@bouncesecurity/aghast 0.0.13

package/dist/sarif-parser.js

@@ -0,0 +1,76 @@
+/**
+ * SARIF 2.1.0 parser for Semgrep output.
+ * Extracts CheckTarget[] from SARIF results.
+ */
+/**
+ * Parse SARIF 2.1.0 JSON content into CheckTarget[].
+ * Skips results with missing location fields.
+ * Throws on invalid JSON or missing SARIF structure.
+ */
+export function parseSARIF(sarifContent) {
+    let doc;
+    try {
+        doc = JSON.parse(sarifContent);
+    }
+    catch {
+        throw new Error('Invalid SARIF: malformed JSON');
+    }
+    if (!doc.runs || !Array.isArray(doc.runs)) {
+        throw new Error('Invalid SARIF: missing "runs" array');
+    }
+    const targets = [];
+    for (const run of doc.runs) {
+        if (!run.results || !Array.isArray(run.results)) {
+            continue;
+        }
+        for (const result of run.results) {
+            if (!result.locations || result.locations.length === 0) {
+                continue;
+            }
+            const loc = result.locations[0];
+            const phys = loc?.physicalLocation;
+            if (!phys)
+                continue;
+            const file = phys.artifactLocation?.uri;
+            const startLine = phys.region?.startLine;
+            // Skip results missing required location fields
+            if (!file || startLine === undefined) {
+                continue;
+            }
+            const endLine = phys.region?.endLine ?? startLine;
+            const target = {
+                file,
+                startLine,
+                endLine,
+                message: result.message?.text ?? '',
+            };
+            if (phys.region?.snippet?.text) {
+                target.snippet = phys.region.snippet.text;
+            }
+            targets.push(target);
+        }
+    }
+    return targets;
+}
+/**
+ * Deduplicate targets by file:startLine:endLine key.
+ */
+export function deduplicateTargets(targets) {
+    const seen = new Set();
+    const result = [];
+    for (const target of targets) {
+        const key = `${target.file}:${target.startLine}:${target.endLine}`;
+        if (!seen.has(key)) {
+            seen.add(key);
+            result.push(target);
+        }
+    }
+    return result;
+}
+/**
+ * Limit the number of targets to a maximum.
+ */
+export function limitTargets(targets, maxTargets) {
+    return targets.slice(0, maxTargets);
+}
+//# sourceMappingURL=sarif-parser.js.map

package/dist/sarif-parser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sarif-parser.js","sourceRoot":"","sources":["../src/sarif-parser.ts"],"names":[],"mappings":"AAAA;;;GAGG;AA2BH;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,YAAoB;IAC7C,IAAI,GAAkB,CAAC;IACvB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAkB,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,OAAO,GAAkB,EAAE,CAAC;IAElC,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QAC3B,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAChD,SAAS;QACX,CAAC;QAED,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;YACjC,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvD,SAAS;YACX,CAAC;YAED,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YAChC,MAAM,IAAI,GAAG,GAAG,EAAE,gBAAgB,CAAC;YACnC,IAAI,CAAC,IAAI;gBAAE,SAAS;YAEpB,MAAM,IAAI,GAAG,IAAI,CAAC,gBAAgB,EAAE,GAAG,CAAC;YACxC,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC;YAEzC,gDAAgD;YAChD,IAAI,CAAC,IAAI,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBACrC,SAAS;YACX,CAAC;YAED,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,OAAO,IAAI,SAAS,CAAC;YAElD,MAAM,MAAM,GAAgB;gBAC1B,IAAI;gBACJ,SAAS;gBACT,OAAO;gBACP,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,IAAI,EAAE;aACpC,CAAC;YAEF,IAAI,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;gBAC/B,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;YAC5C,CAAC;YAED,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAsB;IACvD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,MAAM,GAAkB,EAAE,CAAC;IAEjC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACnB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,OAAsB,EAAE,UAAkB;IACrE,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;AACtC,CAAC"}

package/dist/scan-runner.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Scan runner (orchestrator).
