sentinelayer-cli 0.25.0 → 0.25.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sentinelayer-cli",
-  "version": "0.25.0",
+  "version": "0.25.1",
   "description": "Scaffold Sentinelayer spec/prompt/guide artifacts with secure browser auth and token bootstrap.",
   "type": "module",
   "scripts": {

package/src/audit/agents/architecture.js

@@ -1,3 +1,5 @@
+import { isAuditSourceFile } from "./path-classification.js";
+
 function normalizeString(value) {
   return String(value || "").trim();
 }
@@ -21,6 +23,7 @@ function summarizeSeverity(findings = []) {
 function buildHotspots(ingest = {}) {
   const indexed = Array.isArray(ingest.indexedFiles?.files) ? ingest.indexedFiles.files : [];
   return indexed
+    .filter((file) => isAuditSourceFile(file))
     .filter((file) => Number(file.loc || 0) >= 300)
     .sort((left, right) => Number(right.loc || 0) - Number(left.loc || 0))
     .slice(0, 20)
@@ -50,7 +53,7 @@ function deriveArchitectureFindings({ findings = [], hotspots = [] } = {}) {
       continue;
     }
     derived.push({
-      severity: hotspot.risk === "high" ? "P1" : "P2",
+      severity: "P2",
       file: hotspot.path,
       line: 1,
       message: `Large architectural hotspot detected (${hotspot.loc} LOC).`,

package/src/audit/agents/documentation.js

@@ -1,3 +1,5 @@
+import { isAuditSourceFile } from "./path-classification.js";
+
 function normalizeString(value) {
   return String(value || "").trim();
 }
@@ -26,9 +28,7 @@ function buildDocumentationInventory(ingest = {}) {
     language: file.language,
   }));
   const docFiles = normalized.filter((file) => /(^|\/)(docs?|guides?|adr|readme)/i.test(file.path));
-  const codeFiles = normalized.filter(
-    (file) => file.loc > 0 && !/(^|\/)(docs?|guides?|adr|readme)/i.test(file.path)
-  );
+  const codeFiles = normalized.filter((file) => file.loc > 0 && isAuditSourceFile(file));
   const docDensity = codeFiles.length > 0 ? docFiles.length / codeFiles.length : 0;
   const undocumentedHotspots = codeFiles
     .filter((file) => file.loc >= 320)
@@ -42,7 +42,7 @@ function buildDocumentationInventory(ingest = {}) {
       path: file.path,
       loc: file.loc,
       language: file.language,
-      severity: file.loc >= 800 ? "P1" : "P2",
+      severity: "P2",
     }));
 
   return {

package/src/audit/agents/path-classification.js

@@ -0,0 +1,120 @@
+const SOURCE_EXTENSIONS = new Set([
+  ".c",
+  ".cc",
+  ".cpp",
+  ".cs",
+  ".css",
+  ".go",
+  ".graphql",
+  ".h",
+  ".hpp",
+  ".java",
+  ".js",
+  ".jsx",
+  ".kt",
+  ".mjs",
+  ".php",
+  ".py",
+  ".rb",
+  ".rs",
+  ".scss",
+  ".sql",
+  ".svelte",
+  ".swift",
+  ".tf",
+  ".ts",
+  ".tsx",
+  ".vue",
+]);
+
+const SOURCE_LANGUAGES = new Set([
+  "c",
+  "c++",
+  "c#",
+  "css",
+  "dockerfile",
+  "go",
+  "graphql",
+  "java",
+  "javascript",
+  "jsx",
+  "kotlin",
+  "php",
+  "python",
+  "ruby",
+  "rust",
+  "scss",
+  "sql",
+  "svelte",
+  "swift",
+  "terraform",
+  "typescript",
+  "tsx",
+  "vue",
+]);
+
+const LOCKFILE_NAMES = new Set([
+  "cargo.lock",
+  "composer.lock",
+  "go.sum",
+  "package-lock.json",
+  "pipfile.lock",
+  "pnpm-lock.yaml",
+  "poetry.lock",
+  "yarn.lock",
+]);
+
+function normalizePath(value) {
+  return String(value || "").replace(/\\/g, "/").replace(/^\.\/+/, "").toLowerCase();
+}
+
+function basename(filePath) {
+  const normalized = normalizePath(filePath);
+  return normalized.slice(normalized.lastIndexOf("/") + 1);
+}
+
+function extension(filePath) {
+  const name = basename(filePath);
+  const dot = name.lastIndexOf(".");
+  return dot > 0 ? name.slice(dot) : "";
+}
+
+export function isAuditTestPath(filePath) {
+  const normalized = normalizePath(filePath);
+  return /(^|\/)(__tests__|tests?|specs?)(\/|$)|\.(test|spec)\.[^.\/]+$/i.test(normalized);
+}
+
+export function isAuditSupportPath(filePath) {
+  const normalized = normalizePath(filePath);
+  if (!normalized) {
+    return true;
+  }
+  if (LOCKFILE_NAMES.has(basename(normalized))) {
+    return true;
+  }
+  if (/(^|\/)(node_modules|vendor|fixtures?|__fixtures__|mocks?|__mocks__|snapshots?|__snapshots__)(\/|$)/i.test(normalized)) {
+    return true;
+  }
+  if (/(^|\/)(generated|__generated__|auto-generated|coverage|dist|build|out|\.next|\.nuxt|\.turbo|\.cache)(\/|$)/i.test(normalized)) {
+    return true;
+  }
+  if (/^(docs?|guides?|adr|tasks?|\.github|\.vscode|\.husky|public)(\/|$)/i.test(normalized)) {
+    return true;
+  }
+  if (/(\.min|\.bundle|generated)\.[^.\/]+$/i.test(normalized)) {
+    return true;
+  }
+  return false;
+}
+
+export function isAuditSourceFile(file = {}) {
+  const filePath = typeof file === "string" ? file : file.path;
+  const normalized = normalizePath(filePath);
+  if (!normalized || isAuditTestPath(normalized) || isAuditSupportPath(normalized)) {
+    return false;
+  }
+  if (SOURCE_EXTENSIONS.has(extension(normalized))) {
+    return true;
+  }
+  return SOURCE_LANGUAGES.has(String(file.language || "").trim().toLowerCase());
+}

