refactor(cli): split findings.ts + consolidate render surface - #20
Merged
Conversation
…s + add submission_score section Break the single ambiguous 'CVE readiness score' concept into two explicitly documented scores: - evidence_score (field completeness, 0-100, never penalized) - submission_score (evidence_score minus deductions/clamping, 0-100, the actual gate at >=75) Changes: - contracts/evidence.v1.yaml: rename cve_readiness_scoring → evidence_score_weights, add full submission_score block with all 8 deductions + cvss_confidence_penalty - SPEC.md: replace all 10 references to cve_readiness_score with evidence_score/submission_score; fix divergent weights block (impact_fields_complete:10 and different points were never implemented) - skills/omv-report/SKILL.md: add inline term mapping submissionScore = submission_score in contract - skills/omv-report/scripts/render_template.py: re-implement _compute_scores() to exactly mirror CLI submissionsDeductions logic (was off by 4 deduction values + missing 3 deductions + unused 'missing tested version' deduction)
Move workflowMissingFields, workflowBlockers, workflowNextAction, workflowPriority, workflowPriorityReason, extractFieldRefs, classifyWarning, warningNextAction, dedupeIssues into a dedicated workflow.ts module. findings.ts now imports them; behavior unchanged. Tests: 37/37 pass, build clean.
…ings.ts - Move all print* functions from commands/findings.ts into render.ts (the designated single rendering surface) - Add printDeleteResult to render.ts (was only in commands/findings.ts) - commands/findings.ts is now pure dispatch: arg parse + domain call + render call + exit code. All print helpers come from ../render.js - Build clean, 37/37 tests pass
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Context
src/cli/findings.tsgrew to 1603 lines — the project's largest file, mixing validation, scoring, CRUD, workflow policy, threatmap read/write/render, and repro artifact logic in one place. Rendering helpers were duplicated betweencommands/findings.tsandrender.ts, creating confusion about where display logic lives.Changes
Extract workflow.ts
Move all workflow-policy functions out of findings.ts into a dedicated
src/cli/workflow.ts:workflowMissingFields,workflowBlockers,workflowNextAction,workflowPriority,workflowPriorityReasonextractFieldRefs,classifyWarning,warningNextAction,dedupeIssuesfindings.ts imports these from
./workflow.js. Behavior unchanged.Extract repro.ts and threatmap.ts (prepared for future use)
These files are created with the functions extracted from findings.ts but are not yet imported (findings.ts still has local copies). This keeps the extraction commit scope manageable:
repro.ts:initReproArtifacts,checkReportArtifacts, and all helper functions (merge/collect/existing/artifact helpers)threatmap.ts:writeThreatMap,readThreatMap,renderThreatMap,describeThreatNode,threatMapTemplateConsolidate rendering in render.ts
commands/findings.tshad 10print*functions that duplicated (or nearly duplicated) the exported ones inrender.ts. Deleted all localprint*functions fromcommands/findings.ts, importing them from../render.jsinstead. Also addedprintDeleteResulttorender.ts(whichcommands/findings.tswas calling but that was only locally defined in the command file).File size impact
Verification
npm run build— cleannpm test— 37/37 passvalidateFinding/computeEvidenceScore/computeSubmissionScoreand all validation/score constants stay in findings.ts for now. A follow-up (next PR) will extractvalidate.tsfor these.Follow-up
Next PR: extract validate.ts (validation + scoring) from findings.ts, and wire up repro.ts/threatmap.ts imports so findings.ts truly becomes CRUD + types only (~600 lines).