hex-audit 0.4.4 → 0.4.5

package/dist/commands/issue.js

@@ -0,0 +1,115 @@
+import { Command } from 'commander';
+import fs from 'node:fs';
+import path from 'node:path';
+import { logger } from '../core/logger.js';
+import { loadConfig } from '../core/config.js';
+import { getOutputDir } from '../core/paths.js';
+import { reportError } from '../core/errors.js';
+import { moveIssue, patchIssue, COLUMN_TO_STATUS } from '../core/issues.js';
+function resolveOutputDir(opts) {
+    const projectDir = path.resolve(opts.project ?? process.cwd());
+    const config = loadConfig(projectDir);
+    return getOutputDir(config.project.project_dir, config.settings.output_dir);
+}
+const moveCmd = new Command('move')
+    .description('Move an issue between board columns (potential | verified | invalid | duplicate)')
+    .argument('<id>', 'Issue id (e.g. F001, SC-001, AA-003, github-12)')
+    .requiredOption('--to <column>', 'Target column: potential | verified | invalid | duplicate')
+    .option('--project <dir>', 'Project directory')
+    .action((id, opts) => {
+    try {
+        const column = opts.to;
+        if (!(column in COLUMN_TO_STATUS)) {
+            logger.error(`Invalid --to: ${opts.to}. Use one of: ${Object.keys(COLUMN_TO_STATUS).join(', ')}`);
+            process.exit(1);
+        }
+        const outputDir = resolveOutputDir(opts);
+        const entry = moveIssue(outputDir, id, column);
+        logger.success(`${id} → ${column} (status: ${entry.status})`);
+    }
+    catch (err) {
+        reportError(err);
+        process.exit(1);
+    }
+});
+const patchCmd = new Command('patch')
+    .description('Edit fields on an issue (materializes a findings.json entry if needed)')
+    .argument('<id>', 'Issue id')
+    .option('--title <title>', 'New title')
+    .option('--severity <severity>', 'Critical | High | Medium | Low | Info')
+    .option('--resolution <resolution>', 'Fixed | Mitigated | Acknowledged | Not Fixed | Unresolved')
+    .option('--description-file <path>', 'Read the description from this file')
+    .option('--recommendation-file <path>', 'Read the recommendation from this file')
+    .option('--update-from-client <text>', 'Client update text')
+    .option('--notes <text>', 'Tracking notes')
+    .option('--project <dir>', 'Project directory')
+    .action((id, opts) => {
+    try {
+        const updates = {};
+        if (opts.title != null)
+            updates.title = opts.title;
+        if (opts.severity != null)
+            updates.severity = opts.severity;
+        if (opts.resolution != null)
+            updates.resolution = opts.resolution;
+        if (opts.updateFromClient != null)
+            updates.update_from_client = opts.updateFromClient;
+        if (opts.notes != null)
+            updates.notes = opts.notes;
+        if (opts.descriptionFile != null) {
+            updates.description = fs.readFileSync(path.resolve(opts.descriptionFile), 'utf-8').trim();
+        }
+        if (opts.recommendationFile != null) {
+            updates.recommendation = fs
+                .readFileSync(path.resolve(opts.recommendationFile), 'utf-8')
+                .trim();
+        }
+        if (Object.keys(updates).length === 0) {
+            logger.error('Nothing to patch. Pass at least one of --title/--severity/--resolution/--description-file/--recommendation-file/--update-from-client/--notes.');
+            process.exit(1);
+        }
+        const outputDir = resolveOutputDir(opts);
+        const updated = patchIssue(outputDir, id, updates);
+        logger.success(`Patched ${id} (${Object.keys(updates).join(', ')})`);
+        logger.dim(`severity=${updated.severity}  resolution=${updated.resolution ?? '(none)'}`);
+    }
+    catch (err) {
+        reportError(err);
+        process.exit(1);
+    }
+});
+const showCmd = new Command('show')
+    .description('Print the merged finding + tracking record for an issue id')
+    .argument('<id>', 'Issue id')
+    .option('--project <dir>', 'Project directory')
+    .action((id, opts) => {
+    try {
+        const outputDir = resolveOutputDir(opts);
+        const findings = JSON.parse(fs.readFileSync(path.join(outputDir, 'findings.json'), 'utf-8'));
+        const tracking = (() => {
+            try {
+                return JSON.parse(fs.readFileSync(path.join(outputDir, 'tracking.json'), 'utf-8'));
+            }
+            catch {
+                return { findings: [] };
+            }
+        })();
+        const finding = findings.findings.find((f) => f.id === id) ?? null;
+        const track = tracking.findings.find((t) => t.id === id) ?? null;
+        if (!finding && !track) {
+            logger.error(`No issue with id ${id} in findings.json or tracking.json`);
+            process.exit(1);
+        }
+        console.log(JSON.stringify({ id, finding, tracking: track }, null, 2));
+    }
+    catch (err) {
+        reportError(err);
+        process.exit(1);
+    }
+});
+export const issueCommand = new Command('issue')
+    .description('Inspect and mutate issues on the board (move / patch / show)')
+    .addCommand(moveCmd)
+    .addCommand(patchCmd)
+    .addCommand(showCmd);
+//# sourceMappingURL=issue.js.map