+ * Runs security checks against a repository and produces ScanResults.
+ * Implements the core workflow from spec Section 2.2.
+ */
+import { type AIProvider, type RepositoryInfo, type CheckDetails, type SecurityCheck, type ScanResults } from './types.js';
+export interface MultiScanOptions {
+    repositoryPath: string;
+    checks: Array<{
+        check: SecurityCheck;
+        details: CheckDetails;
+    }>;
+    aiProvider?: AIProvider;
+    aiModelName?: string;
+    aiProviderName?: string;
+    concurrency?: number;
+    repositoryInfo?: RepositoryInfo;
+    configDir?: string;
+    genericPrompt?: string;
+}
+/**
+ * Generate a scanId in the format: scan-<timestamp>-<hash>
+ */
+export declare function generateScanId(): string;
+/**
+ * Run multiple security checks and return aggregated ScanResults.
+ */
+export declare function runMultiScan(options: MultiScanOptions): Promise<ScanResults>;
+//# sourceMappingURL=scan-runner.d.ts.map

package/dist/scan-runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan-runner.d.ts","sourceRoot":"","sources":["../src/scan-runner.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAaH,OAAO,EAGL,KAAK,UAAU,EACf,KAAK,cAAc,EAInB,KAAK,YAAY,EACjB,KAAK,aAAa,EAElB,KAAK,WAAW,EAGjB,MAAM,YAAY,CAAC;AAgFpB,MAAM,WAAW,gBAAgB;IAC/B,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,aAAa,CAAC;QAAC,OAAO,EAAE,YAAY,CAAA;KAAE,CAAC,CAAC;IAC/D,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;GAEG;AACH,wBAAgB,cAAc,IAAI,MAAM,CAKvC;AAweD;;GAEG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,WAAW,CAAC,CAkHlF"}

package/dist/scan-runner.js

@@ -0,0 +1,559 @@
+/**
+ * Scan runner (orchestrator).
+ * Runs security checks against a repository and produces ScanResults.
+ * Implements the core workflow from spec Section 2.2.
+ */
+import { readFile } from 'node:fs/promises';
+import { randomBytes } from 'node:crypto';
+import { resolve, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { buildPrompt } from './prompt-template.js';
+import { parseAIResponse } from './response-parser.js';
+import { extractSnippet } from './snippet-extractor.js';
+import { analyzeRepository } from './repository-analyzer.js';
+import { runSemgrep } from './semgrep-runner.js';
+import { parseSARIF, deduplicateTargets, limitTargets } from './sarif-parser.js';
+import { logProgress, logDebug, createTimer } from './logging.js';
+import { DEFAULT_AI_MODEL, FatalProviderError, } from './types.js';
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const TAG = 'scan';
+const DEFAULT_CONCURRENCY = 5;
+/**
+ * Sum multiple TokenUsage values into one aggregate.
+ * Returns undefined if no inputs have token usage.
+ */
+function sumTokenUsage(usages) {
+    const defined = usages.filter((u) => u !== undefined);
+    if (defined.length === 0)
+        return undefined;
+    return {
+        inputTokens: defined.reduce((sum, u) => sum + u.inputTokens, 0),
+        outputTokens: defined.reduce((sum, u) => sum + u.outputTokens, 0),
+        totalTokens: defined.reduce((sum, u) => sum + u.totalTokens, 0),
+    };
+}
+/**
+ * Get the version from package.json.
+ */
+async function getVersion() {
+    try {
+        const pkgPath = resolve(__dirname, '..', 'package.json');
+        const pkg = JSON.parse(await readFile(pkgPath, 'utf-8'));
+        return pkg.version ?? '0.0.0';
+    }
+    catch {
+        return '0.0.0';
+    }
+}
+/**
+ * Run an async function over items with bounded concurrency.
+ * Spawns min(concurrency, items.length) workers that pull from a shared index.
+ * Results are written to a pre-allocated array to preserve input order.
