code-auditor-mcp 4.0.4 → 4.1.1

package/dist/cli.js

@@ -25,7 +25,7 @@ import { resolveTelemetryConfig, signatureForFinding, buildTelemetryPayload, for
 import { getInstallId } from './installConfig.js';
 import { ALL_ANALYZERS } from './analyzers/ruleRegistry.js';
 import { computeGatingDecision } from './enforcement/gate.js';
-import { BLOCKING_SEVERITIES } from './types.js';
+import { BLOCKING_SEVERITIES, SEVERITIES } from './types.js';
 import { rankFilesByPriority, orderFindingsWithinFile } from './nextFile.js';
 import { runNextFile } from './nextFileIncremental.js';
 import { describeSqliteBackend } from './sqlite/driver.js';
@@ -96,6 +96,7 @@ program
     .option('-c, --config <config>', 'Configuration name')
     .option('-o, --output <dir>', 'Output directory for reports')
     .option('-f, --format <format>', 'Report format: html, json, csv, or sarif')
+    .option('--overwrite', 'Overwrite an existing report file at --output (default: refuse)')
     .option('--fail-on <severity>', 'Exit code 2 when violations at or above this severity exist')
     .option('--full', 'Show full violation inventory (overrides default delta view when baseline exists)')
     .option('--include-baseline', 'Evaluate baseline-known violations in --fail-on checks')
@@ -118,7 +119,7 @@ program
     try {
         await initParsers();
         // Validate --fail-on severity
-        const validSeverities = ['critical', 'severe', 'high'];
+        const validSeverities = SEVERITIES;
         const failOnSeverity = options.failOn;
         if (failOnSeverity && !validSeverities.includes(failOnSeverity)) {
             const renamed = LEGACY_SEVERITY_NAMES[failOnSeverity];
@@ -194,12 +195,24 @@ program
                 console.log(chalk.yellow(`  ${name} [${d.kind}] — ${d.message}`));
             }
         }
+        // ── Ignored config keys (Spec 61 R1.4) ─────────────────────────
+        // Keys dropped by sanitizeProjectFileConfig: undeclared keys (like
+        // `scope`, which previously reached execSync via mergeConfig's raw-key
+        // iteration) and path keys resolving outside the project root. Surfaced
+        // so a silently-ignored config never reads as "loaded fine".
+        const ignoredConfigKeys = (result.metadata?.diagnostics ?? []).filter((d) => d.kind === 'config-key-rejected');
+        if (ignoredConfigKeys.length > 0) {
+            console.log(chalk.yellow(`── Ignored config keys ── ${ignoredConfigKeys.length}`));
+            for (const d of ignoredConfigKeys) {
+                console.log(chalk.yellow(`  ${d.message}`));
+            }
+        }
         // ── Coverage gaps (Spec 58 follow-up) ─────────────────────────
         // Coverage diagnostics are the analyzer saying "my visibility ends here",
         // not "the code is wrong". They lead with counts, then per-occurrence
         // file:line — visible and counted, never blocking (they never reach the
         // gate). Rendered alongside the coverage panel that leads the report.
-        const coverageDiagnostics = (result.metadata?.diagnostics ?? []).filter((d) => d.kind === 'unresolved-query' || d.kind === 'unresolved-dynamic-import' || d.kind === 'undefined-class-not-found');
+        const coverageDiagnostics = (result.metadata?.diagnostics ?? []).filter((d) => d.kind === 'unresolved-query' || d.kind === 'unresolved-dynamic-import' || d.kind === 'undefined-class-not-found' || d.kind === 'cannot-fire');
         if (coverageDiagnostics.length > 0) {
             const byKind = {};
             for (const d of coverageDiagnostics)
@@ -444,12 +457,33 @@ program
                 ? { rootDir, ...readVersionControlProvenance(rootDir) }
                 : { rootDir };
             const report = generateReport(result, options.format, config);
-            const outputDir = options.output || process.cwd();
             const ext = options.format === 'sarif' ? 'sarif' : options.format;
-            const reportPath = join(outputDir, `audit-report.${ext}`);
-            await fs.mkdir(dirname(reportPath), { recursive: true });
-            await fs.writeFile(reportPath, report, 'utf-8');
-            console.log(chalk.green(`\nReport written to ${reportPath}`));
+            if (options.output) {
+                // Explicit output path — write a file. Refuse to clobber an existing
+                // report unless --overwrite is passed. A report write is destructive;
+                // a silent overwrite of `audit-report.json` in a consuming repo is the
+                // defect this guard removes.
