code-auditor-mcp 3.9.6 → 3.9.9

package/dist/cli.js

@@ -20,6 +20,10 @@ import { queryParser } from './search/QueryParser.js';
 import { CodeIndexDB } from './codeIndexDB.js';
 import { getFilesProcessed, getFactsConsumed, isVisitorStatus, isReducerStatus } from './pipeline.js';
 import { createBaselineFromFindings, saveBaseline, loadBaseline, diffBaselines } from './baseline.js';
+import { fingerprint, buildFingerprintInput } from './fingerprint.js';
+import { buildDismissalEntry, upsertDismissal } from './dismissals.js';
+import { resolveTelemetryConfig, signatureForFinding, buildTelemetryPayload, formatTelemetryPreview, sendTelemetry, languageHint } from './telemetry.js';
+import { getInstallId } from './installConfig.js';
 import { ALL_ANALYZERS } from './analyzers/ruleRegistry.js';
 import { computeGatingDecision } from './enforcement/gate.js';
 import { BLOCKING_SEVERITIES } from './types.js';
@@ -139,6 +143,10 @@ program
         });
         const violations = Object.values(result.analyzerResults).flatMap((r) => r.violations || []);
         const baseline = result.metadata?.baseline;
+        // Spec 57 — dismissed count is reported alongside the total, never
+        // subtracted from it ("43 findings, 3 dismissed").
+        const dismissedCount = result.summary.dismissed ?? 0;
+        const dismissedSuffix = dismissedCount > 0 ? `, ${dismissedCount} dismissed` : '';
         // ── Coverage panel leads the report (Spec 47 R2) ─────────────
         // A diagnostic report opens with what was measured before it lists any
         // readings, so a zero-reading report can't be mistaken for a clean tree.
@@ -215,7 +223,7 @@ program
         }
         else if (!baseline) {
             // No baseline: current behavior + hint
-            console.log(`\nFound ${result.summary.totalViolations} readings`);
+            console.log(`\nFound ${result.summary.totalViolations} findings${dismissedSuffix}`);
             console.log(`Critical: ${result.summary.criticalIssues}`);
             console.log(`Severe: ${result.summary.severe}`);
             console.log(`High: ${result.summary.high}`);
@@ -224,7 +232,7 @@ program
         }
         else {
             // --full with baseline: full itemized inventory (current behavior)
-            console.log(`\nFound ${result.summary.totalViolations} readings`);
+            console.log(`\nFound ${result.summary.totalViolations} findings${dismissedSuffix}`);
             console.log(`Critical: ${result.summary.criticalIssues}`);
             console.log(`Severe: ${result.summary.severe}`);
             console.log(`High: ${result.summary.high}`);
@@ -381,6 +389,9 @@ program
             const severityOrder = ['critical', 'severe', 'high'];
             const failIndex = severityOrder.indexOf(failOnSeverity);
             const hasAtOrAbove = evaluableViolations.some((v) => {
+                // Spec 57 — a dismissed finding never blocks the gate.
+                if (v.dismissed)
+                    return false;
                 const vIndex = severityOrder.indexOf(v.severity);
                 return vIndex >= 0 && vIndex <= failIndex;
             });
@@ -466,6 +477,10 @@ program
         }
         // Collect all violations
         const violations = Object.values(result.analyzerResults).flatMap((r) => r.violations || []);
+        // Spec 57 — dismissed count is reported alongside the total, never
+        // subtracted from it. The hook surface (`changed`) is agent-facing, so it
+        // must show the same "N findings, M dismissed" figure as the full report.
