paqad-ai 1.57.0 → 1.58.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +10 -0
- package/dist/cli/index.js +1822 -433
- package/dist/cli/index.js.map +1 -1
- package/dist/index.d.ts +5 -1
- package/dist/index.js +38 -3
- package/dist/index.js.map +1 -1
- package/dist/kernel/gate.js +9 -0
- package/dist/kernel/gate.js.map +1 -1
- package/dist/rule-scripts/index.js +8 -0
- package/dist/rule-scripts/index.js.map +1 -1
- package/dist/session-ledger/disabled-audit.js +8 -0
- package/dist/session-ledger/disabled-audit.js.map +1 -1
- package/dist/session-ledger/project-ledger.js +8 -0
- package/dist/session-ledger/project-ledger.js.map +1 -1
- package/dist/stage-evidence/live-writer.js +8 -0
- package/dist/stage-evidence/live-writer.js.map +1 -1
- package/dist/stage-evidence/marker-parse.js +8 -0
- package/dist/stage-evidence/marker-parse.js.map +1 -1
- package/dist/stage-evidence/narration.js +8 -0
- package/dist/stage-evidence/narration.js.map +1 -1
- package/package.json +1 -1
- package/runtime/AGENT-BOOTSTRAP.md +7 -6
- package/runtime/base/skills/finding-normalizer/SKILL.md +2 -0
- package/runtime/base/skills/finding-normalizer/assets/vocabulary.txt +12 -0
- package/runtime/capabilities/coding/rules/codebase-health.md +82 -0
- package/runtime/capabilities/coding/rules/health-retest.md +46 -0
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,15 @@
|
|
|
1
1
|
# paqad-ai
|
|
2
2
|
|
|
3
|
+
## 1.58.0
|
|
4
|
+
|
|
5
|
+
### Minor Changes
|
|
6
|
+
|
|
7
|
+
- ee46d89: New routed workflow #10 **codebase-health** (backed by **health-retest**): a project health check-up on demand, at the same tier as pentest and design-test. Say "check my project's health" and paqad scans for six kinds of junk — dead code, unused packages, outdated or risky packages, leaked secrets, stale docs, and copy-paste AI slop — and lands every finding in one report with proof (real tool output, never an AI opinion), a plain-words reason it matters, and what to do about it.
|
|
8
|
+
|
|
9
|
+
Detection is a single deterministic verb, `paqad-ai health run`, that costs zero model tokens: it reuses the code-knowledge index (dead code, unused deps), the 9-ecosystem dependency inventory, OSV/native-audit vulnerability data, registry deprecation metadata, and the chunk-similarity index, shelling out to `osv-scanner`, `gitleaks`, `jscpd`, and `knip` when they are on PATH and degrading gracefully (labelled fallbacks or `blocked_checks`) when they are not. Findings carry stable content-addressed `HL-` ids, split honestly into a "Proven" section (deterministic) and a "Needs judgment" section (ai-judged, confidence-scored), and never expose secret bytes — only a file:line + rule + fingerprint.
|
|
10
|
+
|
|
11
|
+
Finding fingerprints use SHA-256 (a stable content-addressed dedup key, not a security primitive; secret bytes never reach it). All scanners are invoked from Node, so the workflow is cross-platform (Windows included). A baseline ratchet marks findings `new-since-baseline` vs `pre-existing` so a legacy project isn't drowned, `--offline` skips the network categories, and `paqad-ai health retest` re-runs the evidence and reclassifies each finding `fixed | still-open | needs-manual-verification` by its stable id. The workflow is classifier-routed (health phrasings route to codebase-health; pentest phrasings still route to pentest), surfaces in the dashboard, and its run summaries flow to the SIEM export.
|
|
12
|
+
|
|
3
13
|
## 1.57.0
|
|
4
14
|
|
|
5
15
|
### Minor Changes
|