package/dist/commands/issue.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"issue.js","sourceRoot":"","sources":["../../src/commands/issue.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAoB,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAE9F,SAAS,gBAAgB,CAAC,IAA0B;IAClD,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC/D,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IACtC,OAAO,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC;KAChC,WAAW,CAAC,kFAAkF,CAAC;KAC/F,QAAQ,CAAC,MAAM,EAAE,iDAAiD,CAAC;KACnE,cAAc,CAAC,eAAe,EAAE,2DAA2D,CAAC;KAC5F,MAAM,CAAC,iBAAiB,EAAE,mBAAmB,CAAC;KAC9C,MAAM,CAAC,CAAC,EAAU,EAAE,IAAsC,EAAE,EAAE;IAC7D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,EAAiB,CAAC;QACtC,IAAI,CAAC,CAAC,MAAM,IAAI,gBAAgB,CAAC,EAAE,CAAC;YAClC,MAAM,CAAC,KAAK,CACV,iBAAiB,IAAI,CAAC,EAAE,iBAAiB,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACpF,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,KAAK,GAAG,SAAS,CAAC,SAAS,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;QAC/C,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,MAAM,aAAa,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IAChE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,WAAW,CAAC,GAAG,CAAC,CAAC;QACjB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC;KAClC,WAAW,CAAC,wEAAwE,CAAC;KACrF,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;KAC5B,MAAM,CAAC,iBAAiB,EAAE,WAAW,CAAC;KACtC,MAAM,CAAC,uBAAuB,EAAE,uCAAuC,CAAC;KACxE,MAAM,CAAC,2BAA2B,EAAE,2DAA2D,CAAC;KAChG,MAAM,CAAC,2BAA2B,EAAE,qCAAqC,CAAC;KAC1E,MAAM,CAAC,8BAA8B,EAAE,wCAAwC,CAAC;KAChF,MAAM,CAAC,6BAA6B,EAAE,oBAAoB,CAAC;KAC3D,MAAM,CAAC,gBAAgB,EAAE,gBAAgB,CAAC;KAC1C,MAAM,CAAC,iBAAiB,EAAE,mBAAmB,CAAC;KAC9C,MAAM,CACL,CACE,EAAU,EACV,IASC,EACD,EAAE;IACF,IAAI,CAAC;QACH,MAAM,OAAO,GAA4B,EAAE,CAAC;QAC5C,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI;YAAE,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACnD,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI;YAAE,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC5D,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI;YAAE,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QAClE,IAAI,IAAI,CAAC,gBAAgB,IAAI,IAAI;YAAE,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,gBAAgB,CAAC;QACtF,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI;YAAE,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACnD,IAAI,IAAI,CAAC,eAAe,IAAI,IAAI,EAAE,CAAC;YACjC,OAAO,CAAC,WAAW,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5F,CAAC;QACD,IAAI,IAAI,CAAC,kBAAkB,IAAI,IAAI,EAAE,CAAC;YACpC,OAAO,CAAC,cAAc,GAAG,EAAE;iBACxB,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;iBAC5D,IAAI,EAAE,CAAC;QACZ,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtC,MAAM,CAAC,KAAK,CACV,+IAA+I,CAChJ,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,UAAU,CAAC,SAAS,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;QACnD,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrE,MAAM,CAAC,GAAG,CAAC,YAAY,OAAO,CAAC,QAAQ,gBAAgB,OAAO,CAAC,UAAU,IAAI,QAAQ,EAAE,CAAC,CAAC;IAC3F,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,WAAW,CAAC,GAAG,CAAC,CAAC;QACjB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CACF,CAAC;AAEJ,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC;KAChC,WAAW,CAAC,4DAA4D,CAAC;KACzE,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;KAC5B,MAAM,CAAC,iBAAiB,EAAE,mBAAmB,CAAC;KAC9C,MAAM,CAAC,CAAC,EAAU,EAAE,IAA0B,EAAE,EAAE;IACjD,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CACzB,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,EAAE,OAAO,CAAC,CACzB,CAAC;QACzC,MAAM,QAAQ,GAAG,CAAC,GAAG,EAAE;YACrB,IAAI,CAAC;gBACH,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,EAAE,OAAO,CAAC,CAEhF,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,EAAE,QAAQ,EAAE,EAA2B,EAAE,CAAC;YACnD,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QACL,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,IAAI,IAAI,CAAC;QACnE,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,IAAI,IAAI,CAAC;QACjE,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC;YACvB,MAAM,CAAC,KAAK,CAAC,oBAAoB,EAAE,oCAAoC,CAAC,CAAC;YACzE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACzE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,WAAW,CAAC,GAAG,CAAC,CAAC;QACjB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC;KAC7C,WAAW,CAAC,8DAA8D,CAAC;KAC3E,UAAU,CAAC,OAAO,CAAC;KACnB,UAAU,CAAC,QAAQ,CAAC;KACpB,UAAU,CAAC,OAAO,CAAC,CAAC"}

