mjolnir-qa 0.5.3 → 0.5.5

package/CHANGELOG.md

@@ -9,6 +9,147 @@ Rule behavior changes (new rules, FP-rate changes against the corpus,
 severity changes) are first-class entries here — rule IDs are immutable
 once shipped, so this file is the record of what changed between versions.
 
+# [0.5.4] — 2026-09-06
+
+### Agent Handoff + Minimized Reporting (plan 1788599400000)
+
+### Added
+
+- **`mjolnir why <file>:<line>`** — occurrence-level evidence query
+  (informational, NOT a gate): exact file+line match, severity icon,
+  message/why/fix, evidence level, trust level, measured FP rate
+  (or the honest "ships on assumption"), runtime corroboration when
+  present, and the suppression contract (reason required, 90-day
+  expiry). Saved-report mode (`--json <mjolnir.json>`) is
+  authoritative; live scan runs otherwise. Exit 0 match / 1 no match.
+- **`mjolnir handoff [mjolnir.json]`** — the deterministic fix-handoff
+  artifact: per-rule remediation sections (what is wrong / why
+  Mjölnir believes it / evidence boundary by level / occurrences
+  capped at 25 / fix / constraints / occurrences list), a per-rule
+  fenced copy block and a one-shot handoff prompt, and the formal
+  verification contract (TARGET_RESOLVED / TARGET_REMAINS /
+  NEW_FINDINGS_INTRODUCED / VERIFICATION_NOT_RUN, correlated by the
+  fingerprint ruleId+file+message; the standing caveat that a clean
+  `--scope changed` run verifies the changed surface only). Generated
+  solely from Mjölnir's own rule metadata — offline, deterministic,
+  escapeMarkdown'd. Zero findings → exit 0, non-actionable clean
+  artifact with no prompt. `--category`/`--rules` are presentation
+  filters.
+- **`mjolnir install`** — installs the agent instruction surfaces
+  (`.claude/commands/mjolnir.md`, `.kilo/command/mjolnir.md`,
+  `.cursor/rules/mjolnir.mdc`, marker-appended `AGENTS.md`): the
+  version-pinned trust loop brief (scan `--scope changed` before
+  finishing, never suppress to green, report files changed and checks
+  not run). `--staged-hook` adds a NON-BLOCKING pre-commit hook
+  (`mjolnir --staged --blocking warning`, reusing `.husky`/
+  `core.hooksPath` when present). Marker-based idempotency;
+  `--dry-run` writes nothing; refusal (exit 10) before overwriting
+  any non-Mjölnir file; `--force` overwrites only Mjölnir-marked
+  files; never @latest.
+- **`--score`** — prints only the numeric score (`unknown` when no
+  tests exist — never a fake 0); pure rendering flag, exit code
+  unchanged; stderr note when --json was also requested.
+- **`--category <cat>`** (repeatable) — presentation filter on the
+  terminal findings display (and handoff/why): NEVER filters the
+  scan, the JSON/SARIF output, or the score; the terminal prints
+  `filtered view: N of M findings shown; score reflects the full
+scan`. Unknown categories are a usage error (exit 10).
+- **`--staged`** — scan-surface restriction: intersects discovered
+  test files with the git staged list; score reflects the staged
+  surface and is labeled as such (`staged surface: N file(s)`); not a
+  git repo → honest degraded fallback; empty staged set → exit 0.
+- **`--blocking error|warning|none`** — exit-status override only:
+  maps onto the existing gate model (none→advisory, error→errors
+  block, warning→errors+warnings block). Detection and rendering are
+  identical under all three values; E0 findings never block; partial
+  scans stay exit 2.
+- **`fixGroupId`** (additive JSON field): the stable semantic identity
+  of a remediation group — intentionally distinct from `ruleId`
+  (which identifies the detector). Current strategy: one rule = one
+  group, so fixGroupId equals ruleId today; consumers must not rely
+  on that permanently.
+
+### Changed
+
+- help registry gained `why`, `handoff`, `install` and the new flags;
+  site/reference/cli.md documents the handoff trust model.
+
+## [0.5.5] — 2026-09-06
+
+### Audit Remediation 1.0 (engine correctness + trust boundary)
+
+### Changed — plugin execution gate (audit C2, contract-visible, pre-1.0)
+
+- **`--enable-plugins` / `MJOLNIR_ENABLE_PLUGINS=1`** — npm plugins and
+  JS-module external rules (`mjolnir-rules/*.mjs`) now load and execute
+  only behind an explicit opt-in (default OFF). Declared-but-gated
+  sources are listed on a loud stderr notice; they are never imported.