+                const outputDir = resolve(options.output);
+                const reportPath = join(outputDir, `audit-report.${ext}`);
+                let exists = false;
+                try {
+                    await fs.access(reportPath);
+                    exists = true;
+                }
+                catch { /* ok */ }
+                if (exists && !options.overwrite) {
+                    console.error(chalk.red(`Refusing to overwrite existing report ${reportPath} — pass --overwrite to replace it.`));
+                    process.exit(1);
+                }
+                await fs.mkdir(dirname(reportPath), { recursive: true });
+                await fs.writeFile(reportPath, report, 'utf-8');
+                console.log(chalk.green(`\nReport written to ${reportPath}`));
+            }
+            else {
+                // No output path — default to stdout. Never write a report into the
+                // audited project without an explicit --output on the command line.
+                process.stdout.write(report + '\n');
+            }
         }
         // ── Fail-on logic (Spec 18 R3) ───────────────────────────────
         // --fail-on-regression: compare total high debt to baseline snapshot
@@ -487,7 +521,7 @@ program
             const evaluableViolations = (baseline && !options.includeBaseline)
                 ? violations.filter((v) => v.new || v.analyzer === 'invariants')
                 : violations;
-            const severityOrder = ['critical', 'severe', 'high'];
+            const severityOrder = SEVERITIES;
             const failIndex = severityOrder.indexOf(failOnSeverity);
             const hasAtOrAbove = evaluableViolations.some((v) => {
                 // Spec 57 — a dismissed finding never blocks the gate.
@@ -821,7 +855,7 @@ program
     .action(async (paths, options) => {
     try {
         await initParsers();
-        const validSeverities = ['critical', 'severe', 'high'];
+        const validSeverities = SEVERITIES;
         const failOnSeverity = options.failOn;
         if (!validSeverities.includes(failOnSeverity)) {
             const renamed = LEGACY_SEVERITY_NAMES[failOnSeverity];
@@ -859,7 +893,7 @@ program
         });
         const result = await runner.run();
         const violations = Object.values(result.analyzerResults).flatMap((r) => r.violations || []);
-        const severityOrder = ['critical', 'severe', 'high'];
+        const severityOrder = SEVERITIES;
         const failIndex = severityOrder.indexOf(failOnSeverity);
         const blocking = violations.filter((v) => {
             if (!isSelfAuditInScope(v.file ?? ''))
@@ -1186,8 +1220,9 @@ program
     .description('Generate a .codeauditor.json scaffold with invariant rules')
     .option('-o, --output <dir>', 'Output directory', '.')
     .option('-i, --interactive', 'Interactive rule builder')
-    .option('-f, --force', 'Force overwrite existing file without confirmation')
-    .option('-y, --yes', 'Skip confirmation prompts (same as --force)')
+    .option('--overwrite', 'Overwrite an existing .codeauditor.json without confirmation')
+    .option('-f, --force', 'Alias for --overwrite')
+    .option('-y, --yes', 'Alias for --overwrite')
     .action(async (options) => {
     console.log(chalk.blue('🛠️  Code Auditor Config Generator'));
     console.log(chalk.gray('════════════════════════════════════════════════════'));
@@ -1492,7 +1527,7 @@ configCmd
         let profiles = [];
         try {
             await fs.access(configPath);
-            const config = await loadConfig({ configPath });
+            const { config } = await loadConfig({ configPath, projectRoot });
             profiles = config.pathProfiles || [];
         }
         catch {
@@ -1600,7 +1635,7 @@ configCmd
         try {
             const configPath = pathModule.join(projectRoot, '.codeauditor.json');
             await fsPromises.access(configPath);
-            config = await loadConfig({ configPath });
+            config = (await loadConfig({ configPath, projectRoot })).config;
         }
         catch {
             // No config — use defaults
@@ -1783,6 +1818,7 @@ program
     .option('--no-unused-imports', 'Hide unused import warnings')
     .option('--min-complexity <threshold>', 'Minimum complexity threshold for warnings', '7')
     .option('-o, --output <file>', 'Save output to file instead of displaying')
+    .option('--overwrite', 'Overwrite an existing output file (default: refuse)')
     .action(async (options) => {
     console.log(chalk.blue('🗺️  Codebase Map Generator'));
     console.log(chalk.gray('════════════════════════════════════════════════════'));
@@ -3143,16 +3179,13 @@ program
         // normalizes the real config, so path keys compare cleanly instead of
         // reading as "user-set" because one side is absolute and the other is not.