package/src/audit/agents/performance.js

@@ -1,3 +1,5 @@
+import { isAuditSourceFile } from "./path-classification.js";
+
 function normalizeString(value) {
   return String(value || "").trim();
 }
@@ -21,6 +23,7 @@ function summarizeSeverity(findings = []) {
 function buildRuntimeHotspots(ingest = {}) {
   const indexed = Array.isArray(ingest.indexedFiles?.files) ? ingest.indexedFiles.files : [];
   return indexed
+    .filter((file) => isAuditSourceFile(file))
     .filter((file) => Number(file.loc || 0) >= 280)
     .sort((left, right) => Number(right.loc || 0) - Number(left.loc || 0))
     .slice(0, 20)
@@ -28,7 +31,7 @@ function buildRuntimeHotspots(ingest = {}) {
       path: toPosixPath(file.path),
       loc: Number(file.loc || 0),
       language: file.language,
-      severity: Number(file.loc || 0) >= 900 ? "P1" : "P2",
+      severity: "P2",
     }));
 }
 

package/src/audit/agents/testing.js

@@ -1,3 +1,5 @@
+import { isAuditSourceFile, isAuditTestPath } from "./path-classification.js";
+
 function normalizeString(value) {
   return String(value || "").trim();
 }
@@ -18,10 +20,6 @@ function summarizeSeverity(findings = []) {
   return summary;
 }
 
-function isTestPath(filePath) {
-  return /(^|\/)(__tests__|tests?|spec)(\/|$)|\.(test|spec)\.[^.]+$/i.test(filePath);
-}
-
 function buildCoverageInventory(ingest = {}) {
   const indexedFiles = Array.isArray(ingest.indexedFiles?.files) ? ingest.indexedFiles.files : [];
   const normalized = indexedFiles.map((file) => ({
@@ -30,8 +28,8 @@ function buildCoverageInventory(ingest = {}) {
     loc: Number(file.loc || 0),
   }));
 
-  const testFiles = normalized.filter((file) => isTestPath(file.path));
-  const nonTestCodeFiles = normalized.filter((file) => !isTestPath(file.path) && file.loc > 0);
+  const testFiles = normalized.filter((file) => isAuditTestPath(file.path));
+  const nonTestCodeFiles = normalized.filter((file) => isAuditSourceFile(file) && file.loc > 0);
   const ratio = nonTestCodeFiles.length > 0 ? testFiles.length / nonTestCodeFiles.length : 0;
   const likelyGaps = nonTestCodeFiles
     .filter((file) => file.loc >= 260)
@@ -45,7 +43,7 @@ function buildCoverageInventory(ingest = {}) {
       path: file.path,
       loc: file.loc,
       language: file.language,
-      severity: file.loc >= 550 ? "P1" : "P2",
+      severity: "P2",
     }));
 
   return {

package/src/commands/action-options.js

@@ -0,0 +1,27 @@
+export function resolveActionOptions(options = {}, command = null) {
+  const localOptions = options && typeof options.opts === "function" ? options.opts() : { ...options };
+  const parent = command?.parent;
+  if (!parent || typeof parent.opts !== "function") {
+    return localOptions;
+  }
+
+  const parentOptions = parent.opts();
+  const merged = {
+    ...parentOptions,
+    ...localOptions,
+  };
+
+  for (const [key, value] of Object.entries(parentOptions)) {
+    const parentSource =
+      typeof parent.getOptionValueSource === "function" ? parent.getOptionValueSource(key) : null;
+    const localSource =
+      typeof command?.getOptionValueSource === "function" ? command.getOptionValueSource(key) : null;
+    const parentWasProvided = parentSource && parentSource !== "default";
+    const localIsOnlyDefault = localSource === "default" || localOptions[key] === undefined;
+    if (parentWasProvided && localIsOnlyDefault) {
+      merged[key] = value;
+    }
+  }
+
+  return merged;
+}