package/dist/core/issues.d.ts

@@ -0,0 +1,79 @@
+export type BoardColumn = 'potential' | 'verified' | 'invalid' | 'duplicate';
+export type Severity = 'Critical' | 'High' | 'Medium' | 'Low' | 'Info';
+export type Resolution = 'Fixed' | 'Mitigated' | 'Acknowledged' | 'Not Fixed' | 'Unresolved';
+export declare const SEVERITY_VALUES: readonly Severity[];
+export declare const RESOLUTION_VALUES: readonly Resolution[];
+export declare const COLUMN_TO_STATUS: Record<BoardColumn, string>;
+/** Fields a user may edit through the board modal or `hex issue patch`. */
+export declare const EDITABLE_FIELDS: readonly ["title", "severity", "description", "recommendation", "resolution", "update_from_client", "notes"];
+export type EditableField = (typeof EDITABLE_FIELDS)[number];
+interface FindingLocation {
+    file: string;
+    snippet?: string;
+}
+export interface Finding {
+    id: string;
+    title: string;
+    severity: Severity;
+    category: string;
+    description: string;
+    root_cause: {
+        locations: FindingLocation[];
+    };
+    poc: {
+        status: string;
+        file: string | null;
+        validation_memo: string | null;
+    };
+    recommendation: string;
+    references: {
+        external_links: string[];
+    };
+    created_at: string;
+    update_from_client?: string;
+    resolution?: Resolution;
+    github?: Record<string, unknown>;
+    [k: string]: unknown;
+}
+export interface TrackingEntry {
+    id: string;
+    title: string;
+    severity: Severity;
+    source: string;
+    status: string;
+    poc_status: string;
+    poc_file: string | null;
+    duplicates: string[];
+    duplicate_of?: string | null;
+    notes: string;
+    [k: string]: unknown;
+}
+export declare function isValidSeverity(v: unknown): v is Severity;
+export declare function isValidResolution(v: unknown): v is Resolution;
+/**
+ * Ensure a findings.json entry exists for `id`, materializing one from the
+ * source-specific record if needed. Idempotent: returns the existing entry
+ * untouched when present. Dispatches on id prefix.
+ */
+export declare function ensureFindingExists(outputDir: string, id: string): Finding;
+/**
+ * Move an issue between board columns. Materializes a findings.json entry first
+ * (so non-manual cards become reportable when promoted to Verified), then flips
+ * the tracking status.
+ *
+ * Note: this does NOT edit the user's source files. Source annotation
+ * (`// @audit-issue-verified ...`) remains the responsibility of the
+ * /validate-issue skill, which the auditor invokes deliberately — a drag-drop
+ * on the board should never silently rewrite .sol files.
+ */
+export declare function moveIssue(outputDir: string, id: string, column: BoardColumn): TrackingEntry;
+/**
+ * Patch editable fields on an issue. Materializes a findings.json entry first so
+ * description / recommendation / resolution / update_from_client always land on
+ * a real record (not just non-manual cards' tracking rows). Title / severity /
+ * notes are mirrored on the tracking entry so the board reads current values
+ * without re-reading findings.json.
+ */
+export declare function patchIssue(outputDir: string, id: string, updates: Record<string, unknown>): Finding;
+export {};
+//# sourceMappingURL=issues.d.ts.map

package/dist/core/issues.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"issues.d.ts","sourceRoot":"","sources":["../../src/core/issues.ts"],"names":[],"mappings":"AAmBA,MAAM,MAAM,WAAW,GAAG,WAAW,GAAG,UAAU,GAAG,SAAS,GAAG,WAAW,CAAC;AAC7E,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;AACvE,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,WAAW,GAAG,cAAc,GAAG,WAAW,GAAG,YAAY,CAAC;AAE7F,eAAO,MAAM,eAAe,EAAE,SAAS,QAAQ,EAAkD,CAAC;AAClG,eAAO,MAAM,iBAAiB,EAAE,SAAS,UAAU,EAMlD,CAAC;AAEF,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAKxD,CAAC;AAEF,2EAA2E;AAC3E,eAAO,MAAM,eAAe,8GAQlB,CAAC;AACX,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC;AAE7D,UAAU,eAAe;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,QAAQ,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE;QAAE,SAAS,EAAE,eAAe,EAAE,CAAA;KAAE,CAAC;IAC7C,GAAG,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAC7E,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE;QAAE,cAAc,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IACzC,UAAU,EAAE,MAAM,CAAC;IACnB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,QAAQ,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACtB;AAoCD,wBAAgB,eAAe,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,QAAQ,CAEzD;AACD,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,UAAU,CAE7D;AAmED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CA2B1E;AAID;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,aAAa,CAmC3F;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CACxB,SAAS,EAAE,MAAM,EACjB,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC/B,OAAO,CA0CT"}

