hex-audit 0.4.5 → 0.5.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/DEMO.md +12 -11
- package/README.md +38 -37
- package/dashboard/.next/BUILD_ID +1 -1
- package/dashboard/.next/app-build-manifest.json +23 -23
- package/dashboard/.next/app-path-routes-manifest.json +1 -1
- package/dashboard/.next/build-manifest.json +2 -2
- package/dashboard/.next/next-minimal-server.js.nft.json +1 -1
- package/dashboard/.next/next-server.js.nft.json +1 -1
- package/dashboard/.next/prerender-manifest.json +1 -1
- package/dashboard/.next/server/app/_not-found/page_client-reference-manifest.js +1 -1
- package/dashboard/.next/server/app/_not-found.html +1 -1
- package/dashboard/.next/server/app/_not-found.rsc +4 -4
- package/dashboard/.next/server/app/access/page.js +1 -1
- package/dashboard/.next/server/app/access/page.js.nft.json +1 -1
- package/dashboard/.next/server/app/access/page_client-reference-manifest.js +1 -1
- package/dashboard/.next/server/app/api/flows/route.js +1 -1
- package/dashboard/.next/server/app/api/github-status/route.js +1 -1
- package/dashboard/.next/server/app/api/issues/[id]/move/route.js +1 -1
- package/dashboard/.next/server/app/api/issues/[id]/move/route.js.nft.json +1 -1
- package/dashboard/.next/server/app/api/issues/[id]/route.js +1 -1
- package/dashboard/.next/server/app/api/issues/[id]/route.js.nft.json +1 -1
- package/dashboard/.next/server/app/api/mermaid/route.js +1 -1
- package/dashboard/.next/server/app/api/progress/route.js +1 -1
- package/dashboard/.next/server/app/api/watch/route.js +2 -2
- package/dashboard/.next/server/app/calls/page.js +1 -1
- package/dashboard/.next/server/app/calls/page.js.nft.json +1 -1
- package/dashboard/.next/server/app/calls/page_client-reference-manifest.js +1 -1
- package/dashboard/.next/server/app/conformance/page.js +1 -1
- package/dashboard/.next/server/app/conformance/page_client-reference-manifest.js +1 -1
- package/dashboard/.next/server/app/diagram/page_client-reference-manifest.js +1 -1
- package/dashboard/.next/server/app/diagram.html +1 -1
- package/dashboard/.next/server/app/diagram.rsc +4 -4
- package/dashboard/.next/server/app/flows/page_client-reference-manifest.js +1 -1
- package/dashboard/.next/server/app/flows.html +1 -1
- package/dashboard/.next/server/app/flows.rsc +4 -4
- package/dashboard/.next/server/app/functions/page.js +1 -1
- package/dashboard/.next/server/app/functions/page.js.nft.json +1 -1
- package/dashboard/.next/server/app/functions/page_client-reference-manifest.js +1 -1
- package/dashboard/.next/server/app/issues/page.js +5 -3
- package/dashboard/.next/server/app/issues/page_client-reference-manifest.js +1 -1
- package/dashboard/.next/server/app/overleaf/page.js +1 -1
- package/dashboard/.next/server/app/overleaf/page_client-reference-manifest.js +1 -1
- package/dashboard/.next/server/app/page.js +1 -1
- package/dashboard/.next/server/app/page_client-reference-manifest.js +1 -1
- package/dashboard/.next/server/app/progress/page.js +1 -1
- package/dashboard/.next/server/app/progress/page_client-reference-manifest.js +1 -1
- package/dashboard/.next/server/app/stats/page.js +1 -1
- package/dashboard/.next/server/app/stats/page.js.nft.json +1 -1
- package/dashboard/.next/server/app/stats/page_client-reference-manifest.js +1 -1
- package/dashboard/.next/server/app-paths-manifest.json +9 -9
- package/dashboard/.next/server/chunks/42.js +1 -0
- package/dashboard/.next/server/chunks/431.js +1 -1
- package/dashboard/.next/server/chunks/44.js +1 -0
- package/dashboard/.next/server/functions-config-manifest.json +1 -1
- package/dashboard/.next/server/middleware-build-manifest.js +1 -1
- package/dashboard/.next/server/pages/404.html +1 -1
- package/dashboard/.next/server/pages/500.html +1 -1
- package/dashboard/.next/server/server-reference-manifest.js +1 -1
- package/dashboard/.next/server/server-reference-manifest.json +1 -1
- package/dashboard/.next/static/chunks/app/issues/page-6bfbf80884d3c9d8.js +1 -0
- package/dashboard/.next/static/chunks/app/{layout-cde7d75ea6df4f81.js → layout-91d2987f5030a3c4.js} +1 -1
- package/dashboard/.next/static/css/{36c6bb859d4545fd.css → 9c84313d0484b74f.css} +1 -1
- package/dashboard/app/issues/IssuesBoardClient.tsx +55 -24
- package/dashboard/app/issues/page.tsx +6 -3
- package/dashboard/components/DashboardLayout.tsx +1 -1
- package/dashboard/lib/data.ts +11 -19
- package/dashboard/lib/finding-markdown.ts +95 -5
- package/dist/commands/access.d.ts.map +1 -1
- package/dist/commands/access.js +3 -4