package/src/commands/audit.js

@@ -10,6 +10,7 @@ import { loadAuditRegistry, selectAuditAgents } from "../audit/registry.js";
 import { resolveOutputRoot } from "../config/service.js";
 import { createAgentEvent } from "../events/schema.js";
 import { createAuditSessionReporter, resolveAuditSessionId } from "../session/audit-reporter.js";
+import { resolveActionOptions } from "./action-options.js";
 import { buildLegacyArgs } from "./legacy-args.js";
 
 function shouldEmitJson(options, command) {
@@ -213,16 +214,17 @@ export function registerAuditCommand(program, invokeLegacy) {
     .option("--output-dir <path>", "Optional artifact output root override")
     .option("--json", "Emit machine-readable output")
     .action(async (options, command) => {
-      const emitJson = shouldEmitJson(options, command);
-      const targetPath = path.resolve(process.cwd(), String(options.path || "."));
+      const actionOptions = resolveActionOptions(options, command);
+      const emitJson = shouldEmitJson(actionOptions, command);
+      const targetPath = path.resolve(process.cwd(), String(actionOptions.path || "."));
       const outputRoot = await resolveOutputRoot({
         cwd: targetPath,
-        outputDirOverride: options.outputDir,
+        outputDirOverride: actionOptions.outputDir,
         env: process.env,
       });
       const runDirectory = await resolveAuditRunDirectory({
         outputRoot,
-        runId: options.runId,
+        runId: actionOptions.runId,
       });
       const { report } = await loadAuditRunReport(runDirectory);
       const ddPackage = await writeDdPackage({
@@ -264,11 +266,12 @@ export function registerAuditCommand(program, invokeLegacy) {
     .option("--refresh", "Refresh CODEBASE_INGEST before replay")
     .option("--json", "Emit machine-readable output")
     .action(async (runId, options, command) => {
-      const emitJson = shouldEmitJson(options, command);
-      const initialTargetPath = path.resolve(process.cwd(), String(options.path || "."));
+      const actionOptions = resolveActionOptions(options, command);
+      const emitJson = shouldEmitJson(actionOptions, command);
+      const initialTargetPath = path.resolve(process.cwd(), String(actionOptions.path || "."));
       const outputRoot = await resolveOutputRoot({
         cwd: initialTargetPath,
-        outputDirOverride: options.outputDir,
+        outputDirOverride: actionOptions.outputDir,
         env: process.env,
       });
       const baseRunDirectory = await resolveAuditRunDirectory({
@@ -276,12 +279,12 @@ export function registerAuditCommand(program, invokeLegacy) {
         runId,
       });
       const { report: baseReport } = await loadAuditRunReport(baseRunDirectory);
-      const targetPath = options.path
-        ? path.resolve(process.cwd(), String(options.path || "."))
+      const targetPath = actionOptions.path
+        ? path.resolve(process.cwd(), String(actionOptions.path || "."))
         : path.resolve(String(baseReport.targetPath || "."));
 