+ *
+ * If abortHandle is provided, workers stop picking up new items once
+ * abortHandle.aborted is set to true. In-flight items complete naturally.
+ */
+async function mapWithConcurrency(items, concurrency, fn, abortHandle) {
+    const results = new Array(items.length);
+    let nextIndex = 0;
+    async function worker() {
+        while (nextIndex < items.length) {
+            if (abortHandle?.aborted)
+                break;
+            const i = nextIndex++;
+            results[i] = await fn(items[i], i);
+        }
+    }
+    const workerCount = Math.min(concurrency, items.length);
+    const workers = [];
+    for (let w = 0; w < workerCount; w++) {
+        workers.push(worker());
+    }
+    // Use allSettled so in-flight items complete before we propagate errors
+    const settled = await Promise.allSettled(workers);
+    const firstRejection = settled.find((r) => r.status === 'rejected');
+    if (firstRejection && firstRejection.status === 'rejected') {
+        throw firstRejection.reason;
+    }
+    return results;
+}
+/**
+ * Generate a scanId in the format: scan-<timestamp>-<hash>
+ */
+export function generateScanId() {
+    const now = new Date();
+    const ts = now.toISOString().replace(/[-:T]/g, '').replace(/\..+/, '');
+    const hash = randomBytes(3).toString('hex');
+    return `scan-${ts}-${hash}`;
+}
+/**
+ * Enrich a raw AI issue into a full SecurityIssue.
+ * Extracts code snippets, applies check metadata, and normalizes paths.
+ */
+async function enrichIssue(aiIssue, checkId, checkName, repositoryPath, checkMetadata) {
+    const codeSnippet = await extractSnippet(repositoryPath, aiIssue.file, aiIssue.startLine, aiIssue.endLine);
+    const issue = {
+        checkId,
+        checkName,
+        file: aiIssue.file.replace(/\\/g, '/'),
+        startLine: aiIssue.startLine,
+        endLine: aiIssue.endLine,
+        description: aiIssue.description,
+    };
+    if (codeSnippet !== undefined) {
+        issue.codeSnippet = codeSnippet;
+    }
+    if (checkMetadata?.severity !== undefined) {
+        issue.severity = checkMetadata.severity;
+    }
+    if (checkMetadata?.confidence !== undefined) {
+        issue.confidence = checkMetadata.confidence;
+    }
+    if (aiIssue.dataFlow !== undefined) {
+        issue.dataFlow = aiIssue.dataFlow.map((step) => ({
+            ...step,
+            file: step.file.replace(/\\/g, '/'),
+        }));
+    }
+    return issue;
+}
+/**
+ * Execute a single check against a repository via the AI provider.
+ * Routes to multi-target execution if checkTarget is configured.
+ * Handles prompt building, AI call, response parsing, issue enrichment.
+ */
+async function executeSingleCheck(check, checkName, checkInstructions, repositoryPath, aiProvider, checkMetadata, concurrency, configDir, genericPrompt) {
+    const checkId = check.id;
+    // Route to multi-target execution if configured
+    if (check.checkTarget?.type === 'semgrep') {
+        if (!aiProvider) {
+            throw new Error(`Check "${checkId}" requires an AI provider but none was configured`);
+        }
+        return executeMultiTargetCheck(check, checkName, checkInstructions, repositoryPath, aiProvider, checkMetadata, concurrency, configDir, genericPrompt);
+    }
+    // Route to semgrep-only execution (no AI)
+    if (check.checkTarget?.type === 'semgrep-only') {
+        return executeSemgrepOnlyCheck(check, checkName, repositoryPath, checkMetadata);
+    }
+    if (!aiProvider) {
+        throw new Error(`Check "${checkId}" requires an AI provider but none was configured`);
+    }
+    logProgress(TAG, `Running check: ${checkName}`);
+    const prompt = await buildPrompt(checkInstructions, configDir, genericPrompt);
