@clear-capabilities/agentic-security-scanner 0.122.0 → 0.124.0

package/CHANGELOG.md

@@ -1,5 +1,43 @@
 # Changelog
 
+## 0.124.0 — inline finding depth (no second command for "why it fired")
+
+The depth `/triage --explain` produces now renders **inline** in the finding views,
+assembled from fields already on the finding (`narration` + `whyFired` + fix) — so the
+default per-finding view answers "why does this matter / how does it fire / how do I
+fix it" without a separate command. Addresses the "only ~2 sentences per finding"
+feedback. Presentation only — no detector/severity changes.
+
+- **Inline explain block** (`scanner/src/report/index.js`): every per-finding surface
+  now shows `why:` (the impact narration), `how:` (the `whyFired` detector + source→sink
+  flow, with sanitizers/guards/reachability under `--verbose`), and `fix:`. Wired into
+  the firehose list (`toCLI`), the pro table (a compact one-line "why"), and the HTML
+  report ("Why it matters" / "How it fires" blocks). Default trims the narration to two
+  sentences; `--verbose` shows the full narrative + fix code. Degrades gracefully when a
+  finding lacks the fields (e.g. SCA).
+- **`--firehose` actually lists findings now.** Previously it only lowered the
+  confidence threshold while the vibecoder verdict showed no per-finding list; it now
+  appends the full per-finding list (with the inline depth) so "Show ALL findings" does.
+
+## 0.123.0 — report clarity: risk-demotion labels, depth discoverability, HTML export docs
+
+Acting on user feedback that findings could overstate severity, that explanations
+felt thin, and that the browser report was hard to find. No detector/severity logic
+changed — these are presentation + docs improvements in `scanner/src/report/`.
+
+- **"Likely lower risk" labels.** A high/critical finding the reachability /
+  exploitability / confidence pipeline has already marked down now renders a visible
+  `↓ likely lower risk — …` note (not reachable in prod / sanitized / low
+  exploitability / low confidence) in the CLI firehose, the pro table, and the HTML
+  report. Severity stays canonical (SARIF/exit codes/baselines unchanged) — this only
+  annotates, so a hardcoded rule severity isn't taken at face value.
+- **Depth is discoverable.** The one-screen ship verdict now points to
+  `/triage --explain <id>` (the why-it-fired narrative + data-flow trace + fix) and to
+  the shareable HTML report, so users don't conclude the terse default is all there is.
+- **HTML report surfaced in the README.** Documents `scan . --format html --output
+  report.html` (self-contained browser page: severity charts, STRIDE, filterable
+  findings) alongside json / md / sarif / csv.
+
 ## 0.122.0 — cache economics Phase B (depth-first, subagent offload, cost HUD)
 
 Completes the cache-economics program (PRD `docs/CACHE_ECONOMICS_PRD.md`, F4–F6) on

package/bin/agentic-security.js

@@ -543,6 +543,13 @@ async function cmdScan(args) {
   else if (format === 'cli')   body = toCLIByProfile(scan, { profile: effProfile, columns: args.flags.columns, verbose });
   else body = toSummary(scan);
 
+  // --firehose: the verdict/summary views don't list findings — append the full
+  // per-finding list (with inline why-it-matters / how-it-fires / fix depth) so
+  // "Show ALL findings" actually shows them. Add --verbose for full narration + code.
+  if (args.flags.firehose && (!format || format === 'ship' || format === 'summary')) {
+    body += '\n\n' + toCLI(scan, { verbose });
+  }
+
   // v3 next-gen — supplementary blocks for human-readable formats. These
   // are append-only and do not change the verdict / exit code. The blocks
   // are only meaningful when v3 annotators have run (default scan path).