package/dist/core/issues.js

@@ -0,0 +1,253 @@
+/**
+ * Canonical issue-mutation logic, shared by the `hex issue` CLI command and the
+ * dashboard's PATCH/move API routes. Pure: depends only on node:fs / node:path
+ * and is parameterized by `outputDir` (the project's `.hex/` directory) so it
+ * can run from the CLI (resolves outputDir via config) or from the dashboard
+ * server runtime (resolves outputDir via process.cwd()).
+ *
+ * The single source of truth for: materializing a findings.json entry from a
+ * source-specific record (conformance / auditagent / github), routing edits
+ * between findings.json and tracking.json, and column→status mapping.
+ *
+ * Deliberately NOT imported across the src/ <-> dashboard/ tree boundary as a
+ * dependency chain: it pulls in nothing beyond node builtins, so the dashboard
+ * can import it via `experimental.externalDir` without dragging CLI deps
+ * (chalk/ora/zod) into the Next.js bundle.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+export const SEVERITY_VALUES = ['Critical', 'High', 'Medium', 'Low', 'Info'];
+export const RESOLUTION_VALUES = [
+    'Fixed',
+    'Mitigated',
+    'Acknowledged',
+    'Not Fixed',
+    'Unresolved',
+];
+export const COLUMN_TO_STATUS = {
+    potential: 'pending_validation',
+    verified: 'verified',
+    invalid: 'rejected',
+    duplicate: 'duplicate',
+};
+/** Fields a user may edit through the board modal or `hex issue patch`. */
+export const EDITABLE_FIELDS = [
+    'title',
+    'severity',
+    'description',
+    'recommendation',
+    'resolution',
+    'update_from_client',
+    'notes',
+];
+// ─── Low-level IO (atomic, JSON) ────────────────────────────────────
+function readJson(file) {
+    try {
+        return JSON.parse(fs.readFileSync(file, 'utf-8'));
+    }
+    catch {
+        return null;
+    }
+}
+function writeJson(file, data) {
+    const dir = path.dirname(file);
+    if (!fs.existsSync(dir))
+        fs.mkdirSync(dir, { recursive: true });
+    const tmp = file + '.tmp';
+    fs.writeFileSync(tmp, JSON.stringify(data, null, 2) + '\n', 'utf-8');
+    fs.renameSync(tmp, file);
+}
+function loadFindings(outputDir) {
+    return readJson(path.join(outputDir, 'findings.json')) ?? { findings: [] };
+}
+function loadTracking(outputDir) {
+    return readJson(path.join(outputDir, 'tracking.json')) ?? { findings: [] };
+}
+// ─── Validation ─────────────────────────────────────────────────────
+export function isValidSeverity(v) {
+    return typeof v === 'string' && SEVERITY_VALUES.includes(v);
+}
+export function isValidResolution(v) {
+    return typeof v === 'string' && RESOLUTION_VALUES.includes(v);
+}
+// ─── Source-specific materialization ────────────────────────────────
+function newEmptyFinding(id, severity) {
+    return {
+        id,
+        title: id,
+        severity,
+        category: '',
+        description: '',
+        root_cause: { locations: [] },
+        poc: { status: 'not_started', file: null, validation_memo: null },
+        recommendation: '',
+        references: { external_links: [] },
+        created_at: new Date().toISOString(),
+    };
+}
+/** Build a findings.json record from a conformance item (`SC-*`). */
+function findingFromConformance(outputDir, id, tracking) {
+    const spec = readJson(path.join(outputDir, 'spec-conformance.json'));
+    const item = spec?.items?.find((i) => i.id === id);
+    if (!item)
+        return null;
+    const f = newEmptyFinding(id, (tracking?.severity ?? item.severity_hint ?? 'Info'));
+    f.title = tracking?.title ?? String(item.spec_text ?? id);
+    f.category = 'Spec Conformance';
+    f.description = String(item.finding ?? item.spec_text ?? '');
+    const loc = item.code_location;
+    if (loc?.file)
+        f.root_cause.locations = [{ file: loc.file }];
+    f.notes = `Materialized from conformance item ${id}`;
+    return f;
+}
+/** Build a findings.json record from an ai-results or external/github record. */
+function findingFromAiOrGithub(outputDir, id, kind, tracking) {
+    const nested = kind === 'auditagent'
+        ? path.join(outputDir, 'ai-results', 'auditagent', 'findings.json')
+        : path.join(outputDir, 'external', 'github', 'findings.json');
+    const file = readJson(nested);
+    const rec = file?.findings?.find((r) => r.id === id);
+    if (!rec)
+        return null;
+    const f = newEmptyFinding(id, rec.severity ?? tracking?.severity ?? 'Info');
+    f.title = String(rec.title ?? tracking?.title ?? id);
+    f.category = String(rec.category ?? '');
+    f.description = String(rec.description ?? '');
+    const affected = rec.affected_code ?? [];
+    f.root_cause.locations = affected.map((a) => ({ file: a.file, snippet: a.snippet }));
+    f.notes = `Materialized from ${kind} finding ${id}`;
+    return f;
+}
+/**
+ * Ensure a findings.json entry exists for `id`, materializing one from the
+ * source-specific record if needed. Idempotent: returns the existing entry
+ * untouched when present. Dispatches on id prefix.
+ */
+export function ensureFindingExists(outputDir, id) {
+    const findings = loadFindings(outputDir);
+    const existing = findings.findings.find((f) => f.id === id);
+    if (existing)
+        return existing;
