code-auditor-mcp 3.9.6 → 3.9.11

package/dist/cli.js

@@ -8,11 +8,10 @@ import { Command } from 'commander';
 import chalk from 'chalk';
 import { createAuditRunner } from './auditRunner.js';
 import { runAuditDispatch } from './auditRouter.js';
-import { readFileSync } from 'fs';
 import { promises as fs } from 'fs';
 import { createInterface } from 'readline';
-import { fileURLToPath } from 'url';
 import { dirname, isAbsolute, join, relative, resolve } from 'path';
+import { PACKAGE_VERSION } from './constants.js';
 import inquirer from 'inquirer';
 import { CodeMapGenerator } from './services/CodeMapGenerator.js';
 import { initParsers } from './languages/index.js';
@@ -20,16 +19,16 @@ import { queryParser } from './search/QueryParser.js';
 import { CodeIndexDB } from './codeIndexDB.js';
 import { getFilesProcessed, getFactsConsumed, isVisitorStatus, isReducerStatus } from './pipeline.js';
 import { createBaselineFromFindings, saveBaseline, loadBaseline, diffBaselines } from './baseline.js';
+import { fingerprint, buildFingerprintInput } from './fingerprint.js';
+import { buildDismissalEntry, upsertDismissal } from './dismissals.js';
+import { resolveTelemetryConfig, signatureForFinding, buildTelemetryPayload, formatTelemetryPreview, sendTelemetry, languageHint } from './telemetry.js';
+import { getInstallId } from './installConfig.js';
 import { ALL_ANALYZERS } from './analyzers/ruleRegistry.js';
 import { computeGatingDecision } from './enforcement/gate.js';
 import { BLOCKING_SEVERITIES } from './types.js';
 import { rankFilesByPriority, orderFindingsWithinFile } from './nextFile.js';
 import { runNextFile } from './nextFileIncremental.js';
 import { describeSqliteBackend } from './sqlite/driver.js';
-// Get package.json for version info
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = dirname(__filename);
-const packageJson = JSON.parse(readFileSync(join(__dirname, '..', 'package.json'), 'utf-8'));
 const program = new Command();
 // Spec 44 R4 — file accounting summary line + `--explain-skipped` breakdown.
 // The full per-reason file lists live in the JSON report (`metadata.fileAccounting`);
@@ -82,7 +81,7 @@ function printFileAccounting(result, explainSkipped) {
 program
     .name('code-auditor')
     .description('TypeScript/JavaScript code quality auditor with AI tool integration')
-    .version(`${packageJson.version} (sqlite: ${describeSqliteBackend()})`);
+    .version(`${PACKAGE_VERSION} (sqlite: ${describeSqliteBackend()})`);
 // Legacy audit command (default behavior)
 program
     .command('audit', { isDefault: true })
@@ -139,6 +138,10 @@ program
         });
         const violations = Object.values(result.analyzerResults).flatMap((r) => r.violations || []);
         const baseline = result.metadata?.baseline;
+        // Spec 57 — dismissed count is reported alongside the total, never
+        // subtracted from it ("43 findings, 3 dismissed").
+        const dismissedCount = result.summary.dismissed ?? 0;
+        const dismissedSuffix = dismissedCount > 0 ? `, ${dismissedCount} dismissed` : '';
         // ── Coverage panel leads the report (Spec 47 R2) ─────────────
         // A diagnostic report opens with what was measured before it lists any
         // readings, so a zero-reading report can't be mistaken for a clean tree.
@@ -153,6 +156,28 @@ program
                 `${covUnassessed} unassessed · ${covNotApplicable} not-applicable · ` +
                 `${covCannotFire} cannot-fire`));
         }
+        // ── Coverage gaps (Spec 58 follow-up) ─────────────────────────
+        // Coverage diagnostics are the analyzer saying "my visibility ends here",
+        // not "the code is wrong". They lead with counts, then per-occurrence
+        // file:line — visible and counted, never blocking (they never reach the
+        // gate). Rendered alongside the coverage panel that leads the report.
