@bugb-technologies/bravos 1.0.0 → 1.0.1

package/dist/setup.js

@@ -3,7 +3,7 @@ import { spawnSync } from 'node:child_process';
 import { existsSync, mkdirSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { bundleEnvironment, hostTarget, install, missingPaths, staged, VERSIONS } from './artifacts.js';
-import { graphBin } from './codegraph.js';
+import { graphBin, graphEnv } from './codegraph.js';
 import { whichBin } from './guardlink.js';
 import { findAnalyzer } from './graphbin.js';
 import { licenceLib, requireFeature } from './licence.js';
@@ -100,20 +100,32 @@ export async function runSast(root, env, opts = {}) {
     const runDir = join(base, run);
     mkdirSync(runDir, { recursive: true });
     const sha = spawnSync('git', ['rev-parse', 'HEAD'], { cwd: root, encoding: 'utf8', timeout: 5000 }).stdout?.trim() || null;
-    const codegraph = opts.codegraph ?? (graphBin('codegraph-mcp', env) ? 'reuse' : 'off');
-    const argv = ['analyze', root, '--ci', '--fail-on', 'never', '--allow-incomplete-analysis', '--codegraph', codegraph, '--scip', opts.scip ?? 'off', '-f', 'json,sarif', '-o', join(runDir, 'report')];
-    if (opts.scope?.length)
-        argv.push('--scope', opts.scope.join(','));
-    if (opts.exclude?.length)
-        argv.push('--exclude', opts.exclude.join(','));
-    if (opts.minSeverity)
-        argv.push('--min-severity', opts.minSeverity);
-    if (opts.timeoutS)
-        argv.push('--timeout', String(Math.max(1, opts.timeoutS - 1)));
-    const runEnv = dir ? bundleEnvironment(dir, env) : env;
-    const r = spawnSync(bin, argv, { cwd: root, env: runEnv, encoding: 'utf8', timeout: (opts.timeoutS ?? 1800) * 1000, maxBuffer: 64 * 1024 * 1024, stdio: ['ignore', 'pipe', 'pipe'] });
+    let codegraph = opts.codegraph ?? (graphBin('codegraph-mcp', env) ? 'reuse' : 'off');
+    const argvFor = (graph) => {
+        const a = ['analyze', root, '--ci', '--fail-on', 'never', '--allow-incomplete-analysis', '--codegraph', graph, '--scip', opts.scip ?? 'off', '-f', 'json,sarif', '-o', join(runDir, 'report')];
+        if (opts.scope?.length)
+            a.push('--scope', opts.scope.join(','));
+        if (opts.exclude?.length)
+            a.push('--exclude', opts.exclude.join(','));
+        if (opts.minSeverity)
+            a.push('--min-severity', opts.minSeverity);
+        if (opts.timeoutS)
+            a.push('--timeout', String(Math.max(1, opts.timeoutS - 1)));
+        return a;
+    };
+    // @comment -- "The analyzer reads the code graph from the same store bravos graph build writes to, so it runs with BRAVOS_CODEGRAPH_DIR set (graphEnv): without it, --codegraph reuse looks in the analyzer's own default store and finds no graph even when one was just built."
+    const runEnv = dir ? bundleEnvironment(dir, graphEnv(env)) : graphEnv(env);
+    const spawn = (graph) => spawnSync(bin, argvFor(graph), { cwd: root, env: runEnv, encoding: 'utf8', timeout: (opts.timeoutS ?? 1800) * 1000, maxBuffer: 64 * 1024 * 1024, stdio: ['ignore', 'pipe', 'pipe'] });
+    let r = spawn(codegraph);
+    const notes = [];
+    // No graph built for this commit yet: reuse refuses outright. Scan without reachability rather than fail, and say how to get it.
+    if (codegraph === 'reuse' && r.status === 3 && /CodeGraph unavailable|No CodeGraph/i.test(`${r.stdout}\n${r.stderr}`)) {
+        notes.push('  no code graph for this commit yet, so the scan ran without reachability; bravos graph build . --scip no-exec first, then bravos sast run again, to see which findings are reached');
+        codegraph = 'off';
+        r = spawn(codegraph);
+    }
     writeFileSync(join(runDir, 'meta.json'), JSON.stringify({ sha, base: null, scope: opts.scope?.length ? opts.scope.join(',') : 'all', exit: r.status, at: new Date().toISOString(), analyzer: bin, codegraph }, null, 2) + '\n');
-    const lines = [`SAST run ${run}: bravos-cli exited ${r.status ?? 'by signal'} (0 clean at the level, 1 findings, 3 licence refused or analysis failed, 4 a stage failed)`, `  report: ${join(runDir, 'report.json')}`];
+    const lines = [`SAST run ${run}: bravos-cli exited ${r.status ?? 'by signal'} (0 clean at the level, 1 findings, 3 licence refused or analysis failed, 4 a stage failed)`, `  report: ${join(runDir, 'report.json')}`, ...notes];
     if (r.status !== 0 && r.status !== 1)
         lines.push(`  ${(r.stderr || r.stdout || '').trim().split('\n').slice(-3).join('\n  ')}`);
     lines.push('  next: bravos sast candidates');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bugb-technologies/bravos",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "Skills pack and installer that make Claude Code and Codex power users of guardlink (threat-model-as-code) and cert-x-gen (pentest-as-code).",
   "keywords": [
     "security",