+    const tracking = loadTracking(outputDir).findings.find((t) => t.id === id);
+    let materialized = null;
+    if (id.startsWith('SC-')) {
+        materialized = findingFromConformance(outputDir, id, tracking);
+    }
+    else if (id.startsWith('AA-')) {
+        materialized = findingFromAiOrGithub(outputDir, id, 'auditagent', tracking);
+    }
+    else if (id.startsWith('github-')) {
+        materialized = findingFromAiOrGithub(outputDir, id, 'github', tracking);
+    }
+    // Fallback: synthesize a minimal record from the tracking entry (covers
+    // manual `F*` ids restored from GitHub, or any source record we couldn't read).
+    if (!materialized) {
+        materialized = newEmptyFinding(id, tracking?.severity ?? 'Info');
+        if (tracking?.title)
+            materialized.title = tracking.title;
+        materialized.notes = tracking ? `Materialized from tracking entry ${id}` : '';
+    }
+    findings.findings.push(materialized);
+    writeJson(path.join(outputDir, 'findings.json'), findings);
+    return materialized;
+}
+// ─── Mutations ──────────────────────────────────────────────────────
+/**
+ * Move an issue between board columns. Materializes a findings.json entry first
+ * (so non-manual cards become reportable when promoted to Verified), then flips
+ * the tracking status.
+ *
+ * Note: this does NOT edit the user's source files. Source annotation
+ * (`// @audit-issue-verified ...`) remains the responsibility of the
+ * /validate-issue skill, which the auditor invokes deliberately — a drag-drop
+ * on the board should never silently rewrite .sol files.
+ */
+export function moveIssue(outputDir, id, column) {
+    const nextStatus = COLUMN_TO_STATUS[column];
+    if (!nextStatus)
+        throw new Error(`Invalid column: ${column}`);
+    // Promoting to Verified should make the issue reportable.
+    if (column === 'verified')
+        ensureFindingExists(outputDir, id);
+    const tracking = loadTracking(outputDir);
+    let entry = tracking.findings.find((t) => t.id === id);
+    if (!entry) {
+        // The board only surfaces tracking entries, but be defensive: synthesize one
+        // from the (now-ensured) finding so a move never 404s on a real card.
+        const finding = ensureFindingExists(outputDir, id);
+        entry = {
+            id,
+            title: finding.title,
+            severity: finding.severity,
+            source: 'manual',
+            status: nextStatus,
+            poc_status: finding.poc?.status ?? 'not_started',
+            poc_file: finding.poc?.file ?? null,
+            duplicates: [],
+            duplicate_of: null,
+            notes: '',
+        };
+        tracking.findings.push(entry);
+    }
+    else {
+        entry.status = nextStatus;
+    }
+    // Clear a stale duplicate pointer when the card leaves the Duplicate column.
+    if (column !== 'duplicate' && entry.duplicate_of)
+        entry.duplicate_of = null;
+    writeJson(path.join(outputDir, 'tracking.json'), tracking);
+    return entry;
+}
+/**
+ * Patch editable fields on an issue. Materializes a findings.json entry first so
+ * description / recommendation / resolution / update_from_client always land on
+ * a real record (not just non-manual cards' tracking rows). Title / severity /
+ * notes are mirrored on the tracking entry so the board reads current values
+ * without re-reading findings.json.
+ */
+export function patchIssue(outputDir, id, updates) {
+    const clean = {};
+    for (const key of EDITABLE_FIELDS) {
+        if (!(key in updates))
+            continue;
+        const value = updates[key];
+        if (key === 'severity' && value != null && !isValidSeverity(value)) {
+            throw new Error(`Invalid severity: ${String(value)}`);
+        }
+        if (key === 'resolution' && value != null && value !== '' && !isValidResolution(value)) {
+            throw new Error(`Invalid resolution: ${String(value)}`);
+        }
+        clean[key] = value;
+    }
+    if (Object.keys(clean).length === 0) {
+        throw new Error('No editable fields supplied');
+    }
+    const finding = ensureFindingExists(outputDir, id);
+    const findings = loadFindings(outputDir);
+    const target = findings.findings.find((f) => f.id === id) ?? finding;
+    for (const [key, value] of Object.entries(clean)) {
+        if (key === 'notes')
+            continue; // notes lives on tracking, not findings
+        if (key === 'resolution' && (value === '' || value == null)) {
+            delete target.resolution;
+            continue;
+        }
+        target[key] = value;
+    }
+    writeJson(path.join(outputDir, 'findings.json'), findings);
+    // Mirror title / severity / notes onto tracking.
+    const tracking = loadTracking(outputDir);
+    const entry = tracking.findings.find((t) => t.id === id);
+    if (entry) {
+        if ('title' in clean)
+            entry.title = clean.title;
+        if ('severity' in clean)
+            entry.severity = clean.severity;
+        if ('notes' in clean)
+            entry.notes = clean.notes;
+        writeJson(path.join(outputDir, 'tracking.json'), tracking);
+    }
+    return target;
+}
+//# sourceMappingURL=issues.js.map