+  JSON rule manifests execute no code and load without the gate. See
+  SECURITY.md (trust model) and docs/VERSIONING.md (gate contract).
+
+### Fixed — engine correctness (audit M1)
+
+- **C1/W9 (`--cache`)**: the cache key folds in the repo-relative path,
+  adapter id, and parse mode — byte-identical files no longer share
+  verdicts (findings carried the first-scanned file's path), and
+  regex-fallback verdicts are never served as AST ones. `CACHE_VERSION`
+  bumped to 2: one-time invalidation, first post-upgrade scan cold.
+- **C3**: the default console sinks are variadic —
+  "mjolnir internal error:" now carries the actual cause (the message
+  used to be dropped).
+- **C5**: a partial (truncated) scan never writes the
+  first-clean-scan milestone; `mjolnir diff` on a truncated head
+  returns exit 2 and folds no resolved findings into stats.
+- **W1**: the Java/C# maskers keep code after a closed block comment
+  live (`/*x*/y` used to blank `y`).
+- **W2/W3**: parse-semaphore re-check (cap holds under fan-out) and
+  parser-creation retry on rejection (a transient WASM load failure no
+  longer disables the AST path for the process).
+- **W4**: unchecked grammar-shape casts removed in the QA-model
+  extractor; `parseTsFile`'s undefined contract honored.
+- **W8**: runtime corroboration claims "test" level only when the
+  finding's line falls inside the verdict's span; lineless reports
+  degrade to file level.
+- **W10**: malformed rule records at the rule→Finding boundary are
+  rejected with a diagnostic (crash channel), never silently scored.
+- **S5 (QA-CI-001, detectorRevision 2)**: step-level line resolution
+  falls back to the anchor line instead of crashing — the rule no
+  longer vanishes into crash isolation on workflows where the raw
+  `continue-on-error: true` literal sits outside the search window.
+  Behavior changes from crash-dropped to reported; sidecar +
+  measured-FP regenerated per policy.
+- **masking.ts**: outer-delimiter search fixes misclassification of
+  string values ending in a nested quote.
+- **changed.ts**: hunk-content lines that look like diff headers no
+  longer abandon the hunk; one unreadable untracked file degrades only
+  itself (treated fully changed), never the whole scope.
+- **shared-walk.ts**: unreadable directories and skipped symlinks are
+  counted skips with reasons; deadline/cap checks run inside the entry
+  loop.
+- **workflow-parser.ts**: the documented nesting-depth cap is enforced;
+  `jobs` builds on a null-prototype object; step `with` is copied.
+
+### Changed — suppressions expiry (audit S4, contract-visible, pre-1.0)
+
+- The 90-day default for hand-authored `ignore` entries is no longer
+  anchored at the config file's mtime — any config edit used to reset
+  every suppression window. Expiry is the entry's explicit `expires`
+  date; entries without one stay active and are labeled accordingly in
+  `mjolnir suppressions`.
+
+### Hardened — trust boundary (audits S1/S2/S3/S7)
+
+- **S1**: git resolves to an absolute path from PATH (never the scanned
+  CWD) — a planted `git.exe`/`git.bat` cannot hijack Mjölnir's git
+  calls on Windows.
+- **S2**: ignore/glob patterns and external JSON-rule regexes are
+  length/wildcard-capped at compile time; `**/` compiles segment-aware.
+- **S3**: config/ignore/plugins resolve from the explicit scan target's
+  project; the resolved anchor prints in verbose mode.
+- **S7**: `ignore[].files` must be `string[]` (exit 10 on typo);
+  unknown top-level config keys warn; baseline `schemaVersion` is
+  checked (future versions degrade to "no baseline" with a warning).
+
 ## [0.5.3] — 2026-09-05
 
 ### Terminal + CI UX Overhaul (plan 1788579907109)
@@ -159,6 +300,8 @@ rules… → Scoring…`) fed by the new additive `ScanHooks.onProgress`.