+    logDebug(TAG, `Prompt built: ${prompt.length} chars`);
+    let issues = [];
+    let summary;
+    const checkTimer = createTimer();
+    try {
+        const aiResponse = await aiProvider.executeCheck(prompt, repositoryPath);
+        const executionTime = checkTimer.elapsed();
+        logDebug(TAG, `AI response: ${aiResponse.raw.length} chars`);
+        const parsed = aiResponse.parsed ?? parseAIResponse(aiResponse.raw);
+        if (!parsed) {
+            logProgress(TAG, 'Result: ERROR (malformed response)');
+            summary = {
+                checkId,
+                checkName,
+                status: 'ERROR',
+                issuesFound: 0,
+                executionTime,
+                error: 'AI provider returned malformed response',
+                rawAiResponse: aiResponse.raw,
+                tokenUsage: aiResponse.tokenUsage,
+            };
+        }
+        else if (parsed.issues.length > 0) {
+            logProgress(TAG, `Result: FAIL (${parsed.issues.length} issues)`);
+            issues = await Promise.all(parsed.issues.map((aiIssue) => enrichIssue(aiIssue, checkId, checkName, repositoryPath, checkMetadata)));
+            summary = {
+                checkId,
+                checkName,
+                status: 'FAIL',
+                issuesFound: issues.length,
+                executionTime,
+                tokenUsage: aiResponse.tokenUsage,
+            };
+        }
+        else if (parsed.flagged) {
+            logProgress(TAG, 'Result: FLAG (AI flagged for review)');
+            summary = {
+                checkId,
+                checkName,
+                status: 'FLAG',
+                issuesFound: 0,
+                executionTime,
+                tokenUsage: aiResponse.tokenUsage,
+            };
+        }
+        else {
+            logProgress(TAG, 'Result: PASS');
+            summary = {
+                checkId,
+                checkName,
+                status: 'PASS',
+                issuesFound: 0,
+                executionTime,
+                tokenUsage: aiResponse.tokenUsage,
+            };
+        }
+    }
+    catch (err) {
+        // Fatal errors must propagate up to abort the entire scan
+        if (err instanceof FatalProviderError) {
+            throw err;
+        }
+        const executionTime = checkTimer.elapsed();
+        const errorMsg = err instanceof Error ? err.message : String(err);
+        logProgress(TAG, `Result: ERROR (${errorMsg})`);
+        summary = {
+            checkId,
+            checkName,
+            status: 'ERROR',
+            issuesFound: 0,
+            executionTime,
+            error: errorMsg,
+        };
+    }
+    return { summary, issues };
+}
+/**
+ * Map a SARIF CheckTarget directly to a SecurityIssue (for semgrep-only checks).
+ * Extracts code snippet from source file via extractSnippet().
+ */
+async function mapTargetToIssue(target, checkId, checkName, repositoryPath, checkMetadata) {
+    const codeSnippet = await extractSnippet(repositoryPath, target.file, target.startLine, target.endLine);
+    const issue = {
+        checkId,
+        checkName,
+        file: target.file.replace(/\\/g, '/'),
+        startLine: target.startLine,
+        endLine: target.endLine,
+        description: target.message || 'Semgrep finding',
+    };
+    if (codeSnippet !== undefined) {
+        issue.codeSnippet = codeSnippet;
+    }
+    if (checkMetadata?.severity !== undefined) {
+        issue.severity = checkMetadata.severity;
+    }
+    if (checkMetadata?.confidence !== undefined) {
+        issue.confidence = checkMetadata.confidence;
+    }
+    return issue;
+}
+/**
+ * Execute a semgrep-only check: Semgrep discovers findings, mapped directly
+ * to issues with no AI involvement.
