code-auditor-mcp 5.2.0 → 5.3.3

package/dist/cli.js

@@ -27,6 +27,8 @@ import { rankFilesByPriority, orderFindingsWithinFile } from './nextFile.js';
 import { runNextFile } from './nextFileIncremental.js';
 import { describeSqliteBackend } from './sqlite/driver.js';
 import { isRuleTimingEnabled } from './analyzers/ruleTiming.js';
+import { gateBudgetResolutions } from './config/defaults.js';
+import { buildCandidatesArtifact } from './phase/candidates.js';
 const program = new Command();
 // Legacy severity names that were renamed off Spec-54's "advisory" back to "high"
 // (Spec-54's third tier rendered as "advisory", which read as optional — the very
@@ -181,6 +183,27 @@ function printAuditDiagnostics(result) {
             console.log(chalk.yellow(`   ${file} — ${entry.lines.length} site(s)${loc}: ${shown}${more}`));
         }
     }
+    // ── Per-rule unproven breakdown (K9) ──────────────────────────
+    // The raw unproven-site total answers "which analyzer produced these?"
+    // (`schema`); this answers the question the finding actually asks — "which
+    // rule may have under-reported?" One unproven site blanks every rule in its
+    // `affectedRules` set, so a rule's `count` is the number of sites that could
+    // have produced a finding under it, with `causes` naming the emission path
+    // that drove each (parse-failure / dialect-undetermined / unresolved-import /
+    // unproven-receiver). This is the missing discriminant: it surfaces the 465
+    // sites as *per-rule under-report risk*, not a single opaque analyzer total.
+    const unprovenByRule = result.summary?.unprovenSitesByRule;
+    if (unprovenByRule && Object.keys(unprovenByRule).length > 0) {
+        console.log(chalk.yellow(`── Unproven sites by rule ──`));
+        const ruleRows = Object.entries(unprovenByRule).sort(([, a], [, b]) => b.count - a.count);
+        for (const [rule, entry] of ruleRows) {
+            const causes = Object.entries(entry.causes)
+                .sort(([, a], [, b]) => b - a)
+                .map(([cause, n]) => `${n} ${cause}`)
+                .join(' · ');
+            console.log(chalk.yellow(`   ${rule} — ${entry.count} site(s): ${causes}`));
+        }
+    }
     // ── Coverage gaps (Spec 58 follow-up) ─────────────────────────
     const otherCoverageGaps = allDiagnostics.filter((d) => d.kind === 'unresolved-query' || d.kind === 'unresolved-dynamic-import' || d.kind === 'undefined-class-not-found');
     if (otherCoverageGaps.length > 0) {
@@ -237,6 +260,19 @@ function printAuditDiagnostics(result) {
             console.log(chalk.gray(`  … and ${deadClusters.length - 10} more clusters`));
         }
     }
+    // ── Directive K10 — cache GC ─────────────────────────────────
+    // State what the GC collected so a silent delete of operator cache is visible.
+    const cacheGc = result.metadata?.cacheGc;
+    if (cacheGc && (cacheGc.removedCliVersions.length > 0 || cacheGc.removedProjects.length > 0)) {
+        const parts = [];
+        if (cacheGc.removedCliVersions.length > 0) {
+            parts.push(`${cacheGc.removedCliVersions.length} superseded CLI cop${cacheGc.removedCliVersions.length === 1 ? 'y' : 'ies'}`);
+        }
+        if (cacheGc.removedProjects.length > 0) {
+            parts.push(`${cacheGc.removedProjects.length} abandoned project index${cacheGc.removedProjects.length === 1 ? '' : 'es'}`);
+        }
+        console.log(chalk.gray(`── Cache GC ── collected ${parts.join(' and ')}`));
+    }
 }
 /**
  * Print the findings summary: the delta view when a baseline exists, or the
@@ -552,6 +588,7 @@ program
     .option('--preset <id>', 'Apply a shareable preset (repeatable)', (v, prev) => prev.concat([v]), [])
     .option('--detach', 'Run the audit in a detached background process and print the job ID')
     .option('--explain-skipped', 'Print a per-reason breakdown of files dropped from analysis')
+    .option('--emit-candidates <path>', 'Write the sampled-audit candidates artifact (rule dispositions + candidate sites) to this file')
     .action(async (options) => {
     console.log(chalk.blue('🔍 Code Quality Audit Tool'));
     console.log(chalk.gray('══════════════════════════════════════════════════'));
@@ -604,16 +641,18 @@ program
         printFileAccounting(result, !!options.explainSkipped);
         printUnparsedAndSkipped(result);
         printPipelineStages(result, options);
-        // Spec-20 R4: built-in profile visibility — silent behavior changes
-        // are never acceptable. Notify when scripts-and-tests excludes findings
-        // from the blocking gate.
