code-auditor-mcp 5.0.1 → 5.2.0

package/dist/cli.js

@@ -2,15 +2,14 @@
 /**
  * Code Auditor CLI - Enhanced with AI Tool Integration
  */
-// MUST be first import: sets NAPI_RS_NATIVE_LIBRARY_PATH before @ast-grep/napi loads
-import './native-bootstrap.js';
 import { Command } from 'commander';
 import chalk from 'chalk';
 import { createAuditRunner } from './auditRunner.js';
+import { readHookNotice } from './hookLog.js';
 import { promises as fs } from 'fs';
 import { createInterface } from 'readline';
 import { dirname, isAbsolute, join, relative, resolve } from 'path';
-import { PACKAGE_VERSION } from './constants.js';
+import { PACKAGE_VERSION, DEFAULT_RULE_REQUEST_BASE_URL } from './constants.js';
 import inquirer from 'inquirer';
 import { CodeMapGenerator } from './services/CodeMapGenerator.js';
 import { initParsers } from './languages/index.js';
@@ -20,13 +19,14 @@ import { getFilesProcessed, getFactsConsumed, isVisitorStatus, isReducerStatus }
 import { createBaselineFromFindings, saveBaseline, loadBaseline, diffBaselines } from './baseline.js';
 import { fingerprint, buildFingerprintInput } from './fingerprint.js';
 import { buildDismissalEntry, upsertDismissal } from './dismissals.js';
-import { resolveTelemetryConfig, signatureForFinding, buildTelemetryPayload, formatTelemetryPreview, sendTelemetry, languageHint } from './telemetry.js';
+import { resolveTelemetryConfig, signatureForFinding, buildTelemetryPayload, formatTelemetryPreview, sendTelemetry, languageHint, telemetryStatus, telemetryEnable, telemetryDisable, postJson } from './telemetry.js';
 import { getInstallId } from './installConfig.js';
 import { computeGatingDecision } from './enforcement/gate.js';
 import { BLOCKING_SEVERITIES, SEVERITIES } from './types.js';
 import { rankFilesByPriority, orderFindingsWithinFile } from './nextFile.js';
 import { runNextFile } from './nextFileIncremental.js';
 import { describeSqliteBackend } from './sqlite/driver.js';
+import { isRuleTimingEnabled } from './analyzers/ruleTiming.js';
 const program = new Command();
 // Legacy severity names that were renamed off Spec-54's "advisory" back to "high"
 // (Spec-54's third tier rendered as "advisory", which read as optional — the very
@@ -125,26 +125,22 @@ function printAuditDiagnostics(result) {
     const unprovenSiteCount = (result.metadata?.diagnostics ?? [])
         .filter((d) => d.kind === 'cannot-fire' && d.analyzerName === 'schema')
         .length;
+    const heldOutByProfile = result.summary?.heldOut ?? 0;
     if (coverage && coverage.length > 0) {
         const covFired = coverage.filter(c => c.state === 'fired').length;
         const covClean = coverage.filter(c => c.state === 'clean').length;
         const covIncomplete = coverage.filter(c => c.state === 'incomplete').length;
         const covNotApplicable = coverage.filter(c => c.state === 'notApplicable').length;
         const covCannotFire = coverage.filter(c => c.state === 'cannot-fire').length;
-        console.log(chalk.gray(`── Coverage panel ── ${covFired} fired · ${covClean} clean · ` +
+        // Spec 69 §10 R4 follow-up — "clean" is not a printable verdict while any
+        // site is unproven (cannot-fire) or held out by a path profile: a rule that
+        // reports "clean" may have under-reported on access it could not observe.