+ */
+async function executeSemgrepOnlyCheck(check, checkName, repositoryPath, checkMetadata) {
+    const checkId = check.id;
+    const checkTarget = check.checkTarget;
+    logProgress(TAG, `Running semgrep-only check: ${checkName}`);
+    const checkTimer = createTimer();
+    try {
+        // 1. Run Semgrep to discover findings
+        const sarifContent = await runSemgrep({
+            repositoryPath,
+            rules: checkTarget.rules,
+            config: checkTarget.config,
+        });
+        // 2. Parse, deduplicate, and limit targets
+        let targets = parseSARIF(sarifContent);
+        targets = deduplicateTargets(targets);
+        if (checkTarget.maxTargets !== undefined) {
+            targets = limitTargets(targets, checkTarget.maxTargets);
+        }
+        // 3. If no targets, return PASS
+        if (targets.length === 0) {
+            logProgress(TAG, 'Result: PASS (no findings)');
+            return {
+                summary: {
+                    checkId,
+                    checkName,
+                    status: 'PASS',
+                    issuesFound: 0,
+                    executionTime: checkTimer.elapsed(),
+                    targetsAnalyzed: 0,
+                },
+                issues: [],
+            };
+        }
+        // 4. Map each target directly to a SecurityIssue (no AI)
+        const issues = await Promise.all(targets.map((target) => mapTargetToIssue(target, checkId, checkName, repositoryPath, checkMetadata)));
+        const executionTime = checkTimer.elapsed();
+        logProgress(TAG, `Result: FAIL (${issues.length} findings, ${targets.length} targets)`);
+        return {
+            summary: {
+                checkId,
+                checkName,
+                status: 'FAIL',
+                issuesFound: issues.length,
+                executionTime,
+                targetsAnalyzed: targets.length,
+            },
+            issues,
+        };
+    }
+    catch (err) {
+        const executionTime = checkTimer.elapsed();
+        const errorMsg = err instanceof Error ? err.message : String(err);
+        logProgress(TAG, `Result: ERROR (${errorMsg})`);
+        return {
+            summary: {
+                checkId,
+                checkName,
+                status: 'ERROR',
+                issuesFound: 0,
+                executionTime,
+                error: errorMsg,
+            },
+            issues: [],
+        };
+    }
+}
+/**
+ * Execute a multi-target check: Semgrep discovers targets, AI analyzes each.
+ */
+async function executeMultiTargetCheck(check, checkName, checkInstructions, repositoryPath, aiProvider, checkMetadata, optionsConcurrency, configDir, genericPrompt) {
+    const checkId = check.id;
+    const checkTarget = check.checkTarget;
+    logProgress(TAG, `Running multi-target check: ${checkName}`);
+    const checkTimer = createTimer();
+    try {
+        // 1. Run Semgrep to discover targets
+        const sarifContent = await runSemgrep({
+            repositoryPath,
+            rules: checkTarget.rules,
+            config: checkTarget.config,
+        });
+        // 2. Parse, deduplicate, and limit targets
+        let targets = parseSARIF(sarifContent);
+        targets = deduplicateTargets(targets);
+        if (checkTarget.maxTargets !== undefined) {
+            targets = limitTargets(targets, checkTarget.maxTargets);
+        }
+        // 3. If no targets, return PASS
+        if (targets.length === 0) {
+            logProgress(TAG, 'Result: PASS (no targets found)');
+            return {
+                summary: {
+                    checkId,
+                    checkName,
+                    status: 'PASS',
+                    issuesFound: 0,
+                    executionTime: checkTimer.elapsed(),
+                    targetsAnalyzed: 0,
+                },
+                issues: [],
+            };
+        }
+        // 4. Resolve effective concurrency: per-check > options > default
+        const effectiveConcurrency = checkTarget.concurrency ?? optionsConcurrency ?? DEFAULT_CONCURRENCY;
+        logProgress(TAG, `Found ${targets.length} targets to analyze (concurrency: ${effectiveConcurrency})`);
+        // 5. Analyze targets concurrently
+        const basePrompt = await buildPrompt(checkInstructions, configDir, genericPrompt);
+        let completedCount = 0;
+        const abortHandle = { aborted: false };
