Move the code and terraform audits into the reviews plugin

Copy the standalone code-review and terraform-review skills into
plugins/reviews as audit-code and audit-terraform. The rename separates the
automated, linter-driven audits from the guided review-pr walkthrough that
already lived here.

Resolve bundled script paths through ${SKILL_DIR}, exported in a new step 0.
CLAUDE_PLUGIN_ROOT is not set in the Bash tool environment, so the obvious
substitution would have expanded to nothing and broken every collection
script invocation.

Replace the PLAN and DESIGN docs with READMEs written from the current
SKILL.md and scripts. The old docs had drifted badly: they named semgrep
where the code calls opengrep, scoped five review agents where there are
now eight, and predated Lua, PowerShell, and GitHub Actions support.

Add CONSISTENCY_NORMS to the audit-terraform agent inputs. The collection
script writes consistency_norms.json and the agent prompt declares it, but
SKILL.md never listed it, leaving the variable unsubstituted.

Drop the --ingest-verdicts instruction from both skills. review_stats.py
parses no arguments, so the ref-mode verdict template it told users to feed
back could never be read.

Point audit-terraform's smoke test at README.md and resolve its fixture
paths relative to the test file rather than an absolute home directory.

Tests: 197 passing (audit-code), 106 passing (audit-terraform).