+        const cleanSuppressed = unprovenSiteCount > 0 || heldOutByProfile > 0;
+        const cleanPart = cleanSuppressed ? '' : `${covClean} clean · `;
+        console.log(chalk.gray(`── Coverage panel ── ${covFired} fired · ${cleanPart}` +
             `${covIncomplete} incomplete · ${covNotApplicable} not-applicable · ` +
-            `${covCannotFire} cannot-fire · ${unprovenSiteCount} unproven sites`));
-    }
-    // ── Skipped analyzers (Spec 61) ──────────────────────────────
-    const skippedAnalyzers = (result.metadata?.diagnostics ?? []).filter((d) => d.kind === 'go-toolchain-missing' ||
-        d.kind === 'go-analyzer-wrong-arch' ||
-        d.kind === 'go-analyzer-build-failed');
-    if (skippedAnalyzers.length > 0) {
-        console.log(chalk.yellow(`── Skipped analyzers ── ${skippedAnalyzers.length}`));
-        for (const d of skippedAnalyzers) {
-            const name = d.analyzerName || 'go';
-            console.log(chalk.yellow(`  ${name} [${d.kind}] — ${d.message}`));
-        }
+            `${covCannotFire} cannot-fire · ${unprovenSiteCount} unproven sites · ` +
+            `${heldOutByProfile} held out by profile`));
     }
     // ── Ignored config keys (Spec 61 R1.4) ─────────────────────────
     const ignoredConfigKeys = (result.metadata?.diagnostics ?? []).filter((d) => d.kind === 'config-key-rejected');
@@ -254,7 +250,14 @@ function printFindingSummary(result, violations, baseline, options) {
     const dismissedSuffix = dismissedCount > 0 ? `, ${dismissedCount} dismissed` : '';
     const gateExcludedCount = violations.filter((v) => v.gateExcluded).length;
     const gatingCount = (severity) => violations.filter((v) => v.severity === severity && !v.gateExcluded && !v.dismissed).length;
-    const findingsSuffix = `${dismissedSuffix}${gateExcludedCount > 0 ? ` (${gateExcludedCount.toLocaleString()} excluded from gate)` : ''}`;
+    // Spec 69 §10 R4 follow-up — the headline states findings, unproven sites,
+    // and held-out readings together. Held-out readings are named "held out by
+    // profile" (they still count in the total but do not block the gate).
+    const heldOutByProfile = result.summary?.heldOut ?? gateExcludedCount;
+    const unprovenSites = result.summary?.unprovenSites ?? 0;
+    const findingsSuffix = `${dismissedSuffix}` +
+        `${unprovenSites > 0 ? ` · ${unprovenSites.toLocaleString()} unproven sites` : ''}` +
+        `${heldOutByProfile > 0 ? ` · ${heldOutByProfile.toLocaleString()} held out by profile` : ''}`;
     const summaryLine = (label, total, severity) => gateExcludedCount > 0
         ? `${label}: ${total} (${gatingCount(severity)} gating)`
         : `${label}: ${total}`;
@@ -586,6 +589,13 @@ program
             outputDirectory: options.output,
             presets: presetIds
         }).run();
+        // Hook-liveness notice — a top-level notice, not a per-file finding. A live
+        // "hook not running" condition means the PostToolUse hook is not enqueueing
+        // changes, so cached findings may be stale.
+        const hookNotice = readHookNotice();
+        if (hookNotice) {
+            console.log(chalk.yellow(`\n⚠️  ${hookNotice.message}`));
+        }
         const violations = Object.values(result.analyzerResults).flatMap((r) => r.violations || []);
         const baseline = result.metadata?.baseline;
         printAuditDiagnostics(result);
@@ -718,7 +728,7 @@ program
         // Emitted to stderr so it never corrupts --json stdout. Slowest rule first.
         // The gate metric is CPU time (auditCpuMs), not wall clock: the budget is
         // about a slow *rule*, and CPU time isolates that from a slow machine.
-        if (process.env.CODE_AUDIT_RULE_TIMING === '1') {
+        if (isRuleTimingEnabled()) {
             const ruleTiming = result.metadata?.ruleTiming;
             const gateMs = result.metadata?.auditCpuMs;
             const gateWallMs = result.metadata?.auditDuration;
@@ -875,7 +885,18 @@ async function emitChangedOutput(result, violations, blocking, dismissedCount, o
             }
         }
         else {
-            console.log(chalk.green('\n✓ No readings.'));
+            // A bare `changed` scope that found no baseline to diff against must not
+            // report a false clean. The diagnostic names both causes (never indexed,
+            // or the index was discarded) so the agent sees "cannot determine what
+            // changed", never "nothing changed".