- package/dist/commands/access.js.map +1 -1
- package/dist/commands/ai-status.d.ts.map +1 -1
- package/dist/commands/ai-status.js +8 -10
- package/dist/commands/ai-status.js.map +1 -1
- package/dist/commands/calls.d.ts.map +1 -1
- package/dist/commands/calls.js +3 -4
- package/dist/commands/calls.js.map +1 -1
- package/dist/commands/constraints.d.ts.map +1 -1
- package/dist/commands/constraints.js +2 -4
- package/dist/commands/constraints.js.map +1 -1
- package/dist/commands/context.d.ts.map +1 -1
- package/dist/commands/context.js +2 -4
- package/dist/commands/context.js.map +1 -1
- package/dist/commands/dashboard.d.ts.map +1 -1
- package/dist/commands/dashboard.js +21 -5
- package/dist/commands/dashboard.js.map +1 -1
- package/dist/commands/deps.d.ts.map +1 -1
- package/dist/commands/deps.js +2 -4
- package/dist/commands/deps.js.map +1 -1
- package/dist/commands/init.d.ts.map +1 -1
- package/dist/commands/init.js +2 -0
- package/dist/commands/init.js.map +1 -1
- package/dist/commands/issue.d.ts.map +1 -1
- package/dist/commands/issue.js +97 -11
- package/dist/commands/issue.js.map +1 -1
- package/dist/commands/patterns.d.ts.map +1 -1
- package/dist/commands/patterns.js +2 -4
- package/dist/commands/patterns.js.map +1 -1
- package/dist/commands/state.d.ts.map +1 -1
- package/dist/commands/state.js +3 -4
- package/dist/commands/state.js.map +1 -1
- package/dist/commands/stats.d.ts.map +1 -1
- package/dist/commands/stats.js +3 -4
- package/dist/commands/stats.js.map +1 -1
- package/dist/commands/surface.d.ts.map +1 -1
- package/dist/commands/surface.js +3 -4
- package/dist/commands/surface.js.map +1 -1
- package/dist/core/config.d.ts +14 -0
- package/dist/core/config.d.ts.map +1 -1
- package/dist/core/config.js +33 -16
- package/dist/core/config.js.map +1 -1
- package/dist/core/issues.d.ts +51 -12
- package/dist/core/issues.d.ts.map +1 -1
- package/dist/core/issues.js +186 -25
- package/dist/core/issues.js.map +1 -1
- package/dist/core/locate.d.ts +26 -0
- package/dist/core/locate.d.ts.map +1 -0
- package/dist/core/locate.js +56 -0
- package/dist/core/locate.js.map +1 -0
- package/dist/core/schema.d.ts +24 -8
- package/dist/core/schema.d.ts.map +1 -1
- package/dist/core/schema.js +12 -1
- package/dist/core/schema.js.map +1 -1
- package/dist/index.js +1 -1
- package/dist/skills/generate-overleaf.md +18 -10
- package/dist/skills/ingest-aa-report.md +15 -19
- package/dist/skills/init-audit.md +13 -20
- package/dist/skills/sync-issues.md +87 -179
- package/dist/skills/validate-all-findings.md +50 -0
- package/dist/skills/validate-issue.md +5 -3
- package/dist/skills/write-finding.md +33 -29
- package/package.json +1 -1
- package/dashboard/.next/server/chunks/557.js +0 -1
- package/dashboard/.next/static/chunks/app/issues/page-30f7bcde0f4f6ddb.js +0 -1
- /package/dashboard/.next/static/{4HWoeGmBSZi6iGcKL3VWA → dm-uzRRik5AgaBPedT1iR}/_buildManifest.js +0 -0
- /package/dashboard/.next/static/{4HWoeGmBSZi6iGcKL3VWA → dm-uzRRik5AgaBPedT1iR}/_ssgManifest.js +0 -0
package/DEMO.md
CHANGED
|
@@ -58,7 +58,7 @@ Key pages:
|
|
|
58
58
|
- `/functions` — Aggregated function view.
|
|
59
59
|
- `/diagram` and `/flows` — Full-bleed Mermaid canvas with auto-fit zoom and legend overlay.
|
|
60
60
|
- `/conformance` — Conformance check results, deviations first, clickable spec links.
|
|
61
|
-
- `/issues` — **The board.**
|
|
61
|
+
- `/issues` — **The board.** Five columns: Potential / Verified / Synced / Invalid / Duplicate. Uniform `H-NNN` ids with a source badge. Drag cards between the editable columns; click to edit, or copy as HackMD. The **Synced** column is reached only via `/sync-issues` and is read-only (edit on GitHub).
|
|
62
62
|
- `/overleaf` — The four LaTeX report sections from `/generate-overleaf`, each with a copy button. Only populated after you run the skill.
|
|
63
63
|
|
|
64
64
|
### Phase 2 — Manual review + `/write-finding`
|
|
@@ -77,13 +77,15 @@ When you have something concrete, point Claude at it:
|
|
|
77
77
|
|
|
78
78
|
#### `/validate-issue` for any potential issue
|
|
79
79
|
|
|
80
|
-
`/validate-issue` is source-agnostic. Pass
|
|
80
|
+
`/validate-issue` is source-agnostic. Pass a uniform id (`H-003`) or a free-text reference:
|
|
81
81
|
|
|
82
82
|
```
|
|
83
|
-
/validate-issue
|
|
83
|
+
/validate-issue H-003
|
|
84
84
|
/validate-issue for the rounding issue
|
|
85
85
|
```
|
|
86
86
|
|
|
87
|
+
To validate the whole Potential backlog in one interactive pass, run `/validate-all-findings`.