       const registry = await loadAuditRegistry({
-        registryFile: options.registryFile,
+        registryFile: actionOptions.registryFile,
       });
       const selected = selectAuditAgents(registry.agents, (baseReport.selectedAgents || []).join(","));
       if (selected.selected.length === 0) {
@@ -292,9 +295,9 @@ export function registerAuditCommand(program, invokeLegacy) {
         targetPath,
         agents: selected.selected,
         maxParallel: Number(baseReport.maxParallel || 1),
-        outputDir: options.outputDir,
+        outputDir: actionOptions.outputDir,
         dryRun: Boolean(baseReport.dryRun),
-        refreshIngest: Boolean(options.refresh),
+        refreshIngest: Boolean(actionOptions.refresh),
         isolation: baseReport.isolation || "strict",
         seedFromDeterministic: baseReport.seedFromDeterministic !== false,
       });
@@ -341,11 +344,12 @@ export function registerAuditCommand(program, invokeLegacy) {
     .option("--output-dir <path>", "Optional artifact output root override")
     .option("--json", "Emit machine-readable output")
     .action(async (baseRunId, candidateRunId, options, command) => {
-      const emitJson = shouldEmitJson(options, command);
-      const targetPath = path.resolve(process.cwd(), String(options.path || "."));
+      const actionOptions = resolveActionOptions(options, command);
+      const emitJson = shouldEmitJson(actionOptions, command);
+      const targetPath = path.resolve(process.cwd(), String(actionOptions.path || "."));
       const outputRoot = await resolveOutputRoot({
         cwd: targetPath,
-        outputDirOverride: options.outputDir,
+        outputDirOverride: actionOptions.outputDir,
         env: process.env,
       });
       const baseRunDirectory = await resolveAuditRunDirectory({
@@ -388,9 +392,10 @@ export function registerAuditCommand(program, invokeLegacy) {
     .option("--registry-file <path>", "Optional custom audit registry file")
     .option("--json", "Emit machine-readable output")
     .action(async (options, command) => {
-      const emitJson = shouldEmitJson(options, command);
+      const actionOptions = resolveActionOptions(options, command);
+      const emitJson = shouldEmitJson(actionOptions, command);
       const registry = await loadAuditRegistry({
-        registryFile: options.registryFile,
+        registryFile: actionOptions.registryFile,
       });
       const payload = {
         command: "audit registry",
@@ -422,10 +427,11 @@ export function registerAuditCommand(program, invokeLegacy) {
     .option("--dry-run", "Skip deterministic baseline and run security planning only")
     .option("--json", "Emit machine-readable output")
     .action(async (options, command) => {
-      const emitJson = shouldEmitJson(options, command);
-      const targetPath = path.resolve(process.cwd(), String(options.path || "."));
+      const actionOptions = resolveActionOptions(options, command);
+      const emitJson = shouldEmitJson(actionOptions, command);
+      const targetPath = path.resolve(process.cwd(), String(actionOptions.path || "."));
       const registry = await loadAuditRegistry({
-        registryFile: options.registryFile,
+        registryFile: actionOptions.registryFile,
       });
       const selected = selectAuditAgents(registry.agents, "security");
       if (selected.selected.length !== 1) {
@@ -436,9 +442,9 @@ export function registerAuditCommand(program, invokeLegacy) {
         targetPath,
         agents: selected.selected,
         maxParallel: 1,
-        outputDir: options.outputDir,
-        dryRun: Boolean(options.dryRun),
-        refreshIngest: Boolean(options.refresh),
+        outputDir: actionOptions.outputDir,
+        dryRun: Boolean(actionOptions.dryRun),
+        refreshIngest: Boolean(actionOptions.refresh),
       });
       const securityAgent = result.agentResults.find((agent) => agent.agentId === "security") || null;
 
@@ -486,10 +492,11 @@ export function registerAuditCommand(program, invokeLegacy) {
     .option("--dry-run", "Skip deterministic baseline and run architecture planning only")
     .option("--json", "Emit machine-readable output")
     .action(async (options, command) => {
-      const emitJson = shouldEmitJson(options, command);
-      const targetPath = path.resolve(process.cwd(), String(options.path || "."));
+      const actionOptions = resolveActionOptions(options, command);
+      const emitJson = shouldEmitJson(actionOptions, command);
+      const targetPath = path.resolve(process.cwd(), String(actionOptions.path || "."));
       const registry = await loadAuditRegistry({
-        registryFile: options.registryFile,
+        registryFile: actionOptions.registryFile,
       });
       const selected = selectAuditAgents(registry.agents, "architecture");
       if (selected.selected.length !== 1) {
@@ -500,9 +507,9 @@ export function registerAuditCommand(program, invokeLegacy) {
         targetPath,
         agents: selected.selected,
         maxParallel: 1,
-        outputDir: options.outputDir,
-        dryRun: Boolean(options.dryRun),
-        refreshIngest: Boolean(options.refresh),
+        outputDir: actionOptions.outputDir,
+        dryRun: Boolean(actionOptions.dryRun),
+        refreshIngest: Boolean(actionOptions.refresh),
       });
       const architectureAgent =
         result.agentResults.find((agent) => agent.agentId === "architecture") || null;
@@ -551,10 +558,11 @@ export function registerAuditCommand(program, invokeLegacy) {
     .option("--dry-run", "Skip deterministic baseline and run testing planning only")
     .option("--json", "Emit machine-readable output")
     .action(async (options, command) => {
-      const emitJson = shouldEmitJson(options, command);
-      const targetPath = path.resolve(process.cwd(), String(options.path || "."));
+      const actionOptions = resolveActionOptions(options, command);
+      const emitJson = shouldEmitJson(actionOptions, command);
+      const targetPath = path.resolve(process.cwd(), String(actionOptions.path || "."));
       const registry = await loadAuditRegistry({
-        registryFile: options.registryFile,
+        registryFile: actionOptions.registryFile,
       });
       const selected = selectAuditAgents(registry.agents, "testing");
       if (selected.selected.length !== 1) {
@@ -565,9 +573,9 @@ export function registerAuditCommand(program, invokeLegacy) {
         targetPath,
         agents: selected.selected,
         maxParallel: 1,
-        outputDir: options.outputDir,
-        dryRun: Boolean(options.dryRun),
-        refreshIngest: Boolean(options.refresh),
+        outputDir: actionOptions.outputDir,
+        dryRun: Boolean(actionOptions.dryRun),
+        refreshIngest: Boolean(actionOptions.refresh),
       });
       const testingAgent = result.agentResults.find((agent) => agent.agentId === "testing") || null;
 