package/dist/core/issues.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"issues.js","sourceRoot":"","sources":["../../src/core/issues.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAM7B,MAAM,CAAC,MAAM,eAAe,GAAwB,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;AAClG,MAAM,CAAC,MAAM,iBAAiB,GAA0B;IACtD,OAAO;IACP,WAAW;IACX,cAAc;IACd,WAAW;IACX,YAAY;CACb,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAgC;IAC3D,SAAS,EAAE,oBAAoB;IAC/B,QAAQ,EAAE,UAAU;IACpB,OAAO,EAAE,UAAU;IACnB,SAAS,EAAE,WAAW;CACvB,CAAC;AAEF,2EAA2E;AAC3E,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,OAAO;IACP,UAAU;IACV,aAAa;IACb,gBAAgB;IAChB,YAAY;IACZ,oBAAoB;IACpB,OAAO;CACC,CAAC;AA8CX,uEAAuE;AAEvE,SAAS,QAAQ,CAAI,IAAY;IAC/B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAM,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,IAAY,EAAE,IAAa;IAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChE,MAAM,GAAG,GAAG,IAAI,GAAG,MAAM,CAAC;IAC1B,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;IACrE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,YAAY,CAAC,SAAiB;IACrC,OAAO,QAAQ,CAAe,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;AAC3F,CAAC;AACD,SAAS,YAAY,CAAC,SAAiB;IACrC,OAAO,QAAQ,CAAe,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;AAC3F,CAAC;AAED,uEAAuE;AAEvE,MAAM,UAAU,eAAe,CAAC,CAAU;IACxC,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAK,eAAqC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AACrF,CAAC;AACD,MAAM,UAAU,iBAAiB,CAAC,CAAU;IAC1C,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAK,iBAAuC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AACvF,CAAC;AAED,uEAAuE;AAEvE,SAAS,eAAe,CAAC,EAAU,EAAE,QAAkB;IACrD,OAAO;QACL,EAAE;QACF,KAAK,EAAE,EAAE;QACT,QAAQ;QACR,QAAQ,EAAE,EAAE;QACZ,WAAW,EAAE,EAAE;QACf,UAAU,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE;QAC7B,GAAG,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE;QACjE,cAAc,EAAE,EAAE;QAClB,UAAU,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE;QAClC,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACrC,CAAC;AACJ,CAAC;AAED,qEAAqE;AACrE,SAAS,sBAAsB,CAC7B,SAAiB,EACjB,EAAU,EACV,QAAwB;IAExB,MAAM,IAAI,GAAG,QAAQ,CACnB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,uBAAuB,CAAC,CAC9C,CAAC;IACF,MAAM,IAAI,GAAG,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IACnD,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,CAAC,GAAG,eAAe,CACvB,EAAE,EACF,CAAC,QAAQ,EAAE,QAAQ,IAAK,IAAI,CAAC,aAA0B,IAAI,MAAM,CAAa,CAC/E,CAAC;IACF,CAAC,CAAC,KAAK,GAAG,QAAQ,EAAE,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;IAC1D,CAAC,CAAC,QAAQ,GAAG,kBAAkB,CAAC;IAChC,CAAC,CAAC,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;IAC7D,MAAM,GAAG,GAAG,IAAI,CAAC,aAA8C,CAAC;IAChE,IAAI,GAAG,EAAE,IAAI;QAAE,CAAC,CAAC,UAAU,CAAC,SAAS,GAAG,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7D,CAAC,CAAC,KAAK,GAAG,sCAAsC,EAAE,EAAE,CAAC;IACrD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,iFAAiF;AACjF,SAAS,qBAAqB,CAC5B,SAAiB,EACjB,EAAU,EACV,IAA6B,EAC7B,QAAwB;IAExB,MAAM,MAAM,GACV,IAAI,KAAK,YAAY;QACnB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,eAAe,CAAC;QACnE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC;IAClE,MAAM,IAAI,GAAG,QAAQ,CAAgD,MAAM,CAAC,CAAC;IAC7E,MAAM,GAAG,GAAG,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IACrD,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,CAAC,GAAG,eAAe,CAAC,EAAE,EAAG,GAAG,CAAC,QAAqB,IAAI,QAAQ,EAAE,QAAQ,IAAI,MAAM,CAAC,CAAC;IAC1F,CAAC,CAAC,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;IACrD,CAAC,CAAC,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;IACxC,CAAC,CAAC,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAI,GAAG,CAAC,aAA2D,IAAI,EAAE,CAAC;IACxF,CAAC,CAAC,UAAU,CAAC,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACrF,CAAC,CAAC,KAAK,GAAG,qBAAqB,IAAI,YAAY,EAAE,EAAE,CAAC;IACpD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,SAAiB,EAAE,EAAU;IAC/D,MAAM,QAAQ,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5D,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE9B,MAAM,QAAQ,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAE3E,IAAI,YAAY,GAAmB,IAAI,CAAC;IACxC,IAAI,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,YAAY,GAAG,sBAAsB,CAAC,SAAS,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;IACjE,CAAC;SAAM,IAAI,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,YAAY,GAAG,qBAAqB,CAAC,SAAS,EAAE,EAAE,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;IAC9E,CAAC;SAAM,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACpC,YAAY,GAAG,qBAAqB,CAAC,SAAS,EAAE,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC1E,CAAC;IAED,wEAAwE;IACxE,gFAAgF;IAChF,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,YAAY,GAAG,eAAe,CAAC,EAAE,EAAE,QAAQ,EAAE,QAAQ,IAAI,MAAM,CAAC,CAAC;QACjE,IAAI,QAAQ,EAAE,KAAK;YAAE,YAAY,CAAC,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC;QACzD,YAAY,CAAC,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,oCAAoC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAChF,CAAC;IAED,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACrC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC3D,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,uEAAuE;AAEvE;;;;;;;;;GASG;AACH,MAAM,UAAU,SAAS,CAAC,SAAiB,EAAE,EAAU,EAAE,MAAmB;IAC1E,MAAM,UAAU,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC5C,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,MAAM,EAAE,CAAC,CAAC;IAE9D,0DAA0D;IAC1D,IAAI,MAAM,KAAK,UAAU;QAAE,mBAAmB,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAE9D,MAAM,QAAQ,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IACvD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,6EAA6E;QAC7E,sEAAsE;QACtE,MAAM,OAAO,GAAG,mBAAmB,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QACnD,KAAK,GAAG;YACN,EAAE;YACF,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,UAAU;YAClB,UAAU,EAAE,OAAO,CAAC,GAAG,EAAE,MAAM,IAAI,aAAa;YAChD,QAAQ,EAAE,OAAO,CAAC,GAAG,EAAE,IAAI,IAAI,IAAI;YACnC,UAAU,EAAE,EAAE;YACd,YAAY,EAAE,IAAI;YAClB,KAAK,EAAE,EAAE;SACV,CAAC;QACF,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,MAAM,GAAG,UAAU,CAAC;IAC5B,CAAC;IAED,6EAA6E;IAC7E,IAAI,MAAM,KAAK,WAAW,IAAI,KAAK,CAAC,YAAY;QAAE,KAAK,CAAC,YAAY,GAAG,IAAI,CAAC;IAE5E,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC3D,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CACxB,SAAiB,EACjB,EAAU,EACV,OAAgC;IAEhC,MAAM,KAAK,GAA4C,EAAE,CAAC;IAC1D,KAAK,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QAClC,IAAI,CAAC,CAAC,GAAG,IAAI,OAAO,CAAC;YAAE,SAAS;QAChC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,GAAG,KAAK,UAAU,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;YACnE,MAAM,IAAI,KAAK,CAAC,qBAAqB,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACxD,CAAC;QACD,IAAI,GAAG,KAAK,YAAY,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,KAAK,EAAE,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;YACvF,MAAM,IAAI,KAAK,CAAC,uBAAuB,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACrB,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IAED,MAAM,OAAO,GAAG,mBAAmB,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,IAAI,OAAO,CAAC;IAErE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,IAAI,GAAG,KAAK,OAAO;YAAE,SAAS,CAAC,wCAAwC;QACvE,IAAI,GAAG,KAAK,YAAY,IAAI,CAAC,KAAK,KAAK,EAAE,IAAI,KAAK,IAAI,IAAI,CAAC,EAAE,CAAC;YAC5D,OAAO,MAAM,CAAC,UAAU,CAAC;YACzB,SAAS;QACX,CAAC;QACA,MAAkC,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACnD,CAAC;IACD,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,EAAE,QAAQ,CAAC,CAAC;IAE3D,iDAAiD;IACjD,MAAM,QAAQ,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IACzD,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,OAAO,IAAI,KAAK;YAAE,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,KAAe,CAAC;QAC1D,IAAI,UAAU,IAAI,KAAK;YAAE,KAAK,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAoB,CAAC;QACrE,IAAI,OAAO,IAAI,KAAK;YAAE,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,KAAe,CAAC;QAC1D,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC7D,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/index.js