+        const coverageDiagnostics = (result.metadata?.diagnostics ?? []).filter((d) => d.kind === 'unresolved-query' || d.kind === 'unresolved-dynamic-import');
+        if (coverageDiagnostics.length > 0) {
+            const byKind = {};
+            for (const d of coverageDiagnostics)
+                byKind[d.kind] = (byKind[d.kind] ?? 0) + 1;
+            const totals = Object.entries(byKind)
+                .map(([kind, n]) => `${n} ${kind}`)
+                .join(' · ');
+            console.log(chalk.gray(`── Coverage gaps ── ${totals}`));
+            for (const d of coverageDiagnostics.slice(0, 20)) {
+                const loc = d.file ? `${d.file}${typeof d.line === 'number' ? `:${d.line}` : ''}` : '(unknown)';
+                console.log(chalk.gray(`  ${loc} [${d.kind}] — ${d.message}`));
+            }
+            if (coverageDiagnostics.length > 20) {
+                console.log(chalk.gray(`  … and ${coverageDiagnostics.length - 20} more`));
+            }
+        }
         // ── Delta output (Spec 18 R2) ─────────────────────────────────
         if (baseline && !options.full) {
             const newViolations = violations.filter((v) => v.new === true);
@@ -215,7 +240,7 @@ program
         }
         else if (!baseline) {
             // No baseline: current behavior + hint
-            console.log(`\nFound ${result.summary.totalViolations} readings`);
+            console.log(`\nFound ${result.summary.totalViolations} findings${dismissedSuffix}`);
             console.log(`Critical: ${result.summary.criticalIssues}`);
             console.log(`Severe: ${result.summary.severe}`);
             console.log(`High: ${result.summary.high}`);
@@ -224,7 +249,7 @@ program
         }
         else {
             // --full with baseline: full itemized inventory (current behavior)
-            console.log(`\nFound ${result.summary.totalViolations} readings`);
+            console.log(`\nFound ${result.summary.totalViolations} findings${dismissedSuffix}`);
             console.log(`Critical: ${result.summary.criticalIssues}`);
             console.log(`Severe: ${result.summary.severe}`);
             console.log(`High: ${result.summary.high}`);
@@ -381,6 +406,9 @@ program
             const severityOrder = ['critical', 'severe', 'high'];
             const failIndex = severityOrder.indexOf(failOnSeverity);
             const hasAtOrAbove = evaluableViolations.some((v) => {
+                // Spec 57 — a dismissed finding never blocks the gate.
+                if (v.dismissed)
+                    return false;
                 const vIndex = severityOrder.indexOf(v.severity);
                 return vIndex >= 0 && vIndex <= failIndex;
             });
@@ -466,6 +494,10 @@ program
         }
         // Collect all violations
         const violations = Object.values(result.analyzerResults).flatMap((r) => r.violations || []);
+        // Spec 57 — dismissed count is reported alongside the total, never
+        // subtracted from it. The hook surface (`changed`) is agent-facing, so it
+        // must show the same "N findings, M dismissed" figure as the full report.
+        const dismissedCount = result.summary.dismissed ?? 0;
         // Blocking gate decision (Spec 45 R1/R4, Spec 54 R3), computed once so the
         // agent-facing before/after count (Spec 45 A2) and the exit code agree on
         // the same number. Every registered rule participates (R1); enforcement is
@@ -481,7 +513,7 @@ program
         }
         else if (options.json) {
             const projectDir = resolve(options.path || process.cwd());
-            const jsonOutput = violations.map((v) => {
+            const jsonViolations = violations.map((v) => {
                 // Compute relative path if file resolves inside the project
                 let filePath = v.file || '';
                 if (filePath.startsWith('/') || filePath.startsWith('\\\\')) {
@@ -506,9 +538,23 @@ program
                     enclosingSymbol: v.symbol || v.enclosingFunction || '',
                     suggestion: v.suggestion || '',
                     details: v.details || '',
-                    ...(v.new !== undefined && { new: v.new })
+                    ...(v.new !== undefined && { new: v.new }),
+                    ...(v.dismissed !== undefined && { dismissed: v.dismissed }),
+                    fingerprint: fingerprint(buildFingerprintInput(v))
                 };
             });
+            // Coverage diagnostics ride alongside violations so an agent sees "the
+            // analyzer couldn't resolve this" without a metadata flag — and without
+            // it ever gating (diagnostics never reach computeGatingDecision).