|
|
88
|
+
|
|
87
89
|
Claude traces the attack path in the code, writes a validation memo (always), and asks per-issue whether you want a PoC or memo-only. On valid → tracking entry promotes to `verified` and the card moves to Verified on the board. On invalid → tracking entry becomes `rejected` and the card moves to Invalid.
|
|
88
90
|
|
|
89
91
|
#### `/ingest-aa-report` — Nethermind AuditAgent only
|
|
@@ -100,19 +102,18 @@ When complete, the skill fetches findings, materializes them as Potential cards
|
|
|
100
102
|
|
|
101
103
|
#### `/sync-issues` — team mode via GitHub Issues
|
|
102
104
|
|
|
103
|
-
If
|
|
105
|
+
If a repo is configured (`hex init --github-repo <owner/repo>`, or `settings.github.repo`) and `gh auth login` has been run:
|
|
104
106
|
|
|
105
107
|
```
|
|
106
108
|
/sync-issues
|
|
107
109
|
```
|
|
108
110
|
|
|
109
|
-
One run does both directions:
|
|
111
|
+
GitHub is the source of truth; **identity is the issue number `#N`** (no hidden footer). One run does both directions:
|
|
110
112
|
|
|
111
|
-
- **Pulls
|
|
112
|
-
- **
|
|
113
|
-
- **Pushes** local findings whose tracking status is in `settings.github.publish_status` (default `["verified"]`). Updates existing issues by `github.issue_number`, never creates labels.
|
|
113
|
+
- **Pulls every issue** in the repo (no label filter). Title + the five-field body are parsed back into the local finding; issues already linked by `#N` are refreshed, new ones become local findings. All land in the **Synced** column (read-only).
|
|
114
|
+
- **Pushes** verified findings not yet on GitHub. Body is exactly the five fields (no labels, no footer). The returned `#N` is stored, locking the card into Synced.
|
|
114
115
|
|
|
115
|
-
GitHub-sync state shows as a chip on each card
|
|
116
|
+
Once synced, edit on GitHub and re-run `/sync-issues` to pull changes back. GitHub-sync state shows as a chip on each verified/synced card.
|
|
116
117
|
|
|
117
118
|
### Phase 4 — Final deliverable (`/generate-overleaf`)
|
|
118
119
|
|
|
@@ -135,8 +136,8 @@ Only `verified` findings make the cut. Duplicates, rejected, and pending entries
|
|
|
135
136
|
|
|
136
137
|
- `/init-audit` is now a single skill that runs everything pre-manual-review.
|
|
137
138
|
- The board (`/issues`) is the only findings page. Cards are interactive: drag to change column, click to edit.
|
|
138
|
-
- `/write-finding` records Potential issues — promote
|
|
139
|
+
- `/write-finding` records Potential issues (uniform `H-NNN` ids, no in-code comments) — promote via `/validate-issue`, `/validate-all-findings`, or by dragging on the board.
|
|
139
140
|
- `/ingest-aa-report` takes a scan ID, never starts a scan.
|
|
140
|
-
- `/sync-issues` treats GitHub as the source of truth —
|
|
141
|
+
- `/sync-issues` treats GitHub as the source of truth — synced issues are read-only in Hex and identified by issue number; `/generate-overleaf` reports only from synced issues.
|
|
141
142
|
- `/generate-overleaf` is the final handoff to the LaTeX report.
|
|
142
143
|
- `hex update` upgrades the package and prompts to re-sync skills in one shot; `hex update-skills` re-syncs skills only.
|
package/README.md
CHANGED
|
@@ -110,7 +110,7 @@ When you have something concrete, file it as a Potential issue:
|
|
|
110
110
|
/write-finding for the rounding error in src/Vault.sol
|
|
111
111
|
```
|
|
112
112
|
|
|
113
|
-
`/write-finding`
|
|
113
|
+
`/write-finding` allocates a uniform `H-NNN` id (all issues share one scheme regardless of origin; `source` is a separate field) and records the finding with `status: "pending_validation"` and `source: "manual"`, so the card lands in the **Potential** column. It does not write `@audit-issue` comments into the source — the board is the only place the issue lives.
|
|
114
114
|
|
|
115
115
|
Phase 2 is where Hex gets out of your way. You think; the toolkit just gives you a place to record what you find.
|
|
116
116
|
|
|
@@ -126,19 +126,17 @@ Phase 2 is where Hex gets out of your way. You think; the toolkit just gives you
|
|
|
126
126
|
- GitHub teammate entries materialized by `/sync-issues`.
|
|
127
127
|
|
|
128
128
|
```
|
|
129
|
-
/validate-issue
|
|
130
|
-
/validate-issue SC-007
|
|
131
|
-
/validate-issue AA-N002
|
|
129
|
+
/validate-issue H-003
|
|
132
130
|
/validate-issue for the rounding issue in Vault.sol
|
|
133
131
|
```
|
|
134
132
|
|
|
135
|
-
Claude reads the relevant source
|
|
133
|
+
Claude reads the relevant source record, traces the attack path in the code, and writes a validation memo to `.hex/validations/<id>_memo.md`. Then it asks per issue:
|
|
136
134
|
|
|
137
135
|
> The issue appears valid. PoC or memo-only?
|
|
138
136
|
|
|
139
137
|
If PoC: invokes `/generate-poc` to produce a runnable test and iterates until it passes. If memo-only: skips PoC, just records the validation reasoning.
|
|
140
138
|
|
|
141
|
-
Valid →
|
|
139
|
+
Valid → the card moves to Verified (`hex issue move`). Invalid → it moves to Invalid. Severity adjustment is offered after promotion. To clear a whole backlog, **`/validate-all-findings`** runs this same flow over every Potential card, one at a time.