@@ -615,10 +623,11 @@ export function registerAuditCommand(program, invokeLegacy) {
     .option("--dry-run", "Skip deterministic baseline and run performance planning only")
     .option("--json", "Emit machine-readable output")
     .action(async (options, command) => {
-      const emitJson = shouldEmitJson(options, command);
-      const targetPath = path.resolve(process.cwd(), String(options.path || "."));
+      const actionOptions = resolveActionOptions(options, command);
+      const emitJson = shouldEmitJson(actionOptions, command);
+      const targetPath = path.resolve(process.cwd(), String(actionOptions.path || "."));
       const registry = await loadAuditRegistry({
-        registryFile: options.registryFile,
+        registryFile: actionOptions.registryFile,
       });
       const selected = selectAuditAgents(registry.agents, "performance");
       if (selected.selected.length !== 1) {
@@ -629,9 +638,9 @@ export function registerAuditCommand(program, invokeLegacy) {
         targetPath,
         agents: selected.selected,
         maxParallel: 1,
-        outputDir: options.outputDir,
-        dryRun: Boolean(options.dryRun),
-        refreshIngest: Boolean(options.refresh),
+        outputDir: actionOptions.outputDir,
+        dryRun: Boolean(actionOptions.dryRun),
+        refreshIngest: Boolean(actionOptions.refresh),
       });
       const performanceAgent =
         result.agentResults.find((agent) => agent.agentId === "performance") || null;
@@ -680,10 +689,11 @@ export function registerAuditCommand(program, invokeLegacy) {
     .option("--dry-run", "Skip deterministic baseline and run compliance planning only")
     .option("--json", "Emit machine-readable output")
     .action(async (options, command) => {
-      const emitJson = shouldEmitJson(options, command);
-      const targetPath = path.resolve(process.cwd(), String(options.path || "."));
+      const actionOptions = resolveActionOptions(options, command);
+      const emitJson = shouldEmitJson(actionOptions, command);
+      const targetPath = path.resolve(process.cwd(), String(actionOptions.path || "."));
       const registry = await loadAuditRegistry({
-        registryFile: options.registryFile,
+        registryFile: actionOptions.registryFile,
       });
       const selected = selectAuditAgents(registry.agents, "compliance");
       if (selected.selected.length !== 1) {
@@ -694,9 +704,9 @@ export function registerAuditCommand(program, invokeLegacy) {
         targetPath,
         agents: selected.selected,
         maxParallel: 1,
-        outputDir: options.outputDir,
-        dryRun: Boolean(options.dryRun),
-        refreshIngest: Boolean(options.refresh),
+        outputDir: actionOptions.outputDir,
+        dryRun: Boolean(actionOptions.dryRun),
+        refreshIngest: Boolean(actionOptions.refresh),
       });
       const complianceAgent =
         result.agentResults.find((agent) => agent.agentId === "compliance") || null;
@@ -745,10 +755,11 @@ export function registerAuditCommand(program, invokeLegacy) {
     .option("--dry-run", "Skip deterministic baseline and run documentation planning only")
     .option("--json", "Emit machine-readable output")
     .action(async (options, command) => {
-      const emitJson = shouldEmitJson(options, command);
-      const targetPath = path.resolve(process.cwd(), String(options.path || "."));
+      const actionOptions = resolveActionOptions(options, command);
+      const emitJson = shouldEmitJson(actionOptions, command);
+      const targetPath = path.resolve(process.cwd(), String(actionOptions.path || "."));
       const registry = await loadAuditRegistry({
-        registryFile: options.registryFile,
+        registryFile: actionOptions.registryFile,
       });
       const selected = selectAuditAgents(registry.agents, "documentation");
       if (selected.selected.length !== 1) {
@@ -759,9 +770,9 @@ export function registerAuditCommand(program, invokeLegacy) {
         targetPath,
         agents: selected.selected,
         maxParallel: 1,
-        outputDir: options.outputDir,
-        dryRun: Boolean(options.dryRun),
-        refreshIngest: Boolean(options.refresh),
+        outputDir: actionOptions.outputDir,
+        dryRun: Boolean(actionOptions.dryRun),
+        refreshIngest: Boolean(actionOptions.refresh),
       });
       const documentationAgent =
         result.agentResults.find((agent) => agent.agentId === "documentation") || null;
@@ -808,8 +819,9 @@ export function registerAuditCommand(program, invokeLegacy) {
     .option("--reuse-omargate <runId>", "Reuse deterministic findings from an OmarGate run id or latest")
     .option("--json", "Emit machine-readable output")
     .action(async (options, command) => {
+      const actionOptions = resolveActionOptions(options, command);
       const legacyArgs = buildLegacyArgs(["/audit"], {
-        commandOptions: options,
+        commandOptions: actionOptions,
         command,
       });
       await invokeLegacy(legacyArgs);
@@ -848,9 +860,10 @@ export function registerAuditCommand(program, invokeLegacy) {
     .option("--output-dir <path>", "Artifact output root override")
     .option("--json", "Emit machine-readable final output")
     .action(async (options, command) => {
-      const emitJson = shouldEmitJson(options, command);
-      const emitStream = Boolean(options.stream);
-      const targetPath = path.resolve(process.cwd(), String(options.path || "."));
+      const actionOptions = resolveActionOptions(options, command);
+      const emitJson = shouldEmitJson(actionOptions, command);
+      const emitStream = Boolean(actionOptions.stream);
+      const targetPath = path.resolve(process.cwd(), String(actionOptions.path || "."));
 
