Initial project scaffold: macOS package security audit tool

This commit establishes the foundation for a comprehensive security audit
tool for macOS developer machines. It audits all installed software,
detects vulnerabilities via OSV.dev, and provides Claude-powered
mitigation recommendations.

## Architecture

- System inventory collection (Homebrew, pip, npm, Go, Rust, apps)
- CVE scanning via OSV.dev API (no auth, unlimited rate limits)
- Claude integration (CLI or SDK) for mitigation analysis
- JSON + HTML report generation
- Full test suite (34+ tests, 7 benchmarks)
- Production-grade linting (11 linters via golangci-lint)
- Vulnerability scanning (govulncheck)
- GitHub Actions CI/CD pipeline

## Key Components

- cmd/audit/: CLI entry point
- internal/inventory/: System inventory parsing
- internal/security/: OSV.dev querying, Claude integration, audit logic
- internal/report/: JSON and HTML report generation
- scripts/collect-inventory.sh: Bash script for system enumeration

## MVP Features

- Homebrew package scanning
- Python/Node/Go/Rust ecosystem scanning
- CVSS-based severity filtering
- Claude-powered recommendations (update/replace/protect/monitor)
- Makefile automation (test, lint, vulnerability checks)
- Pre-commit hooks configuration

## Testing & Quality

- 34+ unit tests with table-driven patterns
- 7 benchmark tests for performance
- 11 configured linters (staticcheck, gosec, revive, etc.)
- Code coverage reporting
- GitHub Actions CI (tests on Go 1.22 & 1.23)
- Pre-commit hook framework

## Documentation

- README.md: Full feature and usage documentation
- QUICKSTART.md: 3-minute setup guide
- TESTING.md: Testing and code quality guide
- QA_SETUP.md: Analysis tooling reference
- DATA_SOURCES_SPEC.md: Vulnerability data source documentation

## Data Sources

- OSV.dev: Primary CVE database (1.8 day latency, no auth needed)
- GitHub Advisories: Supplement for maintainer-created advisories
- OpenSSF Scorecard: Trust signals (repo health/practices)
- Homebrew Formulae API: Package metadata
- CISA KEV: Active exploitation tracking

## Next Steps

Phase 1 (MVP): Complete and tested ✓
Phase 2 (planned): Third-party app scanning, VirusTotal integration
Phase 3 (planned): Historical monitoring, scheduled audits, webhooks

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

cmd/audit/main.go

@@ -0,0 +1,98 @@
+package main
+
+import (
+	"encoding/json"
+	"flag"
+	"fmt"
+	"log"
+	"os"
+	"path/filepath"
+
+	"github.com/user/package-review/internal/inventory"
+	"github.com/user/package-review/internal/report"
+	"github.com/user/package-review/internal/security"
+)
+
+func main() {
+	var (
+		inventoryFile = flag.String("inventory", "inventory.json", "Path to inventory JSON file")
+		outputJSON    = flag.String("json", "audit_report.json", "Output audit report as JSON")
+		outputHTML    = flag.String("html", "audit_report.html", "Output audit report as HTML")
+		claudeMode    = flag.String("claude", "claude", "Claude integration mode: 'claude' (CLI) or 'sdk' (Anthropic SDK)")
+	)
+
+	flag.Usage = func() {
+		fmt.Fprintf(os.Stderr, `Usage: audit [options]
+
+Options:
+`)
+		flag.PrintDefaults()
+		fmt.Fprintf(os.Stderr, `
+Examples:
+  # Collect inventory and run audit
+  ./scripts/collect-inventory.sh && go run ./cmd/audit
+
+  # Use existing inventory
+  go run ./cmd/audit -inventory=/path/to/inventory.json
+
+  # Specify output files
+  go run ./cmd/audit -json=report.json -html=report.html
+
+  # Use Anthropic SDK for Claude (requires ANTHROPIC_API_KEY)
+  go run ./cmd/audit -claude=sdk
+`)
+	}
+
+	flag.Parse()
+
+	// Verify inventory file exists
+	if _, err := os.Stat(*inventoryFile); os.IsNotExist(err) {
+		log.Fatalf("❌ Inventory file not found: %s\nRun: ./scripts/collect-inventory.sh", *inventoryFile)
+	}
+
+	fmt.Println("🔍 Loading inventory...")
+	inv, err := inventory.LoadInventory(*inventoryFile)
+	if err != nil {
+		log.Fatalf("Error loading inventory: %v", err)
+	}
+
+	fmt.Printf("✓ Loaded %d packages from inventory\n\n", inv.CountPackages())
+
+	// Scan for vulnerabilities
+	fmt.Println("🔎 Scanning for vulnerabilities...")
+	audit := security.NewAudit(inv)
+	if err := audit.ScanOSV(); err != nil {
+		log.Fatalf("Error scanning OSV.dev: %v", err)
+	}
+
+	// Get high-severity findings
+	highSev := audit.FilterByMinSeverity(7.0)
+	fmt.Printf("⚠️  Found %d high-severity vulnerabilities\n\n", len(highSev))
+
+	// Run Claude analysis on high-severity items
+	if len(highSev) > 0 {
+		fmt.Println("🤖 Analyzing with Claude...")
+		if err := audit.AnalyzeWithClaude(*claudeMode); err != nil {
+			log.Fatalf("Error running Claude analysis: %v", err)
+		}
+	}
+
+	// Generate reports
+	fmt.Println("\n📊 Generating reports...")
+
+	// JSON report
+	if err := report.WriteJSON(audit, *outputJSON); err != nil {
+		log.Fatalf("Error writing JSON report: %v", err)
+	}
+	fmt.Printf("✓ JSON report: %s\n", *outputJSON)
+
+	// HTML report (via Astro)
+	if err := report.GenerateAstroSite(audit, *outputHTML); err != nil {
+		log.Fatalf("Error generating HTML report: %v", err)
+	}
+	fmt.Printf("✓ HTML report: %s\n", *outputHTML)
+
+	fmt.Println("\n✅ Audit complete!")
+	fmt.Printf("📈 Summary: %d packages scanned, %d with CVEs, %d high-severity\n",
+		inv.CountPackages(), audit.CountVulnerable(), len(highSev))
+}