|
|
142
140
|
|
|
143
141
|
#### Ingest a Nethermind AuditAgent scan (`/ingest-aa-report`)
|
|
144
142
|
|
|
@@ -157,25 +155,24 @@ The skill:
|
|
|
157
155
|
|
|
158
156
|
#### Team mode (`/sync-issues`)
|
|
159
157
|
|
|
160
|
-
|
|
158
|
+
GitHub is the source of truth for an audit's findings. Set the repo at init time with `hex init --github-repo <owner/repo>` (or `settings.github.repo` in `.hex/config.json`) — the firm's internal repo, e.g. `nethermind/audit-vaultx` — and authenticate the `gh` CLI once:
|
|
161
159
|
|
|
162
160
|
```bash
|
|
163
161
|
gh auth login
|
|
164
162
|
```
|
|
165
163
|
|
|
166
|
-
Hex
|
|
164
|
+
Hex never stores GitHub credentials — `/sync-issues` drives the `gh` CLI directly. Then:
|
|
167
165
|
|
|
168
166
|
```
|
|
169
167
|
/sync-issues
|
|
170
168
|
```
|
|
171
169
|
|
|
172
|
-
One invocation does both directions
|
|
170
|
+
One invocation does both directions. **Identity is the GitHub issue number `#N`** — there is no hidden footer in the issue body (auditors create issues by hand), so reconciliation matches a local finding to the issue number it has stored.
|
|
173
171
|
|
|
174
|
-
- **Pull
|
|
175
|
-
- **
|
|
176
|
-
- **Push** every local finding whose tracking status is in `settings.github.publish_status` (default `["verified"]`). The issue body is a fixed minimal template (File(s), Description, Recommendation(s), Status, Update from the client) plus a hidden `<!-- hex-finding-id -->` footer for round-trip dedup. **No labels are applied** — the target repo's label set is the repo owner's concern, so Hex never assumes labels exist. Existing issues are updated by their `github.issue_number`.
|
|
172
|
+
- **Pull every issue** in the repo (no label filter — audit repos contain only findings). Each issue's title (`[Severity] Title`) and five-field body are parsed back into the local finding. If a body is blatantly not in the Hex format it's skipped with a warning. Issues already linked by `#N` are refreshed from GitHub; new ones become local findings. All pulled issues land in the **Synced** column.
|
|
173
|
+
- **Push** every local finding whose tracking status is in `settings.github.publish_status` (default `["verified"]`) and that isn't already on GitHub. The body is exactly the five-field template (File(s), Description, Recommendation(s), Status, Update from the client) — no labels, no footer. The returned issue number is stored on the finding, which locks it into Synced.
|
|
177
174
|
|
|
178
|
-
The
|
|
175
|
+
**Once synced, an issue is read-only in Hex.** Edit it on GitHub (severity, description, recommendation, status), then re-run `/sync-issues` to pull the changes back. `/generate-overleaf` reports only from synced issues. The board's `/issues` page surfaces sync state as a chip: `GH unsynced` (verified, not pushed), `GH #N open` / `GH #N closed`, or `GH conflict`.
|
|
179
176
|
|
|
180
177
|
Comments stay on GitHub — Hex never posts, edits, or deletes comments. Auditors discuss inside GitHub itself.
|
|
181
178
|
|
|
@@ -202,15 +199,16 @@ Upload these into the Nethermind Overleaf template's matching slots. Only `verif
|
|
|
202
199
|
|
|
203
200
|
Each skill has a recommended model — switch your Claude Code model before invoking skills that recommend Opus.
|
|
204
201
|
|
|
205
|
-
| Skill
|
|
206
|
-
|
|
|
207
|
-
| `init-audit`
|
|
208
|
-
| `write-finding`
|
|
209
|
-
| `validate-issue`
|
|
210
|
-
| `
|
|
211
|
-
| `
|
|
212
|
-
| `
|
|
213
|
-
| `
|
|
202
|
+
| Skill | Phase | Recommended Model | What it does |
|
|
203
|
+
| ----------------------- | ----- | ----------------- | ------------------------------------------------------------------------------------------------------------------------------------------------ |
|
|
204
|
+
| `init-audit` | 1 | Opus | Dependency-safety → `hex analyze` → overview → diagram → flows → spec conformance → materialize DEVIATES/PARTIAL items as Potential cards |
|
|
205
|
+
| `write-finding` | 2 | Sonnet | Records a manual issue to `findings.json` as a Potential card (`status: pending_validation`, `source: manual`) |
|
|
206
|
+
| `validate-issue` | 3 | Opus | Validates any Potential card (manual / auditagent / conformance / github); per-issue choice of PoC vs memo-only; promotes to Verified or Invalid |
|
|
207
|
+
| `validate-all-findings` | 3 | Opus | Runs the `/validate-issue` flow over every Potential card, one at a time |
|
|
208
|
+
| `generate-poc` | 3 | Opus | Generates and runs a PoC test (invoked by `/validate-issue`) |
|
|
209
|
+
| `ingest-aa-report` | 3 | Sonnet | Ingests a completed Nethermind AuditAgent scan by ID; materializes findings + inline dedup |
|
|
210
|
+
| `sync-issues` | 3 | Sonnet | Two-way GitHub Issues sync; GitHub is the source of truth (issue number is identity, synced issues are read-only) |
|
|
211
|
+
| `generate-overleaf` | 4 | Sonnet | Writes the four LaTeX section files for the final report (from synced issues) |
|
|
214
212
|
|
|
215
213
|
### Where Skills Live
|
|
216
214
|
|
|
@@ -221,6 +219,7 @@ Skills use Claude Code's native skill format, stored in `.claude/skills/<name>/S
|
|
|
221
219
|
├── init-audit/SKILL.md
|
|
222
220
|
├── write-finding/SKILL.md
|
|
223
221
|
├── validate-issue/SKILL.md
|
|
222
|
+
├── validate-all-findings/SKILL.md
|
|
224
223
|
├── generate-poc/SKILL.md
|
|
225
224
|
├── ingest-aa-report/SKILL.md
|
|
226
225
|
├── sync-issues/SKILL.md
|
|
@@ -248,20 +247,20 @@ hex update-skills --keep-custom # skip existing skill files to preserve per-pro
|
|
|
248
247
|
|
|
249
248
|
The dashboard runs locally at `http://localhost:3000` and auto-refreshes when output files change. A live "Updated Ns ago" indicator in the sidebar footer tells you the watcher is connected.