plugins/reviews/skills/audit-code/scripts/collect-findings.py

@@ -0,0 +1,464 @@
+"""collect-findings.py — produce a audit-code manifest.json."""
+from __future__ import annotations
+
+import argparse
+import glob
+import json
+import subprocess
+import sys
+from collections import Counter
+from pathlib import Path
+
+_HERE = Path(__file__).resolve().parent
+if str(_HERE.parent) not in sys.path:
+    sys.path.insert(0, str(_HERE.parent))
+
+from scripts.adapters import (
+    bandit as ad_bandit,
+    ruff as ad_ruff,
+    ruff_idiom as ad_ruff_idiom,
+    mypy as ad_mypy,
+    eslint as ad_eslint,
+    tsc as ad_tsc,
+    opengrep as ad_opengrep,
+    gitleaks as ad_gitleaks,
+    pip_audit as ad_pip_audit,
+    osv_scanner as ad_osv,
+    dotnet as ad_dotnet,
+    vulture as ad_vulture,
+    radon as ad_radon,
+    interrogate as ad_interrogate,
+    lizard as ad_lizard,
+    knip as ad_knip,
+    jscpd as ad_jscpd,
+    selene as ad_selene,
+    luac as ad_luac,
+    psscriptanalyzer as ad_pssa,
+    actionlint as ad_actionlint,
+    zizmor as ad_zizmor,
+)
+from scripts.diff_filter import filter_findings_by_diff
+from scripts.git_diff import (
+    changed_files_with_ranges, resolve_base_ref, resolve_default_branch,
+)
+from scripts.language_detect import (
+    detect_language, is_dep_manifest, is_gha_file, is_supported_source,
+    known_unsupported_language,
+)
+from scripts.manifest import (
+    ChangedFile, Finding, LanguageBreakdown, Manifest,
+    PackageDiff, ToolStat,
+)
+from scripts.package_diff import diff_package_json, diff_requirements_txt
+from scripts.runner import run_tool, tool_available
+from scripts.slicing import slice_for_agent
+
+
+def _git_show(repo: str, ref: str, path: str) -> str:
+    """Return file content at `ref`, or empty string if not present (e.g. new file)."""
+    r = subprocess.run(
+        ["git", "-C", repo, "show", f"{ref}:{path}"],
+        capture_output=True, text=True, check=False,
+    )
+    return r.stdout if r.returncode == 0 else ""
+
+
+def _build_package_diffs(
+    repo: str, base: str, dep_manifest_paths: list[str],
+) -> dict[str, PackageDiff]:
+    diffs: dict[str, PackageDiff] = {
+        "python": PackageDiff(),
+        "javascript": PackageDiff(),
+        "csharp": PackageDiff(),
+    }
+    for path in dep_manifest_paths:
+        name = Path(path).name
+        before = _git_show(repo, base, path)
+        after_path = Path(repo) / path
+        after = after_path.read_text() if after_path.is_file() else ""
+        if name.endswith(".txt") and "requirements" in name:
+            pd = diff_requirements_txt(before, after)
+            _merge_package_diff(diffs["python"], pd)
+        elif name == "package.json":
+            pd = diff_package_json(before, after)
+            _merge_package_diff(diffs["javascript"], pd)
+    return diffs
+
+
+def _merge_package_diff(into: PackageDiff, src: PackageDiff) -> None:
+    into.added.extend(src.added)
+    into.removed.extend(src.removed)
+    into.upgraded.extend(src.upgraded)
+
+
+def _build_breakdown(changed_files: list[ChangedFile], skipped: list[str]) -> LanguageBreakdown:
+    n = Counter(cf.language for cf in changed_files)
+    return LanguageBreakdown(
+        python=n["python"], javascript=n["javascript"], typescript=n["typescript"],
+        csharp=n["csharp"], lua=n["lua"], powershell=n["powershell"],
+        github_actions=n["github-actions"], skipped_files=skipped,
+    )
+
+
+def _run_python_tools(repo: str) -> tuple[list[Finding], dict[str, ToolStat]]:
+    findings: list[Finding] = []
+    stats: dict[str, ToolStat] = {}
+    for binary, args, adapter in [
+        ("bandit", ["bandit", "-r", ".", "-f", "json", "-q"], ad_bandit.parse_bandit_output),
+        ("ruff", ["ruff", "check", "--output-format=json", "."], ad_ruff.parse_ruff_output),
+        ("ruff-idiom", [
+            "ruff", "check",
+            "--select", "SIM,PERF,UP,RET,PLR,C90,B",
+            "--output-format=json",
+            "--isolated",
+            ".",
+        ], ad_ruff_idiom.parse_ruff_idiom_output),
+        ("mypy", ["mypy", "."], ad_mypy.parse_mypy_output),
+    ]:
+        if not tool_available(binary):
+            stats[binary] = ToolStat(ran=False, reason="not on PATH")
+            continue
+        r = run_tool(args, cwd=repo)
+        parsed = adapter(r.stdout)
+        stats[binary] = ToolStat(ran=True, pre_filter=len(parsed), post_filter=0)
+        findings.extend(parsed)
+    return findings, stats
+
+
+def _run_js_tools(repo: str) -> tuple[list[Finding], dict[str, ToolStat]]:
+    findings: list[Finding] = []
