audit: bulk project audit + lockfile-keyed scan cache - #32
Open
superbiche wants to merge 1 commit into
Open
Conversation
superbiche
force-pushed
the
feat/mise-gating
branch
2 times, most recently
from
August 1, 2026 00:46
52f5892 to
5da3126
Compare
`safe install` with no package spec and a manifest in cwd (or with the new `--project` flag) bulk-audits the project's dependency evidence instead of printing usage. It runs `safe audit scan --deps-only --project .`, prints a one-screen summary (manifests, package count, findings by severity, verdict, top critical/high findings with package + advisory id) and audits only — no package manager is ever run. Critical findings refuse 104 even under --yes; WARN prompts interactively and refuses 102 non-interactively; a clean verdict exits 0 quietly. A failed scan or a missing result document fails closed with 100 rather than reporting a clean project. A --deps-only scan now reuses its recorded result when the dependency evidence (lockfiles + manifests) hashes to a set already scanned within 24h, printing `[safe audit] scan cache hit (<age>)` with the same verdict and exit code instead of re-running the scanners. Keyed on machine, target, mode, and each evidence file's own hash, so touching any of them forces a real scan. `--no-cache` bypasses; SAFE_AUDIT_SCAN_CACHE_TTL_SECONDS overrides the TTL. The cache can only skip work, never invent a verdict: missing, expired, corrupt, or unrecognizable entries fall through to a real scan, evidence-free scans are never cached, and source/--full scans are excluded entirely. The wrapper project-scan preflight passes --deps-only so bare installs hit the cached path. Tests: new tests/audit/scan_cache.sh (10 cases, hermetic scanner stubs asserting the scanners do not re-run on a hit and that every doubt falls through to a real scan); dispatcher gains project-mode coverage (clean/WARN/critical/--yes/--project, fail-closed paths, and that a named spec still takes the spec path). Claude-Session: https://claude.ai/code/session_01Rk1wZEXbFB23TamMZYuRi6
superbiche
force-pushed
the
feat/bulk-audit
branch
from
August 1, 2026 00:49
b28b23b to
84db190
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on #31. Part 4 of the safe overhaul.
safe installproject mode (auto when no specs + a manifest is present, or explicit--project): runssafe audit scan --deps-only --project ., prints a one-screen verdict summary, TTY-confirms (non-TTY: exit 0 when clean, 102 when confirmation is needed); critical findings exit 104 and--yescannot accept them. Fresh clones finally have a first-class pre-install audit entrypoint in every shell.--deps-onlyscan results cache under the audit data dir keyed by machine + target + scan mode + dependency-evidence sha256, 24h TTL,--no-cachebypass, fail-open to a real scan on any cache problem. Cold scan 45.4s → warm 0.46s on a real toolchain (~100×), which is what makes the wrapper preflight viable.--deps-only— deliberate narrowing called out for the record: barenpm ci/pnpm installpreflights no longer run the first-party source-risk scan (that stays insafe audit scan --project .and machine scans). This is what the approved overhaul plan specified; the trade is preflight latency users will actually keep enabled.Suites: install 79/79, new scan-cache suite 10/10, dispatcher 16/16, version-aware audit 50/50, smoke/external-binary/safe-run integration all green.
Implemented by a subagent from a scoped brief; verified and integrated by the orchestrating session.
@superbiche · maintainer · drafted with Claude Fable 5.
https://claude.ai/code/session_01Rk1wZEXbFB23TamMZYuRi6