+        const targetResults = await mapWithConcurrency(targets, effectiveConcurrency, async (target, idx) => {
+            const label = `[target ${idx + 1}/${targets.length}]`;
+            try {
+                const prompt = basePrompt + `\n\nTARGET LOCATION:
+
+You are analyzing a specific code location:
+- File: ${target.file}
+- Lines: ${target.startLine}-${target.endLine}
+
+You MUST:
+- Analyze ONLY this specific target location — do not search for or report issues at other locations
+- You may read other files to understand context (e.g., imports, type definitions, data flow), but only report issues for this target
+- If the code at this location is not vulnerable, return {"issues": []}
+- Do NOT scan the broader repository for other instances of this vulnerability pattern
+`;
+                logDebug(TAG, `${label} Analyzing target: ${target.file}:${target.startLine}-${target.endLine}`);
+                const aiResponse = await aiProvider.executeCheck(prompt, repositoryPath, label);
+                const parsed = aiResponse.parsed ?? parseAIResponse(aiResponse.raw);
+                if (!parsed) {
+                    logDebug(TAG, `${label} Target returned malformed response`);
+                    return { issues: [], error: true, flagged: false, tokenUsage: aiResponse.tokenUsage };
+                }
+                const issues = await Promise.all(parsed.issues.map((aiIssue) => enrichIssue(aiIssue, checkId, checkName, repositoryPath, checkMetadata)));
+                return { issues, error: false, flagged: parsed.flagged === true, tokenUsage: aiResponse.tokenUsage };
+            }
+            catch (err) {
+                // Fatal errors: signal abort and re-throw to stop other workers
+                if (err instanceof FatalProviderError) {
+                    abortHandle.aborted = true;
+                    abortHandle.reason = err;
+                    throw err;
+                }
+                const errorMsg = err instanceof Error ? err.message : String(err);
+                logDebug(TAG, `${label} Target error: ${errorMsg}`);
+                return { issues: [], error: true, flagged: false, tokenUsage: undefined };
+            }
+            finally {
+                completedCount++;
+                logProgress(TAG, `Progress: ${completedCount}/${targets.length} targets analyzed`);
+            }
+        }, abortHandle);
+        // 6. Aggregate results
+        const allIssues = [];
+        let hasErrors = false;
+        let hasFlagged = false;
+        const targetTokenUsages = [];
+        for (const result of targetResults) {
+            allIssues.push(...result.issues);
+            if (result.error)
+                hasErrors = true;
+            if (result.flagged)
+                hasFlagged = true;
+            targetTokenUsages.push(result.tokenUsage);
+        }
+        // 7. Determine status: FAIL > FLAG > ERROR > PASS
+        const executionTime = checkTimer.elapsed();
+        let status;
+        if (allIssues.length > 0) {
+            status = 'FAIL';
+        }
+        else if (hasFlagged) {
+            status = 'FLAG';
+        }
+        else if (hasErrors) {
+            status = 'ERROR';
+        }
+        else {
+            status = 'PASS';
+        }
+        logProgress(TAG, `Result: ${status} (${allIssues.length} issues, ${targets.length} targets)`);
+        return {
+            summary: {
+                checkId,
+                checkName,
+                status,
+                issuesFound: allIssues.length,
+                executionTime,
+                targetsAnalyzed: targets.length,
+                tokenUsage: sumTokenUsage(targetTokenUsages),
+            },
+            issues: allIssues,
+        };
+    }
+    catch (err) {
+        // Fatal errors must propagate up to abort the entire scan
+        if (err instanceof FatalProviderError) {
+            throw err;
+        }
+        const executionTime = checkTimer.elapsed();
+        const errorMsg = err instanceof Error ? err.message : String(err);
+        logProgress(TAG, `Result: ERROR (${errorMsg})`);
+        return {
+            summary: {
+                checkId,
+                checkName,
+                status: 'ERROR',
+                issuesFound: 0,
+                executionTime,
+                error: errorMsg,
+            },
+            issues: [],
+        };
+    }
+}
+/**
+ * Run multiple security checks and return aggregated ScanResults.
