Assess

junco assess audits a repository and parks what it finds; filing findings as GitHub issues is a separate, human-confirmed step. Junco authors issues — it never merges anything on its own.

What a run does

junco assess acme/reef-api
junco assess acme/reef-api#52 --auto-plan

The command composes and queues a machine-owned ticket; the audit itself runs when the daemon claims it — the daemon must be running. The run is read-only: npm audit --json for the dependency tree plus a read-only agent pass over the code, then validate, sanitize, severity-filter (assess.minSeverity), dedup, and park every survivor in a durable review store keyed by the ticket id. Three target shapes: a local path; owner/repo, matched against the watched-repo list (an unwatched name errors rather than guessing a clone path); or owner/repo#N / an issue URL, which scopes the audit to the code that issue implicates and — unlike the bare form — auto-provisions an unwatched repo (fork, managed clone, watchlist add). A scoped run posts no comment on the issue; each filed finding instead carries a Context: acme/reef-api#52 line GitHub cross-references onto the issue's timeline.

Review and file

junco assess review
junco assess review <id>
junco assess file <id> --all
junco assess file <id> --only <fingerprint>,<fingerprint>

review lists pending batches; with an id it shows each finding's fingerprint, severity, and title. file is the confirm step — no bare default, since these are writes on an issue tracker: pass --all or --only. Each selected finding files as one issue titled [<severity>] <title> (<ruleId>), with a machine-readable JSON block and a marker as the literal last line. On a repo you own, issues get junco:finding + severity/<level> labels, best-effort; on a repo you don't own they file label-free — junco never assumes triage rights it doesn't have. Unselected findings stay unreviewed and re-park on the next audit; they are not suppressed.

Dedup semantics

Each finding's fingerprint is sha256("<kind>|<ruleId>|<locus>") truncated to 16 hex characters — locus is the package name for dependency findings, else the file path, else the title; line numbers are excluded so the fingerprint survives code drift. Both the audit-time pre-filter and the authoritative file-time check scan your own most recent 500 issues on the target repo — closed ones included — for  markers, skipping any fingerprint already present. Offline filing re-runs that scan fresh at outbox flush time, so two offline runs converge on one issue.

warn — because closed issues still count toward the scan, closing a finding issue — wontfix included — suppresses that fingerprint forever, including a genuine future regression that hashes the same. To let junco re-file it, delete the issue or edit the  marker line out of its body.

--auto-plan

--auto-plan adds the configured trigger label to every issue the batch files, so each one feeds straight into the label → plan → approve → PR loop on the bridge's next sweep. It is only effective on owned, bridge-watched repos with github.enabled: an external batch forces it off, and on an unwatched repo the label sits inert until the repo is watched.