Release 1.4.0

audit v1.4.0

Background runs you can fire-and-track, and a redesigned triage viewer that opens on a live analytics dashboard.

✨ Highlights

Background runs & session tracking

• audit run -d / --background — detach a scan into a background process and get your shell back immediately. Output streams to results/<run-id>/run.log; auth and path checks still
  run in the foreground so misconfiguration fails fast before detaching.
• audit sessions (alias ps) — list every run currently in progress. Background runs show their driving PID and whether it's still alive (a running row whose process has
  died is flagged in red as crashed); foreground runs are shown too, and finished runs are pruned automatically. --json for scripting.

audit run -d --max-cost-usd 30      # start in the background, returns at once
audit sessions                      # what's active, and is it still alive?
tail -f results/<run-id>/run.log    # follow along

Redesigned triage viewer

audit report --serve is now a modern triage dashboard, still a zero-build local UI served straight from SQLite:

• Live analytics — finding / reachable / confirmed / triaged counts, average confidence, and severity / vulnerability-class / hottest-file distribution bars that recompute as you
  filter. The severity and class bars are click-to-filter.
  filter. The severity and class bars are click-to-filter.
• Filter, search & sort — full-text search plus severity, status, class, reachable-only, and canonical-only filters; sort any column; navigate the list with j / k or arrow keys.
• Richer detail panel — severity, reachability, validation status, confidence and canonical flags, with the reachability call chain drawn as a connected timeline.
• Triage verdicts (confirm / false-positive / won't-fix) still persist to the triage table, and "Export baseline" downloads a suppression baseline for the next run.

Viewer networking

• report --serve --host <host> — bind the viewer beyond loopback (e.g. --host 0.0.0.0) when you need it reachable from another machine. It binds to 127.0.0.1 by default and warns
  when exposed, since the viewer has no authentication.

📝 Notes

• Background runs and the sessions registry require no new flags to read — audit sessions works for foreground runs as well.
• The viewer continues to render all finding text via DOM textContent (never innerHTML), so evidence from the audited repo can't execute inside the tool.