+    stats: dict[str, ToolStat] = {}
+    if tool_available("eslint"):
+        r = run_tool(["eslint", ".", "-f", "json"], cwd=repo)
+        parsed = ad_eslint.parse_eslint_output(r.stdout, repo_root=repo)
+        stats["eslint"] = ToolStat(ran=True, pre_filter=len(parsed))
+        findings.extend(parsed)
+    else:
+        stats["eslint"] = ToolStat(ran=False, reason="not on PATH")
+    if tool_available("tsc"):
+        r = run_tool(["tsc", "--noEmit"], cwd=repo)
+        parsed = ad_tsc.parse_tsc_output(r.stdout)
+        stats["tsc"] = ToolStat(ran=True, pre_filter=len(parsed))
+        findings.extend(parsed)
+    else:
+        stats["tsc"] = ToolStat(ran=False, reason="not on PATH")
+    return findings, stats
+
+
+def _run_dotnet_tools(repo: str) -> tuple[list[Finding], dict[str, ToolStat]]:
+    findings: list[Finding] = []
+    stats: dict[str, ToolStat] = {}
+    if tool_available("dotnet"):
+        r = run_tool(["dotnet", "build", "--no-incremental"], cwd=repo)
+        parsed = ad_dotnet.parse_dotnet_build_output(r.stdout, repo_root=repo)
+        stats["dotnet"] = ToolStat(ran=True, pre_filter=len(parsed))
+        findings.extend(parsed)
+    else:
+        stats["dotnet"] = ToolStat(ran=False, reason="not on PATH")
+    return findings, stats
+
+
+def _run_lua_tools(repo: str) -> tuple[list[Finding], dict[str, ToolStat]]:
+    findings: list[Finding] = []
+    stats: dict[str, ToolStat] = {}
+    if tool_available("selene"):
+        r = run_tool(["selene", "--display-style=json", "."], cwd=repo)
+        parsed = ad_selene.parse_selene_output(r.stdout)
+        stats["selene"] = ToolStat(ran=True, pre_filter=len(parsed), post_filter=0)
+        findings.extend(parsed)
+    else:
+        stats["selene"] = ToolStat(ran=False, reason="not on PATH")
+    if tool_available("luac"):
+        lua_files = sorted(glob.glob(f"{repo}/**/*.lua", recursive=True))
+        combined_stderr = ""
+        for lua_file in lua_files:
+            r = run_tool(["luac", "-p", lua_file], cwd=repo)
+            if r.stderr:
+                combined_stderr += r.stderr
+        parsed = ad_luac.parse_luac_output(combined_stderr, repo_root=repo)
+        stats["luac"] = ToolStat(ran=True, pre_filter=len(parsed), post_filter=0)
+        findings.extend(parsed)
+    else:
+        stats["luac"] = ToolStat(ran=False, reason="not on PATH")
+    return findings, stats
+
+
+_PSSA_PROJECT = (
+    " | Select-Object RuleName,"
+    "@{n='Severity';e={$_.Severity.ToString()}},"
+    "ScriptPath,"
+    "@{n='Line';e={$_.Extent.StartLineNumber}},"
+    "@{n='EndLine';e={$_.Extent.EndLineNumber}},"
+    "Message | ConvertTo-Json -Depth 3 -AsArray"
+)
+
+_PSSA_COMMAND = "Invoke-ScriptAnalyzer -Path . -Recurse -ErrorAction SilentlyContinue"
+
+_INJECTION_HUNTER_COMMAND = (
+    "$m = (Get-Module -ListAvailable -Name InjectionHunter | Select-Object -First 1).Path; "
+    "Invoke-ScriptAnalyzer -Path . -Recurse -CustomRulePath $m -ErrorAction SilentlyContinue"
+)
+
+
+def _pwsh_module_available(repo: str, module: str) -> bool:
+    r = run_tool(
+        ["pwsh", "-NoProfile", "-NonInteractive", "-Command",
+         f"if (Get-Module -ListAvailable -Name {module}) {{ exit 0 }} else {{ exit 1 }}"],
+        cwd=repo,
+    )
+    return r.ran and r.exit_code == 0
+
+
+def _run_powershell_tools(repo: str) -> tuple[list[Finding], dict[str, ToolStat]]:
+    findings: list[Finding] = []
+    stats: dict[str, ToolStat] = {}
+    if not tool_available("pwsh"):
+        for name in ("psscriptanalyzer", "injectionhunter"):
+            stats[name] = ToolStat(ran=False, reason="pwsh not on PATH")
+        return findings, stats
+    for tool, module, command in [
+        ("psscriptanalyzer", "PSScriptAnalyzer", _PSSA_COMMAND),
+        ("injectionhunter", "InjectionHunter", _INJECTION_HUNTER_COMMAND),
+    ]:
+        if not _pwsh_module_available(repo, module):
+            stats[tool] = ToolStat(ran=False, reason=f"{module} module not installed")
+            continue
+        r = run_tool(
+            ["pwsh", "-NoProfile", "-NonInteractive", "-Command", command + _PSSA_PROJECT],
+            cwd=repo,
+        )
+        parsed = ad_pssa.parse_psscriptanalyzer_output(r.stdout, repo_root=repo, tool=tool)
+        stats[tool] = ToolStat(ran=True, pre_filter=len(parsed), post_filter=0)
+        findings.extend(parsed)
+    return findings, stats
+
+
+def _run_gha_tools(repo: str) -> tuple[list[Finding], dict[str, ToolStat]]:
+    findings: list[Finding] = []
+    stats: dict[str, ToolStat] = {}
+    if tool_available("actionlint"):
+        r = run_tool(["actionlint", "-format", "{{json .}}", ".github/"], cwd=repo)