       // Lazy-load modules
       const { julesAuditLoop } = await import("../agents/jules/loop.js");
@@ -861,7 +874,7 @@ export function registerAuditCommand(program, invokeLegacy) {
       const { runDeterministicReviewPipeline } = await import("../review/local-review.js");
       const fsp = await import("node:fs/promises");
 
-      const outputRoot = await resolveOut({ targetPath, outputDir: options.outputDir });
+      const outputRoot = await resolveOut({ targetPath, outputDir: actionOptions.outputDir });
       const artifactDir = path.join(outputRoot, "reports", "jules-" + Date.now());
       await fsp.mkdir(artifactDir, { recursive: true });
 
@@ -876,7 +889,7 @@ export function registerAuditCommand(program, invokeLegacy) {
       try {
         ingest = await generateCodebaseIngest({
           rootPath: targetPath, outputDir: outputRoot,
-          refresh: Boolean(options.refresh),
+          refresh: Boolean(actionOptions.refresh),
         });
       } catch {
         ingest = await collectCodebaseIngest({ rootPath: targetPath });
@@ -887,7 +900,7 @@ export function registerAuditCommand(program, invokeLegacy) {
 
       // ── [2] OMAR BASELINE (blind — Jules won't see until reconciliation) ──
       let omarBaseline = null;
-      if (!options.skipBaseline) {
+      if (!actionOptions.skipBaseline) {
         emitProgress(onEvent, JULES_DEFINITION, "Running Omar 7-layer deterministic baseline...");
         try {
           omarBaseline = await runDeterministicReviewPipeline({
@@ -925,14 +938,14 @@ export function registerAuditCommand(program, invokeLegacy) {
 
       // ── [5] PROVIDER ──────────────────────────────────────────────
       const providerConfig = {};
-      if (options.provider) providerConfig.provider = options.provider;
-      if (options.model) providerConfig.model = options.model;
-      if (options.apiKey) providerConfig.apiKey = options.apiKey;
+      if (actionOptions.provider) providerConfig.provider = actionOptions.provider;
+      if (actionOptions.model) providerConfig.model = actionOptions.model;
+      if (actionOptions.apiKey) providerConfig.apiKey = actionOptions.apiKey;
 
       // ── [6] SYSTEM PROMPT (full production prompt) ─────────────────
       const { buildJulesProductionPrompt } = await import("../agents/jules/config/system-prompt.js");
       const systemPrompt = buildJulesProductionPrompt({
-        mode: options.mode,
+        mode: actionOptions.mode,
         framework: ingest?.frameworks?.[0] || "unknown",
         componentCount: ingest?.indexedFiles?.files?.filter(
           f => /\.(tsx|jsx|vue|svelte)$/.test(f.path || ""),
@@ -952,14 +965,14 @@ export function registerAuditCommand(program, invokeLegacy) {
         blackboard,
         memory: memoryIndex,
         budget: {
-          maxCostUsd: parseFloat(options.maxCost) || 5.0,
+          maxCostUsd: parseFloat(actionOptions.maxCost) || 5.0,
           maxOutputTokens: JULES_DEFINITION.budget.maxOutputTokens,
           maxRuntimeMs: JULES_DEFINITION.budget.maxRuntimeMs,
           maxToolCalls: JULES_DEFINITION.budget.maxToolCalls,
         },
         provider: providerConfig,
-        mode: options.mode,
-        maxTurns: parseInt(options.maxTurns) || 25,
+        mode: actionOptions.mode,
+        maxTurns: parseInt(actionOptions.maxTurns) || 25,
         onEvent,
       });
 
@@ -973,8 +986,8 @@ export function registerAuditCommand(program, invokeLegacy) {
 