 
 ### Added — folder-based external rules, zero network
 
+### Added — folder-based external rules, zero network
+
 - **`mjolnir-rules/` contract** (`src/plugins/local-rules.ts`): a
   workspace directory loaded from the scan target root alongside npm
   plugins. Two file kinds: **JSON rule manifests** (declarative regex

package/README.md

@@ -558,10 +558,17 @@ are immutable once shipped and never reused.
   real OSS code ship in the headline tiers (see
   [How much of this is measured](#how-much-of-this-is-measured)); the scan
   footer and `mjolnir rules --unmeasured` tell you which is which.
-- **Plugin trust** — plugins are npm packages declared under `"plugins"`.
-  There is **no sandbox**: plugin code runs with full Node privileges, the
-  same trust model as ESLint or Vitest plugins. Core rule-ID prefixes are
-  reserved and rejected from plugins to prevent spoofing.
+- **Plugin trust & execution gate** — plugins are npm packages declared
+  under `"plugins"`; JS modules live in `mjolnir-rules/*.mjs`. There is
+  **no sandbox**: plugin code runs with full Node privileges, the same
+  trust model as ESLint or Vitest plugins. Because of that, code execution
+  is **opt-in at every scan**: pass `--enable-plugins` (or set
+  `MJOLNIR_ENABLE_PLUGINS=1`) or the sources are NOT loaded — a loud
+  stderr notice lists exactly what was skipped. Scanning untrusted code
+  never executes it. JSON rule manifests (`mjolnir-rules/*.json`) are
+  unaffected: they declare regex patterns and execute no code by design.
+  Core rule-ID prefixes are reserved and rejected from plugins and
+  external rules to prevent spoofing.
 - **Workspace-local external rules** (folder-based, zero network) — a
   `mjolnir-rules/` directory next to the scan target loads custom rules:
   JSON files declare regex patterns (no code executed), `.mjs`/`.js`

package/dist/cli.d.mts

@@ -33,7 +33,7 @@ type EvidenceLevel = (typeof EVIDENCE_ORDER)[number];
  */
 type QaImpact = "BLOCKS-RELEASE" | "FLAKY-RISK" | "FALSE-GREEN" | "HYGIENE";
 /** Rule namespaces are frozen public API (§18.4). IDs are never reused. */
-type RuleCategory = "QA-TEST" | "QA-TQUAL" | "QA-PW" | "QA-CI";
+type RuleCategory = "QA-TEST" | "QA-TQUAL" | "QA-PW" | "QA-CI" | "QA-PY" | "QA-ENV" | "QA-JV" | "QA-CS" | "QA-CYP" | "QA-SE" | "QA-WDIO" | "QA-PPTR" | "QA-APM";
 /**
  * Trust levels (Verification Trust Evolution Plan §16): the OVERALL
  * trust a consumer can place in one finding, combining the static
@@ -128,6 +128,21 @@ interface Finding {
   /** How to fix — concrete action. */
   fix: string;
   docsUrl?: string;
+  /**
+   * Stable semantic identity of a remediation group: findings that can
+   * be reasoned about and potentially remediated as one root-cause unit
+   * (agent-handoff plan §5.1). This is intentionally a DIFFERENT
+   * concept from `ruleId` (which identifies the detector/rule).
+   *
+   * Current implementation strategy: fixGroupId = ruleId, because each
+   * rule currently represents one remediation group. Future rules may
+   * emit multiple findings belonging to one fix group, or multiple
+   * remediation groups. Consumers MUST NOT rely on
+   * fixGroupId === ruleId permanently.
+   *
+   * Additive within schemaVersion 1.
+   */
+  fixGroupId?: string;
 }
 interface DimensionScore {
   category: RuleCategory;
@@ -147,6 +162,16 @@ interface ScanResult {
   /** Present when --scope changed was requested. */
   scope?: "all" | "changed";
   scopeDegraded?: string;
+  /**
+   * Present when --staged was requested (agent-handoff plan §5.7):
+   * the scan surface was restricted to git staged files, and `files`
+   * is how many survived the intersection. The score reflects THAT
+   * surface — never present it as a full-repo score. Additive within
+   * schemaVersion 1.