|
|
250
249
|
|
|
251
|
-
| Page | URL | What you see
|
|
252
|
-
| ---------------- | -------------- |
|
|
253
|
-
| Home | `/` | Project info, AI overview, key stats
|
|
254
|
-
| Progress | `/progress` | Weighted progress bar (70% nSLOC reviewed, 20% audit steps, 10% findings triage), contract review checklist
|
|
255
|
-
| Statistics | `/stats` | Per-contract metrics, test coverage, dependencies, ERCs
|
|
256
|
-
| System Diagram | `/diagram` | Mermaid architecture diagram with zoom/pan
|
|
257
|
-
| Flows | `/flows` | Mermaid flow charts with zoom/pan
|
|
258
|
-
| Access Control | `/access` | Role → function matrix with "Show unprotected only" and "Show inferred / unknown modifiers" toggles
|
|
259
|
-
| State Variables | `/state` | Variable inventory with reader/writer tracking and storage-collision warnings
|
|
260
|
-
| External Calls | `/calls` | Call surface with filterable Trust column
|
|
261
|
-
| Functions | `/functions` | Aggregated function view
|
|
262
|
-
| Spec Conformance | `/conformance` | Code vs spec check results, deviations first, clickable spec links
|
|
263
|
-
| **Issues** | `/issues` | **The board.**
|
|
264
|
-
| **Overleaf** | `/overleaf` | The four LaTeX report sections from `/generate-overleaf`, each with a copy-to-clipboard button — paste straight into the Nethermind Overleaf template.
|
|
250
|
+
| Page | URL | What you see |
|
|
251
|
+
| ---------------- | -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
|
|
252
|
+
| Home | `/` | Project info, AI overview, key stats |
|
|
253
|
+
| Progress | `/progress` | Weighted progress bar (70% nSLOC reviewed, 20% audit steps, 10% findings triage), contract review checklist |
|
|
254
|
+
| Statistics | `/stats` | Per-contract metrics, test coverage, dependencies, ERCs |
|
|
255
|
+
| System Diagram | `/diagram` | Mermaid architecture diagram with zoom/pan |
|
|
256
|
+
| Flows | `/flows` | Mermaid flow charts with zoom/pan |
|
|
257
|
+
| Access Control | `/access` | Role → function matrix with "Show unprotected only" and "Show inferred / unknown modifiers" toggles |
|
|
258
|
+
| State Variables | `/state` | Variable inventory with reader/writer tracking and storage-collision warnings |
|
|
259
|
+
| External Calls | `/calls` | Call surface with filterable Trust column |
|
|
260
|
+
| Functions | `/functions` | Aggregated function view |
|
|
261
|
+
| Spec Conformance | `/conformance` | Code vs spec check results, deviations first, clickable spec links |
|
|
262
|
+
| **Issues** | `/issues` | **The board.** Five columns (Potential / Verified / Synced / Invalid / Duplicate). Drag cards between the editable columns, click to edit (severity, description, recommendation, resolution, client update), or copy a finding as HackMD markdown. The **Synced** column is reached only via `/sync-issues` and is read-only (edit on GitHub). GitHub-sync chip per verified/synced card. |
|
|
263
|
+
| **Overleaf** | `/overleaf` | The four LaTeX report sections from `/generate-overleaf`, each with a copy-to-clipboard button — paste straight into the Nethermind Overleaf template. |
|
|
265
264
|
|
|
266
265
|
---
|
|
267
266
|
|
|
@@ -355,7 +354,7 @@ All commands run from within the project directory (or with `--project /path/to/
|
|
|
355
354
|
| --------------------------------- | ------------------------------------------------------------------------------------------------------------------ |
|
|
356
355
|
| `hex doctor` | Preflight check: node, forge, slither, solc, Claude Code, output-dir writability, project config |
|
|
357
356
|
| `hex claude` | Copy skills to `.claude/skills/` for Claude Code discovery |
|
|
358
|
-
| `hex init` | Initialise audit config — scope, commit, chain, docs URL (called by `/init-audit`)
|
|
357
|
+
| `hex init` | Initialise audit config — scope, commit, chain, docs URL, `--github-repo` (called by `/init-audit`) |
|
|
359
358
|
| `hex analyze` | Run all analysis commands in parallel (stats, deps, access, state, calls, patterns, constraints), then surface |
|
|
360
359
|
| `hex stats` | Generate codebase statistics and test coverage |
|
|
361
360
|
| `hex deps` | Build contract dependency graph |
|
|
@@ -377,6 +376,8 @@ All commands run from within the project directory (or with `--project /path/to/
|
|
|
377
376
|
| `hex update-skills --keep-custom` | Skip existing skill files instead of overwriting |
|
|
378
377
|
