Add audit subagent for codebases, agents, and processes

[CDave79]

Summary

Adds a third specialist subagent — an auditor — to the existing coordinator/subagent system. It performs a read-only audit of a target directory across three domains and produces a structured, severity-sorted markdown report.

• codebase — correctness bugs, unhandled errors, security/secret risks, input validation, dependency concerns, dead code, missing types.
• agents — agent/subagent definitions: system prompts, tool wiring, model selection, loop/termination safety, prompt-injection exposure, least-privilege tooling.
• processes — git/branch hygiene, CI gates, build/test/lint commands, documentation accuracy, config and .gitignore hygiene, secret management.

How it works

• src/agents/auditor.ts — new subagent. Maps the tree with list_dir, reads files with read_file (both confined to the audit root via a path-escape guard, 64 KB read cap, ignores node_modules/.git/dist/etc.), records findings via a structured record_finding tool, then renders a markdown report sorted by severity and grouped by domain. It never writes to the target.
• src/coordinator.ts — exposes the auditor as delegate_audit(target, scope) alongside the existing research/writing tools.
• package.json — adds an npm run audit script.
• README.md — documents the auditor, the updated architecture diagram, and usage.

Usage

npm run audit                                   # audit current project, all domains
npm run audit -- ../some-project --scope=codebase,agents
npm start -- "Audit this codebase, the agents, and the processes"

Verification

• npm run typecheck passes.
• Runtime execution requires ANTHROPIC_API_KEY (not run in CI).

Notes

• CLAUDE.md is stale independent of this change (it still describes the repo as "freshly initialized" with only README.md, predating the existing src/ tree). I left a full refresh of it out of scope here — happy to follow up in a separate change.

https://claude.ai/code/session_0163nHqJ7tB7zwySim4BidgW

---

Generated by Claude Code