+   */
+  staged?: {
+    files: number;
+  };
   /** Detected test frameworks (0.2). Empty + unknown=true when undetectable. */
   frameworks: string[];
   frameworkDetectionUnknown: boolean;
@@ -223,6 +248,20 @@ interface ScanResult {
   };
 }
 //#endregion
+//#region src/engine/tier-policy.d.ts
+type Tier = "core" | "extended" | "quarantine";
+//#endregion
+//#region src/engine/overlap-dedup.d.ts
+/** Per-rule metadata the dedup pass needs, built from RULES. */
+interface OverlapMeta {
+  /** Rule IDs this rule can double-report on the same root cause. */
+  overlapWith?: string[];
+  /** Tier rank for survivor resolution (missing = core). */
+  tier?: Tier;
+  /** RULES registry order for final tie-breaking. */
+  order?: number;
+}
+//#endregion
 //#region src/discovery/workspace.d.ts
 /**
  * Repository discovery (Sprint-Plan W1-03).
@@ -238,9 +277,6 @@ interface Workspace {
   workspaceGlobs: string[];
 }
 //#endregion
-//#region src/engine/tier-policy.d.ts
-type Tier = "core" | "extended" | "quarantine";
-//#endregion
 //#region src/rules/rule.d.ts
 /**
  * How the rule's primary detection decision is made (Verification Trust
@@ -480,19 +516,13 @@ interface UniversalRule {
   run(file: ParsedFile): Array<Omit<Finding, "ruleId" | "category">>;
 }
 //#endregion
-//#region src/cli.d.ts
-/**
- * Tool version for `mjolnir --version`.
- *
- * A literal, not a package.json read: the shipped artifact is a single
- * bundled `dist/cli.mjs`, so resolving package.json at runtime depends on
- * where the file happens to sit after install. This follows the same
- * discipline as SARIF's `driver.version` — kept in sync by
- * `scripts/sync-sarif-version.cjs` on release and guarded by
- * `tests/version-consistency.spec.ts` locally.
- */
-declare const CLI_VERSION = "0.5.3";
-declare function buildUniversalRules(root: string, strict?: boolean): Promise<{
+//#region src/engine/scan-pipeline.d.ts
+declare function buildUniversalRules$1(root: string, strict?: boolean, opts?: {
+  /** CLI trust-gate flag (`--enable-plugins`) for this scan. */
+  enablePlugins?: boolean;
+  /** Called with the gate notice when code sources were skipped. */
+  onGateNotice?: (notice: string) => void;
+}): Promise<{
   rules: UniversalRule[];
   pluginErrors: string[];
   tierByRuleId: Map<string, Tier>;
@@ -536,25 +566,41 @@ interface CliArgs {
    * and auto-disabled in CI/machine formats; this flag is the manual off.
    */
   noProgress?: boolean;
+  /**
+   * --staged: scan-surface restriction (plan §5.7) — intersect the
+   * discovered test files with the git staged file list. Does NOT
+   * change rule semantics; score implications come only from the
+   * narrowed surface (labeled as such in the report).
+   */
+  staged?: boolean;
+  /**
+   * --blocking error|warning|none (plan §5.8): invocation-level gate
+   * override. Controls PROCESS EXIT BEHAVIOR ONLY via the existing
+   * exitForFindings mechanism — detection, rendering, JSON and score
+   * are identical under all three values. Overrides config.gate.
+   */
+  blocking?: "error" | "warning" | "none";
+  /**
+   * --category <cat> (repeatable): presentation filter — narrows the
+   * TERMINAL findings display (and handoff/why output) to the given
+   * rule categories. NEVER filters the scan, the JSON/SARIF output,
+   * or the score (agent-handoff plan §5.5).
+   */
+  categories?: RuleCategory[];
+  /**
+   * --score: print only the numeric score (or `unknown` when the repo
+   * has no tests) instead of the full report. Pure rendering flag:
+   * scan semantics and exit codes are unchanged (plan §5.6).
+   */
+  scoreOnly?: boolean;
+  /**
+   * Audit C2: --enable-plugins opens the plugin trust gate for THIS
+   * invocation — npm-plugin and JS-module rule sources may load (and
+   * execute). Default OFF; MJOLNIR_ENABLE_PLUGINS=1 is the env
+   * equivalent. JSON rule manifests are unaffected (no code by design).