       // ── [7.5] RUNTIME AUDIT (if --url provided or URL detected) ────
       let runtimeResult = null;
-      const runtimeUrl = options.url || null;
-      if (runtimeUrl || !options.skipRuntime) {
+      const runtimeUrl = actionOptions.url || null;
+      if (runtimeUrl || !actionOptions.skipRuntime) {
         emitProgress(onEvent, JULES_DEFINITION, "Checking for deployed URL...");
         try {
           const { runtimeAudit: runRT } = await import("../agents/jules/tools/runtime-audit.js");
@@ -1057,7 +1070,7 @@ export function registerAuditCommand(program, invokeLegacy) {
         command: "audit frontend",
         persona: JULES_DEFINITION.persona,
         targetPath,
-        mode: options.mode,
+        mode: actionOptions.mode,
         framework: ingest?.frameworks?.[0] || "unknown",
         findings: allFindings,
         summary: { total: allFindings.length, ...severityCounts, blocking: severityCounts.P0 > 0 || severityCounts.P1 > 0 },
@@ -1109,7 +1122,7 @@ export function registerAuditCommand(program, invokeLegacy) {
         const syncResult = await syncRunToDashboard({
           command: "audit frontend",
           persona: JULES_DEFINITION.persona,
-          mode: options.mode,
+          mode: actionOptions.mode,
           framework: ingest?.frameworks?.[0] || "unknown",
           summary: { total: allFindings.length, ...severityCounts, blocking: severityCounts.P0 > 0 || severityCounts.P1 > 0 },
           usage: report?.usage || {},

package/src/commands/review.js

@@ -25,6 +25,7 @@ import {
   writeReviewComparisonArtifact,
   writeReviewRunContext,
 } from "../review/replay.js";
+import { resolveActionOptions } from "./action-options.js";
 
 function shouldEmitJson(options, command) {
   const local = Boolean(options && options.json);
@@ -236,16 +237,17 @@ function registerVerdictCommand(review, verdict) {
     .option("--actor <id>", "Operator identifier for audit trail", "")
     .option("--json", "Emit machine-readable output")
     .action(async (findingId, options, command) => {
-      const emitJson = shouldEmitJson(options, command);
-      const targetPath = resolveTargetPath(".", options);
+      const actionOptions = resolveActionOptions(options, command);
+      const emitJson = shouldEmitJson(actionOptions, command);
+      const targetPath = resolveTargetPath(".", actionOptions);
       const result = await recordReviewDecision({
         targetPath,
-        runId: options.runId,
-        outputDir: options.outputDir,
+        runId: actionOptions.runId,
+        outputDir: actionOptions.outputDir,
         findingId,
         verdict,
-        note: options.note,
-        actor: options.actor,
+        note: actionOptions.note,
+        actor: actionOptions.actor,
         env: process.env,
       });
 
@@ -374,12 +376,13 @@ export function registerReviewCommand(program) {
     .option("--output-dir <path>", "Optional artifact output root override")
     .option("--json", "Emit machine-readable output")
     .action(async (options, command) => {
-      const emitJson = shouldEmitJson(options, command);
-      const targetPath = resolveTargetPath(".", options);
+      const actionOptions = resolveActionOptions(options, command);
+      const emitJson = shouldEmitJson(actionOptions, command);
+      const targetPath = resolveTargetPath(".", actionOptions);
       const loaded = await loadUnifiedReviewReport({
         targetPath,
-        runId: options.runId,
-        outputDir: options.outputDir,
+        runId: actionOptions.runId,
+        outputDir: actionOptions.outputDir,
         env: process.env,
       });
 
@@ -412,14 +415,15 @@ export function registerReviewCommand(program) {
     .option("--output-file <path>", "Optional custom export output path")
     .option("--json", "Emit machine-readable output")
     .action(async (options, command) => {
-      const emitJson = shouldEmitJson(options, command);
-      const targetPath = resolveTargetPath(".", options);
+      const actionOptions = resolveActionOptions(options, command);
+      const emitJson = shouldEmitJson(actionOptions, command);
+      const targetPath = resolveTargetPath(".", actionOptions);
       const exported = await exportUnifiedReviewReport({
         targetPath,
-        runId: options.runId,
-        outputDir: options.outputDir,
-        format: options.format,
-        outputFile: options.outputFile,
+        runId: actionOptions.runId,
+        outputDir: actionOptions.outputDir,
+        format: actionOptions.format,
+        outputFile: actionOptions.outputFile,
         env: process.env,
       });
 
@@ -453,12 +457,13 @@ export function registerReviewCommand(program) {
     .option("--ai-dry-run", "Force AI dry-run during replay")
     .option("--json", "Emit machine-readable output")
     .action(async (runId, options, command) => {
-      const emitJson = shouldEmitJson(options, command);
-      const lookupPath = resolveTargetPath(".", options);
+      const actionOptions = resolveActionOptions(options, command);
+      const emitJson = shouldEmitJson(actionOptions, command);
+      const lookupPath = resolveTargetPath(".", actionOptions);
       const source = await loadUnifiedReviewReport({
         targetPath: lookupPath,
         runId,
-        outputDir: options.outputDir,
+        outputDir: actionOptions.outputDir,
         env: process.env,
       });
 