+        const dismissedCount = result.summary.dismissed ?? 0;
         // Blocking gate decision (Spec 45 R1/R4, Spec 54 R3), computed once so the
         // agent-facing before/after count (Spec 45 A2) and the exit code agree on
         // the same number. Every registered rule participates (R1); enforcement is
@@ -506,7 +521,9 @@ program
                     enclosingSymbol: v.symbol || v.enclosingFunction || '',
                     suggestion: v.suggestion || '',
                     details: v.details || '',
-                    ...(v.new !== undefined && { new: v.new })
+                    ...(v.new !== undefined && { new: v.new }),
+                    ...(v.dismissed !== undefined && { dismissed: v.dismissed }),
+                    fingerprint: fingerprint(buildFingerprintInput(v))
                 };
             });
             process.stdout.write(JSON.stringify(jsonOutput, null, 2) + '\n');
@@ -522,6 +539,9 @@ program
                 console.log('');
                 printCountSummary(violations);
                 console.log(chalk.bold(`gate before/after: ${violations.length} → ${blocking.length} blocking`));
+                if (dismissedCount > 0) {
+                    console.log(chalk.dim(`  ${dismissedCount} dismissed — still counted above, excluded from the gate`));
+                }
                 console.log(chalk.gray('── Violations ────────────────────────────────────'));
                 for (const v of violations) {
                     const icon = v.severity === 'critical' ? '🔴' :
@@ -529,7 +549,10 @@ program
                     const statusTag = v.new === false
                         ? chalk.dim(' [known — still open]')
                         : '';
-                    console.log(`${icon} ${chalk.bold(v.file)}${v.line ? `:${v.line}` : ''} [${v.severity}] ${v.message}${statusTag}`);
+                    const dismissedTag = v.dismissed
+                        ? chalk.dim(' [dismissed]')
+                        : '';
+                    console.log(`${icon} ${chalk.bold(v.file)}${v.line ? `:${v.line}` : ''} [${v.severity}] ${v.message}${statusTag}${dismissedTag}`);
                 }
             }
             else {
@@ -947,6 +970,90 @@ program
         process.exit(1);
     }
 });
+// Dismiss command (Spec 57)
+program
+    .command('dismiss <fingerprint>')
+    .description('Dismiss one finding by fingerprint — a written reason is required')
+    .requiredOption('--reason <reason>', 'Why this finding is dismissed (required — a dismissal without a reason is a config error)')
+    .option('-p, --path <path>', 'Project path', process.cwd())
+    .option('--telemetry-endpoint <url>', 'Feedback service endpoint override (defaults to the opt-in endpoint recorded by the telemetry tool)')
+    .option('--json', 'Output as JSON')
+    .action(async (fingerprintArg, options) => {
+    try {
+        const reason = (options.reason ?? '').trim();
+        if (!reason) {
+            console.error(chalk.red('Error: --reason is required and must be non-empty. A dismissal without a reason is a config error, not a suppression.'));
+            process.exit(1);
+        }
+        const projectRoot = resolve(options.path || process.cwd());
+        await initParsers();
+        // Re-audit so the fingerprint resolves against the live finding. The
+        // fingerprint is a content hash of rule+file+symbol, so it is stable
+        // across runs on the same machine (same tuple the baseline uses).
+        const runner = createAuditRunner({ projectRoot });
+        const result = await runner.run();
+        const violations = Object.values(result.analyzerResults).flatMap((r) => r.violations || []);
+        const match = violations.find((v) => fingerprint(buildFingerprintInput(v)) === fingerprintArg);
+        if (!match) {
+            console.error(chalk.red(`Error: no finding matches fingerprint "${fingerprintArg}".`));
+            console.error(chalk.gray(`The fingerprint is a content hash of rule+file+symbol. Get the exact value from `));
+            console.error(chalk.gray(`the JSON report: run ${chalk.cyan('code-audit audit --format json')} (or ${chalk.cyan('code-audit changed --json')}) `));
+            console.error(chalk.gray(`and copy the "fingerprint" field of the finding you want to dismiss.`));
+            process.exit(1);
+        }
+        const entry = buildDismissalEntry(match, reason, packageJson.version);
+        const dismissals = upsertDismissal(projectRoot, entry);
+        // Spec 57 — opt-in telemetry. Nothing is sent unless the user opted in via
+        // the `telemetry` MCP tool (default OFF) AND an endpoint is configured. The
+        // payload is printed for review before sending; any send failure is silent
+        // and never affects the dismissal or the exit code.
+        const telemetry = resolveTelemetryConfig({ endpoint: options.telemetryEndpoint });
+        if (telemetry.enabled && telemetry.endpoint) {
+            const signature = signatureForFinding(match.file, match.line ?? match.start?.line ?? 1, match.column ?? match.start?.column ?? 1) ?? 'unknown';
+            const payload = buildTelemetryPayload({
+                install_id: getInstallId(),
+                toolVersion: packageJson.version,
+                rule: entry.rule,
+                level: match.severity,
+                reason: entry.reason,
+                signature,
+                lang: languageHint(match.file),
+            });
+            process.stderr.write(formatTelemetryPreview(payload));
+            const sendResult = await sendTelemetry(payload, telemetry.endpoint);
+            if (options.json) {
+                // Surface the send outcome in machine output without ever failing on it.