+   */
+  enablePlugins?: boolean;
 }
-/** A usage-error detail: the offending token, when one exists. */
-interface UsageErrorDetail {
-  /** The unknown flag or rejected value (e.g. `--nope`, `loud`). */
-  token?: string | undefined;
-  /** The flag whose value was rejected (`--tone` for `--tone loud`). */
-  flag?: string | undefined;
-}
-declare function parseArgs(argv: string[], onError?: (detail: UsageErrorDetail) => void): CliArgs | null;
-/** Hand-rolled Levenshtein distance (plan M2: no new dependencies). */
-declare function levenshtein(a: string, b: string): number;
-/** Nearest known flags within distance ≤ 2, nearest first. */
-declare function nearestFlags(flag: string, max?: number): string[];
-/**
- * Friendly usage error (plan M2, exit 10 preserved): nearest-flag
- * suggestion, the valid neighbors, and the exact help command. Printed
- * to stderr; findings/usage stay on their documented streams.
- */
-declare function usageErrorMessage(detail: UsageErrorDetail): string;
 interface ScanHooks {
   /** Invoked when a rule throws on a file (audit R-9). */
   onRuleCrash?: (ruleId: string, file: string, error: unknown) => void;
@@ -572,6 +618,13 @@ interface ScanHooks {
     total?: number | undefined;
     detail?: string | undefined;
   }) => void;
+  /**
+   * Audit C2: invoked when code-executing rule sources were skipped
+   * because the plugin trust gate is closed. Default (no hook): the
+   * gate notice is written straight to stderr — loud in every verb,
+   * never on the stdout machine contracts.
+   */
+  onGateNotice?: (notice: string) => void;
 }
 /**
  * Workspace fallback for targets with no discoverable project root
@@ -579,7 +632,40 @@ interface ScanHooks {
  * root-path degenerate case (`C:\` → basename "") is testable without
  * scanning a filesystem root.
  */
-declare function fallbackWorkspace(targetAbs: string): Workspace;
+declare function fallbackWorkspace$1(targetAbs: string): Workspace;
+/**
+ * Minimal glob match for suppression `files` patterns, with gitignore
+ * `**` semantics (bug-audit M5). Supports:
+ *   "tests/**"             — everything inside tests/
+ *   "tests" + "/**\/*.spec.ts" — any depth UNDER tests/ (including none) ending in .spec.ts
+ *   "**" + "/*.spec.ts"    — any depth including root-level files
+ *   "tests/foo.spec.ts"    — exact path
+ *   "*" within a segment never crosses "/".
+ *
+ * Forward slashes only (findings always use normalized paths). `?`,
+ * character classes and `!` negation are not metacharacters here — same
+ * as before this rewrite.
+ */
+declare function pathMatchesGlob$1(path: string, glob: string): boolean;
+/**
+ * Plan §16: locate a runtime run report next to the scan target, using
+ * the exact conventions the forensics ingestion already accepts —
+ * `mjolnir.report.json` (the packages/playwright-reporter default
+ * output) or a `test-results/` directory. Returns the path for
+ * `runForensics`, or undefined when neither convention is present
+ * ("no runtime evidence" — never guessed).
+ */
+declare function discoverRuntimeReport$1(scanRoot: string): string | undefined;
+/**
+ * Audit W10 — runtime shape validation at the rule→Finding boundary.
+ * A finding record coming out of a rule (plugin/JSON-manifest rules are
+ * external data, not trusted internal code) must carry the fields the
+ * whole downstream pipeline indexes on: severity within the enum,
+ * integer line ≥ 1, non-empty message, and a file path. Malformed
+ * records are rejected (routed to the crash/plugin-error channel by the
+ * caller) — never silently scored.
+ */
+declare function isValidFindingRecord$1(f: unknown): f is Omit<Finding, "ruleId" | "category">;
 /**
  * Testable default scan path core. `hooks` lets callers observe
  * normally-invisible events (swallowed rule crashes) without changing
@@ -590,9 +676,42 @@ declare function fallbackWorkspace(targetAbs: string): Workspace;
  * inherently async); `runRules` and every rule stay synchronous and
  * consume `ParsedFile.ast`. Callers await the returned promise.