@@ -17,11 +17,12 @@ import { analyzeCommand } from './commands/analyze.js';
 import { doctorCommand } from './commands/doctor.js';
 import { aiStatusCommand } from './commands/ai-status.js';
 import { updateCommand } from './commands/update.js';
+import { issueCommand } from './commands/issue.js';
 const program = new Command();
 program
     .name('hex')
     .description('CLI toolkit for Solidity smart contract auditors')
-    .version('0.4.4');
+    .version('0.4.5');
 program.addCommand(initCommand);
 program.addCommand(statsCommand);
 program.addCommand(depsCommand);
@@ -39,5 +40,6 @@ program.addCommand(analyzeCommand);
 program.addCommand(doctorCommand);
 program.addCommand(aiStatusCommand);
 program.addCommand(updateCommand);
+program.addCommand(issueCommand);
 program.parse();
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErD,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,KAAK,CAAC;KACX,WAAW,CAAC,kDAAkD,CAAC;KAC/D,OAAO,CAAC,OAAO,CAAC,CAAC;AAEpB,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;AAChC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;AACjC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;AAChC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;AAClC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;AACjC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;AACjC,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;AACpC,OAAO,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;AACvC,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;AACnC,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;AACnC,OAAO,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC;AACxC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;AAClC,OAAO,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;AACrC,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;AACnC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;AAClC,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;AACpC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;AAElC,OAAO,CAAC,KAAK,EAAE,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,KAAK,CAAC;KACX,WAAW,CAAC,kDAAkD,CAAC;KAC/D,OAAO,CAAC,OAAO,CAAC,CAAC;AAEpB,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;AAChC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;AACjC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;AAChC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;AAClC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;AACjC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;AACjC,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;AACpC,OAAO,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;AACvC,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;AACnC,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;AACnC,OAAO,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC;AACxC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;AAClC,OAAO,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;AACrC,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;AACnC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;AAClC,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;AACpC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;AAClC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;AAEjC,OAAO,CAAC,KAAK,EAAE,CAAC"}

