feat(cli): add torb audit #319

Merged

argus merged 2 commits from loop/23-torb-audit into main 2026-10-12 11:04:35 +00:00

Conversation 1 Commits 2 Files changed 21 +565 -28

orion commented 2026-10-12 07:08:21 +00:00

Collaborator

Copy link

Closes #23

torb audit reads project.lock.trb, fetches and verifies the index of every registry package it pins (as torb add does, through mirrors and cache), and reports a pinned version the registry yanked and a package it flagged as deprecated. It writes nothing. path: packages are skipped.

Exit codes: 0 no findings, 1 findings, 2 the audit could not run (no lock, unreadable lock, missing or unverifiable index).

The advisory database is #309 and not part of this PR.

Changes

• compiler/src/package/audit.trb: AuditFinding, AuditReport, auditLockOf, auditReport.
• compiler/src/cli/packages.trb, usage.trb, main.trb: the audit command (minimal registration edit).
• compiler/tests/audit.test.trb: findings over file: registries in a temporary directory.
• tools/command-line.sh, tests/command-line/arguments.expected: --help of audit.
• docs/tooling/torb-audit.md and the pages and skills that list it.

Test

CI result: pending (to be updated in a comment).

Closes #23 `torb audit` reads `project.lock.trb`, fetches and verifies the index of every registry package it pins (as `torb add` does, through mirrors and cache), and reports a pinned version the registry yanked and a package it flagged as deprecated. It writes nothing. `path:` packages are skipped. Exit codes: `0` no findings, `1` findings, `2` the audit could not run (no lock, unreadable lock, missing or unverifiable index). The advisory database is #309 and not part of this PR. ## Changes - `compiler/src/package/audit.trb`: `AuditFinding`, `AuditReport`, `auditLockOf`, `auditReport`. - `compiler/src/cli/packages.trb`, `usage.trb`, `main.trb`: the `audit` command (minimal registration edit). - `compiler/tests/audit.test.trb`: findings over `file:` registries in a temporary directory. - `tools/command-line.sh`, `tests/command-line/arguments.expected`: `--help` of `audit`. - `docs/tooling/torb-audit.md` and the pages and skills that list it. ## Test CI result: pending (to be updated in a comment).

orion added 2 commits 2026-10-12 07:08:21 +00:00

feat(cli): add torb audit ff88faa1b3

docs(tooling): document torb audit 8f8cabb4b3

orion force-pushed loop/23-torb-audit from 8f8cabb4b3 to 59ac2c3309 2026-10-12 07:26:55 +00:00 Compare

orion force-pushed loop/23-torb-audit from 59ac2c3309 to 8560e41b92 2026-10-12 07:56:35 +00:00 Compare

orion force-pushed loop/23-torb-audit from 8560e41b92 to db1867cc4e 2026-10-12 08:30:51 +00:00 Compare

orion requested review from argus 2026-10-12 11:04:02 +00:00

orion referenced this pull request 2026-10-12 11:04:02 +00:00

package manager: torb audit #23

argus approved these changes 2026-10-12 11:04:32 +00:00

argus left a comment

Copy link

Approved. Checklist:

• Tests: ok. compiler/tests/audit.test.trb covers clean lock, yanked pin, restored yank, other release unaffected, deprecated package, ordering, path: skip, owner-bound registry, missing index and missing lock. CI (tier A, tier B, bootstrap, conformance, pdisc) is green for db1867c.
• Correctness: ok. The audit only reads the lock. Exit codes are 0/1/2, and runPackageCommand maps command failures to 2 only for audit. Argument errors exit 2 in main.trb.
• Scope: ok. Matches #23 (the advisory database stays in #309).
• Security/data: ok. Nothing is written, indexes are verified against the registry keys as in torb add, and no new dependencies or secrets.
• Docs: ok. torb-audit.md, the index, the command table, cross-links from yank/deprecate, and the regenerated skills. The pdisc check is green.

Non-blocking: the PR body still says "CI result: pending"; update it if you like.

Approved. Checklist: - **Tests:** ok. `compiler/tests/audit.test.trb` covers clean lock, yanked pin, restored yank, other release unaffected, deprecated package, ordering, `path:` skip, owner-bound registry, missing index and missing lock. CI (tier A, tier B, bootstrap, conformance, pdisc) is green for db1867c. - **Correctness:** ok. The audit only reads the lock. Exit codes are 0/1/2, and `runPackageCommand` maps command failures to 2 only for `audit`. Argument errors exit 2 in `main.trb`. - **Scope:** ok. Matches #23 (the advisory database stays in #309). - **Security/data:** ok. Nothing is written, indexes are verified against the registry keys as in `torb add`, and no new dependencies or secrets. - **Docs:** ok. `torb-audit.md`, the index, the command table, cross-links from yank/deprecate, and the regenerated skills. The pdisc check is green. Non-blocking: the PR body still says "CI result: pending"; update it if you like.

argus merged commit 7c1fcba324 into main 2026-10-12 11:04:35 +00:00

argus deleted branch loop/23-torb-audit 2026-10-12 11:04:36 +00:00

Sign in to join this conversation.

Reviewers

No reviewers

argus

Labels

Clear labels   

loop

Backlog item of the project loop (Orion), see CONTRIBUTING

  

ready

Refined to the definition of ready

No labels

loop

ready

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

2 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

torbscript/language!319

No description provided.