+            const noBaseline = (result.metadata?.diagnostics ?? []).find((d) => d.kind === 'no-baseline');
+            if (noBaseline) {
+                console.log(chalk.yellow('\n⚠ Cannot determine what changed.'));
+                console.log(chalk.yellow(noBaseline.message));
+            }
+            else {
+                console.log(chalk.green('\n✓ No readings.'));
+            }
         }
     }
 }
@@ -1292,7 +1313,7 @@ program
     .description('Dismiss one finding by fingerprint — a written reason is required')
     .requiredOption('--reason <reason>', 'Why this finding is dismissed (required — a dismissal without a reason is a config error)')
     .option('-p, --path <path>', OPTION_PROJECT_PATH, process.cwd())
-    .option('--telemetry-endpoint <url>', 'Feedback service endpoint override (defaults to the opt-in endpoint recorded by the telemetry tool)')
+    .option('--telemetry-endpoint <url>', 'Feedback service endpoint override (defaults to the opt-in endpoint recorded by the `code-audit telemetry` command)')
     .option('--json', OPTION_OUTPUT_AS_JSON)
     .action(async (fingerprintArg, options) => {
     try {
@@ -1320,9 +1341,9 @@ program
         const entry = buildDismissalEntry(match, reason, PACKAGE_VERSION);
         const dismissals = upsertDismissal(projectRoot, entry);
         // Spec 57 — opt-in telemetry. Nothing is sent unless the user opted in via
-        // the `telemetry` MCP tool (default OFF) AND an endpoint is configured. The
-        // payload is printed for review before sending; any send failure is silent
-        // and never affects the dismissal or the exit code.
+        // the `code-audit telemetry enable` command (default OFF) AND an endpoint is
+        // configured. The payload is printed for review before sending; any send
+        // failure is silent and never affects the dismissal or the exit code.
         const telemetry = resolveTelemetryConfig({ endpoint: options.telemetryEndpoint });
         if (telemetry.enabled && telemetry.endpoint) {
             const signature = signatureForFinding(match.file, match.line ?? match.start?.line ?? 1, match.column ?? match.start?.column ?? 1) ?? 'unknown';
@@ -1370,6 +1391,153 @@ program
         process.exit(1);
     }
 });
+// Telemetry opt-in (Spec 57) — status/enable/disable call the same three
+// functions as the telemetry MCP tool (telemetry.ts), so the CLI and the MCP
+// tool can never disagree about what is enabled or what a submission contains.
+const telemetry = program
+    .command('telemetry')
+    .description('Manage anonymous dismissal feedback opt-in (default OFF). Actions: status, enable, disable.');
+telemetry
+    .command('status')
+    .description('Show whether anonymous dismissal feedback is enabled, its endpoint, and the anonymous install ID.')
+    .option('--json', OPTION_OUTPUT_AS_JSON)
+    .action(async (options) => {
+    const s = telemetryStatus();
+    if (options.json) {
+        process.stdout.write(JSON.stringify(s, null, 2) + '\n');
+    }
+    else {
+        console.log(chalk.bold(s.enabled ? 'Telemetry: enabled' : 'Telemetry: disabled'));
+        if (s.enabled) {
+            console.log(chalk.gray(`  endpoint:    ${s.endpoint}`));
+            console.log(chalk.gray(`  install ID:  ${s.installId}`));
+        }
+        else {
+            console.log(chalk.gray('  endpoint:    (none — enable with `code-audit telemetry enable`)'));
+        }
+        console.log(chalk.gray(`\n${s.message}`));
+    }
+});
+telemetry
+    .command('enable')
+    .description('Opt in to anonymous dismissal feedback. Defaults to the built-in service endpoint. Generates the anonymous install ID on first use.')
+    .option('--endpoint <url>', 'Optional ingest URL. Defaults to the built-in service endpoint.')
+    .option('--json', OPTION_OUTPUT_AS_JSON)
+    .action(async (options) => {
+    try {
+        const s = telemetryEnable(options.endpoint);
+        if (options.json) {
+            process.stdout.write(JSON.stringify(s, null, 2) + '\n');
+        }
+        else {
+            console.log(chalk.green('✓ Telemetry enabled.'));
+            console.log(chalk.gray(`  endpoint:    ${s.endpoint}`));
+            console.log(chalk.gray(`  install ID:  ${s.installId}`));
+            console.log(chalk.gray(`\n${s.message}`));
+        }
+    }
+    catch (error) {
+        console.error(chalk.red('Error:'), error);
+        process.exit(1);
+    }
+});
+telemetry
+    .command('disable')
+    .description('Turn off anonymous dismissal feedback. The endpoint is remembered; nothing further is sent.')