  */
-declare function runScan(args: CliArgs, hooks?: ScanHooks): Promise<ScanResult>;
+declare function runScan$1(args: CliArgs, hooks?: ScanHooks): Promise<ScanResult>;
+//#endregion
+//#region src/cli.d.ts
+declare const runScan: typeof runScan$1, buildUniversalRules: typeof buildUniversalRules$1, fallbackWorkspace: typeof fallbackWorkspace$1, pathMatchesGlob: typeof pathMatchesGlob$1, isValidFindingRecord: typeof isValidFindingRecord$1, discoverRuntimeReport: typeof discoverRuntimeReport$1, KNOWN_RULE_IDS: ReadonlySet<string>, OVERLAP_META_BY_RULE_ID: ReadonlyMap<string, OverlapMeta>, EVIDENCE_OVERRIDES: ReadonlyMap<string, string>, SUITE_INVALIDATING_RULE_IDS: ReadonlySet<string>;
+/**
+ * Tool version for `mjolnir --version`.
+ *
+ * A literal, not a package.json read: the shipped artifact is a single
+ * bundled `dist/cli.mjs`, so resolving package.json at runtime depends on
+ * where the file happens to sit after install. This follows the same
+ * discipline as SARIF's `driver.version` — kept in sync by
+ * `scripts/sync-sarif-version.cjs` on release and guarded by
+ * `tests/version-consistency.spec.ts` locally.
+ */
+declare const CLI_VERSION = "0.5.5";
+/** A usage-error detail: the offending token, when one exists. */
+interface UsageErrorDetail {
+  /** The unknown flag or rejected value (e.g. `--nope`, `loud`). */
+  token?: string | undefined;
+  /** The flag whose value was rejected (`--tone` for `--tone loud`). */
+  flag?: string | undefined;
+}
+declare function parseArgs(argv: string[], onError?: (detail: UsageErrorDetail) => void): CliArgs | null;
+/** Hand-rolled Levenshtein distance (plan M2: no new dependencies). */
+declare function levenshtein(a: string, b: string): number;
+/** Nearest known flags within distance ≤ 2, nearest first. */
+declare function nearestFlags(flag: string, max?: number): string[];
+/**
+ * Friendly usage error (plan M2, exit 10 preserved): nearest-flag
+ * suggestion, the valid neighbors, and the exact help command. Printed
+ * to stderr; findings/usage stay on their documented streams.
+ */
+declare function usageErrorMessage(detail: UsageErrorDetail): string;
 type Output = (...parts: unknown[]) => void;
-declare function pathMatchesGlob(path: string, glob: string): boolean;
+declare const out: Output;
+declare const err: Output;
 /** Testable `ci install` handler. Returns the process exit code. */
 declare function runCiInstall(argv: string[], io?: {
   out: Output;
@@ -735,4 +854,4 @@ declare function runHelpCommand(argv: string[], io?: {
 declare function internalErrorMessage(err: unknown, emit: (s: string) => void, debug: boolean): void;
 declare function isEntryPoint(): boolean;
 //#endregion
-export { CLI_VERSION, Output, ScanHooks, UsageErrorDetail, buildUniversalRules, exitForFindings, fallbackWorkspace, internalErrorMessage, isEntryPoint, levenshtein, main, nearestFlags, parseArgs, pathMatchesGlob, runBadgeCommand, runBaselineCommand, runCiInstall, runCreateRuleCommand, runDebtCommand, runDiffCommand, runDoctorCommand, runDoctorPlaywright, runExplainCommand, runFixCommand, runForensicsCommand, runHandoverCommand, runHelpCommand, runImpactCommand, runInitCommand, runPrCommentCommand, runPwReportCommand, runRulesCommand, runScan, runScanCommand, runStatsCommand, runSuppressions, runTriageCommand, usageErrorMessage };
+export { CLI_VERSION, type CliArgs, EVIDENCE_OVERRIDES, KNOWN_RULE_IDS, OVERLAP_META_BY_RULE_ID, Output, SUITE_INVALIDATING_RULE_IDS, type ScanHooks, UsageErrorDetail, buildUniversalRules, discoverRuntimeReport, err, exitForFindings, fallbackWorkspace, internalErrorMessage, isEntryPoint, isValidFindingRecord, levenshtein, main, nearestFlags, out, parseArgs, pathMatchesGlob, runBadgeCommand, runBaselineCommand, runCiInstall, runCreateRuleCommand, runDebtCommand, runDiffCommand, runDoctorCommand, runDoctorPlaywright, runExplainCommand, runFixCommand, runForensicsCommand, runHandoverCommand, runHelpCommand, runImpactCommand, runInitCommand, runPrCommentCommand, runPwReportCommand, runRulesCommand, runScan, runScanCommand, runStatsCommand, runSuppressions, runTriageCommand, usageErrorMessage };