+        parsed = ad_actionlint.parse_actionlint_output(r.stdout)
+        stats["actionlint"] = ToolStat(ran=True, pre_filter=len(parsed), post_filter=0)
+        findings.extend(parsed)
+    else:
+        stats["actionlint"] = ToolStat(ran=False, reason="not on PATH")
+    if tool_available("zizmor"):
+        r = run_tool(["zizmor", "--format", "sarif", ".github/"], cwd=repo)
+        parsed = ad_zizmor.parse_zizmor_output(r.stdout)
+        stats["zizmor"] = ToolStat(ran=True, pre_filter=len(parsed), post_filter=0)
+        findings.extend(parsed)
+    else:
+        stats["zizmor"] = ToolStat(ran=False, reason="not on PATH")
+    return findings, stats
+
+
+def _run_polyglot_tools(repo: str) -> tuple[list[Finding], dict[str, ToolStat]]:
+    findings: list[Finding] = []
+    stats: dict[str, ToolStat] = {}
+    if tool_available("opengrep"):
+        lua_rules = _HERE / "rules" / "lua-security.yaml"
+        r = run_tool(
+            ["opengrep", "--config=auto", f"--config={lua_rules}", "--json", "--quiet"],
+            cwd=repo,
+        )
+        parsed = ad_opengrep.parse_opengrep_output(r.stdout)
+        stats["opengrep"] = ToolStat(ran=True, pre_filter=len(parsed))
+        findings.extend(parsed)
+    else:
+        stats["opengrep"] = ToolStat(ran=False, reason="not on PATH")
+    if tool_available("gitleaks"):
+        r = run_tool(["gitleaks", "detect", "--report-format=json", "--report-path=/dev/stdout", "--no-banner"], cwd=repo)
+        parsed = ad_gitleaks.parse_gitleaks_output(r.stdout)
+        stats["gitleaks"] = ToolStat(ran=True, pre_filter=len(parsed))
+        findings.extend(parsed)
+    else:
+        stats["gitleaks"] = ToolStat(ran=False, reason="not on PATH")
+    return findings, stats
+
+
+def _run_maintainability_tools(
+    repo: str, languages_present: set[str]
+) -> tuple[list[Finding], dict[str, ToolStat]]:
+    findings: list[Finding] = []
+    stats: dict[str, ToolStat] = {}
+    is_python = "python" in languages_present
+    is_js = "javascript" in languages_present or "typescript" in languages_present
+    for binary, args, adapter, should_run in [
+        ("vulture", ["vulture", "."], ad_vulture.parse_vulture_output, is_python),
+        ("radon", ["radon", "cc", "-j", "."], ad_radon.parse_radon_output, is_python),
+        ("interrogate", ["interrogate", "--quiet", "--output-format=json", "."], ad_interrogate.parse_interrogate_output, is_python),
+        ("lizard", ["lizard", "--csv", "."], ad_lizard.parse_lizard_output, True),
+        ("npx", ["npx", "knip", "--reporter", "json"], ad_knip.parse_knip_output, is_js),
+        ("jscpd", ["jscpd", "--reporters", "json", "--silent", "."], ad_jscpd.parse_jscpd_output, is_js),
+    ]:
+        tool_name = "knip" if binary == "npx" else binary
+        if not should_run:
+            continue
+        if not tool_available(binary):
+            stats[tool_name] = ToolStat(ran=False, reason="not on PATH")
+            continue
+        r = run_tool(args, cwd=repo)
+        parsed = adapter(r.stdout)
+        stats[tool_name] = ToolStat(ran=True, pre_filter=len(parsed), post_filter=0)
+        findings.extend(parsed)
+    return findings, stats
+
+
+def _run_dep_tools(repo: str) -> tuple[list[Finding], dict[str, ToolStat]]:
+    findings: list[Finding] = []
+    stats: dict[str, ToolStat] = {}
+    if tool_available("pip-audit"):
+        r = run_tool(["pip-audit", "-f", "json"], cwd=repo)
+        parsed = ad_pip_audit.parse_pip_audit_output(r.stdout)
+        stats["pip-audit"] = ToolStat(ran=True, pre_filter=len(parsed))
+        findings.extend(parsed)
+    else:
+        stats["pip-audit"] = ToolStat(ran=False, reason="not on PATH")
+    if tool_available("osv-scanner"):
+        r = run_tool(["osv-scanner", "--recursive", "--format=json", "."], cwd=repo)
+        parsed = ad_osv.parse_osv_scanner_output(r.stdout)
+        stats["osv-scanner"] = ToolStat(ran=True, pre_filter=len(parsed))
+        findings.extend(parsed)
+    else:
+        stats["osv-scanner"] = ToolStat(ran=False, reason="not on PATH")
+    return findings, stats
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--repo", required=True)
+    parser.add_argument("--base", default=None)
+    parser.add_argument("--head", default="HEAD")
+    parser.add_argument("--output-dir", required=True)
+    parser.add_argument("--mode", choices=("local", "ref"), required=True)
+    args = parser.parse_args(argv)
+
+    repo = str(Path(args.repo).resolve())
+    out_dir = Path(args.output_dir).resolve()
+    out_dir.mkdir(parents=True, exist_ok=True)
+