+    .option('--json', OPTION_OUTPUT_AS_JSON)
+    .action(async (options) => {
+    const s = telemetryDisable();
+    if (options.json) {
+        process.stdout.write(JSON.stringify(s, null, 2) + '\n');
+    }
+    else {
+        console.log(chalk.green('✓ Telemetry disabled.'));
+        console.log(chalk.gray(s.message));
+    }
+});
+// Accumulate a repeatable option (commander's default keeps only the last value).
+function collectOption(value, previous) {
+    return [...(previous ?? []), value];
+}
+// Request a new rule (rule-request intake). POSTs to the docs site's HTTP tool
+// API, which validates and forwards to the shared feedback service. The CLI does
+// no own validation: it reads the example files, sends them with the client
+// surface, and prints whatever the server decides (receipt id, or field errors).
+program
+    .command('request-rule')
+    .description('Submit a request for a new Code Auditor rule (an unflagged defect class)')
+    .requiredOption('--title <title>', 'Short rule title (10-120 chars)')
+    .requiredOption('--symptom <text>', 'Symptom this rule should catch (40-2000 chars)')
+    .requiredOption('--signal <text>', 'Signal/pattern the rule should look for (40-2000 chars)')
+    .option('--language <lang>', 'Language the rule applies to (repeatable)', collectOption, [])
+    .option('--fires <path>', 'Example file that SHOULD be flagged (repeatable)', collectOption, [])
+    .option('--clean <path>', 'Example file that should NOT be flagged (repeatable)', collectOption, [])
+    .option('--endpoint <url>', `Docs API base URL (default ${DEFAULT_RULE_REQUEST_BASE_URL})`)
+    .option('--json', OPTION_OUTPUT_AS_JSON)
+    .action(async (options) => {
+    try {
+        const readFiles = async (paths) => {
+            const out = [];
+            for (const p of paths) {
+                out.push({ path: p, content: await fs.readFile(resolve(p), 'utf-8') });
+            }
+            return out;
+        };
+        const [firingExample, cleanExample] = await Promise.all([
+            readFiles(options.fires ?? []),
+            readFiles(options.clean ?? []),
+        ]);
+        const body = {
+            title: options.title,
+            symptom: options.symptom,
+            signal: options.signal,
+            languages: options.language ?? [],
+            firingExample,
+            cleanExample,
+            toolVersion: PACKAGE_VERSION,
+        };
+        const base = (options.endpoint ?? DEFAULT_RULE_REQUEST_BASE_URL).replace(/\/+$/, '');
+        const url = `${base}/api/tools/request_rule`;
+        const result = await postJson(url, body, {
+            timeoutMs: 5000,
+            headers: { 'x-code-auditor-client': 'cli' },
+        });
+        if (result.error) {
+            console.error(chalk.red('Error:'), result.error);
+            process.exit(1);
+        }
+        if (!result.ok) {
+            const res = result.body;
+            if (res?.fields) {
+                console.error(chalk.red(`Error: request rejected (${res.error ?? 'validation failed'})`));
+                for (const [field, msgs] of Object.entries(res.fields)) {
+                    console.error(chalk.gray(`  ${field}: ${msgs.join('; ')}`));
+                }
+            }
+            else if (res?.retryAfterSeconds !== undefined) {
+                console.error(chalk.red(`Error: rate limited — retry in ${res.retryAfterSeconds}s`));
+            }
+            else {
+                console.error(chalk.red(`Error: ${res?.message ?? res?.error ?? `HTTP ${result.status}`}`));
+            }
+            process.exit(1);
+        }
+        const out = result.body;
+        if (options.json) {
+            process.stdout.write(JSON.stringify(out, null, 2) + '\n');
+        }
+        else {
+            console.log(chalk.green(`✓ Rule request submitted${out.duplicateSubmission ? ' (duplicate — already received)' : ''}`));
+            console.log(chalk.gray(`  receipt id: ${out.id}`));
+            const matches = out.existingRuleMatches ?? [];
+            console.log(chalk.gray(`  existingRuleMatches: ${matches.length ? matches.join(', ') : '(none)'}`));
+        }
+    }
+    catch (error) {
+        console.error(chalk.red('Error:'), error);
+        process.exit(1);
+    }
+});
 // Generate configuration command
 program
     .command('generate-config')
@@ -2284,8 +2452,18 @@ program
         if (existing.cnt === 0 && options.path) {
             const { extractChurn } = await import('./churn/churnExtractor.js');
             const { computeHotspots } = await import('./hotspots/hotspotScorer.js');
+            const { findConfigFileUp, loadConfig } = await import('./config/configLoader.js');
+            const { DEFAULT_CHURN_CONFIG } = await import('./config/defaults.js');
             try {
-                extractChurn(rawDb, options.path, { churnWindowMonths: 12 });
+                // Read the `churn` config key (Spec 13 R1) — the literal
+                // `{ churnWindowMonths: 12 }` was the orphan; the window now resolves
+                // from `.codeauditor.json` with DEFAULT_CHURN_CONFIG as the default.
