,IAAI;YACjC,QAAQ,EAAE,OAAO,MAAM,EAAE,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;SACtE,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC1C,CAAC;AACH,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,iBAAiB,CAAC,KAAqB,EAAE,GAAY;IACnE,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;IACrD,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACrC,aAAa,CACX,QAAQ,EACR,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,KAAK,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EACnG,EAAE,IAAI,EAAE,KAAK,EAAE,CAChB,CAAC;AACJ,CAAC"}

package/dist/languages/go/analyzer-src/solid.go

@@ -57,9 +57,12 @@ func (s *SOLIDAnalyzer) analyzeFunctionSize() []Violation {
 
 	for _, function := range s.functions {
 		returns := strings.Split(function.ReturnType, ",")
-		complex := function.Complexity > 10
+		// 2026-09-12 recalibration: complexity ceiling aligned to the 20-cyclomatic
+		// threshold, params aligned to the TS `parameter-count` default of 6. The
+		// rule is AND-combined (complexity + returns + params) so it stays conservative.
+		complex := function.Complexity > 20
 		multiReturn := len(returns) > 2
-		manyParams := len(function.Parameters) > 5
+		manyParams := len(function.Parameters) > 6
 		if complex && multiReturn && manyParams {
 			violations = append(violations, Violation{
 				File:     function.File,
@@ -94,7 +97,8 @@ func (s *SOLIDAnalyzer) analyzeStructSize() []Violation {
 	var violations []Violation
 
 	for _, structInfo := range s.structs {
-		if len(structInfo.Fields) > 10 {
+		// 2026-09-12 recalibration: 10 flags ordinary config/model structs; 15 is a god-struct.
+		if len(structInfo.Fields) > 15 {
 			violations = append(violations, Violation{
 				File:     structInfo.File,
 				Line:     structInfo.StartLine,
@@ -131,7 +135,9 @@ func (s *SOLIDAnalyzer) analyzeSwitchSize() []Violation {
 			switch node := n.(type) {
 			case *ast.SwitchStmt:
 				caseCount := s.countSwitchCases(node)
-				if caseCount > 5 {
+				// 2026-09-12 recalibration: 5 flags idiomatic dispatch (HTTP status /
+				// command maps); 8 suggests table-driven lookup.
+				if caseCount > 8 {
 					pos := s.parser.fileSet.Position(node.Pos())
 					violations = append(violations, Violation{
 						File:     filePath,
@@ -149,7 +155,7 @@ func (s *SOLIDAnalyzer) analyzeSwitchSize() []Violation {
 				}
 			case *ast.TypeSwitchStmt:
 				caseCount := s.countTypeSwitchCases(node)
-				if caseCount > 5 {
+				if caseCount > 8 {
 					pos := s.parser.fileSet.Position(node.Pos())
 					violations = append(violations, Violation{
 						File:     filePath,
@@ -233,7 +239,9 @@ func (s *SOLIDAnalyzer) analyzeISP() []Violation {
 	var violations []Violation
 
 	for _, interfaceInfo := range s.interfaces {
-		if len(interfaceInfo.Methods) > 5 {
+		// 2026-09-12 recalibration: 5 flags idiomatic Reader/Writer-style interfaces;
+		// 10 is where segregation is warranted.
+		if len(interfaceInfo.Methods) > 10 {
 			violations = append(violations, Violation{
 				File:     interfaceInfo.File,
 				Line:     interfaceInfo.StartLine,

package/dist/mcp.js

@@ -63,6 +63,7 @@ import { searchFunctions, findDefinition, syncFileIndex, getDatabase } from './c
 import { CodeMapGenerator } from './services/CodeMapGenerator.js';
 import { analyzeDocumentation } from './analyzers/documentationAnalyzer.js';
 import { ConfigGeneratorFactory } from './generators/ConfigGeneratorFactory.js';
+import { getInstallId, getTelemetryOptIn, setTelemetryOptIn, PRIVACY_MESSAGE, resolveTelemetryEndpoint } from './installConfig.js';
 import { MCP_DEFAULT_ANALYZERS } from './analyzers/ruleRegistry.js';
 import { DEFAULT_SERVER_URL, IS_DEV_MODE, PACKAGE_VERSION } from './constants.js';
 import { getAuditJobStatus, getAuditResultsPage, getAuditResultsAsSarif, startAuditJob } from './mcpAuditJobs.js';
@@ -1269,6 +1270,59 @@ function registerAllTools(registry) {
             },
         ],
     });
+    // ── telemetry ──────────────────────────────────────────────────────────────
+    registry.register({
+        name: 'telemetry',
+        description: 'Manage anonymous dismissal feedback opt-in (default OFF). Actions: status, enable, disable. When enabled, a dismissal and its reason are sent to the feedback endpoint, grouped by an anonymous install ID generated locally.',
+        actions: [
+            {
+                name: 'status',
+                description: 'Show whether anonymous dismissal feedback is enabled, its endpoint, and the anonymous install ID.',
+                parameters: [],
+                handler: async () => {
+                    const optIn = getTelemetryOptIn();
+                    return {
+                        enabled: optIn.enabled,
+                        endpoint: optIn.endpoint,
+                        installId: optIn.enabled ? getInstallId() : null,
+                        message: PRIVACY_MESSAGE,
+                    };
+                },
+            },
+            {
+                name: 'enable',
+                description: 'Opt in to anonymous dismissal feedback. Defaults to the built-in service endpoint. Generates the anonymous install ID on first use.',
+                parameters: [
+                    {
+                        name: 'endpoint',
+                        type: 'string',
+                        required: false,
+                        description: 'Optional ingest URL. Defaults to the built-in service endpoint.',
+                    },
+                ],
+                handler: async (args) => {
+                    const endpoint = resolveTelemetryEndpoint(args.endpoint);
+                    setTelemetryOptIn({ enabled: true, endpoint });
+                    return {
+                        enabled: true,
+                        endpoint,
+                        installId: getInstallId(),
+                        message: PRIVACY_MESSAGE,
+                    };
+                },
+            },
+            {
+                name: 'disable',
+                description: 'Turn off anonymous dismissal feedback. The endpoint is remembered; nothing further is sent.',
+                parameters: [],
+                handler: async () => {
+                    const current = getTelemetryOptIn();
+                    setTelemetryOptIn({ enabled: false, endpoint: current.endpoint });
+                    return { enabled: false, message: PRIVACY_MESSAGE };
+                },
+            },
+        ],
+    });
     // ── code_map ───────────────────────────────────────────────────────────────
     registry.register({
         name: 'code_map',