@clear-capabilities/agentic-security-scanner 0.122.0 → 0.123.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +19 -0
- package/dist/agentic-security.mjs +1 -1
- package/dist/agentic-security.mjs.sha256 +1 -1
- package/package.json +2 -2
- package/src/report/index.js +39 -1
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,24 @@
|
|
|
1
1
|
# Changelog
|
|
2
2
|
|
|
3
|
+
## 0.123.0 — report clarity: risk-demotion labels, depth discoverability, HTML export docs
|
|
4
|
+
|
|
5
|
+
Acting on user feedback that findings could overstate severity, that explanations
|
|
6
|
+
felt thin, and that the browser report was hard to find. No detector/severity logic
|
|
7
|
+
changed — these are presentation + docs improvements in `scanner/src/report/`.
|
|
8
|
+
|
|
9
|
+
- **"Likely lower risk" labels.** A high/critical finding the reachability /
|
|
10
|
+
exploitability / confidence pipeline has already marked down now renders a visible
|
|
11
|
+
`↓ likely lower risk — …` note (not reachable in prod / sanitized / low
|
|
12
|
+
exploitability / low confidence) in the CLI firehose, the pro table, and the HTML
|
|
13
|
+
report. Severity stays canonical (SARIF/exit codes/baselines unchanged) — this only
|
|
14
|
+
annotates, so a hardcoded rule severity isn't taken at face value.
|
|
15
|
+
- **Depth is discoverable.** The one-screen ship verdict now points to
|
|
16
|
+
`/triage --explain <id>` (the why-it-fired narrative + data-flow trace + fix) and to
|
|
17
|
+
the shareable HTML report, so users don't conclude the terse default is all there is.
|
|
18
|
+
- **HTML report surfaced in the README.** Documents `scan . --format html --output
|
|
19
|
+
report.html` (self-contained browser page: severity charts, STRIDE, filterable
|
|
20
|
+
findings) alongside json / md / sarif / csv.
|
|
21
|
+
|
|
3
22
|
## 0.122.0 — cache economics Phase B (depth-first, subagent offload, cost HUD)
|
|
4
23
|
|
|
5
24
|
Completes the cache-economics program (PRD `docs/CACHE_ECONOMICS_PRD.md`, F4–F6) on
|