         const pristine = { ...getDefaultConfig(), codeIndex: { ...DEFAULT_CODE_INDEX_CONFIG } };
-        if (pristine.outputDirectory) {
-            pristine.outputDirectory = pathModule.resolve(projectRoot, pristine.outputDirectory);
-        }
         pristine.includePaths = (pristine.includePaths ?? []).map((p) => pathModule.isAbsolute(p) ? p : pathModule.resolve(projectRoot, p));
         pristine.excludePaths = (pristine.excludePaths ?? []).map((p) => pathModule.isAbsolute(p) ? p : pathModule.resolve(projectRoot, p));
         // Load the project config (defaults when no config file exists).
         let config;
         try {
             await fs.access(configPath);
-            config = await loadConfig({ configPath });
+            config = (await loadConfig({ configPath, projectRoot })).config;
         }
         catch {
             config = pristine;
@@ -3522,6 +3555,9 @@ const SCAFFOLD_CONFIG = {
 async function generateConfigurations(options) {
     const outputDir = resolve(options.output || '.');
     const outputPath = join(outputDir, '.codeauditor.json');
+    // One consent spelling across the CLI: `--overwrite`. `--force`/`--yes` are
+    // retained as aliases for back-compat.
+    const overwrite = Boolean(options.overwrite || options.force || options.yes);
     let config;
     if (options.interactive) {
         // --- Interactive rule builder ---
@@ -3541,7 +3577,7 @@ async function generateConfigurations(options) {
             config = await buildRulesInteractively();
         }
         // Confirm output directory
-        if (!options.force && !options.yes) {
+        if (!overwrite) {
             const { dir } = await inquirer.prompt({
                 dir: {
                     type: 'input',
@@ -3586,12 +3622,12 @@ async function generateConfigurations(options) {
             exists = true;
         }
         catch { /* ok */ }
-        if (exists && !options.force && !options.yes) {
+        if (exists && !overwrite) {
             console.log(chalk.yellow(`.codeauditor.json already exists at ${outputPath}`));
-            console.log(chalk.gray('Use --force or --yes to overwrite, or --interactive to build a custom config.'));
+            console.log(chalk.gray('Use --overwrite to replace it, or --interactive to build a custom config.'));
             return;
         }
-        if (exists && (options.force || options.yes)) {
+        if (exists && overwrite) {
             console.log(chalk.yellow('Overwriting existing .codeauditor.json...'));
         }
         config = SCAFFOLD_CONFIG;
@@ -3865,9 +3901,22 @@ async function generateCodeMap(options) {
         const textOutput = mapGenerator.formatAsText(completeCodeMap, mapOptions);
         // Output results
         if (options.output) {
-            // Save to file
-            await fs.writeFile(options.output, textOutput);
-            console.log(chalk.green(`✓ Code map saved to: ${options.output}`));
+            // Save to file. Refuse to clobber an existing file unless --overwrite is
+            // passed — same guard as the report writer, so `map -o` cannot silently
+            // destroy a file the developer did not consent to replacing.
+            const outPath = resolve(options.output);
+            let exists = false;
+            try {
+                await fs.access(outPath);
+                exists = true;
+            }
+            catch { /* ok */ }
+            if (exists && !options.overwrite) {
+                console.error(chalk.red(`Refusing to overwrite existing file ${outPath} — pass --overwrite to replace it.`));
+                process.exit(1);
+            }
+            await fs.writeFile(outPath, textOutput);
+            console.log(chalk.green(`✓ Code map saved to: ${outPath}`));
             // Show summary
             console.log('');
             console.log(chalk.blue('Summary:'));