@clear-capabilities/agentic-security-scanner 0.157.0 → 0.157.1

package/CHANGELOG.md

@@ -9,6 +9,18 @@
 > make the history less accurate, not more.
 
 
+## 0.157.1 - `ci` summary adds up; Haskell and Nix/NixOS shown in the language table, the npm README and the manifests
+
+One scanner fix, otherwise documentation and metadata.
+
+- **`agentic-security ci` prints every severity.** The summary line tallied `info` findings but never printed them, so a scan with info findings showed a total that did not equal the listed counts (the README example read 45 findings beside counts summing to 33). The line now ends `· N info`, and `test/ci.test.js` pins that the printed counts sum to the total and match `findings.json`. The README, `docs/guides/ci-setup.md` and `docs/walkthroughs/assurance-modes.md` examples were re-captured from a real run of the demo app (44 findings: 3 critical, 6 high, 7 medium, 16 low, 12 info).
+
+- **README language table** lists Haskell and Nix/NixOS beside the nine first-class languages, linking to their guides and to the per-capability support record.
+- **The npm package has a README.** `scanner/README.md` is new (the package page was empty); it states the supported languages, that both are scanned statically, and the limits of the measurement.
+- **Manifests.** `haskell`, `nix` and `nixos` keywords on the plugin and marketplace manifests, and a Haskell/Nix line in the scanner package description.
+
+This entry makes no claim about how many requirements are verified: that number is derived from the controller's evidence for the exact tree it ran on, and this release has not had a new controller pass.
+
 ## 0.157.0 - hosted verification for the suites that need Nix or NixOS
 
 NIX-011 needs `nix` and NIX-012 needs a booted NixOS, which a developer's laptop often lacks, so the loop controller could only ever report them as blocked. This release lets the controller run them on a GitHub-hosted runner and record the outcome as evidence, bound to the exact commit.

package/README.md

@@ -0,0 +1,22 @@
+# @clear-capabilities/agentic-security-scanner
+
+The scan engine behind the [agentic-security](https://github.com/Clear-Capabilities/agentic-security) Claude Code plugin: SAST, SCA with function-level reachability and CISA KEV, secrets, IaC, prompt-injection and MCP/agent-tool audit, auth/authZ analysis, SBOM/AI-BOM, and compliance evidence.
+
+```bash
+npx @clear-capabilities/agentic-security-scanner scan .
+```
+
+## Languages
+
+JavaScript/TypeScript, Python, Java, Kotlin, Go, Ruby, PHP, C#, Rust, **Haskell** and **Nix/NixOS**.
+
+- **Haskell** (`.hs`, `.lhs`, `.hs-boot`, `.hsc`, Cabal and Stack): SAST, taint, web routes and auth, privacy lineage, dependency inventory and SBOM, verified fixes.
+- **Nix and NixOS** (`.nix`, flakes, NixOS and Home Manager modules): effective-configuration analysis, host hardening, secrets and build-trust checks, dependency inventory and SBOM, verified fixes.
+
+Both are scanned with no compiler, no `nix` binary and no network. Each capability is reported **supported** only from measured evidence of its own kind, and **blocked** when it needs a tool the measurement did not have; the corpus behind the figures is synthetic, so they describe robustness over those shapes, not arbitrary real-world code. Read the [Haskell guide](https://github.com/Clear-Capabilities/agentic-security/blob/main/docs/guides/haskell.md), the [Nix and NixOS guide](https://github.com/Clear-Capabilities/agentic-security/blob/main/docs/guides/nix-nixos.md), [installing on NixOS](https://github.com/Clear-Capabilities/agentic-security/blob/main/docs/guides/nixos-install.md) and the [support record](https://github.com/Clear-Capabilities/agentic-security/blob/main/docs/language-support.md).
+
+The repository's Nix flake packages the scanner with `agentic-security`, `agentic-security-mcp` and `agentic-security-lsp` binaries, and ships NixOS VM tests (`checks.<system>.nixos-host`).
+
+## More
+
+Full documentation, the plugin, and the IDE integrations are in the [repository README](https://github.com/Clear-Capabilities/agentic-security#readme). License: PolyForm Internal Use 1.0.0.

package/bin/agentic-security.js

@@ -1373,7 +1373,7 @@ async function cmdCi(args) {
     ? `[ci] ⚠ scan-health=${_health.status} — ${(_health.conditions || [])[0] || 'analysis did not complete cleanly'}${(_health.conditions || []).length > 1 ? ` (+${_health.conditions.length - 1} more)` : ''}\n`
     : `[ci] scan-health=${_health && _health.status ? _health.status : 'unknown'}\n`;
   process.stderr.write(
-    `[ci] ${findings.length} findings — ${sev.critical} critical · ${sev.high} high · ${sev.medium} medium · ${sev.low} low\n` +
+    `[ci] ${findings.length} findings — ${sev.critical} critical · ${sev.high} high · ${sev.medium} medium · ${sev.low} low · ${sev.info} info\n` +
     _healthLine +
     (_canWriteCi
       ? `[ci] artifacts: .agentic-security/findings.{json,sarif,junit.xml}\n`