| `hex ai-status` | Show the latest status for AuditAgent scans |
|
|
379
378
|
| `hex ai-status --watch` | Poll every 5 minutes until pending scans resolve (typical scan: 30-60 min) |
|
|
379
|
+
| `hex issue new --source <s> ...` | Allocate a uniform `H-NNN` id and create a board card (used by the skills) |
|
|
380
380
|
| `hex issue move <id> --to <col>` | Move an issue between board columns (potential / verified / invalid / duplicate); materializes a finding on verify |
|
|
381
381
|
| `hex issue patch <id> [...]` | Edit an issue's severity / resolution / description-file / recommendation-file / update-from-client / notes |
|
|
382
|
+
| `hex issue sync-set <id> ...` | Mark an issue synced to a GitHub issue number (used by `/sync-issues`) |
|
|
382
383
|
| `hex issue show <id>` | Print the merged finding + tracking record for an issue |
|
package/dashboard/.next/BUILD_ID
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
|
|
1
|
+
dm-uzRRik5AgaBPedT1iR
|
|
@@ -12,16 +12,9 @@
|
|
|
12
12
|
"static/chunks/618f8807-547c5614e1318888.js",
|
|
13
13
|
"static/chunks/3205-728c260fbb4f89c6.js",
|
|
14
14
|
"static/chunks/main-app-9d2f6b8a47133e9b.js",
|
|
15
|
-
"static/css/
|
|
15
|
+
"static/css/9c84313d0484b74f.css",
|
|
16
16
|
"static/chunks/7498-ea83cb9e30ec5491.js",
|
|
17
|
-
"static/chunks/app/layout-
|
|
18
|
-
],
|
|
19
|
-
"/flows/page": [
|
|
20
|
-
"static/chunks/webpack-08869f2b18792e51.js",
|
|
21
|
-
"static/chunks/618f8807-547c5614e1318888.js",
|
|
22
|
-
"static/chunks/3205-728c260fbb4f89c6.js",
|
|
23
|
-
"static/chunks/main-app-9d2f6b8a47133e9b.js",
|
|
24
|
-
"static/chunks/app/flows/page-fa67783d8cd79cab.js"
|
|
17
|
+
"static/chunks/app/layout-91d2987f5030a3c4.js"
|
|
25
18
|
],
|
|
26
19
|
"/diagram/page": [
|
|
27
20
|
"static/chunks/webpack-08869f2b18792e51.js",
|
|
@@ -30,14 +23,12 @@
|
|
|
30
23
|
"static/chunks/main-app-9d2f6b8a47133e9b.js",
|
|
31
24
|
"static/chunks/app/diagram/page-b228444265546495.js"
|
|
32
25
|
],
|
|
33
|
-
"/
|
|
26
|
+
"/flows/page": [
|
|
34
27
|
"static/chunks/webpack-08869f2b18792e51.js",
|
|
35
28
|
"static/chunks/618f8807-547c5614e1318888.js",
|
|
36
29
|
"static/chunks/3205-728c260fbb4f89c6.js",
|
|
37
30
|
"static/chunks/main-app-9d2f6b8a47133e9b.js",
|
|
38
|
-
"static/chunks/
|
|
39
|
-
"static/chunks/8928-60c623ee89d2e6ad.js",
|
|
40
|
-
"static/chunks/app/access/page-3668562e7464eb5d.js"
|
|
31
|
+
"static/chunks/app/flows/page-fa67783d8cd79cab.js"
|
|
41
32
|
],
|
|
42
33
|
"/calls/page": [
|
|
43
34
|
"static/chunks/webpack-08869f2b18792e51.js",
|
|
@@ -47,12 +38,14 @@
|
|
|
47
38
|
"static/chunks/8452-e616b5f43bceb95f.js",
|
|
48
39
|
"static/chunks/app/calls/page-d07f5b8664cc8303.js"
|
|
49
40
|
],
|
|
50
|
-
"/
|
|
41
|
+
"/access/page": [
|
|
51
42
|
"static/chunks/webpack-08869f2b18792e51.js",
|
|
52
43
|
"static/chunks/618f8807-547c5614e1318888.js",
|
|
53
44
|
"static/chunks/3205-728c260fbb4f89c6.js",
|
|
54
45
|
"static/chunks/main-app-9d2f6b8a47133e9b.js",
|
|
55
|
-
"static/chunks/
|
|
46
|
+
"static/chunks/8452-e616b5f43bceb95f.js",
|
|
47
|
+
"static/chunks/8928-60c623ee89d2e6ad.js",
|
|
48
|
+
"static/chunks/app/access/page-3668562e7464eb5d.js"
|
|
56
49
|
],
|
|
57
50
|
"/functions/page": [
|
|
58
51
|
"static/chunks/webpack-08869f2b18792e51.js",
|
|
@@ -70,20 +63,20 @@
|
|
|
70
63
|
"static/chunks/main-app-9d2f6b8a47133e9b.js",
|
|
71
64
|
"static/chunks/app/conformance/page-2fede1d7b5f9265d.js"
|
|
72
65
|
],
|
|
73
|
-
"/
|
|
66
|
+
"/overleaf/page": [
|
|
74
67
|
"static/chunks/webpack-08869f2b18792e51.js",
|
|
75
68
|
"static/chunks/618f8807-547c5614e1318888.js",
|
|
76
69
|
"static/chunks/3205-728c260fbb4f89c6.js",
|
|
77
70
|
"static/chunks/main-app-9d2f6b8a47133e9b.js",
|
|
78
|
-
"static/chunks/
|
|
79
|
-
"static/chunks/app/stats/page-db81f600a086f252.js"
|
|
71
|
+
"static/chunks/app/overleaf/page-bcea12a80c97b92f.js"
|
|
80
72
|
],
|
|
81
|
-
"/
|
|
73
|
+
"/issues/page": [
|
|
82
74
|
"static/chunks/webpack-08869f2b18792e51.js",
|
|
83
75
|
"static/chunks/618f8807-547c5614e1318888.js",
|
|
84
76
|
"static/chunks/3205-728c260fbb4f89c6.js",
|
|
85
77
|
"static/chunks/main-app-9d2f6b8a47133e9b.js",
|
|
86
|
-
"static/chunks/
|
|
78
|
+
"static/chunks/3924-4a05057b5450abe1.js",
|
|
79
|
+
"static/chunks/app/issues/page-6bfbf80884d3c9d8.js"
|
|
87
80
|
],
|
|
88
81
|
"/page": [
|
|
89
82
|
"static/chunks/webpack-08869f2b18792e51.js",
|
|