+            const jsonDiagnostics = (result.metadata?.diagnostics ?? []).map((d) => ({
+                analyzer: d.analyzerName ?? d.analyzer ?? '',
+                kind: d.kind,
+                message: d.message,
+                ...(d.file ? { file: d.file } : {}),
+                ...(typeof d.line === 'number' ? { line: d.line } : {}),
+                ...(d.details ? { details: d.details } : {}),
+            }));
+            const jsonOutput = { violations: jsonViolations, diagnostics: jsonDiagnostics };
             process.stdout.write(JSON.stringify(jsonOutput, null, 2) + '\n');
         }
         else if (!options.quiet || violations.length > 0) {
@@ -522,6 +568,9 @@ program
                 console.log('');
                 printCountSummary(violations);
                 console.log(chalk.bold(`gate before/after: ${violations.length} → ${blocking.length} blocking`));
+                if (dismissedCount > 0) {
+                    console.log(chalk.dim(`  ${dismissedCount} dismissed — still counted above, excluded from the gate`));
+                }
                 console.log(chalk.gray('── Violations ────────────────────────────────────'));
                 for (const v of violations) {
                     const icon = v.severity === 'critical' ? '🔴' :
@@ -529,7 +578,10 @@ program
                     const statusTag = v.new === false
                         ? chalk.dim(' [known — still open]')
                         : '';
-                    console.log(`${icon} ${chalk.bold(v.file)}${v.line ? `:${v.line}` : ''} [${v.severity}] ${v.message}${statusTag}`);
+                    const dismissedTag = v.dismissed
+                        ? chalk.dim(' [dismissed]')
+                        : '';
+                    console.log(`${icon} ${chalk.bold(v.file)}${v.line ? `:${v.line}` : ''} [${v.severity}] ${v.message}${statusTag}${dismissedTag}`);
                 }
             }
             else {
@@ -911,7 +963,7 @@ program
         }
         // Create new baseline
         const newBaseline = createBaselineFromFindings(allViolations, {
-            toolVersion: packageJson.version,
+            toolVersion: PACKAGE_VERSION,
             totalFindings: allViolations.filter((v) => v.analyzer !== 'invariants').length,
             analyzerCounts,
             corpusStats,
@@ -947,6 +999,90 @@ program
         process.exit(1);
     }
 });
+// Dismiss command (Spec 57)
+program
+    .command('dismiss <fingerprint>')
+    .description('Dismiss one finding by fingerprint — a written reason is required')
+    .requiredOption('--reason <reason>', 'Why this finding is dismissed (required — a dismissal without a reason is a config error)')
+    .option('-p, --path <path>', 'Project path', process.cwd())
+    .option('--telemetry-endpoint <url>', 'Feedback service endpoint override (defaults to the opt-in endpoint recorded by the telemetry tool)')
+    .option('--json', 'Output as JSON')
+    .action(async (fingerprintArg, options) => {
+    try {
+        const reason = (options.reason ?? '').trim();
+        if (!reason) {
+            console.error(chalk.red('Error: --reason is required and must be non-empty. A dismissal without a reason is a config error, not a suppression.'));
+            process.exit(1);
+        }
+        const projectRoot = resolve(options.path || process.cwd());
+        await initParsers();
+        // Re-audit so the fingerprint resolves against the live finding. The
+        // fingerprint is a content hash of rule+file+symbol, so it is stable
+        // across runs on the same machine (same tuple the baseline uses).
+        const runner = createAuditRunner({ projectRoot });
+        const result = await runner.run();
+        const violations = Object.values(result.analyzerResults).flatMap((r) => r.violations || []);
+        const match = violations.find((v) => fingerprint(buildFingerprintInput(v)) === fingerprintArg);
+        if (!match) {
+            console.error(chalk.red(`Error: no finding matches fingerprint "${fingerprintArg}".`));
+            console.error(chalk.gray(`The fingerprint is a content hash of rule+file+symbol. Get the exact value from `));
+            console.error(chalk.gray(`the JSON report: run ${chalk.cyan('code-audit audit --format json')} (or ${chalk.cyan('code-audit changed --json')}) `));
+            console.error(chalk.gray(`and copy the "fingerprint" field of the finding you want to dismiss.`));
+            process.exit(1);
+        }
+        const entry = buildDismissalEntry(match, reason, PACKAGE_VERSION);
+        const dismissals = upsertDismissal(projectRoot, entry);
+        // Spec 57 — opt-in telemetry. Nothing is sent unless the user opted in via
+        // the `telemetry` MCP tool (default OFF) AND an endpoint is configured. The
+        // payload is printed for review before sending; any send failure is silent
+        // and never affects the dismissal or the exit code.
+        const telemetry = resolveTelemetryConfig({ endpoint: options.telemetryEndpoint });
+        if (telemetry.enabled && telemetry.endpoint) {
+            const signature = signatureForFinding(match.file, match.line ?? match.start?.line ?? 1, match.column ?? match.start?.column ?? 1) ?? 'unknown';
+            const payload = buildTelemetryPayload({
+                install_id: getInstallId(),
+                toolVersion: PACKAGE_VERSION,
+                rule: entry.rule,
+                level: match.severity,
+                reason: entry.reason,
+                signature,
+                lang: languageHint(match.file),
+            });
+            process.stderr.write(formatTelemetryPreview(payload));
+            const sendResult = await sendTelemetry(payload, telemetry.endpoint);
+            if (options.json) {
+                // Surface the send outcome in machine output without ever failing on it.