+ */
+export async function runMultiScan(options) {
+    const { repositoryPath, checks, aiProvider, aiModelName, aiProviderName, concurrency, configDir, genericPrompt } = options;
+    const scanTimer = createTimer();
+    const scanId = generateScanId();
+    const startTime = new Date();
+    const version = await getVersion();
+    logProgress(TAG, `Starting multi-check scan ${scanId} (${checks.length} checks)`);
+    logDebug(TAG, `Repository: ${repositoryPath}`);
+    // Use pre-analyzed repository info if provided, otherwise analyze here
+    let repositoryInfo;
+    if (options.repositoryInfo) {
+        repositoryInfo = options.repositoryInfo;
+    }
+    else {
+        const repoAnalysis = await analyzeRepository(repositoryPath);
+        repositoryInfo = repoAnalysis.repository;
+    }
+    const allCheckSummaries = [];
+    const allIssues = [];
+    // Execute checks sequentially
+    for (let ci = 0; ci < checks.length; ci++) {
+        const { check, details } = checks[ci];
+        const checkMetadata = {
+            severity: check.severity,
+            confidence: check.confidence,
+        };
+        try {
+            const { summary: checkSummary, issues } = await executeSingleCheck(check, details.name, details.content, repositoryPath, aiProvider, checkMetadata, concurrency, configDir, genericPrompt);
+            allCheckSummaries.push(checkSummary);
+            allIssues.push(...issues);
+        }
+        catch (err) {
+            if (err instanceof FatalProviderError) {
+                // Record the failing check as ERROR
+                logProgress(TAG, `Fatal error during check "${check.id}": ${err.message}`);
+                allCheckSummaries.push({
+                    checkId: check.id,
+                    checkName: details.name,
+                    status: 'ERROR',
+                    issuesFound: 0,
+                    executionTime: 0,
+                    error: err.message,
+                });
+                // Record remaining checks as ERROR (aborted)
+                for (let ri = ci + 1; ri < checks.length; ri++) {
+                    const remaining = checks[ri];
+                    logProgress(TAG, `Skipping check "${remaining.check.id}" due to fatal error`);
+                    allCheckSummaries.push({
+                        checkId: remaining.check.id,
+                        checkName: remaining.details.name,
+                        status: 'ERROR',
+                        issuesFound: 0,
+                        executionTime: 0,
+                        error: `Scan aborted: ${err.message}`,
+                    });
+                }
+                logProgress(TAG, `Scan aborted due to fatal error: ${err.message}`);
+                break;
+            }
+            // Non-fatal errors should not reach here (executeSingleCheck catches them),
+            // but handle gracefully just in case.
+            throw err;
+        }
+    }
+    const endTime = new Date();
+    const executionTime = endTime.getTime() - startTime.getTime();
+    const summary = {
+        totalChecks: allCheckSummaries.length,
+        passedChecks: allCheckSummaries.filter((c) => c.status === 'PASS').length,
+        failedChecks: allCheckSummaries.filter((c) => c.status === 'FAIL').length,
+        flaggedChecks: allCheckSummaries.filter((c) => c.status === 'FLAG').length,
+        errorChecks: allCheckSummaries.filter((c) => c.status === 'ERROR').length,
+        totalIssues: allIssues.length,
+    };
+    logProgress(TAG, `Scan completed in ${scanTimer.elapsedStr()}`);
+    // Aggregate token usage across all checks
+    const aggregateTokenUsage = sumTokenUsage(allCheckSummaries.map((c) => c.tokenUsage));
+    const results = {
+        scanId,
+        timestamp: startTime.toISOString(),
+        version,
+        repository: repositoryInfo,
+        issues: allIssues,
+        checks: allCheckSummaries,
+        summary,
+        executionTime,
+        startTime: startTime.toISOString(),
+        endTime: endTime.toISOString(),
+        aiProvider: aiProvider
+            ? { name: aiProviderName ?? 'claude-code', models: aiModelName ? [aiModelName] : [DEFAULT_AI_MODEL] }
+            : { name: 'none', models: [] },
+        tokenUsage: aggregateTokenUsage,
+    };
+    return results;
+}
+//# sourceMappingURL=scan-runner.js.map