@@ -94,13 +87,20 @@
|
|
|
94
87
|
"static/chunks/7397-f6f4dddc7a20bfc1.js",
|
|
95
88
|
"static/chunks/app/page-a0f25953d4457935.js"
|
|
96
89
|
],
|
|
97
|
-
"/
|
|
90
|
+
"/progress/page": [
|
|
98
91
|
"static/chunks/webpack-08869f2b18792e51.js",
|
|
99
92
|
"static/chunks/618f8807-547c5614e1318888.js",
|
|
100
93
|
"static/chunks/3205-728c260fbb4f89c6.js",
|
|
101
94
|
"static/chunks/main-app-9d2f6b8a47133e9b.js",
|
|
102
|
-
"static/chunks/
|
|
103
|
-
|
|
95
|
+
"static/chunks/app/progress/page-f07ac39d1d27b480.js"
|
|
96
|
+
],
|
|
97
|
+
"/stats/page": [
|
|
98
|
+
"static/chunks/webpack-08869f2b18792e51.js",
|
|
99
|
+
"static/chunks/618f8807-547c5614e1318888.js",
|
|
100
|
+
"static/chunks/3205-728c260fbb4f89c6.js",
|
|
101
|
+
"static/chunks/main-app-9d2f6b8a47133e9b.js",
|
|
102
|
+
"static/chunks/8452-e616b5f43bceb95f.js",
|
|
103
|
+
"static/chunks/app/stats/page-db81f600a086f252.js"
|
|
104
104
|
]
|
|
105
105
|
}
|
|
106
106
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"/_not-found/page":"/_not-found","/api/code/route":"/api/code","/api/
|
|
1
|
+
{"/_not-found/page":"/_not-found","/api/code/route":"/api/code","/api/mermaid/route":"/api/mermaid","/api/progress/route":"/api/progress","/diagram/page":"/diagram","/flows/page":"/flows","/icon.svg/route":"/icon.svg","/api/github-status/route":"/api/github-status","/api/issues/[id]/route":"/api/issues/[id]","/api/issues/[id]/move/route":"/api/issues/[id]/move","/api/watch/route":"/api/watch","/api/flows/route":"/api/flows","/calls/page":"/calls","/access/page":"/access","/functions/page":"/functions","/conformance/page":"/conformance","/overleaf/page":"/overleaf","/issues/page":"/issues","/page":"/","/progress/page":"/progress","/stats/page":"/stats"}
|
|
@@ -5,8 +5,8 @@
|
|
|
5
5
|
"devFiles": [],
|
|
6
6
|
"ampDevFiles": [],
|
|
7
7
|
"lowPriorityFiles": [
|
|
8
|
-
"static/
|
|
9
|
-
"static/
|
|
8
|
+
"static/dm-uzRRik5AgaBPedT1iR/_buildManifest.js",
|
|
9
|
+
"static/dm-uzRRik5AgaBPedT1iR/_ssgManifest.js"
|
|
10
10
|
],
|
|
11
11
|
"rootMainFiles": [
|
|
12
12
|
"static/chunks/webpack-08869f2b18792e51.js",
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":1,"files":["../../node_modules/styled-jsx/index.js","../../node_modules/styled-jsx/package.json","../../node_modules/styled-jsx/dist/index/index.js","../../node_modules/react/package.json","../../node_modules/react/index.js","../../node_modules/client-only/package.json","../../node_modules/react/cjs/react.production.min.js","../../node_modules/client-only/index.js","../../node_modules/styled-jsx/style.js","../../node_modules/next/dist/compiled/next-server/server.runtime.prod.js","../../node_modules/next/package.json","../../node_modules/next/dist/server/body-streams.js","../../node_modules/next/dist/lib/picocolors.js","../../node_modules/next/dist/shared/lib/constants.js","../../node_modules/next/dist/server/web/utils.js","../../node_modules/next/dist/client/components/app-router-headers.js","../../node_modules/next/dist/server/lib/trace/tracer.js","../../node_modules/next/dist/server/lib/trace/constants.js","../../node_modules/next/dist/client/components/static-generation-async-storage.external.js","../../node_modules/next/dist/shared/lib/modern-browserslist-target.js","../../node_modules/next/dist/client/components/static-generation-async-storage-instance.js","../../node_modules/next/dist/shared/lib/runtime-config.external.js","../../node_modules/next/dist/compiled/ws/package.json","../../node_modules/next/dist/compiled/node-html-parser/package.json","../../node_modules/next/dist/compiled/lru-cache/package.json","../../node_modules/@swc/helpers/_/_interop_require_default/package.json","../../node_modules/next/dist/compiled/ws/index.js","../../node_modules/next/dist/compiled/node-html-parser/index.js","../../node_modules/next/dist/compiled/lru-cache/index.js","../../node_modules/next/dist/compiled/@opentelemetry/api/package.json","../../node_modules
|
|
1
|
+