-        const builtinCapped = Object.values(result.analyzerResults)
-            .reduce((count, ar) => count + ar.violations.filter(v => v.profile === 'scripts-and-tests').length, 0);
-        if (builtinCapped > 0) {
-            console.log(chalk.blue(`\nℹ️  ${builtinCapped.toLocaleString()} readings excluded from the blocking gate by built-in profile "scripts-and-tests" (scripts/tests/fixtures).`));
-            console.log(chalk.gray(`   Set ${chalk.cyan('"builtin": false')} in .codeauditor.json to disable.`));
-        }
         await writeReport(result, options);
+        // Directive H item 2 — emit the sampled-audit candidates artifact when
+        // `--emit-candidates` names a destination. The artifact is the audit's
+        // only dependency on app/: rule disposition vocabularies (read from the
+        // rules) + candidate sites with their source line text. Nothing here
+        // reaches a model; it only serializes what the deterministic matchers
+        // emitted.
+        if (options.emitCandidates) {
+            const artifact = await buildCandidatesArtifact(result);
+            await fs.writeFile(resolve(options.emitCandidates), JSON.stringify(artifact, null, 2), 'utf8');
+            console.log(chalk.gray(`Candidates artifact written to ${options.emitCandidates} (${artifact.rules.reduce((n, r) => n + r.sites.length, 0)} sites across ${artifact.rules.length} rules)`));
+        }
         applyFailOnGates(result, violations, baseline, options, failOnSeverity);
     }
     catch (error) {
@@ -724,20 +763,29 @@ program
         // blocks; there is no configurable gate.
         const { blocking, resolutionGaps } = computeGatingDecision(violations, BLOCKING_SEVERITIES);
         await emitChangedOutput(result, violations, blocking, dismissedCount, options);
-        // Spec 38 R2/R3 — per-rule timing + gate cpu-time, opt-in by env var.
+        // Spec 38 R2/R3 — per-rule timing + gate work count, opt-in by env var.
         // Emitted to stderr so it never corrupts --json stdout. Slowest rule first.
-        // The gate metric is CPU time (auditCpuMs), not wall clock: the budget is
-        // about a slow *rule*, and CPU time isolates that from a slow machine.
+        // Directive J: the gate budget is now a deterministic-work count
+        // (receiverResolutions), not CPU time — the count moves only when the work
+        // does, where CPU time jitters with machine load. The wall/CPU times are
+        // still printed as a measurement for bench/gate-timing.ts, but they are no
+        // longer what the budget asserts on.
         if (isRuleTimingEnabled()) {
             const ruleTiming = result.metadata?.ruleTiming;
             const gateMs = result.metadata?.auditCpuMs;
             const gateWallMs = result.metadata?.auditDuration;
+            const gateWork = result.metadata?.receiverResolutions;
+            const budget = gateBudgetResolutions();
             const lines = [];
             lines.push('');
-            // §16 criterion 16 — report both wall-clock (what the hook's user feels)
-            // and CPU (what the rule actually burned); the budget asserts on CPU.
+            // Directive J — the asserted metric: deterministic receiver-resolution
+            // count vs the single-source budget (gateBudgetResolutions()). The
+            // verifier parses this line, so the CLI is the one source of the budget.
+            lines.push(`⏱  gate work: ${gateWork ?? 0} receiver resolutions (budget ${budget})`);
+            // Measurement, not assertion — wall-clock (what the hook's user feels)
+            // and CPU (what the rule actually burned); consumed by bench/gate-timing.ts.
             lines.push(`⏱  gate wall-clock: ${(gateWallMs ?? 0).toFixed(1)} ms`);
-            lines.push(`⏱  gate cpu-time: ${(gateMs ?? 0).toFixed(1)} ms (budget 400 ms)`);
+            lines.push(`⏱  gate cpu-time: ${(gateMs ?? 0).toFixed(1)} ms`);
             lines.push('── per-rule timing (slowest first) ──');
             if (ruleTiming && ruleTiming.length > 0) {
                 for (const t of ruleTiming) {
@@ -1883,9 +1931,7 @@ configCmd
                 else {
                     console.log(chalk.bold(`Profiles matching: ${options.file}`));
                     for (const name of resolved.matchedProfileNames) {
-                        const profile = profiles.find(p => p.name === name);
-                        const builtinTag = profile?.builtin !== false && profiles.some(p => p.name === name) ? '' : '';
-                        console.log(`  ${chalk.cyan(name)}${builtinTag ? chalk.gray(' (built-in)') : ''}`);
+                        console.log(`  ${chalk.cyan(name)}`);
                     }
                     if (resolved.excludeFromGate) {
                         console.log(chalk.yellow(`  excludeFromGate: true`));
@@ -1908,7 +1954,6 @@ configCmd
                         name: p.name,
                         paths: p.paths,
                         overrides: p.overrides,
-                        builtin: p.builtin !== false,
                     })),
                 }, null, 2) + '\n');
             }
@@ -1919,8 +1964,7 @@ configCmd
                 else {
                     console.log(chalk.bold('Active path profiles:'));
                     for (const p of profiles) {
-                        const tag = p.builtin !== false ? chalk.gray(' [built-in]') : '';
-                        console.log(`  ${chalk.cyan(p.name)}${tag}`);
+                        console.log(`  ${chalk.cyan(p.name)}`);
                         console.log(chalk.gray(`    paths: ${p.paths.join(', ')}`));
                         if (p.overrides && Object.keys(p.overrides).length > 0) {
                             for (const [key, value] of Object.entries(p.overrides)) {