+                process.stderr.write(`  telemetry: ${sendResult.sent ? 'sent' : 'not sent'}${sendResult.error ? ` (${sendResult.error})` : ''}\n`);
+            }
+            else if (!sendResult.sent) {
+                console.log(chalk.gray(`  Telemetry not sent${sendResult.error ? ` (${sendResult.error})` : ''} — offline is never an error.`));
+            }
+            else {
+                console.log(chalk.gray('  Telemetry sent.'));
+            }
+        }
+        if (options.json) {
+            process.stdout.write(JSON.stringify({
+                success: true,
+                fingerprint: entry.fingerprint,
+                rule: entry.rule,
+                file: entry.file,
+                symbol: entry.symbol,
+                reason: entry.reason,
+                totalDismissed: dismissals.entries.length,
+            }, null, 2) + '\n');
+        }
+        else {
+            console.log(chalk.green(`\n✓ Dismissed ${chalk.bold(entry.rule)} @ ${entry.symbol || entry.file} — "${entry.reason}"`));
+            console.log(chalk.gray(`  ${dismissals.entries.length} dismissal(s) recorded in .codeauditor.dismissals.json.`));
+            console.log(chalk.gray(`  The finding is still counted in every report, but excluded from the gate.`));
+        }
+    }
+    catch (error) {
+        console.error(chalk.red('Error:'), error);
+        process.exit(1);
+    }
+});
 // Generate configuration command
 program
     .command('generate-config')
@@ -2903,6 +3010,7 @@ program
         const { getDefaultConfig, DEFAULT_CODE_INDEX_CONFIG } = await import('./config/defaults.js');
         const { computeEffectiveConfig, computeTopLevelConfig, } = await import('./config/effectiveConfig.js');
         const { getPreset, PRESET_IDS } = await import('./presets/presets.js');
+        const { readProjectLintThresholds, thresholdsToAnalyzerConfig } = await import('./config/lintConfigReader.js');
         const projectRoot = pathModule.resolve(options.path);
         const filePath = pathModule.resolve(file);
         const configPath = pathModule.join(projectRoot, '.codeauditor.json');
@@ -2937,6 +3045,10 @@ program
             }
         }
         const presets = presetIds.map((id) => getPreset(id));
+        // Spec 50 R2 — read the project's own lint config so size thresholds sourced
+        // from ESLint are named `project-lint-config` rather than `default`.
+        const lintResult = await readProjectLintThresholds(projectRoot);
+        const lintConfig = lintResult ? thresholdsToAnalyzerConfig(lintResult.thresholds) : {};
         const effective = computeEffectiveConfig({
             filePath,
             projectRoot,
@@ -2944,6 +3056,7 @@ program
             pathProfiles,
             enabledAnalyzers,
             presets,
+            lintConfig,
         });
         const topLevel = computeTopLevelConfig(pristine, config);
         if (options.json) {
@@ -2952,6 +3065,7 @@ program
                 projectRoot,
                 configPath,
                 presets: presetIds,
+                lintConfigPath: lintResult?.configPath ?? null,
                 matchedProfiles: effective.matchedProfiles,
                 excludeFromGate: effective.excludeFromGate ?? null,
                 topLevel,
@@ -2964,6 +3078,7 @@ program
         console.log(`${chalk.bold('file:')}        ${effective.relativePath}`);
         console.log(`${chalk.bold('project root:')} ${projectRoot}`);
         console.log(`${chalk.bold('presets:')}     ${presetIds.length > 0 ? presetIds.join(', ') : chalk.gray('(none)')}`);
+        console.log(`${chalk.bold('lint config:')} ${lintResult?.configPath ? chalk.cyan(lintResult.configKind) + ' ' + chalk.dim(lintResult.configPath) : chalk.gray('(none — defaults)')}`);
         console.log(`${chalk.bold('profiles:')}    ${effective.matchedProfiles.length > 0 ? effective.matchedProfiles.join(', ') : chalk.gray('(none)')}`);
         if (effective.excludeFromGate) {
             console.log(`${chalk.bold('excludeFromGate:')} ${chalk.yellow('true')}`);