Release 1.5.0

audit v1.5.0

Code-grounded fix guidance: every finding can now carry a remediation written from the actual code, surfaced wherever you review findings.

✨ Highlights

audit advise — remediation grounded in your code

A new read-only stage that reads the real sink and reachability call chain and writes a fix specific to this codebase — the actual function, the framework's safe API, the exact change —
plus an optional fix sketch and references. It explains the fix; the fix stage writes the patch.

audit advise --run-id my-run                  # reachable findings (default)
audit advise --run-id my-run --scope all      # every finding
audit advise --run-id my-run --finding f_ab12 # just one

--scope reachable|confirmed|all, --finding <id>, and --force (regenerate) are supported. Results are stored per finding and reused everywhere.

One recommendation, surfaced everywhere

• report (json / md / sarif) now fills each finding's recommendation from the generated advice, so the report, the viewer, and audit advise never disagree.
• Triage viewer — each finding's detail panel has a Solution box showing the code-grounded recommendation (with root cause, an optional fixed-code sketch, references, the
  validator's suggested test, and a CWE link). When advice hasn't been generated yet, a Generate fix button produces it on demand (report --serve --allow-api-key when you rely on
  ANTHROPIC_API_KEY).

🔄 Changed

• The viewer's previous hard-coded, vuln-class remediation catalog has been removed in favor of the code-grounded advice above. Generic boilerplate is replaced by guidance that names
  the real code.

📝 Notes

• advise is read-only and opt-in (a command or the viewer button) — it never edits files; use audit fix to produce patches.
• The triage run stores its reproduced finding, so audit advise --run-id <triage-run> --finding <id> produces the same code-grounded fix for a triaged report.