@@ -470,20 +475,20 @@ export function registerReviewCommand(program) {
       }
 
       const invocation = sourceContext?.context?.invocation || {};
-      const replayTargetPath = options.path
-        ? resolveTargetPath(".", options)
+      const replayTargetPath = actionOptions.path
+        ? resolveTargetPath(".", actionOptions)
         : path.resolve(sourceContext?.context?.targetPath || source.report.targetPath || lookupPath);
-      const aiEnabled = options.noAi ? false : Boolean(invocation.aiEnabled);
+      const aiEnabled = actionOptions.noAi ? false : Boolean(invocation.aiEnabled);
 
       const replayOutcome = await executeReviewRun({
         targetPath: replayTargetPath,
         mode: sourceContext?.context?.mode || source.report.mode || "full",
-        outputDir: options.outputDir || invocation.outputDir || "",
-        specFile: options.spec || invocation.specFile || "",
-        refreshIngest: Boolean(options.refresh || invocation.refreshIngest),
+        outputDir: actionOptions.outputDir || invocation.outputDir || "",
+        specFile: actionOptions.spec || invocation.specFile || "",
+        refreshIngest: Boolean(actionOptions.refresh || invocation.refreshIngest),
         aiConfig: {
           enable: aiEnabled,
-          aiDryRun: Boolean(options.aiDryRun || invocation.aiDryRun),
+          aiDryRun: Boolean(actionOptions.aiDryRun || invocation.aiDryRun),
           provider: invocation.provider,
           model: invocation.model,
           sessionId: invocation.sessionId,
@@ -542,18 +547,19 @@ export function registerReviewCommand(program) {
     .option("--output-file <path>", "Optional custom output path for comparison JSON")
     .option("--json", "Emit machine-readable output")
     .action(async (baseRunId, candidateRunId, options, command) => {
-      const emitJson = shouldEmitJson(options, command);
-      const targetPath = resolveTargetPath(".", options);
+      const actionOptions = resolveActionOptions(options, command);
+      const emitJson = shouldEmitJson(actionOptions, command);
+      const targetPath = resolveTargetPath(".", actionOptions);
       const base = await loadUnifiedReviewReport({
         targetPath,
         runId: baseRunId,
-        outputDir: options.outputDir,
+        outputDir: actionOptions.outputDir,
         env: process.env,
       });
       const candidate = await loadUnifiedReviewReport({
         targetPath,
         runId: candidateRunId,
-        outputDir: options.outputDir,
+        outputDir: actionOptions.outputDir,
         env: process.env,
       });
 
@@ -566,8 +572,8 @@ export function registerReviewCommand(program) {
       });
 
       let outputPath = artifact.artifactPath;
-      if (options.outputFile) {
-        outputPath = path.resolve(targetPath, String(options.outputFile));
+      if (actionOptions.outputFile) {
+        outputPath = path.resolve(targetPath, String(actionOptions.outputFile));
         await fsp.mkdir(path.dirname(outputPath), { recursive: true });
         await fsp.writeFile(outputPath, `${JSON.stringify(artifact.payload, null, 2)}\n`, "utf-8");
       }
@@ -611,13 +617,14 @@ export function registerReviewCommand(program) {
     .option("--refresh", "Refresh CODEBASE_INGEST prior to compatibility scan")
     .option("--json", "Emit machine-readable output")
     .action(async (options, command) => {
-      const emitJson = shouldEmitJson(options, command);
-      const targetPath = resolveTargetPath(".", options);
+      const actionOptions = resolveActionOptions(options, command);
+      const emitJson = shouldEmitJson(actionOptions, command);
+      const targetPath = resolveTargetPath(".", actionOptions);
       let ingestRefresh = null;
-      if (options.refresh) {
+      if (actionOptions.refresh) {
         const ingestResolution = await resolveCodebaseIngest({
           rootPath: targetPath,
-          outputDir: options.outputDir,
+          outputDir: actionOptions.outputDir,
           refresh: true,
         });
         ingestRefresh = {
@@ -630,13 +637,13 @@ export function registerReviewCommand(program) {
           contentHash: ingestResolution.fingerprint?.contentHash || "",
         };
       }
-      const mode = resolveModeFromOptions(options, {
-        defaultMode: String(options.mode || "full").trim().toLowerCase() || "full",
+      const mode = resolveModeFromOptions(actionOptions, {
+        defaultMode: String(actionOptions.mode || "full").trim().toLowerCase() || "full",
       });
       const scan = await runLocalReviewScan({
         targetPath,
         mode,
-        specFile: options.spec,
+        specFile: actionOptions.spec,
       });
 
       const report = `# Local Review Scan
@@ -660,7 +667,7 @@ ${formatFindingsMarkdown(scan.findings)}
       const reportPath = await writeReviewReport({
         targetPath: scan.targetPath,
         mode: scan.mode,
-        outputDir: options.outputDir,
+        outputDir: actionOptions.outputDir,
         reportMarkdown: report,
       });