+                process.stderr.write(`  telemetry: ${sendResult.sent ? 'sent' : 'not sent'}${sendResult.error ? ` (${sendResult.error})` : ''}\n`);
+            }
+            else if (!sendResult.sent) {
+                console.log(chalk.gray(`  Telemetry not sent${sendResult.error ? ` (${sendResult.error})` : ''} — offline is never an error.`));
+            }
+            else {
+                console.log(chalk.gray('  Telemetry sent.'));
+            }
+        }
+        if (options.json) {
+            process.stdout.write(JSON.stringify({
+                success: true,
+                fingerprint: entry.fingerprint,
+                rule: entry.rule,
+                file: entry.file,
+                symbol: entry.symbol,
+                reason: entry.reason,
+                totalDismissed: dismissals.entries.length,
+            }, null, 2) + '\n');
+        }
+        else {
+            console.log(chalk.green(`\n✓ Dismissed ${chalk.bold(entry.rule)} @ ${entry.symbol || entry.file} — "${entry.reason}"`));
+            console.log(chalk.gray(`  ${dismissals.entries.length} dismissal(s) recorded in .codeauditor.dismissals.json.`));
+            console.log(chalk.gray(`  The finding is still counted in every report, but excluded from the gate.`));
+        }
+    }
+    catch (error) {
+        console.error(chalk.red('Error:'), error);
+        process.exit(1);
+    }
+});
 // Generate configuration command
 program
     .command('generate-config')
@@ -2903,6 +3039,7 @@ program
         const { getDefaultConfig, DEFAULT_CODE_INDEX_CONFIG } = await import('./config/defaults.js');
         const { computeEffectiveConfig, computeTopLevelConfig, } = await import('./config/effectiveConfig.js');
         const { getPreset, PRESET_IDS } = await import('./presets/presets.js');
+        const { readProjectLintThresholds, thresholdsToAnalyzerConfig } = await import('./config/lintConfigReader.js');
         const projectRoot = pathModule.resolve(options.path);
         const filePath = pathModule.resolve(file);
         const configPath = pathModule.join(projectRoot, '.codeauditor.json');
@@ -2937,6 +3074,10 @@ program
             }
         }
         const presets = presetIds.map((id) => getPreset(id));
+        // Spec 50 R2 — read the project's own lint config so size thresholds sourced
+        // from ESLint are named `project-lint-config` rather than `default`.
+        const lintResult = await readProjectLintThresholds(projectRoot);
+        const lintConfig = lintResult ? thresholdsToAnalyzerConfig(lintResult.thresholds) : {};
         const effective = computeEffectiveConfig({
             filePath,
             projectRoot,
@@ -2944,6 +3085,7 @@ program
             pathProfiles,
             enabledAnalyzers,
             presets,
+            lintConfig,
         });
         const topLevel = computeTopLevelConfig(pristine, config);
         if (options.json) {
@@ -2952,6 +3094,7 @@ program
                 projectRoot,
                 configPath,
                 presets: presetIds,
+                lintConfigPath: lintResult?.configPath ?? null,
                 matchedProfiles: effective.matchedProfiles,
                 excludeFromGate: effective.excludeFromGate ?? null,
                 topLevel,
@@ -2964,6 +3107,7 @@ program
         console.log(`${chalk.bold('file:')}        ${effective.relativePath}`);
         console.log(`${chalk.bold('project root:')} ${projectRoot}`);
         console.log(`${chalk.bold('presets:')}     ${presetIds.length > 0 ? presetIds.join(', ') : chalk.gray('(none)')}`);
+        console.log(`${chalk.bold('lint config:')} ${lintResult?.configPath ? chalk.cyan(lintResult.configKind) + ' ' + chalk.dim(lintResult.configPath) : chalk.gray('(none — defaults)')}`);
         console.log(`${chalk.bold('profiles:')}    ${effective.matchedProfiles.length > 0 ? effective.matchedProfiles.join(', ') : chalk.gray('(none)')}`);
         if (effective.excludeFromGate) {
             console.log(`${chalk.bold('excludeFromGate:')} ${chalk.yellow('true')}`);