@clear-capabilities/agentic-security-scanner 0.123.0 → 0.124.1

package/CHANGELOG.md

@@ -1,5 +1,37 @@
 # Changelog
 
+## 0.124.1 — fix: narration no longer prints a broken location
+
+Now that v0.124.0 surfaces `narration` prominently inline, a pre-existing template
+bug became visible: some narrations read `app.js:?` / `app.js:undefined` because the
+location was interpolated before the finding's line was finalised.
+
+- `scanner/src/posture/flow-narration.js`: the location is redundant (the finding
+  header already shows `file:line`), so the family templates are now
+  location-agnostic, and `_routeOf()` (generic fallback + LLM prompt) falls back to
+  the file alone — or "this endpoint" — instead of emitting `:undefined` / `:?`.
+- Regression test in `test/flow-narration.test.js` asserts no template renders a
+  broken location when the line is absent.
+
+## 0.124.0 — inline finding depth (no second command for "why it fired")
+
+The depth `/triage --explain` produces now renders **inline** in the finding views,
+assembled from fields already on the finding (`narration` + `whyFired` + fix) — so the
+default per-finding view answers "why does this matter / how does it fire / how do I
+fix it" without a separate command. Addresses the "only ~2 sentences per finding"
+feedback. Presentation only — no detector/severity changes.
+
+- **Inline explain block** (`scanner/src/report/index.js`): every per-finding surface
+  now shows `why:` (the impact narration), `how:` (the `whyFired` detector + source→sink
+  flow, with sanitizers/guards/reachability under `--verbose`), and `fix:`. Wired into
+  the firehose list (`toCLI`), the pro table (a compact one-line "why"), and the HTML
+  report ("Why it matters" / "How it fires" blocks). Default trims the narration to two
+  sentences; `--verbose` shows the full narrative + fix code. Degrades gracefully when a
+  finding lacks the fields (e.g. SCA).
+- **`--firehose` actually lists findings now.** Previously it only lowered the
+  confidence threshold while the vibecoder verdict showed no per-finding list; it now
+  appends the full per-finding list (with the inline depth) so "Show ALL findings" does.
+
 ## 0.123.0 — report clarity: risk-demotion labels, depth discoverability, HTML export docs
 
 Acting on user feedback that findings could overstate severity, that explanations

package/bin/agentic-security.js

@@ -543,6 +543,13 @@ async function cmdScan(args) {
   else if (format === 'cli')   body = toCLIByProfile(scan, { profile: effProfile, columns: args.flags.columns, verbose });
   else body = toSummary(scan);
 
+  // --firehose: the verdict/summary views don't list findings — append the full
+  // per-finding list (with inline why-it-matters / how-it-fires / fix depth) so
+  // "Show ALL findings" actually shows them. Add --verbose for full narration + code.
+  if (args.flags.firehose && (!format || format === 'ship' || format === 'summary')) {
+    body += '\n\n' + toCLI(scan, { verbose });
+  }
+
   // v3 next-gen — supplementary blocks for human-readable formats. These
   // are append-only and do not change the verdict / exit code. The blocks
   // are only meaningful when v3 annotators have run (default scan path).