+    default_branch = resolve_default_branch(repo)
+    base = args.base or resolve_base_ref(repo, default_branch)
+    errors: list[str] = []
+
+    try:
+        changed = changed_files_with_ranges(repo, base, args.head)
+    except RuntimeError as e:
+        manifest = Manifest(
+            mode=args.mode, base_ref=base, head_ref=args.head,
+            default_branch=default_branch,
+            language_breakdown=LanguageBreakdown(),
+            changed_files=[], findings=[],
+            package_diffs={}, tool_stats={}, tools_unavailable=[],
+            errors=[str(e)],
+        )
+        (out_dir / "manifest.json").write_text(manifest.to_json())
+        return 1
+
+    changed_files: list[ChangedFile] = []
+    skipped: list[str] = []
+    dep_manifest_paths: list[str] = []
+    unsupported_by_language: dict[str, list[str]] = {}
+    for path, ranges in changed:
+        if is_supported_source(path):
+            changed_files.append(ChangedFile(
+                path=path,
+                language=detect_language(path),
+                added_lines=ranges,
+            ))
+            continue
+        if is_gha_file(path):
+            changed_files.append(ChangedFile(
+                path=path,
+                language="github-actions",
+                added_lines=ranges,
+            ))
+            continue
+        if is_dep_manifest(path):
+            dep_manifest_paths.append(path)
+            continue
+        unsupported = known_unsupported_language(path)
+        if unsupported is not None:
+            unsupported_by_language.setdefault(unsupported, []).append(path)
+        skipped.append(path)
+
+    for language, paths in sorted(unsupported_by_language.items()):
+        errors.append(
+            f"unsupported language not reviewed: {language} ({', '.join(paths)})"
+        )
+
+    breakdown = _build_breakdown(changed_files, skipped)
+
+    if not changed_files and not dep_manifest_paths:
+        errors.append("no supported source files in change set; skipped: " + ", ".join(skipped))
+        manifest = Manifest(
+            mode=args.mode, base_ref=base, head_ref=args.head,
+            default_branch=default_branch, language_breakdown=breakdown,
+            changed_files=[], findings=[],
+            package_diffs={}, tool_stats={}, tools_unavailable=[],
+            errors=errors,
+        )
+        (out_dir / "manifest.json").write_text(manifest.to_json())
+        return 1
+
+    findings: list[Finding] = []
+    tool_stats: dict[str, ToolStat] = {}
+
+    def collect(runner, *args) -> None:
+        f, s = runner(*args)
+        findings.extend(f)
+        tool_stats.update(s)
+
+    languages_present = {cf.language for cf in changed_files}
+    if "python" in languages_present:
+        collect(_run_python_tools, repo)
+    if "javascript" in languages_present or "typescript" in languages_present:
+        collect(_run_js_tools, repo)
+    if "csharp" in languages_present:
+        collect(_run_dotnet_tools, repo)
+
+    collect(_run_polyglot_tools, repo)
+    collect(_run_dep_tools, repo)
+    collect(_run_maintainability_tools, repo, languages_present)
+    if "lua" in languages_present:
+        collect(_run_lua_tools, repo)
+    if "powershell" in languages_present:
+        collect(_run_powershell_tools, repo)
+    if "github-actions" in languages_present:
+        collect(_run_gha_tools, repo)
+
+    filtered = filter_findings_by_diff(findings, changed_files, repo_root=repo)
+    for tool_name, stat in tool_stats.items():
+        if stat.ran:
+            stat.post_filter = sum(1 for f in filtered if f.tool == tool_name)
+
+    tools_unavailable = [name for name, s in tool_stats.items() if not s.ran]
+
+    package_diffs = _build_package_diffs(repo, base, dep_manifest_paths)
+
+    manifest = Manifest(
+        mode=args.mode,
+        base_ref=base,
+        head_ref=args.head,
+        default_branch=default_branch,
+        language_breakdown=breakdown,
+        changed_files=changed_files,
+        findings=filtered,
+        package_diffs=package_diffs,
+        tool_stats=tool_stats,
+        tools_unavailable=tools_unavailable,
+        errors=errors,
+    )
+
+    (out_dir / "manifest.json").write_text(manifest.to_json())
+    manifest_dict = manifest.to_dict()
+    for agent in ("security-triage", "type-safety", "dependency", "consistency", "secrets", "maintainability", "walkthrough", "gha-reviewer"):
+        sliced = slice_for_agent(manifest_dict, agent)
+        (out_dir / f"manifest-{agent}.json").write_text(json.dumps(sliced, indent=2))
+
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())