+                const configPath = await findConfigFileUp(options.path);
+                const { config } = await loadConfig({
+                    configPath: configPath ?? undefined,
+                    projectRoot: options.path,
+                });
+                extractChurn(rawDb, options.path, config.churn ?? DEFAULT_CHURN_CONFIG);
                 computeHotspots(rawDb);
             }
             catch (err) {
@@ -2572,8 +2750,6 @@ ledgerCmd
 // `audit --detach` forks workers/auditJobRunner; `status`/`result`/`jobs` read
 // the persisted ledger. One job model (the ledger run), one write path — these
 // are thin wrappers over ledger.ts + mcpAuditJobs.ts, not a second store.
-/** Lease TTL used by read-path reclaim, mirroring mcpAuditJobs.jobLeaseTtlMs. */
-const CLI_JOB_LEASE_TTL_MS = Number(process.env.CODE_AUDITOR_JOB_LEASE_TTL_MS) || 30_000;
 function spec41StatusBadge(status) {
     switch (status) {
         case 'completed':
@@ -2678,10 +2854,11 @@ program
     .action(async (jobId, options) => {
     try {
         const { getLedgerRun, reclaimStaleRunning, computeStaleness } = await import('./ledger.js');
+        const { jobLeaseTtlMs } = await import('./mcpAuditJobs.js');
         const projectRoot = resolve(options.path);
         const db = CodeIndexDB.getInstance(undefined, projectRoot);
         await db.initialize();
-        reclaimStaleRunning(db.rawDb, projectRoot, CLI_JOB_LEASE_TTL_MS);
+        reclaimStaleRunning(db.rawDb, projectRoot, jobLeaseTtlMs());
         const run = getLedgerRun(db.rawDb, jobId);
         if (!run) {
             console.error(chalk.red(`Job not found: ${jobId}`));
@@ -2839,10 +3016,11 @@ program
     .action(async (options) => {
     try {
         const { listLedgerRuns, reclaimStaleRunning, pruneLedgerRuns, computeStaleness } = await import('./ledger.js');
+        const { jobLeaseTtlMs } = await import('./mcpAuditJobs.js');
         const projectRoot = resolve(options.path);
         const db = CodeIndexDB.getInstance(undefined, projectRoot);
         await db.initialize();
-        reclaimStaleRunning(db.rawDb, projectRoot, CLI_JOB_LEASE_TTL_MS);
+        reclaimStaleRunning(db.rawDb, projectRoot, jobLeaseTtlMs());
         if (options.prune) {
             const keep = parseInt(options.keep, 10) || 10;
             const n = pruneLedgerRuns(db.rawDb, projectRoot, keep);
@@ -3055,6 +3233,11 @@ program
             hooks: options.hooks,
             list: options.list,
         });
+        // Nudge an undecided user toward the one-time telemetry choice. Only after
+        // a real install (not `--list`), and never once they've already decided.
+        if (!options.list && !telemetryStatus().decided) {
+            console.log('Anonymous dismissal feedback is off. Run `code-audit telemetry enable` to opt in, or `code-audit telemetry disable` to decline.');
+        }
     }
     catch (error) {
         console.error(chalk.red('Error:'), error);