@clear-capabilities/agentic-security-scanner 0.121.0 → 0.123.0

package/CHANGELOG.md

@@ -1,5 +1,44 @@
 # Changelog
 
+## 0.123.0 — report clarity: risk-demotion labels, depth discoverability, HTML export docs
+
+Acting on user feedback that findings could overstate severity, that explanations
+felt thin, and that the browser report was hard to find. No detector/severity logic
+changed — these are presentation + docs improvements in `scanner/src/report/`.
+
+- **"Likely lower risk" labels.** A high/critical finding the reachability /
+  exploitability / confidence pipeline has already marked down now renders a visible
+  `↓ likely lower risk — …` note (not reachable in prod / sanitized / low
+  exploitability / low confidence) in the CLI firehose, the pro table, and the HTML
+  report. Severity stays canonical (SARIF/exit codes/baselines unchanged) — this only
+  annotates, so a hardcoded rule severity isn't taken at face value.
+- **Depth is discoverable.** The one-screen ship verdict now points to
+  `/triage --explain <id>` (the why-it-fired narrative + data-flow trace + fix) and to
+  the shareable HTML report, so users don't conclude the terse default is all there is.
+- **HTML report surfaced in the README.** Documents `scan . --format html --output
+  report.html` (self-contained browser page: severity charts, STRIDE, filterable
+  findings) alongside json / md / sarif / csv.
+
+## 0.122.0 — cache economics Phase B (depth-first, subagent offload, cost HUD)
+
+Completes the cache-economics program (PRD `docs/CACHE_ECONOMICS_PRD.md`, F4–F6) on
+top of the v0.121.0 measured foundation. All in `hooks/model-cost-advisor.js`,
+`hooks/lib/transcript.js`, and `scanner/src/posture/cache-economics.js`.
+
+- **F4 — depth-first routing.** A model switch is now chosen over a cache-safe effort
+  drop only when it saves *materially* more (`A.savings ≥ B.savings × (1 +
+  depthFirstMargin)`, default 0.25). Effort is the primary lever; switching is the
+  break-even-gated exception.
+- **F5 — subagent offload.** For a simple one-off whose cheap-model switch is
+  cache-blocked (deep warm cache), the advisor suggests running it as a **Haiku
+  subagent** — full cheap-model savings without discarding the main session's cache.
+  Config `subagentAdvice` (default true).
+- **F6 — cost HUD + cache budget.** `cache-statusline` CLI prints a one-line HUD
+  (`$ spent · % cached · $/turn`) for a Claude Code `statusLine` command and writes
+  `.agentic-security/cache-telemetry.json`; the `query_cache_telemetry` MCP tool gains
+  a `statusline` field. A soft `sessionBudgetUsd` biases the `costQualityTradeoff`
+  dial toward cheaper as real session spend (priced from the transcript) approaches it.
+
 ## 0.121.0 — prompt-cache economics (measured, cache-aware cost optimization)
 
 Cache-economics core (PRD `docs/CACHE_ECONOMICS_PRD.md`, features F1–F3). Turns

package/bin/agentic-security.js

@@ -1642,6 +1642,25 @@ async function main() {
         else console.log(formatCacheReport(result));
         process.exit(0);
       }
+      case 'cache-statusline': {
+        // F6 — one-line cost HUD for a Claude Code statusLine command. Also writes
+        // .agentic-security/cache-telemetry.json for other pollers. Always exits 0.
+        const { analyzeTranscript, renderCacheStatusLine } = await import('../src/posture/cache-economics.js');
+        const projectDir = path.resolve(args.flags.root || process.env.CLAUDE_PROJECT_DIR || process.cwd());
+        const result = analyzeTranscript({ transcriptPath: args.flags.transcript, projectDir });
+        if (result.ok) {
+          try {
+            const dir = path.join(projectDir, '.agentic-security');
+            fs.mkdirSync(dir, { recursive: true });
+            fs.writeFileSync(path.join(dir, 'cache-telemetry.json'),
+              JSON.stringify({ updatedAt: new Date().toISOString(), metrics: result.metrics, leaks: result.leaks }, null, 2));
+          } catch { /* best-effort */ }
+          console.log(renderCacheStatusLine(result.metrics));
+        } else {
+          console.log('agentic-security: no session cost yet');
+        }
+        process.exit(0);
+      }
       case 'mcp':      {
         const { runStdio } = await import('../src/mcp/stdio.js');
         const root = args.flags.root || process.env.AGENTIC_SECURITY_MCP_ROOT || process.cwd();

package/dist/752.index.js

@@ -7,7 +7,8 @@ export const modules = {
 
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
 /* harmony export */   analyzeTranscript: () => (/* binding */ analyzeTranscript),
-/* harmony export */   formatCacheReport: () => (/* binding */ formatCacheReport)
+/* harmony export */   formatCacheReport: () => (/* binding */ formatCacheReport),
+/* harmony export */   renderCacheStatusLine: () => (/* binding */ renderCacheStatusLine)
 /* harmony export */ });
 /* unused harmony export _internal */
 /* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(3024);
@@ -218,6 +219,14 @@ const CAUSE_LABEL = {
   'prefix-change': 'prefix changed (system prompt / tools / context edit)',
 };
 
+// F6 — one-line HUD for a Claude Code statusLine command (mirrors
+// watch-mode.js renderStatusLine). Takes the metrics from computeCacheEconomics.
+function renderCacheStatusLine(metrics) {
+  if (!metrics || !metrics.turns) return 'agentic-security: no session cost yet';
+  const hit = Math.round(metrics.cacheHitRatio * 100);
+  return `agentic-security: ${money(metrics.actualUsd)} · ${hit}% cached · ${money(metrics.costPerTurnUsd)}/turn`;
+}
+
 function formatCacheReport(result) {
   if (!result.ok) {
     return result.reason === 'no-transcript'

package/dist/985.index.js

@@ -1420,6 +1420,7 @@ const query_cache_telemetry = {
       metrics: result.metrics,
       leaks: result.leaks,
       report: (0,cache_economics.formatCacheReport)(result),
+      statusline: (0,cache_economics.renderCacheStatusLine)(result.metrics),
     };
   },
 };
@@ -1947,7 +1948,8 @@ function runStdio({
 
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
 /* harmony export */   analyzeTranscript: () => (/* binding */ analyzeTranscript),
-/* harmony export */   formatCacheReport: () => (/* binding */ formatCacheReport)
+/* harmony export */   formatCacheReport: () => (/* binding */ formatCacheReport),
+/* harmony export */   renderCacheStatusLine: () => (/* binding */ renderCacheStatusLine)
 /* harmony export */ });
 /* unused harmony export _internal */
 /* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(3024);
@@ -2158,6 +2160,14 @@ const CAUSE_LABEL = {
   'prefix-change': 'prefix changed (system prompt / tools / context edit)',
 };
 
+// F6 — one-line HUD for a Claude Code statusLine command (mirrors
+// watch-mode.js renderStatusLine). Takes the metrics from computeCacheEconomics.
+function renderCacheStatusLine(metrics) {
+  if (!metrics || !metrics.turns) return 'agentic-security: no session cost yet';
+  const hit = Math.round(metrics.cacheHitRatio * 100);
+  return `agentic-security: ${money(metrics.actualUsd)} · ${hit}% cached · ${money(metrics.costPerTurnUsd)}/turn`;
+}
+
 function formatCacheReport(result) {
   if (!result.ok) {
     return result.reason === 'no-transcript'