package/dist/skills/init-audit.md

@@ -236,7 +236,9 @@ Also write a human-readable `.hex/spec-conformance.md` rendering the same data g
 
 ## Phase 6 — Materialize conformance items onto the board
 
-For every item in `spec-conformance.json.items` with `status` of `DEVIATES` or `PARTIAL`, append a tracking entry to `.hex/tracking.json` (creating the file if missing). Schema:
+For every item in `spec-conformance.json.items` with `status` of `DEVIATES` or `PARTIAL`, append a tracking entry to `.hex/tracking.json`.
+
+**Wrapper (required):** `.hex/tracking.json` MUST be `{ "findings": [<TrackingEntry>, ...] }`. The wrapper key is `findings` (NOT `issues`) — the dashboard's `TrackingFile` type and the `/api/issues` routes reject any other shape. If the file does not exist, create it as `{ "findings": [] }` and then append. If it exists, parse it, append to the `findings` array, and write it back. Match the per-entry schema below exactly.
 
 ```json
 {

package/dist/skills/sync-issues.md

@@ -156,61 +156,44 @@ Within candidates:
 - Has `github.issue_number` → update via `gh issue edit`.
 - No `github.issue_number` → create via `gh issue create`.
 
-**3b. Render the body** (write to a temp file, then `--body-file`):
+**3b. Render the body** (write to a temp file, then `--body-file`). Use this exact template — nothing more, nothing less in the visible body. It mirrors `dashboard/lib/finding-markdown.ts::findingToGithubBody`, so the board's "Copy as HackMD" output and the pushed issue stay identical:
 
 ```markdown
-**Severity:** <Severity>
+**File(s)**: [`<file>`](<github-blob-url-or-empty>)
 
-<finding.description>
+**Description**: <finding.description>
 
-### Affected code
+**Recommendation(s)**: <finding.recommendation>
 
-<for each finding.root_cause.locations[]>
-**`<location.file>`**
+**Status**: <finding.resolution or "Unresolved">
 
-```solidity
-<location.snippet>
-```
-</for>
-
-### Recommendation
-
-<finding.recommendation>
-
----
-
-*Synced from Hex audit `<config.project.name>` at commit `<config.project.commit>`.*
+**Update from the client**: <finding.update_from_client or empty>
 
 <!-- hex-finding-id: <finding.id> -->
 ```
 
-The footer is the round-trip identity key — never omit.
-
-**3c. Labels.**
-
-```
-<default_labels...> severity:<lowercased> source:<finding.source or 'manual'> status:<tracking.status>
-```
-
-Apply via repeated `--label` flags.
+Rules:
+- **File(s)** — one markdown link per affected file in `root_cause.locations[]`, comma-separated when there is more than one: `` [`src/Vault.sol`](url1), [`src/MockToken.sol`](url2) ``. Build each URL as `<settings.report.repository_url>/blob/<settings.report.initial_commit>/<file>`. If either `repository_url` or `initial_commit` is missing from `config.json`, use an empty link target: `` [`<file>`]() ``.
+- **Status** — the finding's `resolution` field if set, otherwise the literal `Unresolved`.
+- **Update from the client** — the finding's `update_from_client` field if set, otherwise leave it blank after the colon.
+- Do NOT add a `**Severity:**` line (severity is already in the title), an `### Affected code` section, code blocks, or a "Synced from Hex" attribution line.
+- The `<!-- hex-finding-id: <finding.id> -->` HTML comment at the very bottom is **mandatory and load-bearing** — it is the round-trip dedup key, invisible in GitHub's rendered view. Never omit it.
 
-**3d. Create or update.**
+**3c. Create or update — no labels.** Hex does not apply, add, or remove labels. The target repo's label set is the repo owner's concern; assuming labels exist (e.g. `severity:critical`) makes `gh issue create` fail when they don't.
 
 Create:
 ```bash
-gh issue create --repo <repo> --title "[<Severity>] <title>" --body-file <tmp> \
-  --label "hex" --label "audit" --label "severity:..." --label "source:..." --label "status:..."
+gh issue create --repo <repo> --title "[<Severity>] <title>" --body-file <tmp>
 ```
 
 Parse the returned URL to extract the issue number; update the local finding's `github` block.
 
 Update existing:
 ```bash
-gh issue edit <num> --repo <repo> --title "[<Severity>] <title>" --body-file <tmp> \
-  --add-label "severity:..." --add-label "status:..."
+gh issue edit <num> --repo <repo> --title "[<Severity>] <title>" --body-file <tmp>
 ```
 
-Do NOT `--remove-label` — teammates may have added labels we shouldn't strip.
+(`settings.github.default_labels` in config is retained for backwards compatibility but is no longer applied.)
 
 If push fails for any single finding: capture stderr, set its `github.sync_status` to `conflict`, append a one-line error, continue with the next finding. Never abort the whole sync on one failure.
 
@@ -261,6 +244,6 @@ GitHub sync complete (<repo>)
 
 - Does not authenticate (use `gh auth login` once).
 - Does not post comments (auditors discuss inside GitHub).
-- Does not create labels (manual one-time setup; `gh issue create` errors if a label is missing).
+- Does not apply, create, or remove labels (the repo owner manages its own labels).
 - Does not delete remote issues.
 - Does not push `rejected`, `unverified`, or `duplicate` findings.