{"version":1,"files":["../../node_modules/styled-jsx/index.js","../../node_modules/styled-jsx/package.json","../../node_modules/styled-jsx/dist/index/index.js","../../node_modules/react/package.json","../../node_modules/react/index.js","../../node_modules/client-only/package.json","../../node_modules/react/cjs/react.production.min.js","../../node_modules/client-only/index.js","../../node_modules/styled-jsx/style.js","../../node_modules/next/dist/compiled/next-server/server.runtime.prod.js","../../node_modules/next/package.json","../../node_modules/next/dist/server/body-streams.js","../../node_modules/next/dist/lib/picocolors.js","../../node_modules/next/dist/shared/lib/constants.js","../../node_modules/next/dist/server/web/utils.js","../../node_modules/next/dist/client/components/app-router-headers.js","../../node_modules/next/dist/server/lib/trace/tracer.js","../../node_modules/next/dist/server/lib/trace/constants.js","../../node_modules/next/dist/client/components/static-generation-async-storage.external.js","../../node_modules/next/dist/shared/lib/modern-browserslist-target.js","../../node_modules/next/dist/client/components/static-generation-async-storage-instance.js","../../node_modules/next/dist/shared/lib/runtime-config.external.js","../../node_modules/next/dist/compiled/ws/package.json","../../node_modules/next/dist/compiled/node-html-parser/package.json","../../node_modules/next/dist/compiled/lru-cache/package.json","../../node_modules/@swc/helpers/_/_interop_require_default/package.json","../../node_modules/next/dist/compiled/ws/index.js","../../node_modules/next/dist/compiled/node-html-parser/index.js","../../node_modules/next/dist/compiled/lru-cache/index.js","../../node_modules/next/dist/compiled/@opentelemetry/api/package.json","../../node_modules/next/dist/client/components/async-local-storage.js","../../node_modules/@swc/helpers/package.json","../../node_modules/next/dist/shared/lib/error-source.js","../../node_modules/next/dist/compiled/jsonwebtoken/package.json","../../node_modules/@swc/helpers/cjs/_interop_require_default.cjs","../../node_modules/next/dist/compiled/@opentelemetry/api/index.js","../../node_modules/next/dist/compiled/jsonwebtoken/index.js","../../node_modules/next/dist/compiled/debug/package.json","../../node_modules/next/dist/lib/semver-noop.js","../../node_modules/next/dist/compiled/debug/index.js","../../node_modules/next/dist/server/future/route-modules/app-page/vendored/contexts/amp-context.js","../../node_modules/next/dist/server/future/route-modules/app-page/vendored/contexts/app-router-context.js","../../node_modules/next/dist/server/future/route-modules/app-page/vendored/contexts/entrypoints.js","../../node_modules/next/dist/server/future/route-modules/app-page/vendored/contexts/head-manager-context.js","../../node_modules/next/dist/server/future/route-modules/app-page/vendored/contexts/hooks-client-context.js","../../node_modules/next/dist/server/future/route-modules/app-page/vendored/contexts/html-context.js","../../node_modules/next/dist/server/future/route-modules/app-page/vendored/contexts/image-config-context.js","../../node_modules/next/dist/server/future/route-modules/app-page/vendored/contexts/loadable-context.js","../../node_modules/next/dist/server/future/route-modules/app-page/vendored/contexts/loadable.js","../../node_modules/next/dist/server/future/route-modules/app-page/vendored/contexts/router-context.js","../../node_modules/next/dist/server/future/route-modules/app-page/vendored/contexts/server-inserted-html.js","../../node_modules/next/dist/server/future/route-modules/app-page/module.compiled.js","../../node_modules/next/dist/server/future/route-modules/pages/vendored/contexts/amp-context.js","../../node_modules/next/dist/server/future/route-modules/pages/vendored/contexts/app-router-context.js","../../node_modules/next/dist/server/future/route-modules/pages/vendored/contexts/entrypoints.js","../../node_modules/next/dist/server/future/route-modules/pages/vendored/contexts/head-manager-context.js","../../node_modules/next/dist/server/future/route-modules/pages/vendored/contexts/hooks-client-context.js","../../node_modules/next/dist/server/future/route-modules/pages/vendored/contexts/html-context.js","../../node_modules/next/dist/server/future/route-modules/pages/vendored/contexts/image-config-context.js","../../node_modules/next/dist/server/future/route-modules/pages/vendored/contexts/loadable-context.js","../../node_modules/next/dist/server/future/route-modules/pages/vendored/contexts/loadable.js","../../node_modules/next/dist/server/future/route-modules/pages/vendored/contexts/router-context.js","../../node_modules/next/dist/server/future/route-modules/pages/vendored/contexts/server-inserted-html.js","../../node_modules/next/dist/server/future/route-modules/pages/module.compiled.js"]}
|